FOIA Privacy Exemptions: Exemptions 6 and 7(C), Balancing Test

Two provisions of the Freedom of Information Act let a federal agency hold back personal information about individuals: Exemption 6, which covers personnel, medical, and similar files, and Exemption 7(C), which covers records compiled for law enforcement purposes. Both FOIA privacy exemptions require the agency to weigh the individual’s privacy against the public’s interest in seeing what the government is doing, but they set different bars, and the difference decides a lot of requests.

Exemption 6: Personnel, Medical, and Similar Files

Exemption 6 covers personnel and medical files and “similar files” when releasing them would be a clearly unwarranted invasion of personal privacy.¹ The word “clearly” tilts the scale toward disclosure. If the privacy harm isn’t obvious and significant, the information should come out.

“Similar files” is broader than it sounds. In Department of State v. Washington Post Co., the Supreme Court held that Exemption 6 isn’t limited to files with a particular label; it reaches any government record containing information that applies to a specific individual.² If the record identifies a particular person, it qualifies, regardless of which office created it or how it’s stored.

In practice, agencies invoke Exemption 6 to shield Social Security numbers, home addresses, private financial details, and the identities of lower-level employees or private citizens mentioned in administrative records. A stamp isn’t enough. The agency has to show a real and clearly unwarranted intrusion, not a speculative one.

Exemption 7(C): Law Enforcement Records

Records compiled for law enforcement purposes get stronger privacy protection. Exemption 7(C) applies when release could reasonably be expected to constitute an unwarranted invasion of personal privacy.¹ The word “clearly” is gone. That single-word difference gives agencies materially more room to withhold on privacy grounds when the file is a law enforcement one.

The people protected are a wide group. Witnesses, informants, undercover officers, investigators, and suspects who were never charged all have recognized privacy interests in staying out of a public file. Witnesses and informants face retaliation risks. Officers need to protect their identities to keep working. And people investigated but never prosecuted shouldn’t have to carry that stigma into the public record.

The Supreme Court set the tone in DOJ v. Reporters Committee for Freedom of the Press, holding that a third party’s request for law enforcement records about a private citizen can reasonably be expected to invade privacy, and that when the request seeks no “official information” about a government agency, the invasion is unwarranted.³ Privacy is at its peak when the record reveals nothing about how the agency itself operates.

Two related law enforcement provisions run alongside 7(C). Exemption 7(D) shields the identities of confidential sources, whether the promise of confidentiality was express or reasonably inferred from the circumstances. Exemption 7(F) allows withholding when disclosure could reasonably endanger someone’s life or physical safety.¹

Who Has Privacy Under FOIA

Only individuals do. In FCC v. AT&T Inc., the Supreme Court ruled unanimously that corporations have no “personal privacy” interests under FOIA.⁴ AT&T had argued that documents it gave the FCC during an investigation should be shielded under Exemption 7(C). The Court disagreed, reading “personal” to refer to individuals, not artificial entities. A company can’t block a request for its dealings with a federal agency by claiming personal privacy.

Death reduces a privacy interest but doesn’t erase it. Agencies are expected to take reasonable steps to determine whether a subject is alive before invoking a privacy exemption for them.

Family members have interests of their own. In NARA v. Favish, the Supreme Court held that surviving relatives have a recognized right to prevent the exploitation of a close family member’s death-scene images, grounded in the common-law tradition of families controlling the treatment of a deceased relative’s remains.⁵ Even when the subject of a record has died, the family can sometimes block release of especially sensitive material.

How the Balancing Test Actually Works

Neither exemption is absolute. The agency has to weigh the individual’s privacy against the public interest in disclosure, and FOIA defines public interest narrowly. It means information that sheds light on what a government agency is doing: how it performs its duties, how it spends money, whether its officials act properly.³

Your reason for wanting the records doesn’t factor in. Curiosity, private litigation, commercial use, and journalistic interest all fall outside the FOIA definition. The only question is whether the records help the general public understand how the government operates. If they don’t, privacy usually wins.

Where the public-interest theory is that the records show government wrongdoing, Favish added a hurdle. The requester has to produce evidence that would lead a reasonable person to believe the misconduct actually occurred.⁵ A hunch isn’t enough. This is where a lot of requests fail: the requester suspects something but can’t point to anything concrete, so the privacy justification holds.

The Foreseeable Harm Requirement

Fitting inside an exemption isn’t the end of the analysis. The FOIA Improvement Act of 2016 added a foreseeable harm standard: an agency may withhold only if it reasonably foresees that disclosure would actually harm the interest the exemption protects.¹ The exemption is necessary; the concrete harm is also necessary.

Before 2016, some agencies treated exemptions as automatic authority to redact. A name in a law enforcement file got blacked out without asking whether releasing that particular name would harm anyone. The foreseeable harm standard forces a more specific answer, and it pairs with the segregability rule: agencies must consider partial release whenever a full release isn’t possible.

When an Agency Won’t Confirm Records Exist

Sometimes an agency won’t tell you whether responsive records exist at all. This is called a Glomar response, and it’s used when confirming or denying the existence of a record would itself reveal protected information.⁶ In the privacy setting, it usually comes up with law enforcement files. If you ask for the FBI’s investigative records on a named person, confirming that such records exist tells the world that person was investigated, and that fact alone triggers Exemption 7(C).

A Glomar response isn’t automatic either. It requires a genuine privacy interest that outweighs the public interest in disclosure. Several things can defeat it: the subject has died, the subject has waived privacy in writing, or the government has already publicly confirmed the investigation through an indictment, prosecution, or official statement. Once any of those is true, the agency generally can’t refuse to confirm or deny.

What You Should Get Back After Redactions

A record with some private information isn’t a record the agency can withhold entirely. The statute requires release of any reasonably segregable portion after the exempt parts are removed.¹ That means a line-by-line review: names, Social Security numbers, and other identifiers are blacked out, and the rest of the document goes to you.

Each redaction should be labeled with the specific exemption behind it, either on the page or in the cover letter.⁷ A page with three redactions should tell you which exemption applies to each one. You might see “b(6)” beside a blacked-out name and “b(7)(C)” beside a redacted witness statement on the same page. The only exception is when labeling the exemption would itself reveal the protected content.

If You’re Denied on Privacy Grounds

You have at least 90 days from the date of a denial to file an administrative appeal with the head of the agency, and the agency must decide it within 20 business days.¹ You can also ask the agency’s FOIA Public Liaison for help, or contact the Office of Government Information Services, which acts as a federal FOIA ombudsman and can mediate.

If the appeal fails, you can sue in federal district court. Venue options include where you live, where you have your principal place of business, where the records are located, or the District of Columbia.¹ The court reviews the withholding from scratch, owes the agency no deference, and puts the burden of justification on the government. The judge can look at the disputed records privately to decide whether the exemption was properly applied.

If you substantially prevail, the court can order the government to pay your reasonable attorney fees and litigation costs.¹ You’ve substantially prevailed if you get a court order requiring disclosure, reach an enforceable settlement, or the agency voluntarily releases records after you file suit and your claim wasn’t frivolous. The award is discretionary; the court considers the public benefit of the released materials, whether you had a commercial motive, and whether the government had a reasonable basis for its position.

1
Office of the Law Revision Counsel. 5 USC 552 – Public Information; Agency Rules, Opinions, Orders, Records, and Proceedings
2
Justia Law. Department of State v. Washington Post Co., 456 U.S. 595
3
Legal Information Institute. United States Department of Justice v. Reporters Committee for Freedom of the Press
4
Legal Information Institute. FCC v. AT&T Inc.
5
Legal Information Institute. National Archives and Records Administration v. Favish
6
U.S. Department of Justice. FOIA Update: OIP Guidance: Privacy Glomarization
7
FOIA.gov. Freedom of Information Act – Frequently Asked Questions