FOIA, which was originally enacted in 1966 and subsequently amended several times, establishes a legal right of access to government records and information, on the basis of the principles of openness and accountability in government. Before the act, an individual seeking access to federal records had faced the burden of establishing a right to examine them. FOIA established a “right to know” standard for access, instead of a “need to know,” and shifted the burden of proof from the individual to the government agency seeking to deny access. The act has been amended several times, including in 1974, 1976, 1986, 1996, and 2002. FOIA provides the public with access to government information either through “affirmative agency disclosure”—publishing information in the Federal Register or making it available in reading rooms—or in response to public requests for disclosure. Public requests for disclosure of records are the best known type of FOIA disclosure. Any member of the public may request access to information held by federal agencies, without showing a need or reason for seeking the information. The act prescribes nine specific categories of information that is exempt from disclosure; agencies may cite these exemptions in denying access to material (see table 1). The act also includes provisions for excluding specific sensitive records held by law enforcement agencies. The act requires agencies to notify requesters of the reasons for any adverse determination and grants requesters the right to appeal agency decisions to deny access. In addition, agencies are required to meet certain time frames for making key determinations: whether to comply with requests (20 business days from receipt of the request), responses to appeals of adverse determinations (20 business days from filing of the appeal), and whether to provide expedited processing of requests (10 business days from receipt of the request). Congress did not establish a statutory deadline for making releasable records available, but instead required agencies to make them available promptly. We have reported several times in the past on the contents of the annual reports of 25 major agencies, covering fiscal years 1998 through 2002. We first reported information in 2001 on the implementation of the 1996 amendments to FOIA. At that time we recommended that Justice (1) encourage agencies to make material electronically available and (2) review agency annual reports to address specific data quality issues. Since our report was issued, Justice has taken steps to implement both of these recommendations. In 2002, we reported that the number of requests received and processed appeared for most agencies—except the Department of Veterans Affairs—to peak in fiscal year 2000 and decline slightly in fiscal year 2001. In our 2004 report, we reported that between 2000 and 2002, the number of requests received and processed declined when the Department of Veterans Affairs is excluded. We also reported that agencies’ backlogs of pending requests were declining, and that the number of FOIA requests denied governmentwide had dropped dramatically between 2000 and 2001 and remained low in 2002. The Department of Justice and the Office of Management and Budget (OMB) both have roles in the implementation of FOIA. The Department of Justice oversees agencies’ compliance with FOIA and is the primary source of policy guidance for agencies. OMB is responsible for issuing guidelines on the uniform schedule of fees. Specifically, Justice’s requirements under the act are to ● make agencies’ annual FOIA reports available through a single electronic access point and notify Congress as to their availability; in consultation with OMB, develop guidelines for the required annual agency reports, so that all reports use common terminology and follow a similar format; and ● submit an annual report on FOIA statistics and the efforts undertaken by Justice to encourage agency compliance. Within the Department of Justice, the Office of Information and Privacy (OIP) has lead responsibility for providing guidance and support to federal agencies on FOIA issues. OIP first issued guidelines for agency preparation and submission of annual reports in the spring of 1997 and periodically issued additional guidance. OIP also periodically issues guidance on compliance, provides training, and maintains a counselors service to provide expert, one- on-one assistance to agency FOIA staff. Further, it also makes a variety of FOIA and Privacy Act resources available to agencies and the public via the Justice Web site and on-line bulletins. In addition, the act requires OMB to issue guidelines to “provide for a uniform schedule of fees for all agencies.” In charging fees for responding to requests, agencies are required to conform to the OMB guidelines. Further, in 1987, the Department of Justice issued guidelines on waiving fees when requests are determined to be in the public interest. Under the guidelines, requests for waivers or reduction of fees are to be considered on a case-by-case basis, taking into account both the public interest and the requester’s commercial interests. The 1996 FOIA amendments, referred to as e-FOIA, require that agencies submit a report to the Attorney General on or before February 1 of each year that covers the preceding fiscal year and includes information about agencies’ FOIA operations. The following are examples of information that is to be included in these reports: ● number of requests received, processed, and pending; ● median number of days taken by the agency to process different ● determinations made by the agency not to disclose information and the reasons for not disclosing the information; ● disposition of administrative appeals by requesters; information on the costs associated with handling of FOIA requests; and ● full-time-equivalent staffing information. In addition to providing their annual reports to the Attorney General, agencies are to make them available to the public in electronic form. The Attorney General is required to make all agency reports available on line at a single electronic access point and report to Congress no later than April 1 of each year that these reports are available in electronic form. As agencies process FOIA requests, they generally place them in one of four possible disposition categories: grants, partial grants, denials, and “not disclosed for other reasons.” These categories are defined as follows: ● Grants: agency decisions to disclose all requested records in full. ● Partial grants: decisions to withhold some records in whole or in part, because such information was determined to fall within one or more exemptions. ● Denials: agency decisions not to release any part of the requested records because all information in the records is determined to be exempt under one or more statutory exemptions. ● Not disclosed for other reasons: agency decisions not to release requested information for any of a variety of reasons other than statutory exemptions from disclosing records. The categories and definitions of these “other” reasons for nondisclosure are shown in table 2. When a FOIA request is denied in full or in part, or the requested records are not disclosed for other reasons, the requester is entitled to be told the reason for the denial, to appeal the denial, and to challenge it in court. FOIA also authorizes agencies to recoup certain direct costs associated with processing requests, and agencies also have the discretion to reduce or waive fees under various circumstances. Agency determinations about fees and fee waivers are complex decisions that include determining (1) a requester’s fee category, (2) whether a fee waiver is to be granted, and (3) the actual fees to be charged. FOIA stipulates three types of fee categories for requesters: (1) commercial; (2) educational or noncommercial scientific institutions and representatives of the news media; and (3) other. Further, fees can be charged for three types of FOIA-related activities—search, duplication, and review—depending on the requester’s fee category. In addition, fees may not be charged to a requester in certain situations, such as when a fee waiver is granted or when the applicable fees are below a certain threshold. Commercial users can be charged for the broadest range of FOIA- related activities, including document search, review, and duplication. Commercial use is defined in the OMB fee schedule guidelines as “a use or purpose that furthers the commercial, trade or profit interests of the requester or the person on whose behalf the request is being made.” The second category exempts search and review fees for documents sought for noncommercial use by educational or noncommercial scientific institutions, and for documents sought by representatives of the news media. The third category of fees, which applies to all requesters who do not fall within either of the other two categories, allows for “reasonable” charges for document search and duplication. Table 3 shows the FOIA-related activities for which agencies can charge by fee category, as stipulated in the act. Although the act generally requires that requesters pay fees to cover the costs of processing their requests, in certain circumstances, fees are not to be charged. For example, as stipulated in the act, fees may not be charged when the government’s cost of collecting and processing the fee is likely to equal or exceed the amount of the fee itself. Further, under certain circumstances, the act requires an agency to furnish documents without charge, or at reduced charges. This is commonly referred to as the FOIA fee-waiver provision. Based on this provision, an agency must provide a fee waiver if two conditions are met: ● disclosure of the requested information is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government, and ● disclosure of the information is not primarily in the commercial interest of the requester. Under the act and guidance, when these requirements are both satisfied, based upon information supplied by a requester or otherwise made known to the agency, the fee waiver or reduction is to be granted by the FOIA officer. When one or both of these requirements are not satisfied, a fee waiver is not warranted. As these criteria suggest, fee waivers are to be granted on a case-by- case basis. Individuals who receive fee waivers in some cases may not necessarily receive them in other cases. In addition to FOIA, the Privacy Act of 1974 includes provisions granting individuals the right to gain access to and correct information about themselves held by federal agencies. Thus the Privacy Act serves as a second major legal basis, in addition to FOIA, for the public to use in obtaining government information. The Privacy Act also places limitations on agencies’ collection, disclosure, and use of personal information. Although the two laws differ in scope, procedures in both FOIA and the Privacy Act permit individuals to seek access to records about themselves—known as “first-party” access. Depending on the individual circumstances, one law may allow broader access or more extensive procedural rights than the other, or access may be denied under one act and allowed under the other. Subsequently, the Department of Justice’s Office of Information and Privacy (OIP) issued guidance that it is “good policy for agencies to treat all first- party access requests as FOIA requests (as well as possibly Privacy Act requests), regardless of whether the FOIA is cited in a requester’s letter.” This guidance was intended to help ensure that requesters receive the fullest possible response to their inquiries, regardless of which law they cite. For more information about FOIA and the Privacy Act, see appendix I. Although the specific details of processes for handling FOIA requests vary among agencies, the major steps in handling a request are similar across the government. Agencies receive requests, usually in writing (although they may accept requests by telephone or electronically), which can come from any organization or member of the public. Once received, the request goes through several phases, which include initial processing, searching for and retrieving responsive records, preparing responsive records for release, approving the release of the records, and releasing the records to the requester. Figure 1 is an overview of the process, from the receipt of a request to the release of records. During the initial processing phase, a request is logged into the agency’s FOIA system, and a case file is started. The request is then reviewed to determine its scope, estimate fees, and provide an initial response to the requester. After this point, the FOIA staff begins its search to retrieve responsive records. This step may include searching for records from multiple locations and program offices. After potentially responsive records are located, the documents are reviewed to ensure that they are within the scope of the request. During the next two phases, the agency ensures that appropriate information is to be released under the provisions of the act. First, the agency reviews the responsive records to make any redactions based on the statutory exemptions. Once the exemption review is complete, the final set of responsive records is turned over to the FOIA office, which calculates appropriate fees, if applicable. Before release, the redacted responsive records are then given a final review, possibly by the agency’s general counsel, and then a response letter is generated, summarizing the agency’s actions regarding the request. Finally, the responsive records are released to the requester. Some requests are relatively simple to process, such as requests for specific pieces of information that the requester sends directly to the appropriate office. Other requests may require more extensive processing, depending on their complexity, the volume of information involved, the need for the agency FOIA office to work with offices that have relevant subject-matter expertise to find and obtain information, the need for a FOIA officer to review and redact information in the responsive material, the need to communicate with the requester about the scope of the request, and the need to communicate with the requester about the fees that will be charged for fulfilling the request (or whether fees will be waived). Specific details of agency processes for handling requests vary, depending on the agency’s organizational structure and the complexity of the requests received. While some agencies centralize processing in one main office, other agencies have separate FOIA offices for each agency component and field office. Agencies also vary in how they allow requests to be made. Depending on the agency, requesters can submit requests by telephone, fax, letter, or e-mail or through the Web. In addition, agencies may process requests in two ways, known as “multitrack” and “single track.” Multitrack processing involves dividing requests into two groups: (1) simple requests requiring relatively minimal review, which are placed in one processing track, and (2) more voluminous and complex requests, which are placed in another track. In contrast, single-track processing does not distinguish between simple and complex requests. With single-track processing, agencies process all requests on a first-in/first-out basis. Agencies can also process FOIA requests on an expedited basis when a requester has shown a compelling need or urgency for the information. Citizens have been requesting and receiving an ever-increasing amount of information from the federal government, as reflected in the increasing number of FOIA requests that have been received and processed in recent years. In fiscal year 2004, the 25 agencies we reviewed reported receiving and processing about 4 million requests, an increase of 25 percent compared to 2003. From 2002 to 2004, the number of requests received increased by 71 percent, and the number of requests processed increased by 68 percent. The 25 agencies we reviewed handle over 97 percent of FOIA requests governmentwide. They include the 24 major agencies covered by the Chief Financial Officers Act, as well as the Central Intelligence Agency and, beginning in 2003, the Department of Homeland Security (DHS) in place of the Federal Emergency Management Agency (FEMA). While the creation of DHS in fiscal year 2003 led to a shift in some FOIA requests from agencies affected by the creation of the new department, the same major component entities are reflected in all 3 years that we reviewed. For example, in 2002, before DHS was formed, FEMA independently reported on its FOIA requests, and its annual report is reflected in our analysis. However, beginning in 2003, FEMA became part of DHS, and thus its FOIA requests are reflected in DHS figures for 2003 and 2004. In recent years, Veterans Affairs (VA) has accounted for a large portion—about half—of governmentwide FOIA requests received and processed. This is because the agency includes in its totals the many first-party medical records requests that it processes. However, VA’s numbers have not driven the large increases in FOIA requests. In fact, in 2004, the agency had a decline in the number of requests received, processed, and pending compared to 2003. Thus, when VA is excluded from governmentwide FOIA request totals, the increase between 2003 and 2004 changes from 25 percent to 61 percent. Figure 2 shows total requests reported governmentwide for fiscal years 2002 through 2004, with VA’s share shown separately. In 2004, most dispositions of FOIA requests (92 percent) were reported to have been granted in full, as shown in table 4. Only relatively small numbers were partially granted (3 percent), denied (1 percent), or not disclosed for other reasons (5 percent). When VA is excluded from the totals, the percentages remain roughly comparable. Agencies other than VA that reported receiving large numbers of requests in fiscal year 2004 included the Social Security Administration (SSA), the Department of Health and Human Services (HHS), and the Department of Homeland Security (DHS), as shown in figure 3. Agencies other than VA, SSA, HHS, and DHS accounted for only 9 percent of all requests. Three of the four agencies that handled the largest numbers of requests—VA, SSA, and HHS—also granted the largest percentages of requests in full. However, as shown in figure 4, the numbers of fully granted requests varied widely among agencies in fiscal year 2004. For example, three agencies—State, the Central Intelligence Agency, and the National Science Foundation —made full grants of requested records in less than 20 percent of the cases they processed. Eight of the 25 agencies we reviewed made full grants of requested records in over 60 percent of their cases. This variance among agencies in the disposition of requests has been evident in prior years as well. In addition to processing greater numbers of requests, many agencies (13 of 25) also reported that their backlogs of pending requests—requests carried over from one year to the next—have increased since 2002. In 2002, pending requests governmentwide were reported to number about 140,000; whereas in 2004, about 160,000—14 percent more—were reported. Mixed results were reported in reducing backlogs at the agency level—some backlogs decreased while others increased, as reported from 2002 through 2004. The number of requests that an agency processes relative to the number it receives is an indicator of whether an agency’s backlog is increasing or decreasing. Six of the 25 agencies we reviewed reported processing fewer requests than they received each year for fiscal years 2002, 2003, and 2004— therefore increasing their backlogs (see fig. 4). Nine additional agencies also processed less than they received in two of these three years. In contrast, five agencies (CIA, Energy, Labor, SBA, and State) had processing rates above 100 percent in all three years, meaning that each made continued progress in reducing their backlogs of pending cases. Thirteen agencies were able to make at least a small reduction in their backlogs in 1 or more years between fiscal years 2002 and 2004. FOIA does not require agencies to make records available within a specific amount of time. As I mentioned earlier, Congress did not establish a statutory deadline for making releasable records available, but instead required agencies to make them available promptly. Agencies, however, are required to inform requesters within 20 days of receipt of a request as to whether the agency will comply with the request. For 2004, the reported time required to process requests by track varied considerably among agencies (see table 5). Eleven agency components reported processing simple requests in less than 10 days, as evidenced by the lower value of the reported ranges. These components are part of the Departments of Energy, Education, Homeland Security, Health and Human Services, the Interior, Justice, Labor, Transportation, the Treasury, and Agriculture. On the other hand, some organizations are taking much more time to process simple requests, such as components of Energy, Interior, and Justice. This can be seen in upper end values of the median ranges greater than 100 days. Components of four agencies (Interior, Education, Treasury, and VA) reported processing complex requests quickly—in less than 10 days. In contrast, several other agencies (DHS, Energy, Justice, Transportation, Education, HHS, HUD, State, Treasury, and Agriculture) reported components taking longer to process complex requests, with median days greater than 100. Four agencies (HHS, NSF, OPM, and SBA) reported using single-track processing. The processing times for single track varied from 5 days (at SBA) to 182 days (at an HHS component). Based on the data in agency annual reports, it was not feasible to determine trends at the agency level in the amount of time taken to process requests (reported annually as the median number of days to process requests). This is largely because many agencies have reported median processing times at a component level, making it difficult to derive overall agency median processing times. Nearly half (12 of 25) of the agencies reported median times at a component level. Although this practice does not provide agency- level indicators, it provides visibility into differences in processing times among the various components of agencies, which can sometimes be substantial. In summary, FOIA continues to be a valuable tool for citizens to obtain information about the operation and decisions of the federal government. Agencies have received steadily increasing numbers of requests and have also continued to increase the number of requests that they process. Despite this increase in processing requests, the backlog of pending cases continues to grow. Given this steadily increasing workload, it will remain critically important that strong oversight of FOIA implementation continue in order to ensure that agencies remain responsive to the needs of citizens. Mr. Chairman, this completes my prepared statement. I would be happy to respond to any questions you or other Members of the Subcommittee may have at this time. If you should have questions about this testimony, please contact me at (202) 512-6240 or via e-mail at koontzl@gao.gov. Other major contributors included Barbara Collier, John de Ferrari, and Elizabeth Zhao. In addition to rights under the Freedom of Information Act (FOIA), individuals also have rights of access to government information under the Privacy Act of 1974. The Privacy Act restricts the federal government’s use of personal information. More precisely, it governs use of information about an individual that is maintained in a “system of records,” which is any group of records containing information about an individual from which information is retrieved by individual identifier. With regard to access, the Privacy Act gives individuals the right to have access to information about themselves that is maintained in a system of records so that they can review, challenge, and correct the accuracy of personal information held by the government. While both laws generally give individuals the right of access to information (subject to exemptions), there are several important differences: ● While FOIA generally gives a right of access to all federal government records, the Privacy Act applies only to records pertaining to an individual that are retrieved by individual identifier. ● While FOIA generally gives “any person” a right of access to records, the Privacy Act gives access to only the subject of a particular record and only if that person is a U.S. citizen or a lawfully admitted permanent resident alien. ● While FOIA exempts categories of records from public release, including where disclosure would constitute an unwarranted invasion of personal privacy, the Privacy Act’s exemptions pertain to a variety of the act’s requirements, not just access (e.g., that agencies account for all disclosures of personal information, that they maintain only relevant and necessary personal information, and that they notify the public of their sources for obtaining records of personal information). Under current Department of Justice guidance, agencies are to treat an individual’s requests for his or her own records as a request under FOIA as well as the Privacy Act. This is intended to ensure that individuals are fully afforded their rights under both laws. As a practical matter, it appears that agencies generally consider requests for access to one’s own records as FOIA requests, without any separate accounting as Privacy Act requests. These requests are referred to as “first-party requests” and their addition to agency FOIA statistics can been seen, for example, in the large numbers of FOIA requests reported by agencies such as VA and SSA. Apart from questions about the role of the Privacy Act in FOIA decisions, privacy questions are often dealt with independently under FOIA. The act’s two privacy exemptions protect from public release information about individuals in “personnel and medical files and similar files” and “information compiled for law enforcement purposes,” the disclosure of which would constitute an “unwarranted invasion of personal privacy.” These statutory provisions have resulted in an analysis that involves a “balancing of the public’s right to disclosure against the individual’s right to privacy.” This approach led, for example, the Supreme Court to decide that there is a significant private interest in the “practical obscurity” of criminal history records even though they are officially public records. The development and refinement of such privacy principles continues as agencies and the courts make new “balancing” decisions in FOIA cases. Accordingly, it is difficult to definitively describe the extent of privacy protection under FOIA, or to characterize federal privacy protection as limited to the terms of the Privacy Act. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Freedom of Information Act (FOIA) establishes that federal agencies must provide the public with access to government information, thus enabling them to learn about government operations and decisions. To help ensure appropriate implementation, the act requires that agencies report annually to the Attorney General, providing specific information about their FOIA operations. GAO has reported previously on the contents of these annual reports for 25 major agencies. GAO was asked to describe the FOIA process and discuss the reported implementation of FOIA. Although the specific details of processes for handling FOIA requests vary among agencies, the major steps in handling a request are similar across the government. Agencies receive requests, usually in writing (although they may accept requests by telephone or electronically), which can be submitted by any organization or member of the public. Once requests are received, the agency responds through a process that includes several phases: initial processing, searching for and retrieving responsive records, preparing responsive records for release, approving the release of the records, and releasing the records to the requester. According to data reported by agencies in their annual FOIA reports, citizens have been requesting and receiving an ever-increasing amount of information from the federal government through FOIA. The number of requests that agencies received increased by 71 percent from 2002 to 2004. Further, agencies reported they have been processing more requests--68 percent more from 2002 to 2004. For 92 percent of requests processed in 2004, agencies reported that responsive records were provided in full to requesters. However, the number of pending requests carried over from year to year--known as the backlog--has also been increasing, rising 14 percent since 2002.