FOIA establishes a legal right of access to government records and information, on the basis of the principles of openness and accountability in government. Before the act (originally enacted in 1966), an individual seeking access to federal records had faced the burden of establishing a right to examine them. FOIA established a “right to know” standard for access, instead of a “need to know,” and shifted the burden of proof from the individual to the government agency seeking to deny access. FOIA provides the public with access to government information either through “affirmative agency disclosure”—publishing information in the Federal Register or the Internet, or making it available in reading rooms—or in response to public requests for disclosure. Public requests for disclosure of records are the best known type of FOIA disclosure. Any member of the public may request access to information held by federal agencies, without showing a need or reason for seeking the information. Not all information held by the government is subject to FOIA. The act prescribes nine specific categories of information that are exempt from disclosure: for example, trade secrets and certain privileged commercial or financial information, certain personnel and medical files, and certain law enforcement records or information (attachment II provides the complete list). In denying access to material, agencies may cite these exemptions. The act requires agencies to notify requesters of the reasons for any adverse determination (that is, a determination not to provide records) and grants requesters the right to appeal agency decisions to deny access. In addition, agencies are required to meet certain time frames for making key determinations: whether to comply with requests (20 business days from receipt of the request), responses to appeals of adverse determinations (20 business days from receipt of the appeal), and whether to provide expedited processing of requests (10 calendar days from receipt of the request). Congress did not establish a statutory deadline for making releasable records available, but instead required agencies to make them available promptly. Although the specific details of processes for handling FOIA requests vary among agencies, the major steps in handling a request are similar across the government. Agencies receive requests, usually in writing (although they may accept requests by telephone or electronically), which can come from any organization or member of the public. Once received, the request goes through several phases, which include initial processing, searching for and retrieving responsive records, preparing responsive records for release, approving the release of the records, and releasing the records to the requester. Figure 1 is an overview of the process, from the receipt of a request to the release of records. During the initial processing phase, a request is logged into the agency’s FOIA system, and a case file is started. The request is then reviewed to determine its scope, estimate fees, and provide an initial response to the requester (in general, this simply acknowledges receipt of the request). After this point, the FOIA staff begins its search to retrieve responsive records. This step may include searching for records from multiple locations and program offices. After potentially responsive records are located, the documents are reviewed to ensure that they are within the scope of the request. During the next two phases, the agency ensures that appropriate information is to be released under the provisions of the act. First, the agency reviews the responsive records to make any redactions based on the statutory exemptions. Once the exemption review is complete, the final set of responsive records is turned over to the FOIA office, which calculates appropriate fees, if applicable. Before release, the redacted responsive records are then given a final review, possibly by the agency’s general counsel, and then a response letter is generated, summarizing the agency’s actions regarding the request. Finally, the responsive records are released to the requester. Some requests are relatively simple to process, such as requests for specific pieces of information that the requester sends directly to the appropriate office. Other requests may require more extensive processing, depending on their complexity, the volume of information involved, the need for the agency FOIA office to work with offices that have relevant subject-matter expertise to find and obtain information, the need for a FOIA officer to review and redact information in the responsive material, the need to communicate with the requester about the scope of the request, and the need to communicate with the requester about the fees that will be charged for fulfilling the request (or whether fees will be waived). Specific details of agency processes for handling requests vary, depending on the agency’s organizational structure and the complexity of the requests received. While some agencies centralize processing in one main office, other agencies have separate FOIA offices for each agency component and field office. Agencies also vary in how they allow requests to be made. Depending on the agency, requesters can submit requests by telephone, fax, letter, or e-mail or through the Web. In addition, agencies may process requests in two ways, known as “multitrack” and “single track.” Multitrack processing involves dividing requests into two groups: (1) simple requests requiring relatively minimal review, which are placed in one processing track, and (2) more voluminous and complex requests, which are placed in another track. In contrast, single-track processing does not distinguish between simple and complex requests. With single-track processing, agencies process all requests on a first-in/first-out basis. Agencies can also process FOIA requests on an expedited basis when a requester has shown a compelling need or urgency for the information. As agencies process FOIA requests, they generally place them in one of four possible disposition categories: grants, partial grants, denials, and “not disclosed for other reasons.” These categories are defined as follows: Grants: Agency decisions to disclose all requested records in full. Partial grants: Agency decisions to withhold some records in whole or in part, because such information was determined to fall within one or more exemptions. Denials: Agency decisions not to release any part of the requested records because all information in the records is determined to be exempt under one or more statutory exemptions. Not disclosed for other reasons: Agency decisions not to release requested information for any of a variety of reasons other than statutory exemptions from disclosing records. The categories and definitions of these “other” reasons for nondisclosure are shown in table 1. When a FOIA request is denied in full or in part, or the requested records are not disclosed for other reasons, the requester is entitled to be told the reason for the denial, to appeal the denial, and to challenge it in court. In addition to FOIA, the Privacy Act of 1974 includes provisions granting individuals the right to gain access to and correct information about themselves held by federal agencies. Thus the Privacy Act serves as a second major legal basis, in addition to FOIA, for the public to use in obtaining government information. The Privacy Act also places limitations on agencies’ collection, disclosure, and use of personal information. Although the two laws differ in scope, procedures in both FOIA and the Privacy Act permit individuals to seek access to records about themselves—known as “first-party” access. Depending on the individual circumstances, one law may allow broader access or more extensive procedural rights than the other, or access may be denied under one act and allowed under the other. Consequently, the Department of Justice’s Office of Information and Privacy issued guidance that it is “good policy for agencies to treat all first-party access requests as FOIA requests (as well as possibly Privacy Act requests), regardless of whether the FOIA is cited in a requester’s letter.” This guidance was intended to help ensure that requesters receive the fullest possible response to their inquiries, regardless of which law they cite. In addition, Justice guidance for the annual FOIA report directs agencies to include Privacy Act requests (that is, first-party requests) in the statistics reported. According to the guidance, “A Privacy Act request is a request for records concerning oneself; such requests are also treated as FOIA requests. (All requests for access to records, regardless of which law is cited by the requester, are included in this report. )” Although FOIA and the Privacy Act can both apply to first-party requests, these may not always be processed in the same way as described earlier for FOIA requests. In some cases, little review and redaction (see fig. 1) is required, for example, for a request for one’s own Social Security benefits records. In contrast, various degrees of review and redaction could be required for other types of first-party requests: for example, files on security background checks would need review and redaction before being provided to the person who was the subject of the investigation. OMB and the Department of Justice both have roles in the implementation of FOIA. Under various statutes, including the Paperwork Reduction Act, OMB exercises broad authority for coordinating and administering various aspects of governmentwide information policy. FOIA specifically requires OMB to issue guidelines to “provide for a uniform schedule of fees for all agencies.” OMB issued this guidance in April 1987. The Department of Justice oversees agencies’ compliance with FOIA and is the primary source of policy guidance for agencies. Specifically, Justice’s requirements under the act are to make agencies’ annual FOIA reports available through a single electronic access point and notify Congress as to their availability; in consultation with OMB, develop guidelines for the required annual agency reports, so that all reports use common terminology and follow a similar format; and submit an annual report on FOIA litigation and the efforts undertaken by Justice to encourage agency compliance. Within the Department of Justice, the Office of Information and Privacy has lead responsibility for providing guidance and support to federal agencies on FOIA issues. This office first issued guidelines for agency preparation and submission of annual reports in the spring of 1997.