FOIA Exemptions 6 & 7C Personal Privacy Exemptions Denver, Colorado June 17-18, 2015 Instructor Fred Sadler Consultant, FOI & Privacy Statutes Former FOI & Privacy Officer, FDA/HHS, Retired FOIA Exemptions 6 & 7(C) Personal privacy interests are protected by 2 provisions of the FOIA Each exemption covers different records Same analysis applies to both exemptions: Is the exemption threshold met? Is there an identifiable privacy interest? Is there a qualifying public interest? Balance the two interests! 1
Exemption 6 Non-law enforcement records Threshold language: Personnel and medical files and similar files You must withhold records, IF disclosure would constitute a clearly unwarranted invasion of personal privacy 5 U.S.C. 552(b)(6) What is a Similar File? 1983 Supreme Ct. decision interprets this as any info about a specific individual. 2010 Supreme Ct decision defined this as a file showing where an employee was born, names of parents, where he lived, school records, exam results, work performance/evaluations. Ask what release would reveal about the person Exemption 7(C) Law enforcement records Threshold language: Records or information compiled for law enforcement purposes, AND Disclosure could reasonably be expected to constitute an unwarranted invasion of personal privacy Extends to inc. criminal, civil & admin proceedings 5 U.S.C. 552(b)(7)(C) 2
Potential overlap with the Privacy Act There could be an overlap with records subject to the Privacy Act, IF the records are contained within a System of Records subject to that statute this would require publication of a SORN (System of Records Notice) in the Fed. Register. Even if the request(er) doesn t specify which statute the request should be processed under, you may process under either law, or both. Identify and Evaluate Privacy Interest Under Either 6 or 7(C) Do you have information about an identifiable individual? No "Personal Privacy" for Corporations under Ex. 7(C) (FCC v. AT&T, Inc., No. 09-1279, 2010 WL 1623772 (U.S. Sept. 28, 2010) Can you identify an individual by reading the document? What type of information about an individual would you consider private? Working definition of PII For purposes of this session, PII is any information in a record that would reveal the identity of an individual PII includes info that, when combined with other public info, would reveal the individual s identity or invade his/her privacy. This may include info that could be used to fill in the redactions 3
PII Requirements FOI officers should interact with Privacy Act officers, & CIO offices The absence of PII does not mean that data doesn t identify individuals OMB Memo M-07-16 (May 22, 2007), Safeguarding Against and Responding to the Breach of Personally Identifiable Info NIST Publication 800-122 NIST Publication 800-122 Guide to Protecting PII (2010) Name, maiden name, mother s maiden name, or alias Personal ID number, SSN Passport number Driver s license number Taxpayer ID number Patient ID number Financial account or credit card number Address (street or email address or email) Internet Protocol (IP) or Media Access Control (MAC) (address or other host-specific persistent static identifier that links to a particular person or small, well-defined group of people) NIST Publication 800-122 Phone numbers - mobile, business, or personal Personal characteristics, including photographic images, x-rays, fingerprints, other biometric data (e.g., retina scan, voice signature, facial geometry) Information identifying personally owned property, such as vehicle registration number or title number and related information Individual Information linked/linkable to any of the above (e.g., date of birth, place of birth, race, religion, weight, activities, geographical indicators, employment info, medical info, education info, financial info). 4
The Privacy Interest U.S. Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (1989) Broadened interpretation of privacy; Practical obscurity information once public, but memories have faded over time; Limited scope of public interest sheds light on government operations; Categorical withholding no balancing The Privacy Interest NARA v. Favish, 541 U.S. 157 (2004) Recognized survivor privacy Does not alter longstanding rule that an individual s privacy rights are extinguished upon death Established heightened public interest standard Requester must produce evidence of agency wrongdoing that would warrant a belief by a reasonable person that the alleged impropriety might have occurred The Privacy Interest Remember that the information must identify a specific individual There is generally no privacy interest: o Corporations o Deceased individuals unless there is a survivor privacy issue o Public records (unless they are practically obscure ) o Most federal employees professional info o Identities of FOIA requesters 5
The Privacy Interest Some rules to remember: An agency cannot invoke a privacy exemption when the particular interest to be protected is the requester s own interest. Generally, the passage of time does not diminish privacy. If there is no privacy interest in the information, the exemption doesn t apply; unless other exemptions can be exerted, disclose the record. The Privacy Interest What do you think - is there an identifiable privacy interest in: A list of names and credit card numbers for government employees? Information about who commented on a notice of proposed rulemaking and what they said? A deceased detainee s journal entries written in the days leading up to her suicide? The name of an FBI Special Agent who testified at a public trial? The Public Interest The Reporters Committee case held that public interest must fall within the FOIA s core purpose of shedding light on an agency s performance of its duties. Neither the identity of the requester nor the purpose for which the information is sought is given any weight. A requester s private need for the info is not given any weight. 6
Is There a Qualifying Public Interest? Generally, the agency s conduct is the focus, not the personal conduct of individuals. The public interest must be directly served by disclosure of the requested information. The particular way that one requester can use the information to serve the public is irrelevant because all FOIA disclosures are public disclosure (except for first party requests). What do you think - Is There a Qualifying Public Interest in: A list of the names of borrowers and loan amounts of loans approved by the Farm Services Agency? Records of an investigation into allegations of misconduct of a state prosecutor? All info pertaining to the selection process for the position of FOIA specialist? Balancing the Interests If there is no privacy interest (unless another exemption is applicable) disclose the information. If there is an identifiable privacy interest and no qualifying public interest, withhold the information. If there is a privacy interest and a public interest, balance them to see which is greater. 7
Factors to Consider in Balancing Passage of time serves to increase privacy interest. Are intimate details of a person s life involved? Any known adverse consequences in disclosure? Were allegations of official misconduct proven? Generally, proven misconduct of a serious & intentional nature by a high-level official is sufficient public interest to disclose. Categorical Withholding The Reporters Committee case introduced the concept of categorical withholding: Allows agencies to withhold certain categories of information without conducting a balancing of interests. Examples: in law enforcement records, 3rd party names; names of special agents; state, local, foreign law enforcement personnel; names of third parties merely mentioned; names of witnesses, informants and suspects. Personnel Investigations as Law Enforcement The following are not enforcement: Employee discipline for actions which aren t a violation of law (illegal parking). Misuse of gov t equipment. Conducting personal business while on official duty time. May have EEO, or Whistleblower impact 8
Dept. of Defense Note Post 9/11, many courts have accepted DOD s broad interpretation that persons have a heightened security interest in protecting IDs of persons associated with DOD (especially when serving abroad) See also Ex. 3 statute for Routinely Deployable Units (categorical withholding) The Glomar Response An agency may neither confirm nor deny the existence of the records = Glomar response. When records concerning an identifiable individual and are of a particularly sensitive nature: o Targeted or third party request o To acknowledge existence of records would cause harm o Consistency in application is key o Bifurcate file to process separate investigatory records from non-investigatory records Reasonable Segregation Rule: We are always obligated to review each document line-by-line and release all non-exempt information Exception: When the non-exempt information is inextricably intertwined with the exempt information, so that only meaningless words/phrase are left for disclosure (a denial may be appropriate) 9
Emerging European Privacy Policy Litigation in Spain against Google Requested right to have information & documents removed from the net EU Court agreed that individuals have the right to be forgotten (5-13-2014) Google has removed more than 1million records from direct access EU believes this may become an issue in the US Privacy Policy & Interpretation Dept. of Justice Policy on FOIA @ FOIA Guide Guidance on 6 & 7(C) available on line at http://www.justice.gov/oip/doj-guidefreedom-information-act Your Department Regulations NIST & OMB (intersection of FOI & Privacy Act) Thank you! FOIA Exemption 6 & 7(c) American Society of Access Professionals, Inc. 1444 I (Eye) Street, NW Suite 700 Washington, D.C. 20005 Tel: 202-712-9054 Fax: 202-216-9646 Email: asap@accesspro.org www.accesspro.org 10