Information Management: Implementation of the Freedom of Information Act
Published: 2005-05-11T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Freedom of Information Act (FOIA) establishes that federal agencies must provide the public with access to government information, thus enabling them to learn about government operations and decisions. To help ensure appropriate implementation, the act requires that agencies report annually to the Attorney General, providing specific information about their FOIA operations. GAO has reported previously on the contents of these annual reports for 25 major agencies. GAO was asked to describe the FOIA process and discuss the reported implementation of FOIA.
section_title: What GAO Found
paragraphs: Although the specific details of processes for handling FOIA requests vary among agencies, the major steps in handling a request are similar across the government. Agencies receive requests, usually in writing (although they may accept requests by telephone or electronically), which can be submitted by any organization or member of the public. Once requests are received, the agency responds through a process that includes several phases: initial processing, searching for and retrieving responsive records, preparing responsive records for release, approving the release of the records, and releasing the records to the requester. According to data reported by agencies in their annual FOIA reports, citizens have been requesting and receiving an ever-increasing amount of information from the federal government through FOIA. The number of requests that agencies received increased by 71 percent from 2002 to 2004. Further, agencies reported they have been processing more requests--68 percent more from 2002 to 2004. For 92 percent of requests processed in 2004, agencies reported that responsive records were provided in full to requesters. However, the number of pending requests carried over from year to year--known as the backlog--has also been increasing, rising 14 percent since 2002.

section_title: Letter
paragraphs: I appreciate the opportunity to participate in the Subcommittee’s  hearing on the implementation of the Freedom of Information Act  (FOIA). Generally speaking, FOIA establishes that federal agencies  must provide the public with access to government information,  thus enabling them to learn about government operations and  decisions. Specific requests by the public for information through  the act have led to disclosure of waste, fraud, abuse, and  wrongdoing in the government, as well as the identification of  unsafe consumer products, harmful drugs, and serious health  hazards. To help ensure appropriate implementation, the act  requires that agencies report annually to the Attorney General,  providing specific information about their FOIA operations.
As requested, in my remarks today, I will describe the FOIA process  at federal agencies and discuss the implementation of FOIA. To  develop a description of the FOIA process at federal agencies, we  compiled and analyzed information from Department of Justice  documentation and from our previous reports. To assess  implementation of FOIA, we examined, consolidated, and analyzed  annual report data for fiscal years 2002 through 2004 from 25 major  agencies (herein we refer to this scope as governmentwide). We did  not independently verify the accuracy of the data provided in agency  annual reports. We discussed the content of this statement with an  official of the Department of Justice’s Office of Information and  Privacy to confirm the accuracy of our information. We performed  our work from April 2005 to May 2005, in accordance with generally  accepted government auditing standards.
subsections: section_title: Background
paragraphs: FOIA, which was originally enacted in 1966 and subsequently  amended several times, establishes a legal right of access to  government records and information, on the basis of the principles  of openness and accountability in government. Before the act, an  individual seeking access to federal records had faced the burden of  establishing a right to examine them. FOIA established a “right to  know” standard for access, instead of a “need to know,” and shifted  the burden of proof from the individual to the government agency  seeking to deny access. The act has been amended several times,  including in 1974, 1976, 1986, 1996, and 2002.
FOIA provides the public with access to government information  either through “affirmative agency disclosure”—publishing  information in the Federal Register or making it available in reading  rooms—or in response to public requests for disclosure. Public  requests for disclosure of records are the best known type of FOIA  disclosure. Any member of the public may request access to  information held by federal agencies, without showing a need or  reason for seeking the information.
The act prescribes nine specific categories of information that is  exempt from disclosure; agencies may cite these exemptions in  denying access to material (see table 1). The act also includes  provisions for excluding specific sensitive records held by law  enforcement agencies. The act requires agencies to notify requesters  of the reasons for any adverse determination and grants requesters  the right to appeal agency decisions to deny access.
In addition, agencies are required to meet certain time frames for  making key determinations: whether to comply with requests (20  business days from receipt of the request), responses to appeals of  adverse determinations (20 business days from filing of the appeal),  and whether to provide expedited processing of requests (10  business days from receipt of the request). Congress did not  establish a statutory deadline for making releasable records  available, but instead required agencies to make them available  promptly.
We have reported several times in the past on the contents of the  annual reports of 25 major agencies, covering fiscal years 1998  through 2002. We first reported information in 2001 on the  implementation of the 1996 amendments to FOIA. At that time we  recommended that Justice (1) encourage agencies to make material  electronically available and (2) review agency annual reports to  address specific data quality issues. Since our report was issued,  Justice has taken steps to implement both of these  recommendations. In 2002, we reported that the number of requests  received and processed appeared for most agencies—except the  Department of Veterans Affairs—to peak in fiscal year 2000 and  decline slightly in fiscal year 2001. In our 2004 report, we reported  that between 2000 and 2002, the number of requests received and  processed declined when the Department of Veterans Affairs is  excluded. We also reported that agencies’ backlogs of pending  requests were declining, and that the number of FOIA requests  denied governmentwide had dropped dramatically between 2000  and 2001 and remained low in 2002.
subsections: section_title: Roles of Justice and OMB in FOIA Implementation
paragraphs: The Department of Justice and the Office of Management and  Budget (OMB) both have roles in the implementation of FOIA. The  Department of Justice oversees agencies’ compliance with FOIA and  is the primary source of policy guidance for agencies. OMB is  responsible for issuing guidelines on the uniform schedule of fees.
Specifically, Justice’s requirements under the act are to  ●  make agencies’ annual FOIA reports available through a single  electronic access point and notify Congress as to their availability;  in consultation with OMB, develop guidelines for the required  annual agency reports, so that all reports use common terminology  and follow a similar format; and  ●  submit an annual report on FOIA statistics and the efforts  undertaken by Justice to encourage agency compliance.
Within the Department of Justice, the Office of Information and  Privacy (OIP) has lead responsibility for providing guidance and  support to federal agencies on FOIA issues. OIP first issued  guidelines for agency preparation and submission of annual reports  in the spring of 1997 and periodically issued additional guidance.  OIP also periodically issues guidance on compliance, provides  training, and maintains a counselors service to provide expert, one- on-one assistance to agency FOIA staff. Further, it also makes a  variety of FOIA and Privacy Act resources available to agencies and  the public via the Justice Web site and on-line bulletins.
In addition, the act requires OMB to issue guidelines to “provide for  a uniform schedule of fees for all agencies.” In charging fees for  responding to requests, agencies are required to conform to the  OMB guidelines. Further, in 1987, the Department of Justice issued  guidelines on waiving fees when requests are determined to be in  the public interest. Under the guidelines, requests for waivers or  reduction of fees are to be considered on a case-by-case basis,  taking into account both the public interest and the requester’s  commercial interests.
The 1996 FOIA amendments, referred to as e-FOIA, require that  agencies submit a report to the Attorney General on or before  February 1 of each year that covers the preceding fiscal year and  includes information about agencies’ FOIA operations. The  following are examples of information that is to be included in these  reports:  ●  number of requests received, processed, and pending;  ●  median number of days taken by the agency to process different  ●  determinations made by the agency not to disclose information and  the reasons for not disclosing the information;  ●  disposition of administrative appeals by requesters;  information on the costs associated with handling of FOIA requests;  and  ●  full-time-equivalent staffing information.
In addition to providing their annual reports to the Attorney  General, agencies are to make them available to the public in  electronic form. The Attorney General is required to make all agency  reports available on line at a single electronic access point and  report to Congress no later than April 1 of each year that these  reports are available in electronic form.
section_title: Disposition of Agency Requests
paragraphs: As agencies process FOIA requests, they generally place them in one  of four possible disposition categories: grants, partial grants,  denials, and “not disclosed for other reasons.” These categories are  defined as follows:  ●  Grants: agency decisions to disclose all requested records in full.  ●  Partial grants: decisions to withhold some records in whole or in  part, because such information was determined to fall within one or  more exemptions.  ●  Denials: agency decisions not to release any part of the requested  records because all information in the records is determined to be  exempt under one or more statutory exemptions.  ●  Not disclosed for other reasons: agency decisions not to release  requested information for any of a variety of reasons other than  statutory exemptions from disclosing records. The categories and  definitions of these “other” reasons for nondisclosure are shown in  table 2.
When a FOIA request is denied in full or in part, or the requested  records are not disclosed for other reasons, the requester is entitled  to be told the reason for the denial, to appeal the denial, and to  challenge it in court.
section_title: Fee Structure and Fee Waivers
paragraphs: FOIA also authorizes agencies to recoup certain direct costs  associated with processing requests, and agencies also have the  discretion to reduce or waive fees under various circumstances.  Agency determinations about fees and fee waivers are complex  decisions that include determining (1) a requester’s fee category,  (2) whether a fee waiver is to be granted, and (3) the actual fees to  be charged.
FOIA stipulates three types of fee categories for requesters:  (1) commercial; (2) educational or noncommercial scientific  institutions and representatives of the news media; and (3) other.  Further, fees can be charged for three types of FOIA-related  activities—search, duplication, and review—depending on the  requester’s fee category. In addition, fees may not be charged to a  requester in certain situations, such as when a fee waiver is granted  or when the applicable fees are below a certain threshold.
Commercial users can be charged for the broadest range of FOIA- related activities, including document search, review, and  duplication. Commercial use is defined in the OMB fee schedule  guidelines as “a use or purpose that furthers the commercial, trade  or profit interests of the requester or the person on whose behalf the  request is being made.” The second category exempts search and  review fees for documents sought for noncommercial use by  educational or noncommercial scientific institutions, and for  documents sought by representatives of the news media. The third  category of fees, which applies to all requesters who do not fall  within either of the other two categories, allows for “reasonable”  charges for document search and duplication. Table 3 shows the  FOIA-related activities for which agencies can charge by fee  category, as stipulated in the act.
Although the act generally requires that requesters pay fees to cover  the costs of processing their requests, in certain circumstances, fees  are not to be charged. For example, as stipulated in the act, fees  may not be charged when the government’s cost of collecting and  processing the fee is likely to equal or exceed the amount of the fee  itself.
Further, under certain circumstances, the act requires an agency to  furnish documents without charge, or at reduced charges. This is  commonly referred to as the FOIA fee-waiver provision. Based on  this provision, an agency must provide a fee waiver if two  conditions are met:  ●  disclosure of the requested information is in the public interest  because it is likely to contribute significantly to public  understanding of the operations or activities of the government, and  ●  disclosure of the information is not primarily in the commercial  interest of the requester.
Under the act and guidance, when these requirements are both  satisfied, based upon information supplied by a requester or  otherwise made known to the agency, the fee waiver or reduction is  to be granted by the FOIA officer. When one or both of these  requirements are not satisfied, a fee waiver is not warranted. As  these criteria suggest, fee waivers are to be granted on a case-by- case basis. Individuals who receive fee waivers in some cases may  not necessarily receive them in other cases.
section_title: Relationship of FOIA and the Privacy Act
paragraphs: In addition to FOIA, the Privacy Act of 1974 includes provisions  granting individuals the right to gain access to and correct  information about themselves held by federal agencies. Thus the  Privacy Act serves as a second major legal basis, in addition to  FOIA, for the public to use in obtaining government information.  The Privacy Act also places limitations on agencies’ collection,  disclosure, and use of personal information.
Although the two laws differ in scope, procedures in both FOIA and  the Privacy Act permit individuals to seek access to records about  themselves—known as “first-party” access. Depending on the  individual circumstances, one law may allow broader access or  more extensive procedural rights than the other, or access may be  denied under one act and allowed under the other. Subsequently,  the Department of Justice’s Office of Information and Privacy (OIP)  issued guidance that it is “good policy for agencies to treat all first- party access requests as FOIA requests (as well as possibly Privacy  Act requests), regardless of whether the FOIA is cited in a  requester’s letter.” This guidance was intended to help ensure that  requesters receive the fullest possible response to their inquiries,  regardless of which law they cite. For more information about FOIA  and the Privacy Act, see appendix I.
section_title: The FOIA Process at Federal Agencies
paragraphs: Although the specific details of processes for handling FOIA  requests vary among agencies, the major steps in handling a request  are similar across the government. Agencies receive requests,  usually in writing (although they may accept requests by telephone  or electronically), which can come from any organization or  member of the public. Once received, the request goes through  several phases, which include initial processing, searching for and  retrieving responsive records, preparing responsive records for  release, approving the release of the records, and releasing the  records to the requester. Figure 1 is an overview of the process,  from the receipt of a request to the release of records.
During the initial processing phase, a request is logged into the  agency’s FOIA system, and a case file is started. The request is then  reviewed to determine its scope, estimate fees, and provide an initial  response to the requester. After this point, the FOIA staff begins its  search to retrieve responsive records. This step may include  searching for records from multiple locations and program offices.  After potentially responsive records are located, the documents are  reviewed to ensure that they are within the scope of the request.
During the next two phases, the agency ensures that appropriate  information is to be released under the provisions of the act. First,  the agency reviews the responsive records to make any redactions  based on the statutory exemptions. Once the exemption review is  complete, the final set of responsive records is turned over to the  FOIA office, which calculates appropriate fees, if applicable. Before  release, the redacted responsive records are then given a final  review, possibly by the agency’s general counsel, and then a  response letter is generated, summarizing the agency’s actions  regarding the request. Finally, the responsive records are released to  the requester.
Some requests are relatively simple to process, such as requests for  specific pieces of information that the requester sends directly to  the appropriate office. Other requests may require more extensive  processing, depending on their complexity, the volume of  information involved, the need for the agency FOIA office to work  with offices that have relevant subject-matter expertise to find and  obtain information, the need for a FOIA officer to review and redact  information in the responsive material, the need to communicate  with the requester about the scope of the request, and the need to  communicate with the requester about the fees that will be charged  for fulfilling the request (or whether fees will be waived).
Specific details of agency processes for handling requests vary,  depending on the agency’s organizational structure and the  complexity of the requests received. While some agencies centralize  processing in one main office, other agencies have separate FOIA  offices for each agency component and field office. Agencies also  vary in how they allow requests to be made. Depending on the  agency, requesters can submit requests by telephone, fax, letter, or  e-mail or through the Web. In addition, agencies may process  requests in two ways, known as “multitrack” and “single track.”  Multitrack processing involves dividing requests into two groups:  (1) simple requests requiring relatively minimal review, which are  placed in one processing track, and (2) more voluminous and  complex requests, which are placed in another track. In contrast,  single-track processing does not distinguish between simple and  complex requests. With single-track processing, agencies process all  requests on a first-in/first-out basis. Agencies can also process FOIA  requests on an expedited basis when a requester has shown a  compelling need or urgency for the information.
section_title: FOIA Implementation
paragraphs: Citizens have been requesting and receiving an ever-increasing  amount of information from the federal government, as reflected in  the increasing number of FOIA requests that have been received and  processed in recent years. In fiscal year 2004, the 25 agencies we  reviewed reported receiving and processing about 4 million  requests, an increase of 25 percent compared to 2003. From 2002 to  2004, the number of requests received increased by 71 percent, and  the number of requests processed increased by 68 percent.
The 25 agencies we reviewed handle over 97 percent of FOIA  requests governmentwide. They include the 24 major agencies  covered by the Chief Financial Officers Act, as well as the Central  Intelligence Agency and, beginning in 2003, the Department of  Homeland Security (DHS) in place of the Federal Emergency  Management Agency (FEMA). While the creation of DHS in fiscal  year 2003 led to a shift in some FOIA requests from agencies  affected by the creation of the new department, the same major  component entities are reflected in all 3 years that we reviewed. For  example, in 2002, before DHS was formed, FEMA independently  reported on its FOIA requests, and its annual report is reflected in  our analysis. However, beginning in 2003, FEMA became part of  DHS, and thus its FOIA requests are reflected in DHS figures for  2003 and 2004.
In recent years, Veterans Affairs (VA) has accounted for a large  portion—about half—of governmentwide FOIA requests received  and processed. This is because the agency includes in its totals the  many first-party medical records requests that it processes.  However, VA’s numbers have not driven the large increases in FOIA  requests. In fact, in 2004, the agency had a decline in the number of  requests received, processed, and pending compared to 2003. Thus,  when VA is excluded from governmentwide FOIA request totals,  the increase between 2003 and 2004 changes from 25 percent to 61  percent. Figure 2 shows total requests reported governmentwide for  fiscal years 2002 through 2004, with VA’s share shown separately.
In 2004, most dispositions of FOIA requests (92 percent) were  reported to have been granted in full, as shown in table 4. Only  relatively small numbers were partially granted (3 percent), denied  (1 percent), or not disclosed for other reasons (5 percent). When VA  is excluded from the totals, the percentages remain roughly  comparable.
Agencies other than VA that reported receiving large numbers of  requests in fiscal year 2004 included the Social Security  Administration (SSA), the Department of Health and Human  Services (HHS), and the Department of Homeland Security (DHS),  as shown in figure 3. Agencies other than VA, SSA, HHS, and DHS  accounted for only 9 percent of all requests.
Three of the four agencies that handled the largest numbers of  requests—VA, SSA, and HHS—also granted the largest percentages  of requests in full. However, as shown in figure 4, the numbers of  fully granted requests varied widely among agencies in fiscal year  2004. For example, three agencies—State, the Central Intelligence  Agency, and the National Science Foundation —made full grants of  requested records in less than 20 percent of the cases they  processed. Eight of the 25 agencies we reviewed made full grants of  requested records in over 60 percent of their cases. This variance  among agencies in the disposition of requests has been evident in  prior years as well.
subsections: section_title: Agency Backlogs Have Increased
paragraphs: In addition to processing greater numbers of requests, many  agencies (13 of 25) also reported that their backlogs of pending  requests—requests carried over from one year to the next—have  increased since 2002. In 2002, pending requests governmentwide  were reported to number about 140,000; whereas in 2004, about  160,000—14 percent more—were reported.
Mixed results were reported in reducing backlogs at the agency  level—some backlogs decreased while others increased, as reported  from 2002 through 2004. The number of requests that an agency  processes relative to the number it receives is an indicator of  whether an agency’s backlog is increasing or decreasing. Six of the  25 agencies we reviewed reported processing fewer requests than  they received each year for fiscal years 2002, 2003, and 2004— therefore increasing their backlogs (see fig. 4). Nine additional  agencies also processed less than they received in two of these three  years. In contrast, five agencies (CIA, Energy, Labor, SBA, and  State) had processing rates above 100 percent in all three years,  meaning that each made continued progress in reducing their  backlogs of pending cases. Thirteen agencies were able to make at  least a small reduction in their backlogs in 1 or more years between  fiscal years 2002 and 2004.
FOIA does not require agencies to make records available within a  specific amount of time. As I mentioned earlier, Congress did not  establish a statutory deadline for making releasable records  available, but instead required agencies to make them available  promptly. Agencies, however, are required to inform requesters  within 20 days of receipt of a request as to whether the agency will  comply with the request.
For 2004, the reported time required to process requests by track  varied considerably among agencies (see table 5). Eleven agency  components reported processing simple requests in less than 10  days, as evidenced by the lower value of the reported ranges. These  components are part of the Departments of Energy, Education,  Homeland Security, Health and Human Services, the Interior,  Justice, Labor, Transportation, the Treasury, and Agriculture. On the  other hand, some organizations are taking much more time to  process simple requests, such as components of Energy, Interior,  and Justice. This can be seen in upper end values of the median  ranges greater than 100 days. Components of four agencies (Interior,  Education, Treasury, and VA) reported processing complex requests  quickly—in less than 10 days. In contrast, several other agencies  (DHS, Energy, Justice, Transportation, Education, HHS, HUD, State,  Treasury, and Agriculture) reported components taking longer to  process complex requests, with median days greater than 100. Four  agencies (HHS, NSF, OPM, and SBA) reported using single-track  processing. The processing times for single track varied from 5 days  (at SBA) to 182 days (at an HHS component).
Based on the data in agency annual reports, it was not feasible to  determine trends at the agency level in the amount of time taken to  process requests (reported annually as the median number of days  to process requests). This is largely because many agencies have  reported median processing times at a component level, making it  difficult to derive overall agency median processing times. Nearly  half (12 of 25) of the agencies reported median times at a  component level. Although this practice does not provide agency- level indicators, it provides visibility into differences in processing  times among the various components of agencies, which can  sometimes be substantial.
In summary, FOIA continues to be a valuable tool for citizens to  obtain information about the operation and decisions of the federal  government. Agencies have received steadily increasing numbers of  requests and have also continued to increase the number of requests  that they process. Despite this increase in processing requests, the  backlog of pending cases continues to grow. Given this steadily  increasing workload, it will remain critically important that strong  oversight of FOIA implementation continue in order to ensure that  agencies remain responsive to the needs of citizens.
Mr. Chairman, this completes my prepared statement. I would be  happy to respond to any questions you or other Members of the  Subcommittee may have at this time.
section_title: Contact and Acknowledgements
paragraphs: If you should have questions about this testimony, please contact  me at (202) 512-6240 or via e-mail at koontzl@gao.gov. Other major  contributors included Barbara Collier, John de Ferrari, and  Elizabeth Zhao.
section_title: Appendix I: Relationship of FOIA and the Privacy Act of 1974
paragraphs: In addition to rights under the Freedom of Information Act (FOIA),  individuals also have rights of access to government information  under the Privacy Act of 1974. The Privacy Act restricts the federal  government’s use of personal information. More precisely, it  governs use of information about an individual that is maintained in  a “system of records,” which is any group of records containing  information about an individual from which information is retrieved  by individual identifier. With regard to access, the Privacy Act gives  individuals the right to have access to information about themselves  that is maintained in a system of records so that they can review,  challenge, and correct the accuracy of personal information held by  the government.
While both laws generally give individuals the right of access to  information (subject to exemptions), there are several important  differences:  ●  While FOIA generally gives a right of access to all federal  government records, the Privacy Act applies only to records  pertaining to an individual that are retrieved by individual identifier.  ●  While FOIA generally gives “any person” a right of access to records,  the Privacy Act gives access to only the subject of a particular  record and only if that person is a U.S. citizen or a lawfully admitted  permanent resident alien.  ●  While FOIA exempts categories of records from public release,  including where disclosure would constitute an unwarranted  invasion of personal privacy, the Privacy Act’s exemptions pertain  to a variety of the act’s requirements, not just access (e.g., that  agencies account for all disclosures of personal information, that  they maintain only relevant and necessary personal information, and  that they notify the public of their sources for obtaining records of  personal information).
Under current Department of Justice guidance, agencies are to treat  an individual’s requests for his or her own records as a request  under FOIA as well as the Privacy Act. This is intended to ensure  that individuals are fully afforded their rights under both laws. As a  practical matter, it appears that agencies generally consider requests  for access to one’s own records as FOIA requests, without any  separate accounting as Privacy Act requests. These requests are  referred to as “first-party requests” and their addition to agency  FOIA statistics can been seen, for example, in the large numbers of  FOIA requests reported by agencies such as VA and SSA.
Apart from questions about the role of the Privacy Act in FOIA  decisions, privacy questions are often dealt with independently  under FOIA. The act’s two privacy exemptions  protect  from public release information about individuals in “personnel and  medical files and similar files” and “information compiled for law  enforcement purposes,” the disclosure of which would constitute an  “unwarranted invasion of personal privacy.” These statutory  provisions have resulted in an analysis that involves a “balancing of  the public’s right to disclosure against the individual’s right to  privacy.” This approach led, for example, the Supreme Court to  decide that there is a significant private interest in the “practical  obscurity” of criminal history records even though they are officially  public records. The development and refinement of such privacy  principles continues as agencies and the courts make new  “balancing” decisions in FOIA cases. Accordingly, it is difficult to  definitively describe the extent of privacy protection under FOIA, or  to characterize federal privacy protection as limited to the terms of  the Privacy Act.
This  is  a  work  of  the  U.S.  government  and  is  not  subject  to  copyright  protection  in  the  United  States.  It  may  be  reproduced  and  distributed  in  its  entirety  without  further  permission  from  GAO.  However,  because  this  work  may  contain  copyrighted  images  or  other  material,  permission  from  the  copyright  holder  may  be  necessary  if  you  wish  to  reproduce this material separately.