Supreme Court Limits Freedom of Information Act Exemptions
Privacy, Data Security & Information Law Update
To view this Sidley update as a PDF, click here.
In two recent decisions, the United States Supreme Court narrowed the scope of two exemptions from the Freedom of Information Act (FOIA), potentially expanding the types and amount of government and private information that may be disclosed under the Act. FOIA generally requires the public disclosure of federal agency records upon request. See 5 U.S.C. § 552(a)(3). Agencies may, however, withhold documents that fall under one of nine exemptions. Id. § 552(b). At issue in the Court’s recent decisions are Exemption 2 and Exemption 7(C): Exemption 2 covers information “related solely to the internal personnel rules and practices of an agency,” Id. § 552(b)(2); Exemption 7(C) covers “records or information compiled for law enforcement purposes” the disclosure of which “could reasonably be expected to constitute an unwarranted invasion of personal privacy,” Id. § 552(b)(7)(C). Each decision turned on the Court’s interpretation of one word—“personnel,” in one, and “personal,” in the other. In both cases, the Court ruled in favor of the release of information, reaffirming the proposition that FOIA Exemptions should be construed narrowly to promote disclosure.
Exemption 2 Protects Only Employment And Human Resources Records; Milner v. Department of the Navy, No. 09-1163 (Mar. 7, 2011)
Acknowledging that its decision “upsets three decades of agency practice” and “therefore may force considerable adjustments,” Slip Op. at 18, the Supreme Court ruled in Milner v. Department of the Navy that Exemption 2 “encompasses only records relating to issues of employee relations and human resources,” id. at 19. Milner overruled the U.S. Court of Appeals for the District of Columbia Circuit’s 1981 decision in Crooker v. Bureau of Alcohol, Tobacco & Firearms, which had applied Exemption 2 not only to personnel-related matters such as pay and working hours, but also to any “predominantly internal” agency materials whose disclosure would “significantly ris[k] circumvention of agency regulations or statutes.” 670 F.2d 1051, 1056-57, 1074 (D.C. Cir. 1981). These became known as the “Low 2” and “High 2” exemptions, respectively. In Milner, the Supreme Court ruled that the “High 2” exemption is not part of FOIA Exemption 2. Justice Kagan wrote for the Court, and Justice Breyer dissented.
Background
At issue in Milner were data and maps regarding the “minimum separation distances” for explosives and other munitions stored at Naval Magazine Indian Island naval base in Puget Sound, Washington. After receiving a FOIA request from a Puget Sound resident, the Navy refused to disclose this information, invoking, inter alia, the “High 2” exemption. The Ninth Circuit upheld the district court’s grant of summary judgment to the Navy, holding that the information was predominantly internal in that it is used to “instruct[] agency personnel on how to do their jobs” and that its disclosure would risk circumvention of the law by identifying the most damaging targets for attack. The Supreme Court reversed.
Supreme Court Decision
The Supreme Court began by examining the text of Exemption 2, emphasizing the “provision’s 12 simple words: ‘related solely to the internal personnel rules and practices of an agency.’” Slip Op. at 6. The Court explained that Exemption 2 uses the term “personnel” to refer to employee relations or human resources and therefore covers only materials relating to “conditions of employment in federal agencies”—namely, those materials that fall within the so-called “Low 2” exemption. Id. at 7-8. The Court emphasized FOIA’s purpose of “broad disclosure” to support its narrow reading of Exemption 2. Id. at 8-9.
The Court rejected Crooker’s “High 2” exemption, as having “no basis or referent in Exemption 2’s language.” Id. at 10. The Court rejected the government’s reliance on FOIA’s legislative history. Although the House Report provides some support for a “High 2” exemption, the Court noted that the Senate Report “says exactly the opposite.” Id. at 11. “When presented, on the one hand, with clear statutory language, and, on the other, with dueling committee reports, we must choose the language.” Id. The Court also rejected the government’s argument that “personnel rules and practices” means “internal rules and practices for [agency] personnel to follow in the discharge of their governmental functions.” Id. at 14. This interpretation, the Court explained, would mean that all agency rules and practices are “internal personnel rules and practices” and would thus “strip[] the word ‘personnel’ of any real meaning.” Id. at 15. Such a broad interpretation would create a sweeping exemption that would “engulf other FOIA exemptions.” Id. at 16.
Finally, the Court highlighted the various ways the government could nonetheless protect from disclosure sensitive security information such as the explosives information at issue in Milner, including Exemption 1 for classified documents, Exemption 3 for material protected by another statute, and Exemption 7(F) for law enforcement records the disclosure of which “could reasonably be expected to endanger the life or physical safety of any individual.” Id. at 18. Indeed, the Navy had also invoked Exemption 7(F) in refusing to disclose the explosives data, a claim the Ninth Circuit has yet to address. Id.
Significantly, Milner reaffirms the understanding that FOIA Exemptions are to be construed narrowly in order to promote the congressional objective of disclosure. Id. at 2 (noting that FOIA “exemptions are explicitly made exclusive and must be narrowly construed”) (quotations omitted). The Court articulated this presumption in Milner even though the Department had urged the Court not to apply any such presumption during oral argument in FCC v. AT&T, which is discussed below. The Department explained that FOIA represents Congress’ intent to balance the objectives of openness against those served by its exemptions, so a narrow reading should not be presumed.
Implications
The Court’s decision in Milner may expand the types of federal agency records subject to disclosure. Four United States Circuit Courts of Appeal had adopted the Crooker approach, including the D.C. Circuit, which hears more FOIA-related actions than any other circuit. Under Crooker, agencies could invoke the “High 2” exemption to avoid disclosing internal policies and practices governing how regulators regulate. Under Milner, they may no longer do so. To be sure, as the Supreme Court explained, some such information may be covered by other FOIA exemptions. Milner may nevertheless create an opportunity to use FOIA to probe an agency’s regulatory processes and internal activities.
Corporations Are Not Entitled To Personal Privacy Protection Under Exemption 7(C); Federal Communications Commission v. AT&T Inc., No. 09-1279 (Mar. 1, 2011)
In the other recent FOIA case, the Supreme Court ruled unanimously1 in Federal Communications Commission v. AT&T Inc.,2 that corporations cannot assert “personal privacy” interests to prevent disclosure of information gathered for law enforcement purposes under Exemption 7(C). Exemption 7(C) allows agencies to withhold law enforcement records if their disclosure “could reasonably be expected to constitute an unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(7)(C). The question at issue was whether a corporation—which is included within FOIA’s definition of “person”—could assert a “personal privacy” interest under Exemption 7(C). The Supreme Court held that Exemption 7(C) applies only to individuals, not to corporations.
Background
FCC v. AT&T concerned records collected by the FCC as part of an investigation it undertook after AT&T voluntarily reported that it might have overcharged for services under an FCC program to enhance school and library access to technology. As part of the investigation, AT&T provided the FCC with “responses to interrogatories, invoices, emails with pricing and billing information, names and job descriptions of employees involved, and AT&T’s assessment of whether those employees had violated the company’s code of conduct.” Slip. Op. at 2. After AT&T and the FCC entered into a consent decree (under which AT&T did not concede liability), Comptel, a trade association including some of AT&T’s competitors, submitted a FOIA request seeking release of the FCC’s investigation records. AT&T objected to the disclosure, arguing that the materials were protected from disclosure under FOIA Exemption 4, which covers “trade secrets and commercial or financial information,” 5 U.S.C. § 552(b)(4), as well as under FOIA Exemption 7(C), as their disclosure would invade AT&T’s “personal privacy.” The FCC withheld records pertaining to costs, pricing, and billing, and documents identifying information about staff, contractors, and customer representatives, under Exemption 4. It also withheld documents identifying specific individuals under Exemption 7(C). Slip Op. at 3. However, the FCC rejected AT&T’s argument as to the balance of the documents—possibly including AT&T’s own “assessment of whether … employees had violated the company’s code of conduct”—concluding that the corporation itself had no “personal privacy” interests under Exemption 7(C).
The U.S. Court of Appeals for the Third Circuit disagreed. The court reasoned that because FOIA defines “person” as including corporations, the statutory word “personal” in the phrase “personal privacy” also includes corporations. AT&T Inc. v. FCC, 582 F.3d 490, 497-98 (3d Cir. 2009). The Third Circuit therefore held that “FOIA’s text unambiguously indicates that a corporation may have a ‘personal privacy’ interest within the meaning of Exemption 7(C). Id. at 498.
Supreme Court Decision
The Supreme Court held that although under FOIA the term “person” includes corporations, the term “personal” does not. The Court rejected the Third Circuit’s reasoning, pointing out that adjectives need not always “reflect the meaning of corresponding nouns” and that “in ordinary usage, a noun and its adjective form may have meanings as disparate as any two unrelated words.” Slip. Op. at 4-5. As Chief Justice Roberts wrote for the Court, adjectives sometimes have meanings distinct from their corresponding noun:
The noun “crab” refers variously to a crustacean and a type of apple, while the related adjective “crabbed” can refer to handwriting that is “difficult to read,” Webster’s Third New International Dictionary 527 (2002); “corny” can mean “using familiar and stereotyped formulas believed to appeal to the unsophisticated,” id., at 509, which has little to do with “corn,” id., at 507 (“the seeds of any of the cereal grasses used for food”); and while “crank” is “a part of an axis bent at right angles,” “cranky” can mean “given to fretful fussiness,” id., at 530.
Slip Op. at 4. Instead, because the statute leaves the term “personal” undefined, the Court gave the word what it considered to be its “ordinary meaning:” “‘Personal’ ordinarily refers to individuals,” not to corporations. Id. at 5. “When it comes to the word ‘personal,’” the Court explained, “there is little support for the notion that it denotes corporations, even in the legal context.” Id. at 6-7.
Reading the term “personal” in context, the Court found further support for its interpretation. The statutory phrase “personal privacy” suggests “a type of privacy evocative of human concerns—not the sort usually associated with an entity like, say, AT&T.” Id. at 8. The Court also emphasized that the term “personal privacy” in Exemption 7(C) tracks nearly identical language in the earlier-enacted Exemption 6, which protects “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6), and which the Court has “regularly referred to as involving an ‘individual’s right of privacy.’” Id. at 9-10. By contrast, Exemption 7(C)’s language differs from that in Exemption 4 which protects “trade secrets and commercial or financial information obtained from a person and privileged or confidential,” 5 U.S.C. § 552(b)(4), and which “clearly applies to corporations.” Slip Op. at 10-11. Finally, the Court cited the Government’s longstanding interpretation of Exemption 7(C) as applying only to individuals. Id. at 11.
The Court concluded: “The protection in FOIA against disclosure of law enforcement information on the ground that it would constitute an unwarranted invasion of personal privacy does not extend to corporations.” Id. at 11-12. Therefore, documents not protected as business records under Exemption 4, and that did not invade a particular individual’s “personal privacy,” were subject to disclosure under FOIA.
Implications FCC v. AT&T forecloses resort to Exemption 7(C) to protect corporate information. Nonetheless, because the Third Circuit was the first court of appeals to find that corporations could invoke a personal privacy interest under FOIA, the decision will likely have only limited impact. Corporations and other entities, which have not generally relied on Exemption 7(C) in the past, can simply continue along this course, with no significant change of behavior necessary.
The Supreme Court’s decision does, however, bring into sharp relief the importance of FOIA Exemption 4 for corporations seeking to protect sensitive information from disclosure under FOIA. The lower courts have not always taken an expansive view of what is covered by Exemption 4. Some, including notably the D.C. Circuit, have held that Exemption 4 does not protect information that, if disclosed, would harm only a company’s reputation. E.g., United Techs. Corp. v. U.S. Dep’t of Def., 601 F.3d 557, 563 (D.C. Cir. 2010).
In FCC v. AT&T Inc., the Supreme Court passed on the opportunity to confirm that a company’s reputation is an important commercial asset that can warrant protection under Exemption 4. But the Court did not rule out that protecting a company’s reputation is a legitimate concern of FOIA, nor did it limit Exemption 4 to only those situations where release of a company’s information would cause distinct “competitive” injury as opposed to more generalized harm to a company’s public standing in the marketplace. Indeed, the Court emphasized that it “readily think[s] of corporations as having ‘privileged or confidential’ documents.” The decision therefore would not substantially undercut the ability of a corporation to assert that non-public, commercial documents in the hands of the government should be withheld under FOIA where the information is confidential and sensitive. Corporate counsel should thus be alert to opportunities to extend Exemption 4 protection to information that is provided to or obtained by the government even where the information does not involve quintessential “trade secrets,” pricing information or material whose disclosure would undercut a company’s competitive position.
In practice, the ability to extend Exemption 4 coverage as suggested here will turn on the company’s effectiveness in characterizing and explaining the commercial consequences of information that could impact reputation – such as voluntary disclosures reported to the government under corporate compliance programs, critical self-assessments, public relations or political assessments, internal communications, etc.
If you have any questions regarding this update, please contact the Sidley lawyer with whom you usually work.
1 Justice Kagan took no part in the decision.
2 Sidley participated in the case, filing an amicus curiae brief on behalf of Business Roundtable in support of AT&T.
The Privacy, Data Security & Information Law Practice of Sidley Austin LLP
We offer clients an inter-disciplinary, international group of lawyers focusing on the complex national and international issues of data protection and cyber law. The group includes regulatory compliance lawyers, litigators, financial institution practitioners, healthcare lawyers, EU specialists, IT licensing and marketing counsel, intellectual property, and white collar lawyers.
Sidley provides services in the following areas:
- Privacy and Internet Litigation and Regulatory Advice
- Data Breach, Incident Response, and Cybercrime Advice
- Global Data Protection and Information Security
- International Data Transfer Solutions
- Outsourcing and Cross-Border Issues
- Gramm-Leach-Bliley and Financial Privacy
- HIPAA and Healthcare Privacy
- Workplace Privacy and Employee Monitoring
- Cyberlaw, E-Commerce, and Internet Issues
- Unfair Competition and Consumer Protection
- Trademark and Copyright Litigation and Counseling
- Website Policies and Domain Name Protection
- Records Retention and Electronic Discovery
This Sidley update has been prepared by Sidley Austin LLP for informational purposes only and does not constitute legal advice. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this without seeking advice from professional advisers.
Attorney Advertising - For purposes of compliance with New York State Bar rules, our headquarters are Sidley Austin LLP, 787 Seventh Avenue, New York, NY 10019, 212.839.5300 and One South Dearborn, Chicago, IL 60603, 312.853.7000.
Prior results do not guarantee a similar outcome.