Week 5-Explore the Impact of Administrative Accountability and Week 6 - Assess the Oversight Functions of Administrative Rulemaking

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

221

PROTECTING THE FREEDOM OF INFORMATION ACT

REQUESTOR: PRIVACY FOR INFORMATION SEEKERS

Sarah Shik Lamdan*

ABSTRACT

Freedom of Information Act (“FOIA”) requests are major instruments of American democracy and a primary means for assuring government transparency. Obtaining government information is a basic right of American citizens. Unfortunately, this right is jeopardized by an absence of privacy for FOIA requestors. Current laws lack mechanisms to prevent the release of FOIA requestors’ personal information and the substantive contents of their requests. Once outside of requestors’ hands, the contents of FOIA requests can be used to invade requestors’ private lives, and requestors’ information can even become a tool of persecution in situations where the requests deal with controversial materials and issues. Leaving requestors’ information unprotected threatens to deter people from utilizing the FOIA. This article explains the insidious nature of the current FOIA scheme on requestors’ privacy, describes successful models for requestor privacy protection and proposes that either the FOIA or the Privacy Act of 1974 be amended to protect requestors’ privacy rights, and discusses the benefits and potential pitfalls of each approach.

INTRODUCTION

In January 2011, California Representative Darrell Issa contacted 180 federal agencies, seeking information about Freedom of Information Act (“FOIA”) requestors.1 Issa sought all FOIA data from the preceding five

* University of Kansas B.A., University of Kansas School of Law, J.D., Emporia State

University M.L.I.M., Associate Law Library Professor, City University of New York (“CUNY”)

School of Law. The author wishes to thank Eyal and Benjamin Lamdan, Douglas Cox, Babe

Howell, Yasmin Sokkar Harker, Raquel Gabriel and the Junior Faculty Scholarship Workshop at

CUNY School of Law for their invaluable assistance while writing this article. She would also

like to acknowledge the tremendous support of CUNY School of Law faculty and staff, especially

Director of the Law Library, Julie Lim, without whom this paper would not have been possible.

1. Freedom of Information Act (FOIA), 5 U.S.C. § 552 (2006). This law falls under the

Administrative Procedure Act (APA), 5 U.S.C. §§ 500–84, 701–06. The APA governs the

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

222 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

years, including the dates of FOIA requests and the information sought, a virtual catalog of requestors and their queries.2 His demand went unnoticed by many, but caught the attention of privacy rights advocates.

Congressman Issa said that he only needed the information to see whether federal agencies were responding to their FOIA requests in a “timely, substantive, and non-discriminatory manner,”3 but some did not trust Issa’s motives. Issa, a congressman who is known for his strong viewpoints,4 and has been accused of spearheading “witch hunts” and “fishing expeditions” to root out behavior for which he disagrees,5 drew quick criticism for his request. David Cuillier, chairman of the Freedom of Information Committee at the Society of Professional Journalists called Issa’s request, “an easy way to target people who [Issa] might think are up to no good,”6 and John Verdi, senior counsel at the Electronic Privacy Information Center worried that the compiled requestor information “could be used to track who the biggest gadfly is.”7

As Issa demanded FOIA files, other privacy advocates worried about agencies discriminating against FOIA requests based on FOIA requestors’ identities. The Electronic Frontier Foundation (“EFF”), a freedom of technology watchdog group, accused the Department of Homeland Security (“DHS”) of adding an “extra layer of review” to the requests of FOIA requestors of whom the department was wary, improperly prohibiting the release of some information, and creating unreasonable delays.8

Another privacy organization, the Electronic Privacy Information Center (“EPIC”), also recently asserted that disseminating FOIA requestor data is contrary to federal law.9 EPIC relied, however, on a Supreme Court decision

regulatory procedures of federal agencies.

2. Letter from Darrell E. Issa, Chairman, House Comm. on Oversight and Gov’t Reform, to

FOIA Officers (Jan. 25, 2011), available at graphics8.nytimes.com/packages/pdf/politics/201101

29-issa.pdf.

3. Id.

4. For instance, in October 2010, during an appearance on Rush Limbaugh’s radio show,

Issa called President Obama “one of the most corrupt presidents of modern times.” See Joe

Garofoli, Rep. Darrell Issa Fires Spokesman Kurt Bardella, S.F. Chron., Mar. 2, 2011, at A4,

available at http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2011/03/02/MN4B1I1IVI.DTL.

5. David Jackson, Republican Plans Investigations of ‘Corrupt’ Obama Administration,

USA TODAY, Jan. 3, 2011, available at http://www.usatoday.com/communities/theoval/post/2011

/01/republican-plans-investigations-of-corrupt-obama-investigation/1.

6. Eric Lipton, Republican Congressman Proposes Tracking Freedom of Information Act

Requests, N.Y. TIMES, Jan. 28, 2011, at A14.

7. Id.

8. Jennifer Lynch, House Oversight Committee Investigates DHS FOIA Review Practices—

EFF’s Requests Were Singled Out, Deeplinks Blog (Oct. 29, 2010), https://www.eff.org/deeplink

s/2011/03/house-oversight-committee-investigates-dhs-foia (discussing Why Isn’t the Department

of Homeland Security Meeting the President’s Standard on FOIA?: Hearing Before the H. Com.

on Oversight & Gov’t Reform, 11th Cong. (2011)).

9. Letter from Marc Rotenberg, Exec. Dir., EPIC, and Nichole Rustin-Paschal, Open Gov’t

Fellow, EPIC, to Chairman Darrell E. Issa and Ranking Member Elijah Cummings, of the House

Comm. on Oversight and Gov’t Reform (Feb. 15, 2011), available at http://epic.org/open_gov/foi

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 223

confirming only that FOIA disclosure does not rely on the identity of the requestor or the reasons for his request.10 Despite EPIC’s strong stance in favor of protecting government information seekers, it cannot point to any explicit statutory protections for FOIA requestors. This is because, at this time, there are no such safeguards.

At the center of these watchdog groups’ fears is the fact that the FOIA fails to protect citizens who make information requests of federal agencies. On a state level, freedom of information (“FOI”) laws protect state information seekers and, on a federal level, the Privacy Act safeguards agency-collected personal information from public view.11 In an incongruous statutory gap, the FOIA fails to protect its requestors, releasing their private information to anyone who seeks it. The only existing mechanisms available to protect FOIA requestors are the FOIA privacy exemptions, which are designed to protect only a thin slice of requests and are not designed to cover information requestors.12

The lack of FOIA requestor protection in the federal laws leaves the courts to determine whether FOIA requestors deserve privacy on a case-by- case basis. In the current legal scheme, to respect the privacy of individuals and organizations making information requests of federal agencies, courts must stretch the meanings of current exemptions beyond their reasonable definitions.

The lapse in privacy protection can easily be mended. This article argues that, by utilizing the existing FOIA exemptions and adding protection for requestors, or by protecting requestors under the Privacy Act, the federal government can guarantee the privacy of FOIA requestors while maintaining the transparency for which the FOIA was created.

Protecting FOIA requestors’ privacy is needed in an era in which personal information is increasingly exposed to public scrutiny. Protecting personal information is a permanent backdrop of modern American life. Factors including the “24-hour news cycle”13 and growing political friction have made

a/Issa_FOIA_Oversight_Ltr_02_15_11.pdf. This letter was joined by the Center for Financial

Privacy and Human Rights. See CFPHR Joins EPIC Letter on FOIA Oversight, Feb. 15, 2011, ht

tp://financialprivacy.org/2011/02/issa-foia-oversight-letter/.

10. EPIC cites Nat’l Archives & Records Admin. v. Favish, 541 U.S. 157 (2004). Favish

deals with a FOIA request for 150 post-suicide photographs of Vincent Foster, a White House

lawyer who committed suicide. Justice Anthony Kennedy wrote, in a unanimous opinion, that

the Foster family’s right to privacy justifies withholding photographs of Foster, despite public

interest in the disclosure of the documents. The court stretched Exemption 7(C) of the FOIA,

which was created to protect personal information in law enforcement records, to cover the

disclosure of Foster’s photographs. Id.

11. Privacy Act of 1974, 5 U.S.C. § 552(a) (2006).

12. U.S. DEP’T. OF JUSTICE, GUIDE TO THE FREEDOM OF INFORMATION ACT 417–18

(2009), available at http://www.justice.gov/oip/foia_guide09/exemption6.pdf.

13. See generally David A. Logan, All Monica, All of the Time: The 24-Hour News Cycle

and the Proof of Culpability in Libel Actions, 23 U. ARK. LITTLE ROCK L. REV. 201, 220 (2000)

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

224 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

it more important than ever to protect government data containing information about private citizens from public scrutiny.

Part I of this article discusses FOIA and its failure to protect requestors’ privacy interests. Part II addresses the chilling effect on FOIA requestors, and offers rationales for protecting requestor information from public dissemination, focusing on philosophical, common law, and constitutional law privacy doctrines. Part III introduces successful models for requestor privacy protection, including successful privacy measures in library systems, state laws, the Video Privacy Protection Act,14 and the Privacy Act of 1974.15 Solutions to the lack of requestor privacy are given in Part IV, which proposes a modification of the FOIA exemptions to include requestor information, and discusses the practicalities of amending the Privacy Act to cover information requests to federal agencies.

I. THE FREEDOM OF INFORMATION ACT: HISTORY AND PRESENT ISSUES

A. History and Purpose of the FOIA

On July 4, 1966, President Lyndon B. Johnson signed the FOIA into law.16 Its purpose was to amend and bolster the skimpy public disclosure section of the Administrative Procedure Act, which had failed to meet the disclosure goals for which it was drafted.17 The 1965 Senate Report in support of the FOIA derided Section 3, calling it a “withholding statute.”18 Prior to FOIA, Section 3 of the Administrative Procedure Act, the original provision for public access to government information, was often seen as “an excuse for secrecy” rather than a disclosure law.19 Section 3 allowed the government to withhold information “requiring secrecy in the public interest” as well as public records “held confidential for good cause found.”20 These two exceptions left gaping loopholes for federal entities to ignore or deny requests that they did not wish to fill.

After years of dissatisfaction with “secrecy in government,” Congress was eager to enact a law that would reverse the tide of secrecy in federal government, a sentiment that persevered through dissent from federal agencies

(discussing the 24-hour news cycle phenomenon, and naming an increase in libelous reporting

situations as one of its potential consequences).

14. Video Privacy Protection Act of 1988, 18 U.S.C. § 2710 (2006).

15. 5 U.S.C. § 552(a).

16. See Presidential Statement on Signing the Freedom of Information Act of 1966, 2

WEEKLY COMP. PRES. DOC. 895 (Jul. 11, 1966).

17. U.S. DEPT. OF JUSTICE, supra note 12, at 4 (citing EPA v. Mink, 410 U.S. 73, 79

(1973)), available at http://www.justice.gov/oip/foia_guide09/introduction.pdf.

18. See S. REP. NO. 89-813, at 40 (1965).

19. Id. at 38.

20. Administrative Procedure Act, 5 U.S.C. § 1002 (1964) (enacted in 1946, amended in

1966, and now codified at 5 U.S.C. § 552 (2006)).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 225

and a threatened veto from the President.21 In 1965, the Senate Committee on the Judiciary recommended the bill for passage declaring that FOIA would greatly benefit the American people. The committee wrote, “[a] government by secrecy benefits no one. It injures the people it seeks to serve; it injures its own integrity and operation. It breeds mistrust, dampens the fervor of its citizens, and mocks their loyalty.”22 Congress hailed the FOIA as a reverse in policy because it required the public release of new regulatory measures and information and allowed people to make requests for information not openly available to the public through Subsection (a)(3).23

Today, Subsection (a)(3) is “by far the most commonly utilized part of the Act.”24 Ordinarily, when people talk about FOIA, the “information upon request” provision is what they are discussing. It is the primary way to obtain government information that is not otherwise disclosed. In order to protect sensitive information, some exemptions from FOIA disclosure do exist. Nine basic exemptions are set out in Subsection (b) of the statute, including information pertaining to national security, internal personnel and other internal matters, confidential business information, and personal information about private individuals.25

Since the FOIA’s initial passage in 1966, amendments have increased federal transparency, further closing loopholes that agencies had used to avoid turning over documents to the public. For instance, in 1974, Congress amended the FOIA to cut copying costs for requestors, which were sometimes prohibitively high.26 Amendments also stopped agencies from using “contamination tactics,” that is, avoiding FOIA requests by “mixing confidential, exempt materials with non-exempt materials in the same folder” and refusing to sort out releasable materials.27 Additionally, when the House

21. 1 ENCYCLOPEDIA OF AMERICAN CIVIL LIBERTIES 641 (Paul Finkelman ed., 2006).

22. S. REP. NO. 89-813, at 45 (1965).

23. U.S. DEPT. OF JUSTICE, supra note 12, at 2–3, available at

http://www.justice.gov/oip/fo ia_guide09/introduction.pdf. 5 U.S.C. § 552(a)(1) requires certain

agency activity to be published in the Federal Register. 5 U.S.C. § 552(a)(2), known as the

“proactive disclosure provision”, requires that certain types of agency records be made available

in agency reading rooms.

24. U.S. DEPT. OF JUSTICE, supra note 12, at 2, available at http://www.justice.gov/oip/foia

_guide09/introduction.pdf.

25. 5 U.S.C. §§ 552(b)(1)–(9) make exemptions for documents regarding national security,

internal personnel, confidential business, law enforcement records implicating a privacy concern,

financial institutions, and geological information, among other types of materials.

26. U.S. Government Information Policies and Practices–Administration and Operation of

the Freedom of Information Act (Part 4): Hearing Before the H. Comm. on Gov’t Operations,

92nd Cong. 1223–24 (1972). Testimony discussed agency copying charges of $1.00 per page,

with searching costs of $7.00 per hour, and the manipulation of tasks to increase fees. For

instance, a requestor seeking the names of 26 people who directly reported to an FAA official

accrued a search fee for the information.

27. NATIONAL SECURITY ARCHIVE, ELECTRONIC BRIEFING BOOK NO. 142, Veto Battle 30

Years Ago Set Freedom of Information Norms (Dan Lopez, Thomas Blanton, Meredith Fuchs &

Barbara Elias eds., 2004), http://www.gwu.edu/~nsarchiv/NSAEBB/NSAEBB142/index.htm.

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

226 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

Subcommittee on Government Information found that agencies excessively delayed responses to requestors, and failed to properly inform requestors of their FOIA rights, legislators reacted by crafting the FOIA law to curb those agency procedures.28

More recently, the Electronic Freedom of Information Act Amendments clarified that FOIA applies to records maintained in electronic formats, and “broadens public access to government information by placing more material on-line and expanding the role of the agency reading room.”29 Congressional efforts to bring FOIA up to current information gathering standards demonstrate the intent of the federal government to maintain the flow of information to the public, upholding the ideals at the root of the historic law in a more contemporary setting.

B. Current Lack of Requestor Privacy in the FOIA

Although the FOIA exempts some types of information from disclosure using privacy interests as the rationale,30 the law does not protect requestors’ information from FOIA disclosure. The U.S. Department of Justice’s Guide to the Freedom of Information Act (the “Guide”) offers a detailed discussion of all FOIA provisions and addresses the topic of FOIA requestors,31 but it does not discuss the privacy rights of those requestors, nor the exemption of their personal information from FOIA discovery.

The FOIA promotes an open request policy, allowing wide-ranging requests from a majority of private citizens and entities. The phrase used to define who can make a request is, broadly, “any person.”32 The Guide explains that “any person” includes individuals, corporate entities, public and private organizations.33 Individuals can make requests through attorneys or representatives, and members of Congress, States, and state agencies are entitled to make FOIA requests, as well.34 In fact, the only three exceptions to the permissive “any person” requestor status are fugitives from justice—but only for records relating to their fugitive status—foreign government requests for U.S. intelligence documents, and a requestor who has waived by plea

28. Id.

29. Presidential Statement on Signing the Electronic Freedom of Information Act

Amendments of 1996, 32 WEEKLY COMP. PRES. DOC. 1949 (Oct. 2, 1996).

30. See, e.g., § 552(b)(6) (exempting “personnel and medical files and similar files” from

the FOIA); § 552(b)(7)(C) (providing an exemption for personal information in law enforcement

records).

31. See generally U.S. DEPT. OF JUSTICE, supra note 12, at 40–46, available at http://www.j

ustice.gov/oip/foia_guide09/procedural-requirements.pdf.

32. § 552(a)(3)(A).

33. U.S. DEP’T. OF JUSTICE, supra note 12, at 40, available at http://www.justice.gov/oip/f

oia_guide09/procedural-requirements.pdf.

34. Id. at 40–42.

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 227

agreement his or her FOIA rights, but only in relation to the waived subject.35

Additionally, requestors do not have to “justify or explain their reasons for making requests.”36 In National Archives and Records Administration v. Favish, the Supreme Court determined that, although the privacy rights of a suicide victim’s family are protected by disclosure exemptions, there was no requirement for the party requesting information about the suicide to disclose why they wanted the records.37 “[W]hen documents are within FOIA’s disclosure provisions, citizens should not be required to explain why they seek the information.”38 The Supreme Court, in determining whether FOIA requests should be treated differently if the requestor is a news agency, similarly resolved that a requestor’s identity “has no bearing on the merits of his or her FOIA request.”39

The FOIA helps requestors get information with ease to increase government transparency. It is the same transparency goal that requires agencies to disseminate the requestors’ information to anyone who asks, unless that information fits into one of the Act’s exemptions.

Under the present statutory scheme, finding requestor information is a simple task. A quick Google search reveals scores of FOIA requestor logs, which can be obtained through FOIA requests.40 Using the Government Attic website’s FOIA Log webpage, any Internet user can look through recent and historic lists of requestor information.41 Although the depth of information varies by agency, generally the requestor’s name, entity affiliation—if one exists—request content and request date appear on the log.42 Sometimes, additional information, including how the request was made, the cost of the request, and detailed writing about the subject of the request are published in the log.43

For instance, the U.S. Trade Representative Log from 1999–2004 very specifically lists each requestor’s name, affiliation, and exactly what they requested.44 One can easily discover that David Gelber works at CBS and

35. Id. at 42–43.

36. Id. at 44.

37. Nat’l Archives & Records Admin. v. Favish, 541 U.S. 157, 172 (2004).

38. Id.

39. U.S. Dep’t of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 771

(1989).

40. See GOOGLE, http://www.google.com (search for “FOIA Logs”) (last visited Feb. 27,

2012).

41. Governmentattic.org provides electronic copies of Federal Government documents

obtained pursuant to FOIA requests. See All Other FOIA Logs, GOVERNMENTATTIC.ORG, http:

//www.governmentattic.org/documentsAllOtherLogs.html (last visited Feb. 27, 2012).

42. See, e.g., FOIA Log FY 2011, FMSHRC (Nov. 28, 2011), http://www.fmshrc.gov/foia/f

oialog.htm; U.S. DEP’T OF HOMELAND SEC., FEMA FIOA Log (2011), available at http://www.d

hs.gov/xlibrary/assets/foia/fema_foia_log_second_quarter_2011.pdf.

43. Id.

44. 1999, 2000, 2001, 2002, 2003, 2004, Office of the U.S. Trade Representative Freedom

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

228 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

requested “[a]llegations against, and investigations of, high-ranking Mexican officials—cabinet level and above—concerning money laundering and other corrupt activities (including but not limited to drug trafficking, bribery, extortion, and murder),” and that the law firm Arent Fox wanted “documents concerning or related to Implementation of WTO Recommendations Concerning EC-MEASURES concerning Meat and Meat Products (Hormones).”45

This requestor information lays out a person’s or company’s request. Aside from violating the requestors’ privacy, that information could also be used to learn about requestors’ corporate activities, pending lawsuits, and upcoming documentaries and news broadcasts. If a person reading the FOIA logs can connect the requestor to the material sought, they may be able to deduce why the information is being sought, and use it to predict the private activities of the person or entity. This is likely an unsettling realization for those who make information requests of the federal government.

The law does have disclosure exemptions, which hold back some information. There are two exemptions that focus on privacy, but they are narrow in scope. “Exemption 6 protects information about individuals ‘in personnel and medical files and similar files,’”46 but only when the information “‘would constitute a clearly unwarranted invasion of personal privacy.’”47 Exemption 7(C) is even more limited, covering only “information compiled for law enforcement purposes” when disclosure “could reasonably be expected to constitute an unwarranted invasion of personal privacy.”48 These exemptions were certainly not intended to protect requestors, and there is no guarantee that these measures will assure the privacy of people and entities making FOIA requests.

Case law also limits the exposure of requestor information, to some extent, but not directly. The Seventh Circuit has been especially invested in protecting information requestors. In Silets v. United States Department of Justice, the court allowed the redaction of a prior FOIA requestor’s name from a new query regarding the wiretapping of Jimmy Hoffa.49 The plaintiff fought against the redaction, but the court determined that protecting the previous

of Information Act (5 U.S.C. §552) Requests, GOVERNMENTATTIC.ORG, http://www.government

attic.org/docs/FOIA_Logs_USTradeRepresentative_1999-2004.pdf.

45. Id. Additionally, hitting closer to home, the author of this paper was able to find

instances where she had filed a FOIA request with the SEC on behalf of legal clients as a librarian

at a law firm in less than a minute. You can see where she—under her maiden name, Sarah

Shik—requested items such as “Hedge Funds Commenced on January 16, 1969.” See FOIA Logs

for the US Securities and Exchange Commission (SEC) 2008-2011, GOVERNMENTATTIC.ORG, htt

p://www.governmentattic.org/4docs/SEC-FOIA-Logs_2008-2011.pdf.

46. U.S. DEP’T OF JUSTICE, supra note 12, at 417, available at http://www.justice.gov/oip/

foia_guide09/exemption6.pdf.

47. Id.

48. Privacy Act of 1974, 5 U.S.C. § 552(b)(7)(C) (2006).

49. Silets v. U.S. Dep’t. of Justice, 945 F.2d 227, 233 (7th Cir. 1991).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 229

requestor’s information was permissible under FOIA exemptions.50

The Seventh Circuit Court’s rationale for exempting the FOIA requestor information was Exemption 7(C) of FOIA, which exempts “records or information compiled for law enforcement purposes . . . to the extent that the production . . . could reasonably be expected to constitute an unwarranted invasion of personal privacy.”51 The request fell under that exception, according to the court, because FOIA’s central purpose is to guarantee “‘that the Government’s activities be opened to the sharp eye of public scrutiny, not that information about private citizens that happens to be in the warehouse of the Government be so disclosed.’”52 Although the Exemption 7(C) was designed to protect criminal records and not information gathered outside of law enforcement activities, the court stretched the meaning of the law to cover the FOIA requestor’s information, reasoning that, in this case, using 7(C) to protect the privacy of the requestor “logically fits within the privacy exception.”53

Personal privacy has similarly been granted to people who contact federal agencies for other reasons beyond FOIA requests in the Seventh Circuit. Although those who contact agencies to complain or ask for a change in regulations are not FOIA requestors, their agency contact is analogous to FOI activity, as they are contacting the agency and making a request. According to the court, these people deserve privacy protections under federal privacy doctrine.

For example, when citizens contacted the Federal Trade Commission about inflated charges on their phone bill due to “cramming,” a practice where phone companies add bogus charges to bills, the court protected the citizens’ personal information from release to a law firm. The Lakin Law Firm v. Federal Trade Commission court held that a law firm could not use the FOIA to obtain complainers’ personally identifying information.54 The court surmised, “[w]hen people feel so strongly about something that they actually complain about it to a federal agency, they probably think their names and addresses will not be released to a firm of private lawyers seeking fuel to propel a possible class-action lawsuit.”55

50. Id. at 232 (“Because the Government’s affidavits adequately explain the redacted

material, the information logically fits within the claimed exemptions, and there exists no

contrary evidence or evidence of bad faith, the District Court did not abuse its discretion in

denying in camera review. The opinion of the District Court is AFFIRMED.” (footnote

omitted)).

51. Id. at 229.

52. Id.

53. Id. at 230.

54. Lakin Law Firm, P.C. v. Fed. Trade Comm’n, 352 F.3d 1122, 1124 (7th Cir. 2004)

(quoting United States Dep’t of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S.

749, 774 (1989)).

55. Id. at 1122.

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

230 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

In this case, the court used privacy Exemption 6 from the FOIA protecting “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.”56 Although this exemption is narrow—the clearly unwarranted invasion is a tough threshold to reach—and focuses on personnel or medical files, the court made the exemption fit, determining that “individuals’ right to privacy outweighs the general public’s interest in seeing personal identifying information.”57 The court wrote, “personal identifying information is regularly exempt from disclosure. And that is as it should be, for the core purpose of the FOIA is to expose what the government is doing, not what its private citizens are up to.”58

Although the Seventh Circuit has come the closest to addressing privacy interests for FOIA requestors, other circuits have also discussed the importance of personal privacy rights in relation to the FOIA.59 However, the courts have failed to apply coverage to people’s private information with uniformity.

No court has specifically addressed requestor information, but some courts have recognized the right to privacy in relation to names and addresses. The D.C. Circuit, in National Ass’n of Retired Federal Employees v. Horner held that names and addresses of retired and disabled federal employees could not be disclosed under the FOIA.60 The Horner court adapted Exemption 6 to cover the federal employee lists.61 Quoting the Supreme Court,62 the D.C. Circuit found that the FOIA exemptions were drafted to “protect personal information in public records, even if it is not embarrassing or of an intimate nature.”63 The exemptions thus include information like place and date of birth, date of marriage, employment history, and similar data.64

Similarly, in Seized Property Recovery, Corp. v. U.S. Customs and Border Protection, the Sixth Circuit found that protection of names and addresses under Exemptions 6 and 7(C) was appropriate to cover information relating to people and entities whose belongings were seized by United States Customs and Border Protection.65 Knowing the mere release of names and other identifying information is not an inherent or significant threat to privacy, the court still recognized the privacy interest of an individual in avoiding

56. Privacy Act of 1974, 5 U.S.C. § 552(b)(6) (2006).

57. Lakin, 352 F.3d at 1123.

58. Id. at 1124.

59. See U.S. DEP’T OF JUSTICE, supra note 12, at 417–86, available at http://www.justice.g

ov/oip/foia_guide09/exemption6.pdf.

60. Nat’l Ass’n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 879 (D.C. Cir. 1989).

61. Id. The court stated, “[w]e conclude that disclosure of the requested records ‘would

result in a clearly unwarranted invasion of personal privacy.’” Id.

62. See Dep’t of State v. Wash. Post Co., 456 U.S. 595, 600 (1982).

63. Horner, 879 F.2d at 875.

64. Id.

65. Seized Prop. Recovery Corp. v. U.S. Customs and Border Prot., 502 F. Supp. 2d 50, 63

(D.D.C. 2007).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 231

unlimited disclosure of his or her identifying information.66 In fact, according to the Department of Justice, “[t]he Supreme Court has held that compilations of names and home addresses are protectable under Exemption 6.”67

Despite this assertion by the Department of Justice, U.S. courts do not uniformly protect lists of identifying information like those found in FOIA logs. As the Guide to the Freedom of Information Act states, some courts “have found little or no privacy interest in the names and addresses” in the contents of agency documents, which would include those of FOIA requestors.68 The D.C. District Court has allowed the release of names of people who submitted comments regarding an informational video shown at the Lincoln Memorial.69 The court cited the arguably minimal public interest in knowing who influences the changes to the video shown at the national monument.70 In Baltimore, a district court found that a list of people who purchased property seized by the government waived their privacy rights by participating in a commercial transaction and, “have little to fear in the way of ‘harassment, annoyance or embarrassment.’”71 Personal privacy exemptions also failed to protect lists of farmers receiving subsidies under cotton price support programs.72

Some courts have opted out of the personal privacy exemptions altogether, construing the language of the already restrictive Exemptions 6 and 7(C) more narrowly. The Ninth Circuit, affirming a decision by the District Court of Nevada, held that names in Department of Defense memos were not personnel or medical files or “similar to such files.”

73 Similarly, the D.C. District Court found that Justice Department paralegal lists were not “personnel” or “medical” files under Exemption 6, so that they were retrievable under FOIA.74 The Northern District of California also found that mere names of agency personnel do not satisfy the meaning of “personnel files” under Exemption 6.75

Finally, the Hawaii District Court held that Exemption 6 fails to protect

66. Id. at 58.

67. U.S. DEP’T. OF JUSTICE, GUIDE TO THE FREEDOM OF INFORMATION ACT, supra note

12, at 482–83, available at http://www.justice.gov/oip/foia_guide09/exemption6.pdf.

68. Id. at 484.

69. Id. at 417–18, referencing, Balt. Sun v. U.S. Marshals Serv., 131 F. Supp. 2d 725, 728

(D. Md. 2001).

70. People for the Am. Way Found. v. Nat’l Park Serv., 503 F. Supp. 2d 284, 306 (D.D.C.

2007).

71. Balt. Sun v. U.S. Marshals Serv., 131 F. Supp. 2d 725, 729 (D. Md. 2001).

72. Wash. Post Co. v. United States Dep’t of Agric., 943 F. Supp. 31, 34–36 (D.D.C. 1996).

73. Darby v. U.S. Dep’t of Defense, 74 Fed. Appx. 813, 813–14 (9th Cir. 2003); Darby v.

U.S. Dep’t of the Air Force, No. 00-0661, slip op. at 11–12 (D. Nev. Mar. 1, 2002), aff’d sub

nom.

74. Leadership Conference on Civil Rights v. Gonzales, 404 F. Supp. 2d 246, 257 (D.D.C.

2005).

75. Gordon v. Fed. Bureau of Investigation, 390 F. Supp. 2d 897, 902 (N.D. Cal. 2004).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

232 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

documents containing information about groups of people.76 In holding that the inventory from the Bishop Museum’s disinterment of human remains from Mokapu Peninsula could not be protected under Exemption 6, the court reasoned that, “information pertaining to a large group of individuals is not covered under FOIA Exemption Six. The main thrust of Exemption Six is to avoid identification of particular individuals. Where such a danger is absent or unlikely, Exemption Six is inapplicable.”77 Although these cases are not about the identities of FOIA requestors, the precedents set aside personal privacy restrictions on a broad swath of data, which would probably include FOIA requestors’ information.

Despite some success protecting personally identifying information in the courts, federal agencies have been instructed to favor disclosure when considering FOIA exemptions. The Presidential Memorandum for Heads of Executive Departments and Agencies Concerning the Freedom of Information Act directs agency FOIA officers to “adopt a presumption in favor of disclosure.”78 If agency records, data, and other materials are not specifically protected from disclosure, the agencies are encouraged to disseminate the information to anyone who asks for it.79 In fact, in some instances, courts have rejected attempts to keep personal information exempt from FOIA requests. Exemptions 6 and 7(C), with their narrow constructions, have not proven to be a one-size-fits-all solution to the privacy rights issues presented by the FOIA.

If requestor information is not protected by law, aside from post-hoc lawsuits to protect privacy after making a request,80 a way to get around the privacy issue is by hiring a third party to make the request on a requestor’s behalf. In fact, there is an Internet market for this type of service.81 This “industry” goes against the intent of FOIA, requiring a person to pay fees to a third party to make a request. Along with impeding the seeming transparency of FOIA, it also contradicts the goals of the 1974 fee-limiting amendments.82

76. Na Iwi O Na Kupuna O Mokapu v. Dalton, 894 F. Supp 1397, 1413 (D. Haw. 1995).

77. Id.

78. See U.S. DEP’T OF JUSTICE, supra note 12, at 417 n.1, available at http://www.justice.g

ov/oip/foia_guide09/exemption6.pdf (discussing the Memorandum on Freedom of Information

Act).

79. Id. at 417–18.

80. Such knowledge would seemingly require something akin to a clairvoyant medium to

inform requestors that someone had accessed their request information.

81. See, e.g., FREEDOM INFOSOURCE, INC., http://www.freedominfosource.com/FOIASER

V.HTM (last visited Jan. 26, 2012); EPIPELINE’S ANONYMOUS FOIA REQUESTS AND LIBRARY

SERVICES, http://www.epipeline.com/foia.asp (last visited Jan. 26, 2012); FOIAFIND http://www

.foiafind.com/ (last visited Jan. 26, 2012). FOIAFIND’s tagline is, “[w]hy needlessly expose

yourself (or your organization) to government scrutiny? Use FOIA FIND to submit an

anonymous FOIA request on your behalf. It is hundred [sic] percent legal. Your privacy is of

utmost importance to us. FOIA FIND fully protects your identity from government bureaucrats

while working full time on your behalf.” FOIA FIND, supra.

82. Dan Lopez, Veto Battle 30 Years Ago Set Freedom of Information Norms, NAT’L

SECURITY ARCHIVE (Nov. 23, 2004), available at http://www2.gwu.edu/~nsarchiv/NSAEBB/NS

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 233

Having to contact and pay a third party to make FOIA requests on a person’s behalf is, at best, an inconvenience to a FOIA requestor, likely not intended by the law’s framers, who created FOIA to open information to the public. As President Johnson stated upon signing the bill into law, “I have always believed that freedom of information is so vital that only the national security, not the desire of public officials or private citizens should determine when it must be restricted.”83 Surely he did not intend to curb this freedom by driving requestors to private vendors because they fear their requests may be scrutinized.

II. WHY WE MUST PROTECT FOIA REQUESTORS

A. Philosophical Bases for Privacy Rights

Human privacy is associated with self-determination, dignity, and control. Judge Thomas Cooley put the importance of privacy above penal law concerns when he wrote, “it is better oftentimes that a crime should go unpunished than that the citizen should be liable to have his premises invaded, his desks broken open, his private books, papers, and letters exposed to prying curiosity.”84 Edward Bloustien, President of Rutgers University, stated that privacy “defines man’s essence as a unique and self-determining human being.”85 Privacy is seen as a basic human need, and the heart of personal identity. “[R]especting the rights persons have to privacy is as basic a requirement as there can be in ethics.”86

There is support in the federal government for laws to protect human privacy based on this philosophical privacy standard. North Carolina Senator and longtime civil liberties advocate Sam Ervin, in the Senate hearing regarding the merits of the Privacy Act of 1974, called for the agency records of United States citizens to be protected as private:

Americans are more concerned than ever before about what might be in their records because Government has abused, and may abuse, its power to investigate and store information. They are concerned about the transfer of information from data bank to data bank and black list to black list because

AEBB142/#_ednref4.

83. See Presidential Statement upon Signing the Freedom of Information Act of 1966, supra

note 16, at 2.

84. THOMAS M. COOLEY, A TREATISE ON THE CONSTITUTIONAL LIMITATIONS WHICH

REST UPON THE LEGISLATIVE POWER OF THE STATES OF THE AMERICAN UNION 432 (7th ed.

1903).

85. Edward J. Bloustein, The Right to Privacy vs. the Right to Know, in THE RIGHT TO

INFORMATION: LEGAL QUESTIONS AND POLICY ISSUES 1, 9 (Jana Varlejs ed., McFarland & Co.,

Inc., 1984).

86. Rhoda Garoogian, Library/Patron Confidentiality: An Ethical Challenge, 40 LIBR.

TRENDS 216, 221 (1991).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

234 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

they have seen instances of it. They are concerned about intrusive statistical questionnaires backed by the sanctions of criminal law or the threat of it because they have been subject to these practices over a number of years.87

The philosophical bases for privacy rights are universally recognized; people generally understand the right “to be let alone.”88 This privacy right is more vital than ever in light of current trends in politics and the media. In Law Professor David Logan’s article about the implications of the 24-hour news cycle on libel actions, he describes the current state of journalism as “a beast with a voracious appetite,” where getting information first is more important than getting it right.89 Logan warns that, in the scramble to find stories, newsmakers use unsavory methods to gather information, calling their information gathering tactics “[a] race to the ethical bottom.”90 The irresponsible journalism associated with the 24-hour news cycle “increases the risk that the roll call of the innocent victims of press calumny will be lengthening at warp speed unless legal doctrine adjusts to this new journalistic landscape.”91

While the media pushes to publish more entertaining personal information to lure viewers, policy makers and political commentators utilize private citizens’ information to promote their agendas in an era of heightened political stratification, persecuting populations based on their ideals and actions.92 For example, in early 2011, former Kansas Attorney General Phill Kline was brought before the Kansas Supreme Court to face disbarment for obtaining and misusing citizens’ private information from state agencies.93 Kline, an anti- abortion advocate, claimed during an appearance on the Bill O’Reilly show, to have “evidence” that George Tiller, an abortion provider, was “performing illegal abortions and covering for pedophiles that impregnate girls.”94 The “evidence” Kline collected included the private medical files and records of

87. S. REP. NO. 93-1183, at 4 (1974).

88. Samuel D. Warren & Louis D. Brandeis, The Right To Privacy, 4 HARV. L. REV. 193,

193 (1890).

89. Logan, supra note 13, at 201–02.

90. Id. at 206.

91. Id. at 220.

92. See, e.g., Matthew Continetti, The Paranoid Style in Liberal Politics, WKLY.

STANDARD., Apr. 4, 2011, at 20 (discussing the demonization of David and Charles Koch,

owners of Koch Industries, and describing the growing animosity between political parties in the

United States). Continetti’s illustration of the 2009 battle over health care, and the 2010 debates

about cap and trade, use gory imagery to describe the malevolence between the opposing

ideologies, saying that the “liberals went looking for baddies against whom to mobilize public

opinion. The Kochs’ wealth and political involvement made them an obvious choice. Reflecting

on the ferocity of the onslaught that ensued, Charles told me, ‘I didn’t anticipate the hatred, the

advocacy of violence.’ He must not have been paying attention.”

93. David Klepper, Phill Kline Takes the Stand, MIDWEST DEMOCRACY, http://midwestdem

ocracy.com/blogs/entries/phill-kline-takes-stand/#storylink=misearch.

94. David Klepper, Phill Kline Defends Abortion Investigation, Tactics, KAN. CITY STAR,

Feb. 22, 2011.

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 235

state citizens.95 Kline was accused of illegally obtaining the files from state agencies and storing them in an open garage, private vehicle and the dining room of an investigator.96 Kansans were disturbed to learn that their medical documents were treated with no privacy and used against them as a potential weapon in the battle against abortion rights.97

The Phill Kline scenario is just one example of a political figure using private citizens’ records to promote his political interests. Kline publicized the acts of private citizens and used that information to persecute George Tiller, who was eventually shot and killed by an anti-abortion activist.98 In the current political climate, where tensions run high and the media’s hunger for information makes all sorts of personal tidbits newsworthy, it is vital that we protect people from the improper use of their government held information, lest their requests be used to persecute them or associated parties.

Although less dramatic than the George Tiller tragedy, FOIA requestors have faced scrutiny over the subjects of their requests, and have even been sued for trying to access government information. These requestors, discriminated against for their identities, are often the very news agencies that seek to increase government transparency through their reporting. A 2008 article estimates that “[i]n approximately three dozen cases since 1975, . . . government entities used [access-to-information statutes] to sue citizens and media outlets that requested access to government information.”99

Governments have sued information requestors for a variety of reasons. For instance, one Montana county brought a declaratory judgment action against a newspaper to prevent the paper from obtaining materials regarding litigation against the county and county officials.100 Additionally, a Missouri television station was sued by a county sheriff after requesting the videotape of a state representative being booked on charges of driving while intoxicated.101 Situations where people are tracked and persecuted over government-held information and instances where information is purposefully blocked from

95. Klepper, supra note 93.

96. Id.

97. As one person wrote in the Wichita Eagle: “If Phill Kline is going to look at my patient

file, he better get my permission. Because when I sign paperwork, it says ‘privacy, privacy,

privacy.’ He has no right to my business on my body.” See Opinion Line, WICHITA EAGLE, Feb

26, 2008.

98. Judy L. Thomas, Roeder Found Guilty of Murdering Abortion Doctor, KAN. CITY

STAR, Jan. 29, 2010.

99. Cathy Packer, Don’t Even Ask! A Two-Level Analysis of Government Lawsuits Against

Citizen And Media Access Requestors, 13 COMM. L. & POL’Y 29, 29 (2008). Packer argues that

the persecution of information seekers can “turn access law on its head and deprive citizens of the

power over government granted to them by access statutes” and focuses on state FOI laws and the

troubling nature of preemptive lawsuits against private parties seeking government information.

Id.

100. Yellowstone Cnty. v. Billings Gazette, 143 P.3d 135, 138 (Mont. 2006).

101. Hemeyer v. KRCG-TV, 6 S.W.3d 880, 881 (Mo. 1999).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

236 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

certain information requestors will continue to increase unless we work to protect requestors’ FOIA rights.

B. Common Law Bases for Privacy Rights

Louis D. Brandeis and Samuel D. Warren, in their benchmark paper identifying the tort of privacy invasion,102 titled The Right to Privacy, compare privacy rights, specifically “the protection afforded to thoughts, sentiments, and emotions,” to “the right not to be assaulted or beaten, the right not to be imprisoned, the right not to be maliciously prosecuted, [and] the right not to be defamed.”103 According to the article, rights to privacy are guaranteed by the nation’s common law, and a person cannot be forced to reveal his thoughts, sentiments, and emotions outside of the witness stand in a courtroom.104

Additionally, Supreme Court justices have directly assigned constitutional protection to privacy. In Griswold v. Connecticut, a landmark privacy case dealing with the right to use contraception in marital relationships, Justice Douglas listed “the right to read” and “freedom of inquiry” as freedoms falling under First Amendment protection.105 In Stanley v. Georgia, when the Supreme Court reaffirmed a citizen’s right to view pornography in his own home, the court stated, “the Constitution protects the right to receive information and ideas” privately.106 Personal privacy rights are also inherent in the Fourth Amendment’s protection from “unreasonable searches and seizures,” and the Fifth and Fourteenth Amendments’ exemptions to individuals from having to testify against themselves.107

Warren and Brandeis also analogize privacy rights to those ingrained in property law doctrine. Comparing daily private acts to copyright-able works, they write that even a note or diary entry, if deemed a literary composition, could be protected by copyright.108 They also describe cases where courts spared personal items from publication using property law or alleged breach of implied contract as grounds for protection.109 In the decisions, courts found in favor of protecting unpublished lectures,110 a catalog describing the Prince’s etchings,111 and photographs of people.112 All of the cases reflect the idea that

102. Edward J. Bloustein, Privacy, Tort Law, And The Constitution: Is Warren And

Brandeis’ Tort Petty And Unconstitutional As Well?, 46 TEX. L. REV. 611, 611 (1968).

103. See Warren & Brandeis, supra note 88, at 205.

104. Id. at 198.

105. Griswold v. Connecticut, 381 U.S. 479, 482 (1965).

106. Stanley v. Georgia, 394 U.S. 557, 564 (1969).

107. Nat’l Archives & Records Admin. v. Favish, 541 U.S. 157, 221 (2004).

108. See Warren & Brandeis, supra note 88, at 200–01. The writers note that this type of

protection is not absolute. The papers could still be derived from or quoted, even though they

couldn’t be fully pirated and copied.

109. Id. at 207.

110. Abernethy v. Hutchinson, (1825) 47 Eng. Rep. 1313.

111. Prince Albert v. Strange, (1849) 47 Eng. Rep. 1302.

112. Pollard v. Photographic Co., (1888) Ch. 40 Ch. 345 at 345 (Eng.).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 237

a person should not be compelled to reveal things close to oneself, like personal thoughts, physical bodies, and private acts.

Although the Supreme Court has directly identified privacy rights and defined particular aspects of privacy law, and intellectual property cases have protected some forms of personal material, the court has not been asked to specifically address the privacy of information requestors. The federal legislature, similarly, has yet to address privacy concerns for those requesting information. The lack of uniform protection of privacy rights in relation to requestors under the FOIA is especially insidious, as it could cause a chilling effect among people seeking government information.

C. Constitutional Bases for Privacy Rights: The Dangers of the Chilling

Effect

The Supreme Court has determined that when people are unsure whether their personal information could be used to litigate against them, convict them of a crime, or otherwise persecute them, they may hesitate to exercise certain rights. This hesitancy casts an impermissible “chill,” inhibiting individuals’ exercise of constitutionally granted rights.113 For example, “[t]he recognition of a first amendment right to read and a finding that this right is unduly burdened by disclosure of library circulation records provide an initial basis for the imposition of constitutional limitations on access to library borrower lists.”114

The chilling effect, a term ascribed to the stifling of expression and activity by the existence of certain laws or restraints placed on them by the government, is common in the absence of personal privacy.115 Chilling is a particularly insidious effect of government action, as “[t]hose whose expression is chilled by the existence of an overbroad or unduly vague statute cannot be expected to adjudicate their own rights, lacking by definition the willingness to disobey the law.”

116

The Supreme Court discussed the dangers of chilling in the 1972 case Laird v. Tatum. In Laird, the United States Army was sued for surveillance under its Domestic Intelligence Program, a program that dispatched investigators to track rallies and other politically charged events.117 The case was dismissed for lack of ripeness.118 Despite the dismissal, Justice William

113. See Mark K. Wilson, Surveillance of Individual Reading Habits: Constitutional

Limitations on Disclosure of Library Borrower Lists, 30 AM. U. L. REV. 275, 285–86 (1980).

114. Id. at 279.

115. See Gayle Horn, Online Searches and Offline Challenges: The Chilling Effect,

Anonymity and the New FBI Guidelines, 60 N.Y.U. ANN. SURV. AM. L. 735, 749 (2005).

116. Id.

117. Laird v. Tatum, 408 U.S. 1, 1–2 (1972)

118. See generally id. The case was dismissed for lack of ripeness because the plaintiffs

could not prove that they were genuinely injured by the army activities, and also because the

army claimed to no longer be implementing the program.

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

238 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

Douglas wrote a dissent offering an in-depth description of chilling’s effects on American society:

The Constitution was designed to keep government off the backs of the people. The Bill of Rights was added to keep the precincts of belief and expression, of the press, of political and social activities free from surveillance . . . . When an intelligence officer looks over every nonconformist’s shoulder in the library, or walks invisibly by his side in a picket line, or infiltrates his club, the America once extolled as the voice of liberty heard around the world no longer is cast in the image which Jefferson and Madison designed . . . .119

The U.S. Department of Justice’s Guide to the Freedom of Information Act emphasizes that a “FOIA request can be made for any reason whatsoever; because the purpose for which records are sought has no bearing upon the merits of the requests, FOIA requestors do not have to explain or justify their requests.”120 However, there is no guarantee those requests won’t be used against the requestors. The FOIA makes it clear that the government needs only a minimal amount of information about the requestor, and yet, the government has no privacy barriers set up to protect that personal requestor information once it is in the government’s collection of data. This disparity does nothing to curb the chilling effect, whose dangers are heightened in the context of the FOIA, a law whose purpose is to encourage the dissemination of agency-held information to promote fair government activities.121

III. SUCCESSFUL MODELS FOR PROTECTING REQUESTORS’ RIGHTS

The following four models demonstrate that, with proper governance, requestor privacy can be protected. This right to privacy is already covered in some laws and guidelines. By describing the various models, and discussing some of their shortcomings, it becomes clear that amending the FOIA or the Privacy Act are feasible and simple solutions to address the important issue of protecting requestor information.

A. Model I: The Library System

Libraries may seem like an unlikely place to find a model for federal laws, but in many ways, FOIA officer procedures and processes mimic those of librarians. Librarians, like government entities, receive information requests on a daily basis. Both libraries and FOIA offices are approached with queries

119. Id. at 28–29 (Douglas, J., dissenting). Justice Thurgood Marshall concurred in Justice

Douglas’s dissent.

120. U.S. DEP’T OF JUSTICE, supra note 12, at 20, available at http://www.justice.gov/oip/f

oia_guide09/proactive-disclosures.pdf.

121. Nat’l Labor Relations Bd. v. Robbins Tire & Rubber Co., 437 U.S. 214, 242 (1978)

(“The basic purpose of FOIA is to ensure an informed citizenry, vital to the functioning of a

democratic society, needed to check against corruption and to hold the governors accountable to

the governed.”).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 239

from a public that desires information. However, unlike the federal government, the institution of librarianship has a code of ethics that protects requestors.122 This code of ethics is so prominent that many state legislatures have created laws protecting library requestors’ privacy rights,123 and some have even incorporated those protections into their state’s freedom of information laws.124

As of 2008, forty-eight states have adopted library patron confidentiality laws.125 The protections range from library-specific statutes to FOI request exemptions for library patron information. Arkansas passed a law that goes as far as to require library record-keeping systems to maintain patron anonymity. In Arkansas, “[p]ublic libraries shall use an automated or Gaylord-type circulation system that does not identify a patron with circulated materials after materials are returned.”126 New Mexico directly associates its patron requestor rights with values embedded in the state’s constitution: “The purpose of the Library Privacy Act is to preserve the intellectual freedom guaranteed by . . . the constitution of New Mexico by providing privacy for users of the public libraries of the state with respect to the library materials that they wish to use.”127

Hawaii and Kentucky, the only two states lacking such legislation, have “reliable AG opinions that identify library records as different from other state government files and therefore not in jeopardy of being disclosed under open record laws.”128 The Kentucky opinion says, in part, “we believe that the privacy rights which are inherent in a democratic society should constrain all libraries to keep their circulation lists confidential.”129

Maintaining library patron confidentiality is a paramount concern of public service librarians.130 Librarians go so far to protect their patrons’ identities that they craft policies to regularly discard people’s request information, or not collect patron information in the first place.131 As one

122. AM. LIBRARY ASS’N, CODE OF ETHICS OF THE AMERICAN LIBRARY ASSOCIATION,

(last updated Jan. 22, 2008), available at http://www.ala.org/ala/issuesadvocacy/proethics/codeof

ethics/codeethics.

123. See Garoogian, supra note 86, at 223.

124. Bruce S. Johnson, “A More Cooperative Clerk”: The Confidentiality of Library

Records, 81 LAW LIBR. J. 769, 796 (1989).

125. Chris Matz, Libraries and the USA PATRIOT Act: Values in Conflict, 47 J. OF LIBR.

ADMIN. 69, 76 (2008). The operational name for the Library Awareness Program within the FBI

was the Development of Counterintelligence Among Librarians.

126. ARK. CODE ANN. § 13-2-703(b) (West 2004).

127. N.M. STAT. ANN. § 18-9-2 (West 2003).

128. Haw. Op. Atty. Gen. 90-30 (1990), available at 1990 WL 482378; Ky. Op. Atty. Gen.

82-149 (1982), available at 1982 WL 176791.

129. Ky. Op. Atty. Gen. 82-149 (1982), available at 1982 WL 176791.

130. Public service librarians work with the public, often in reference and circulation

assistance roles, while technical services librarians focus on cataloging and other non-public

aspects of librarianship.

131. Karen Coyle, Make Sure You Are Privacy Literate, LIBR. J. (Oct. 1, 2002), available at

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

240 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

librarian summarizes, “[i]n short, collecting personal identity information about customers is a dangerous activity for a library. We should be careful to engage in it only when absolutely necessary.”132

The library system’s focus on requestor privacy began as a reaction to intrusive library record requests from the government.133 In one instance, the Federal Bureau of Investigation (“FBI”) monitored seven Vietnam War protesters’ use of a college library to build a case against them. According to the FBI, the “Harrisburg Seven” conspired to “kidnap Henry Kissinger, blow up generators in heating tunnels in Washington D.C., and vandalize draft board offices.”134 The FBI intended to use library surveillance and librarian informants as evidence of their characters and intentions.135

Another personal privacy intrusion came from Federal Treasury agents who demanded that public libraries in Milwaukee, Wisconsin and Atlanta, Georgia release circulation records recording the names and identifying information of people who checked out materials on explosives.136 In Milwaukee, agents successfully collected about ten borrowers names and phone numbers before the Library Board of Trustees intervened.137 When this occurred, the American Library Association decried the Treasury’s investigations as an unconscionable and unconstitutional invasion of library patrons’ privacy.138

As a result of government inquiries into library activities, librarians have seen firsthand the danger of the chilling effect on information requests. An incident at a Brooklyn, New York library demonstrates that the fear that people will be judged or persecuted for their requests is not unusual.139 A patron phoned the local library to see whether they had proceedings from a recent Soviet Communist Party Congress. Although she wanted to look at the publicly available proceedings, she was afraid to come into the library to view them. She asked the librarian, “If I come in and ask for that material, will you report me to the FBI?”140

In 1971, the ALA took an official stance on requestor privacy, drafting a

http://www.libraryjournal.com/article/CA245045.html.

132. Ben Ostrowsky, Anonymous Library Cards Allow You to Wonder, ‘Who Was That

Masked Patron?’, 25 COMPUTERS IN LIBRARIES 21, 22 (June 2005), available at http://www.info

today.com/cilmag/jun05/Ostrowsky.shtml.

133. Bruce M. Kennedy, Confidentiality of Library Records: A Survey of Problems,

Policies, and Laws, 81 LAW LIBR. J. 733, 742 (1989).

134. Id. at 741 n.18.

135. Id. at 741–742.

136. Judith F. Krug & James A. Harvey, Intellectual Freedom, AM. LIBR., Sept. 1970, at

751, 751–52.

137. Id. at 751.

138. Id.

139. Garoogian, supra note 86, at 229 (quoting Seeking Spies, BROOKLYN HEIGHTS PRESS,

1988, at 10).

140. Id.

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 241

Policy on the Confidentiality of Library Records.141 This policy declared that all “circulation records and other records identifying the names of library users with specific materials” must be held as confidential.142 Additionally, in 1975, an ALA Statement on Professional Ethics specified that librarians were to “‘protect the essential confidential relationship which exists between a library user and a library,’” and the ALA’s 1980 Code of Ethics insisted that librarians must, “‘protect each user’s right to privacy with respect to information sought or received, and materials consulted, borrowed, or acquired.’”143

The current ALA Code of Ethics reflects an updated provision that covers information transmitted over the Internet or other electronic mediums.144 The ALA, in its Role of Librarians in Protecting Patron Privacy webpage, urges library staff training and a “multi-pronged approach” to actively educate users about privacy when using the Internet.145 Libraries proactively protect Internet users from privacy pitfalls by adjusting technology settings to not save Internet search and browsing histories. They also erase electronic circulation records so that the reading habits of users cannot be tracked.146 As one librarian writes:

In all cases, whether it be a request from a family member, a law enforcement agent, or a reporter, the librarian is ethically and legally bound to make every effort to protect the individual’s right to privacy no matter how convincing the argument for the release of such information appears in the light of the greater good. The individual’s right to privacy should take precedence over the rights of society.147

B. Model II: State Government Requestor Protection Laws

In contrast to the federal government, states have addressed requestor privacy rights in their legislation. Responding to citizens’ concerns about privacy, state legislatures have protected the rights of information requestors, whether their requests are to libraries or to state agencies under state Freedom of Information (“FOI”) laws. Like FOIA, state FOI statutes “usually adhere to the norms of requester neutrality and motive immateriality” by not withholding

141. Kennedy, supra note 133, at 743.

142. Id.

143. Id. at 744.

144. See AM. LIBRARY ASS’N, supra note 122. The new Code of Ethics states: “We protect

each library user’s right to privacy and confidentiality with respect to information sought or

received and resources consulted, borrowed, acquired or transmitted.” Id.

145. AM. LIBRARY ASS’N, ROLE OF LIBRARIANS IN PROTECTING PATRON PRIVACY, (last

visited Jan. 29, 2012), available at http://www.ala.org/ala//aboutala/offices/oitp/emailtutorials/pri

vacya/15.cfm#.

146. See Coyle, supra note 131. The Library Journal advises under Basic Rules for Library

Data, that librarians “[k]eep the minimum information to meet your legitimate goals, and don’t

collect information ‘just in case’,” and “[k]eep the information only as long as you must,” to

avoid having patron information available for inquiries.

147. Garoogian, supra note 86, at 219.

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

242 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

information from requestors based on who they are.148 However, some state laws go further than FOIA, proactively safeguarding requestors from having their requests revealed after the fact.

For example, Wisconsin’s Public Records Law does not require requestors to provide their identities, offering ultimate anonymity for information seekers. The law states that, “no request . . . may be refused because the person making the request is unwilling to be identified or to state the purpose of the request.”149 Similarly, Minnesota’s laws state that requestors need not identify themselves nor offer explanations for why they want the information they seek.150 The Citizen Advocacy Center points out that provisions “that protect requestors’ privacy rights,” like those in the Minnesota FOI law, “eradicate the possibility of a government entity refusing to disclose information for fear of how the information is going to be used. It is also an incentive for those who are concerned about government retaliation to continue to use the [Minnesota Government Data Practices Act].”151

State cases have examined the relationship between state agencies and their FOI requestors, assigning privacy rights to people and entities making informational inquiries of state governments. In Texas, the City of Garland sued a local newspaper trying to get a memo drafted by the city manager about whether to terminate the city’s finance director using the state’s Public Information Act.152 After the court held that the state’s FOI did not prohibit the government from seeking a declaratory judgment against a requestor, the Texas legislature amended its public records law to expressly prohibit a government body from suing a requestor.153 Other similar cases have ruled that states could not sue requestors trying to access government information.154 These cases have claimed that government entities do not have standing to sue under state FOI laws.155 In one case, Filarsky v. Superior Court of Los Angeles County, when a private attorney was sued by the city after requesting government records related to the hiring of a particular police captain, the

148. Richard J. Peltz, Joi L. Leonard & Amanda J. Andrews, The Arkansas Proposal on

Access to Court Records: Upgrading The Common Law With Electronic Freedom of Information

Norms, 59 ARK. L. REV. 555, 705 (2006).

149. WIS. STAT. ANN. § 19.35(1)(i) (West 2003).

150. CITIZEN ADVOCACY CTR., ACCESSING GOVERNMENT: HOW DIFFICULT IS IT? AN

ANALYSIS OF OPEN GOVERNMENT LAWS IN THE MIDWEST, 13 (2008) http://www.citizenadvocac

ycenter.org/uploads/8/8/4/0/8840743/state_reports_minnesota_.pdf.

151. Id. at 14.

152. City of Garland v. Dallas Morning News, 22 S.W.3d 351, 355 (Tex. 2000).

153. See Packer, supra note 99, at 43.

154. See id. at 46–48 for a discussion of these cases.

155. See McCormick v. Hanson Aggregates Se., Inc., 596 S.E.2d 431, 464 (N.C. Ct. App.

2004). The North Carolina Court of Appeals found that the N.C. Public Records Law grants

standing to requestors, not the government entities to which the request is made. Id. at 434. See

also City of Santa Rosa v. Press Democrat, 232 Cal. Rptr. 445, 450 (Cal. Ct. App. 1987), where

the California Court of Appeals found that the California Public Records Act lacks any provision

permitting actions by government agencies to prevent disclosure.

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 243

California Supreme Court looked to the legislative intent of the state FOI law, and found that, “[t]he Legislature has declared that such ‘access to information concerning the conduct of the people’s business is a fundamental and necessary right of every person in this state.’”156 In this case, the court denied the city the right to bring an action against the request.157

States have also protected information about FOI requestors as private, personal information. In Chicago Alliance for Neighborhood Safety v. City of Chicago, Judge Frossard, for the Appellate Court of Illinois, found that the plaintiff’s request for the names and addresses of all FOI requestors submitting requests to the Chicago police department since 1993 was a “clearly unwarranted invasion of personal privacy” prohibited under the section of the State’s FOI law that gives exemptions from inspecting and copying private information.158 The court balanced the interest in releasing requestor information against the degree of invasion of personal privacy and found that “private citizens who request information from the [Chicago Police] Department . . . may very well wish to keep any association they have with the subject of their request confidential.”159 The judge concluded, “[p]ersonal privacy interests do not disappear when an individual provides identifying information about himself upon exercising the right to request information from a governmental agency under the Act.”160

Based on the nature of the state FOI legislation, it seems states have considered the privacy of requestor records and determined that the right to seek information should be protected. Despite the national theme of privacy protection created by the states, the federal government has not adopted similar requestor protection measures to protect the seekers of federal government information through the FOIA. Having a federal policy out-of-line with identical state policies is incongruent at best, and stifling at worst, especially if people are deterred from asking for federal information by the fear of being open to government surveillance or public scrutiny.

C. Model III: The Video Privacy Protection Act

While the federal government has not confirmed that citizens’ FOIA requests are private, it has passed measures protecting video store patron requests. When a Washington D.C. newspaper obtained and published a list of Robert Bork’s video rentals during confirmation hearings for his nomination to the Supreme Court, legislators responded with the Video and Library Privacy Protection Act.161 The law that was eventually passed, the Video Protection

156. Filarsky v. Superior Court of Los Angeles Cnty., 49 P.3d 194, 196 (2002).

157. Id. at 202.

158. Chicago Alliance for Neighborhood Safety v. City of Chicago, 808 N.E.2d 56 (2004).

159. See id. at 74.

160. Id.

161. After the FBI lobbied to add a national security exemption to the portions of the bill

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

244 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

Privacy Act of 1988 (“VPPA”), prevents the wrongful disclosure of video rental and sale records.162 If a video provider discloses patrons’ rental information, it is liable for not less than $2,500 in damages.163 The VPPA also requires rental companies to “destroy personally identifiable information as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected.”164

Although this law is fairly new, and courts have not yet fully weighed in on its effectiveness in practice, several class action lawsuits have come from this legislation. In one case, Facebook and Blockbuster were sued for allowing their online customers’ video rental selections to involuntarily appear on their Facebook pages.165 In this class action lawsuit, Lane v. Facebook, Inc., Facebook users sued under the VPPA after Facebook’s Beacon program shared information about users’ Blockbuster rentals with their Facebook friends.166 Plaintiffs claimed that this VPPA violation caused them to suffer a loss of privacy that warranted damages under the federal law.167

Lawsuits were also brought against Netflix and Redbox for storing rental histories for longer than “necessary” in violation of the VPPA.168 Although the courts have not determined how the cases will come out—the Facebook case settled, and the Netflix and Redbox cases are pending—the cases have raised the attention of national litigation firms, and been tabbed as a burgeoning area of class action litigation.169 It is no wonder this has occurred, because one downside of the VPPA is its private right of action and heavy-handed penalties for violation, which award a minimum of $2,500 per violation, whether or not the plaintiff suffers any actual injury.170 Each successful plaintiff could obtain the $2,500 in actual damages, punitive damages, and attorney’s fees,171 which means that every 1,000 members of a class could represent a minimum of $2.5

covering libraries, librarians removed their support for the bill, and the library portion of the bill

was eventually removed. H.R. 4947, 100th Cong. (2nd Sess. 1988).

162. 18 U.S.C. § 2710 (2006).

163. Id. § 2710(c)(2)(A).

164. Id. § 2710(e).

165. See Original Complaint - Class Action para. 14, Harris v. Blockbuster, No. 2:08-cv-

00155-DF, 2008 WL 1740549 (E.D. Tex. 2008).

166. Class Action Complaint para. 42, Lane v. Facebook, Inc., No. C08 03845 RS, 2008

WL 3886402 (N.D. Cal. 2008). This case later settled out of court.

167. Id. at para. 142.

168. See Comstock v. Netflix, Inc., No. 11-1218 (N.D. Cal. 2011); Boesky v. Redbox

Automated Retail, L.L.C., No. 1:11-cv-01729 (N.D. Ill. 2011).

169. Bart Murphy, The Latest Trend of the Plaintiff-Class Action Bar: Video Privacy

Protection Act Class Action Litigation, ICE MILLER LLP (Mar. 21, 2011), http://www.icemiller.co

m/publications/VPPA2011.htm; David Almeida, Recent Privacy Class Action Lawsuits

Challenge Retailers’ Retention of Consumers’ Viewing History Information, SEDGWICK LLP

(Apr. 2011), http://www.sdma.com/recent-privacy-class-action-lawsuits-challenge-retailers-retent

ion-of-consumers-viewing-history-information-04-12-2011/.

170. 18 U.S.C. § 2710(c) (2006).

171. Id. § 2710(c)(2).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 245

million dollars.172

The penalties ascribed by the VPPA illustrate the government’s commitment to personal privacy laws and the value placed on their protection. If video rental records are considered personal and private enough to deserve protection under federal laws, FOIA requests should earn the same standard of privacy. After all, the goals and results of FOIA requests, with their focus on government transparency and obtaining information to further democracy, could easily be seen as more vital to American freedoms than the protection of movie rentals.

D. Model IV: The Privacy Act of 1974

The Privacy Act of 1974 was passed in response to public distrust of government resulting from the Watergate scandal.173 Congress declared personal privacy a constitutional right and found it necessary and proper to regulate federal agencies’ files of citizens’ information.174

Arthur Miller, a law

professor specializing in privacy law, testified during hearings for the Privacy Act, “[t]he information gathering and surveillance activities of the Federal Government have expanded to such an extent that they are becoming a threat to several of every American’s basic rights, the rights of privacy, speech, assembly, association, and petition of the Government.”175

The Privacy Act covers the maintenance, use and dissemination of federal agency records pertaining to individual citizens,

and limits record collection to

information needed to carry out agency functions.176 Under the Privacy Act, personal records may only be disclosed to agency employees who require the records to perform their duties.177 With narrow exceptions, dissemination outside of permitted agency employees can only occur when the subject of the record permits disclosure.178

The Privacy Act achieves its goals by focusing on the protection of individuals’ “records.”179 Records protected by the law include information about a person’s education, financial transactions, medical history, criminal or employment history, as well as items containing a person’s name, identifying number, symbol, or other identifying particular assigned to the individual, including finger or voice print or photograph.180 It also protects “systems of

172. See Murphy, supra note 169.

173. ALFRED C. AMAN, JR. & WILLIAM T. MAYTON, ADMINISTRATIVE LAW 697 (2d ed.

2001).

174. Id. at 698.

175. S. REP. NO. 93-1183, at 4 (1974).

176. See AMAN & MAYTON, supra note 173 at 699–700.

177. 5 U.S.C. § 552a(b)(1) (2006).

178. 5 U.S.C. § 522a(j) contains general exemptions, and 5 U.S.C. § 522a(k) provides

specific exemptions to the Privacy Act.

179. See § 552a(a)(4).

180. See id. § 552a(a)(4) (defining “record”).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

246 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

records,” which include any group of records from which information is retrieved by the individual’s name, identifying number, symbol or other “identifying particular” assigned to the individual.181

There are exemptions to the protection guarantee.182 General exemptions can be created for systems of records if an agency promulgates a rule to exempt the system under certain circumstances, like if the system is maintained by the Central Intelligence Agency or deals with criminal investigations.183 One loophole used to bypass the Privacy Act is the “routine use” exception,184 which allows agencies to share records for purposes “compatible” to the initial use of the information, so long as the “routine use” is stated in the Federal Register.185 Court decisions have placed limits on how broadly an agency can define “routine uses,”186 but many uses are still permissible even with the limitations.

In a statutory scheme that provides protection for individuals’ fingerprints, pictures, private histories and identifying numeric sequences, it seems that the national goal is that of protecting human liberty through maintaining a sense of personal confidentiality and anonymity. It is incongruent, in that scheme, that the same Congressperson who upholds the Privacy Act can simultaneously access the personal FOIA requests of the same private citizens protected by the Privacy Act. It seems the information about what people want to know about the government also deserves some level of protection as personal identifying information.

IV. CLOSING THE FOIA’S PRIVACY GAP

A. Adding a FOIA Exemption for Requestors

The most straightforward solution to the requestor privacy gap in the FOIA would be an amendment to the law. A specially carved-out exemption to the FOIA for the names and information of FOIA requestors would protect requestors without having to step outside of the existing statutory framework. Simply adding an exemption similar to Exemption 6 or 7(C) of the Act would be a quick fix to the issue of requestor privacy.

An exemption for requestors would be appropriate because requestors’ acts are not government acts, and their publication does nothing to increase government transparency, which is the singular goal of the FOIA. When Attorney William D. Hill wrote to the Attorney General of Texas in 1975

181. Id. § 552a(a)(5).

182. Id. § 552a(j)-(k).

183. Id. § 552a(j).

184. Id. § 552a(a)(7).

185. Id. § 552a (e)(4)(D).

186. See, e.g., Britt v. Naval Investigative Serv., 886 F.2d 544, 550 (3d Cir. 1989).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 247

regarding Freedom of Information exemptions for library circulation records in the state’s laws, his main argument was that “library circulation records clearly do not reflect the official acts of public officials and employees.”187 Like library requests, FOIA requests are not official government acts. While the information sought may be official, the request itself is simply a means of obtaining information. A request comes from the public, and it does not originate in a government body.

Privacy rights also promote a FOIA exemption for requestors. The Supreme Court has said privacy exemptions under FOIA, “‘encompass[es] the individual’s control of information concerning his or her person.’”188 When determining whether things are exempt from FOIA, if a privacy interest can be attached to a piece of information, that private interest is weighed against the public interest in disclosure of the same piece of information.189 A FOIA requestor’s personal information should be under that requestor’s control. In fact, upon reviewing the legislative history of the FOIA, the Supreme Court determined that Congress intended the catchall term “similar files” in Exemption 6 to cover all information that “applies to a particular individual” regardless of file-type—medical or not.190

The new FOIA exemption would provide substantial protection for requestor information. The FOIA’s privacy exemptions are given significant weight, and courts have protected privacy, even in the face of government transparency arguments. Anything above a de minimis privacy interest is considered substantial and valuable enough to be protected under existing FOIA exemptions.191 Once a privacy interest has been established, the Supreme Court has found that, “both the common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person.”192 The D.C. Circuit Court has found that this privacy interest is so strong that “[t]he threat to privacy . . . need not be patent or obvious to be relevant.”193

187. See Kennedy, supra note 133, at 737.

188. See U.S. DEP’T OF JUSTICE, supra note 12, at 417 (quoting Dep’t of Justice v.

Reporters Comm. for the Freedom of the Press, 489 U.S. 749, 763 (1989)), available at

http://www.justice.gov/oip/foia_guide09/exemption6.pdf.

189. Associated Press v. U.S. Dep’t of Defense, 554 F.3d 274, 291 (2d Cir. 2009)

(discussion of Exemption 6 states, “[o]nly where a privacy interest is implicated does the public

interest for which the information will serve become relevant and require a balancing of the

competing interests”).

190. United States Dep’t of State v. Wash. Post Co., 456 U.S. 595, 602 (1982).

191. See U.S. DEP’T OF JUSTICE, supra note 12, at 425 (quoting Multi Ag Media L.L.C. v.

United States Dep’t of Agriculture, 515 F.3d 1224, 1229–30 (9th Cir. 2010)), available at http://

www.justice.gov/oip/foia_guide09/exemption6.pdf.

192. Id. at 423 (quoting Dep’t of Justice v. Reporters Comm. for Freedom of the Press, 489

U.S. 749, 763 (1989)).

193. Id. at 426 (quoting Pub. Citizen Health Research Grp. v. U.S. Dep’t of Labor, 591 F.2d

808, 809 (D.C. Cir. 1978)).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

248 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

Privacy rights in the FOIA would fit with current FOIA trends. Courts have found that FOIA’s privacy rights extend even to maps, because the images may show where people live and offer glimpses into their lives.194 Databases containing information on crops and field acreage superimposed on an aerial photograph was held to be exempt because “letting the public look at photographs of farmland with accompanying data will in some cases allow for an inference to be drawn about the financial situation of an individual farmer.”195 Similarly, another court permitted the exemption of “electronic mapping files” because they could “lead to the discovery of an individual’s name and home address” and bring about “unwanted and unsolicited mail, if not more.”196 The release of requestor information could easily reach this de minimis threshold for privacy invasion.

One possible negative outcome of an explicit requestor exemption under the FOIA is agencies’ potential inability to release information if necessary to promote the public interest. For instance, if a person filed a FOIA request as part of a criminal act, would the proper authorities be able to see the request? The answer, under the FOIA, would likely be, “yes.” There are several mechanisms in place under the existing FOIA law that ensure that, when the public interest in disclosure is significant enough, the information will be released. Once a privacy interest has exceeded the de minimis threshold to be considered substantial enough to warrant potential exemption, the privacy interest must be weighed against the public interest in disclosure.197 According to the Supreme Court, the burden of establishing that disclosure would serve the public interest is on the information requestor.198 If the public interest is significant enough, the privacy interest can be overcome and the exemption avoided.199 This balancing test between public interest and privacy rights would apply to the requestor information exemption as it does to the other personal privacy exemptions.

B. Expanding the Privacy Act to Protect FOIA Requestors

An alternative to amending the exemptions of the FOIA would be to adjust language in the Privacy Act of 1974. The Privacy Act was established to protect the type of information contained in requestor data. When the government collects information about individuals, whether on purpose—the

194. Id. at 429 (citing Forest Guardians v. FEMA, 410 F.3d 1214, 1220–21 (10th Cir.

2005)).

195. Id. at 429 (citing Multi Ag Media L.L.C. v. United States Dep’t of Agriculture, 515

F.3d 1224, 1230 (D.C. Cir. 2008)).

196. Id. (quoting Forest Guardians v. United States Fed. Emergency Mgmt. Agency, 410

F.3d 1214, 1220–1221 (10th Cir. 2005)).

197. Id. at 454.

198. Id.

199. Id. at 456 (citing Nat’l Archives & Records Admin. v. Favish, 541 U.S. 157, 172

(2004)).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 249

aggregation of Census data, for instance—or incidentally—while assigning social security numbers and carrying out other types of administrative tasks— the government does not do so to broadcast that personal information in a public setting. The Privacy Act was drafted to protect citizens from that type of information sharing, and designed to safeguard the personal records of citizens from “actions of some over-zealous investigators, and the curiosity of some government administrators, or the wrongful disclosure and use, in some cases, of personal files held by Federal agencies.”200

The FOIA and The Privacy Act both fall under the general law governing agency activities, the Administrative Procedures Act. Thus, either one of the laws could serve as a vehicle for governing the privacy of those who request information from federal agencies. FOIA requests could be added to the types of materials protected by the Privacy Act, which are defined as “records.”201

The term “record,” as defined by the Privacy Act, determines what type of personal information the government agencies cannot release to the public.202 The key to maintaining a Privacy Act suit for wrongful disclosure of information is to first establish that the information is a “record.”203 The Privacy Act defines a record as “any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph.”204 The term is very inclusive. The statutory language specifies that the list is open for adaptation by using the phrase, “including, but not limited to.”205

Courts have determined that the Privacy Act was meant to protect personal information like FOIA requests. In Quinn v. Stone, the Court of Appeals for the Third Circuit found that information could be a “record” if it was a personal identifier or was linked with one.206 The court contended that, while a timecard only contained an individual’s name, it could reveal whether the person had worked overtime, or taken leave, which constitutes “descriptive” information about the person.207 The court also held that a deer hunter’s address and phone number from a hunting permits roster was a “record” even though the information on the roster was outdated, saying that

200. S. REP. NO. 93-1183, at 4 (1974).

201. 5 U.S.C. § 552a(a)(4) (2006). 5 U.S.C. § 552a(a)(5) defines “systems of records,”

which are similarly treated by the Privacy Act.

202. See id. § 552a(b).

203. See Jo Ann F. Wasil, What Is “Record” Within Meaning of Privacy Act of 1974 (5

U.S.C.A. § 552a), 121 A.L.R. Fed. 465 (originally published in 1994).

204. § 552a(a)(4).

205. Id.

206. Quinn v. Stone, 978 F.2d 126, 133 (3d Cir. 1992).

207. Id. at 132–33.

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

250 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

addresses can reveal personal characteristics about residents.208 From this case, it is clear that the Privacy Act is an inclusive law, and tends towards protecting all private information with its broad definition of record.

Other courts have found a wide variety of materials to be “records” protected under the Privacy Act. The Fifth Circuit held that private notes drafted by an employee’s supervisor were “records” of that employee,209 and the Kansas District Court found statements by one doctor regarding another doctor’s judgment in regards to a pending application for disability retirement to be a private “record” of the patient.210 The FOIA requests of a private citizen or entity seem to fit the intent of the Privacy Act and the courts’ constructions of the act.

Following this overview of courts’ constructions of the Privacy Act, it would be no stretch to imagine including FOIA requests made by an individual under the definition of “record” in the Privacy Act. By explicitly including FOIA requestors’ requests as “records” under the federal law, the materials regarding FOIA requests would be free from scrutiny unless authorized by the individual, or in a situation exempted from the Privacy Act.

Under a Privacy Act amendment to include FOIA coverage, exemptions would be limited. The Privacy Act allows agency heads to promulgate rules to exempt certain systems of records from the Act so long as proper notice is given.211 There are also specific exemptions in the Act for more narrowly construed document types, including exemptions for classified information under an Executive Order in the interest of national defense or foreign policy,212 materials pertaining to the protection of the President of the United States,213 and military evaluative records.214 The exemption covering items “required by statute to be maintained and used solely as statistical records”215 could arguably exclude FOIA requestor records. However, as there is no guarantee that such records, if obtained, would not be used for other purposes aside from statistical tabulations, the exemption should not extend to reach requestor information.

One limitation of using the Privacy Act to protect FOIA requestors is that the Privacy Act was designed to protect individuals only, and not groups or entities.216 Thus, it could be argued that including FOIA requestors in the

208. Id. at 132.

209. Chapman v. Nat’l Aeronautics & Space Admin., 682 F.2d 526, 529 (5th Cir. 1982).

210. Brooks v. Veterans Admin., 773 F. Supp 1483, 1486 (D. Kan. 1991).

211. 5 U.S.C. § 552a(j) (2006).

212. Id. § 552a(k)(1).

213. Id. § 552a(k)(3).

214. Id. § 552a(k)(7).

215. Id. § 552a(k)(4).

216. James Beverage, The Privacy Act of 1974: An Overview, 1976 DUKE L.J. 301, 304

(1976). Additionally, the Office of Management and Budget (“OMB”), in hearings regarding the

Privacy Act, distinguished those protected by the act as “acting in a personal capacity” rather than

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 251

Privacy Act would only protect individuals making FOIA requests, and not larger entities, including media outlets, law firms, corporations and non-profit organizations. 217

However, the distinction between “personal information” belonging to an individual and “information” from an entity seems unintentional, as the distinction would imply that a person could forfeit their Privacy Act rights solely by filing a business as incorporated—which goes under the company name—or unincorporated—filed under the name of the individual filer, and thus falling under the Privacy Act protections. A 1976 overview of the Privacy Act calls the distinction “so arbitrary that the rights granted by the act cannot be limited to individual ones.”218

In fact, many courts have construed the Privacy Act to include business information. In Zeller v. United States, the New York District Court held that the Office of Management and Budget’s distinction between “personal” and “entrepreneurial” information is not reflected in the statute or its legislative history.219 The court quoted framers of the law, like Senator Ervin, who said that the bill would impact “small businessmen” like “private attorneys and accountants,”220 to indicate that the law was to cover more than just the records of individuals. Similarly, the Metadure Corp v. United States court held that the broad language of the Privacy Act negated the contention that “records” consist only of personal information.221

A final issue with amending the Privacy Act to cover FOIA requests is the Act’s historical relationship to the FOIA. In its infancy, the Privacy Act was to “have no effect on the operation of FOIA,” in respect to public access of government information.222 Consideration of requestors’ privacy rights demands a second look at the lack of intersection between the two laws, as requestor privacy is necessary to prevent a chilling effect that would leave requestors reluctant to ask the government to reveal information.223 The use of

“individuals acting in an entrepreneurial capacity.” Privacy Act Guidelines, 40 Fed. Reg. 28,951

(July 9, 1975).

217. See Beverage, supra note 216, at 304–05. However, early observers noted that the

distinction between individuals acting personally versus entrepreneurially “would seem to have

more viability in the context of the Senate bill than of the statute as enacted.” Id. at 304. The

phrase “personal information” is used only in the introductory section of the Act and not

throughout the statute itself, which refers more broadly to “information.” Id. at 305. The version

of the bill that passed is far more permissive than the Senate’s proposed bill, which indicates that

Congress drew a line not between types of activities, but between singular people versus

businesses. Id.

218. Id. at 306.

219. Zeller v. United States, 467 F. Supp. 487, 499 (E.D.N.Y. 1979).

220. 120 Cong. Rec. S36,885, 36,896 (daily ed. Nov. 21, 1974) (statement of Sen. Ervin).

221. Metadure Corp. v. United States, 490 F. Supp. 1368, 1374 (S.D.N.Y. 1980).

222. See Beverage, supra note 216, at 312.

223. See Peltz, Leonard & Andrews, supra note 148, at 707 (“Asking requesters to identify

themselves and their motives results in a chilling effect on access to public records. Chilling the

anonymous exercise of rights is repugnant to classical ideas about individual rights . . . .”).

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

252 KAN. J.L. & PU B. PO L’Y Vol. XXI:2 2012

the Privacy Act to protect requestors would fit with its framers’ privacy goals. Additionally, the amendment to the Privacy Act would be explicit enough to satisfy the FOIA’s third exemption, which incorporates nondisclosure provisions from other federal statutes, so long as the nondisclosure provision leaves no discretion on the issue and establishes particular criteria or matters to be withheld. This means that a Privacy Act exemption would be likewise protected by the FOIA’s third disclosure exemption.224

CONCLUSION

Ordinarily, discussions about the FOIA focus on the need for more transparency, not less. In the Pentagon Papers case, the famous tug-of-war between government secrecy and the public’s right to know, Max Frankel wrote in an affidavit, “‘[f]or the vast majority of “secrets,” there has developed between the government and the press (and Congress) a rather simple rule of thumb: The government hides what it can, pleading necessity as long as it can, and the press pries out what it can, pleading a need and a right to know.”225 The goal of FOIA is not to hide information, but to reveal it.

However, a line must be drawn in revealing government information to the public to protect those requesting the information, in order to keep the flow of information open and welcoming. As those worried about Congressman Darrell Issa’s request for volumes of FOIA records stated, “it seems sort of creepy that one person in the government could track down who is looking into what and what kinds of questions they are asking.”226 Basic rights to privacy, developed through eras of political turmoil and volumes of legal theory and practice, protect the discovery of an individual’s personal inquiries and requests. Anything that chills a person’s right to ask questions of the government is to be avoided under historical and contemporary American legal jurisprudence.227

The federal government should do more to protect FOIA requestors’ privacy. By amending the FOIA exemptions or the Privacy Act definition of “record,” Congress could establish permanent safeguards to shield that information. With a growing focus on personal information by the media and in the political landscape, the goal of requestor privacy to avoid unconstitutional chilling is more important than ever. After all, although Congressman Issa claims that his committee would not use the information to

224. See U.S. DEPT. OF JUSTICE, supra note 12, at 207, available at http://www.justice.gov/

oip/foia_guide09/exemption3.pdf.

225. Bill Keller, The Boy Who Kicked the Hornet’s Nest, N.Y. TIMES, Jan. 30, 2011, at

MM32 (discussing debate over government secrets versus the public’s right to know in light of

Julian Assange and WikiLeaks).

226. See Lipton, supra note 6 (quoting David Cuillier, a University of Arizona professor of

journalism and the chairman of the Freedom of Information Committee at the Society of

Professional Journalists).

227. See generally Peltz, Leonard & Andrews, supra note 148.

LAMDAN - FORMATTED (DO NOT DELETE) 4/20/2012 3:48 PM

SHIK LAMDAN: PRIVACY FOR INFORMATION SEEKERS 253

violate privacy rights, the world would ultimately never know, because Congress is excluded from the FOIA and does not have to reveal any of their activities to the public.228

228. See U.S. DEPT. OF JUSTICE, supra note 12, at 28–30, available at http://www.justice.go

v/oip/foia_guide09/introduction.pdf.

Copyright of Kansas Journal of Law & Public Policy is the property of Kansas Journal of Law & Public Policy

and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright

holder's express written permission. However, users may print, download, or email articles for individual use.