II.2.1 Protection of Privacy Rights

OMB's proposed revisions to Circular A-110 have generated criticism from some federally funded research institutions on the grounds that disclosure will undermine voluntary participation in public health and biomedical research. These researchers argue that disclosure could compromise the confidentiality of research volunteers or permit participants in ongoing studies to determine whether they fall into "treatment" or "control" groups. OMB should therefore restate clearly that the FOIA exemption includes all medical and personnel data and that awarding agencies will be obligated to delete data that would identify an individual.

FOIA enumerates nine matters which do not fall under the FOIA disclosure mandate. Significantly, FOIA's disclosure provisions do not apply to:

(6) personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.

5 U.S.C. § 522 (b)(6). A related exemption is provided for non-disclosure of certain law enforcement records and information (5 U.S. § 552(7)(C) (non-disclosure if records "could reasonably be expected to constitute an unwarranted invasion of personal privacy").

In Department of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749 (1989), the Supreme Court identified three principles governing FOIA's privacy exemptions. First, the Supreme Court ruled that whether disclosure of a private document is warranted must turn on the nature of the requested document and its relationship to the basic purpose of FOIA "to open agency action to the light of public scrutiny." Second, a court must determine that a third party's request for information about a private citizen can reasonably be expected to invade that citizen's privacy. Third, when "the request seeks no 'official information' about a government agency, but merely records that the government happens to be storing, the invasion of privacy is unwarranted." The Court concluded that "the release of information possessed by the government about private citizens constitutes an unwarranted invasion of those citizens' privacy and therefore is not required" under FOIA.³⁰

As noted, FOIA provides an exemption under 5 U.S.C. § 522(b)(6) for "personal and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy." Exemption 6 covers a broad array of information unique to the individual, since "the primary concern of Congress in drafting exemption 6 was to provide for the confidentiality of personal matters." Department of Air Force v. Rose, 425 U.S. 352, 375 n.14 (1976). In sustaining the nondisclosure of passport information of several Iranian nationals, the Supreme Court has held:

[w]e do not think that Congress meant to limit Exemption 6 to a narrow class of files containing only a discrete kind of personal information. Rather, 'the exemption [was] intended to cover detailed Government records on an individual which can be identified as applying to that individual."

Department of State v. Washington Post, 456 U.S. 595, 602 (1982).

Exemption 6 protects information that meets a two part test: (1) the information must be found in personnel, medical or similar files, and (2) a balance of public and private interests favors nondisclosure. In construing the exemption, courts will weigh the privacy interests involved against the public gain occasioned by the disclosure, essentially the likelihood that disclosure would contribute significantly to public understanding of the operations of activities or the government. Department of Air Force v. Rose, 425 U.S. 352, 372 (1976).

Given the protective reach of Exemption 6, federal courts have upheld the practice of redacting identifying information in FOIA disclosures on numerous occasions, observing that the redacted information would not shed any additional light on the government's activities. See Department of State v. Ray, 112 S.Ct. 541 (1991) (State Department's disclosure of monitoring activities involving Haitian returnees, including the number of returnees interviewed, when the interviews took place, the contents of the interview, and the status of the interviewees, with the names of interviewees redacted, satisfied FOIA, in terms of inquiry into State Department's monitoring of Haitian treatment of returnees); Department of Air Force v. Rose, 425 U.S. 352 (Air Force Academy's disclosure of case summaries involving ethics issues, with names redacted, satisfied FOIA, in terms of law review project on military discipline); New York Times v. NASA, 920 F.2d 1002 (D.C. Cir. 1990) (NASA's disclosure of the space shuttle Challenger's communications transcript, with no audio copy of the voice recordings, satisfied FOIA, given that voice inflections were personal to the astronauts, in terms of journalists' investigation of the crash).

In sum, if the information sought applies to an individual, it crosses the Exemption 6 threshold, and the privacy interest of the person to whom it applies must be considered and balanced against the public interest in releasing it. When that balancing is undertaken, unless the public would learn something directly about the workings of the Government by the release of the requested information, its disclosure " is not affected with the public interest" and therefore not required by FOIA.

FOIA's privacy exemptions, and clarifying case law, insulate the confidentiality of research participants, particularly those involved in medical studies. An individual's name, associated with his or her medical history, is a highly personal matter. Exemption 6 shields identifying information, unique to the individual, from disclosure since "the primary concern of Congress in drafting Exemption 6 was to provide for the confidentiality of personal matters." In addition, the disclosure of the names of research participants would not serve any FOIA sanctioned purpose, in that disclosure would not contribute significantly to public understanding of the operations or activities of the government. One could readily disclose raw medical research data while redacting identifying information from such studies.

In its January 26, 1999 letter to OMB, the National Academy of Sciences (NAS) notes that "FOIA protects the confidentiality of personnel and medical files and similar files if the disclosure of such files would constitute a clearly unwarranted invasion of personal privacy." NAS argues, however, "But regardless of whatever legal protection this may provide for the confidentiality of such information, individuals who now provide invaluable personal information for medical and other forms of federal grantee research may be disinclined to continue to do so in the future if such information will now be subject to even the possibility of public access under FOIA." (Letter from President of NAS to Jacob Lew, Director of OMB, January 26, 1999).

To the extent that the concern NAS raises is valid, we suggest that misinformation regarding the scope of privacy protections that FOIA provides, and not FOIA's lack of protections, may be the problem. Researchers are likely to be better acquainted than their test subjects with ethical standards and practices regarding human subject confidentiality (see Section II.3, infra) and also with FOIA's general disclosure exemption for protection of privacy rights. Researchers therefore should explain these confidentiality protections when enlisting volunteers. By publicizing the confidentiality of such matters, researchers could ensure continued involvement by potential subjects.

The Association of American Universities (AAU) and the Council on Governmental Relations (CGR) acknowledge the viability of this approach:

In the past, [FOIA] exemptions have served well to balance the public's right to know with the protection of the public and national interest. In addition, the scope of the FOIA exemptions in the context of sponsored research must be understood in advance so that when researchers are recruiting study participants they can in good faith disclose to them the types of information that will and will not be confidential.

Letter from Presidents of AAU and CGR to Jacob Lew, Director of OMB (January 26, 1999).

Moreover, once involved in an ongoing study, patients could not use FOIA to discover whether they are in a "treatment or control" group. In addition to the protections afforded individual identities under Exemption 6, the proposed OMB language supporting FOIA requests only applies to "published research findings." According to the proposed revision, "In response to a Freedom of Information Act (FOIA) request for data relating to published research findings produced under an award that were used by the Federal Government in developing policy or rules, the Federal awarding agency shall, within a reasonable time, obtain the requested data so they can be made available to the public through the procedures established under the FOIA." Generally, then, FOIA requests would only be entertained after the completion or publication of the research project. The timing of FOIA disclosures, following publication, also obviates fears that raw data will be released before they have been analyzed.

In addition to exemptions (6) and (7)(C), FOIA exemption 5 (5 U.S.C. 552(b)(5)), which protects disclosure of documents "which would not be available by law to a party...in litigation with the agency," also affords protection for ongoing studies. Since Federal Rule of Civil Procedure 26(c)(7) permits a court to enter a protective order for "confidential research" information, courts may choose to protect ongoing studies from FOIA requests, in order to prevent the modification of participant's behavior in response to the release of information. See Burka v. Dept. of Health and Human Services, 87 F.3d 508, 513 (D.C. Cir. 1996) (requiring disclosure of survey data tapes where publication had occurred, but noting possible interest in protecting ongoing studies). Predecisional agency deliberations have also received protection under this FOIA exemption. See Weinstein v. Department of Health & Human Services, 977 F. Supp. 41(D.C. Cir. 1997).

Confidentiality of participants in research studies is adequately protected by existing statutory language and related case law. Given that disclosure of the raw data supporting agency regulations goes to the central FOIA purpose of opening "agency action to the light of public scrutiny," and that privacy concerns can be safeguarded by redacting identifying information, OMB's proposed revision to Circular A-110 represents a balanced approach to ensuring the accountability of government agencies.³¹

³⁰ Although the Reporters Committee case specifically addressed exemption 7(c), the Court's statements apply to other privacy provisions as well. In what many commentators regarded as a dramatic expansion of FOIA privacy exemption 7(c), the U.S. Supreme Court categorically excluded from mandatory disclosure information about private citizens that provides no "official information" about a government agency. "We have also recognized the privacy interest in keeping personal facts away from the public eye," the Court observed. When the information sought concerns a "private citizen" and "when the information is in the government's control as a compilation, rather than a record of 'what the government is up to,' the privacy interest protected by exemption (7)(c) is in fact at its apex while the FOIA based public interest is at its nadir." Following the Reporters Committee decision, numerous courts addressing FOIA requests have withheld identifying information pursuant to exemption 7(c). See Halloran v. Veterans Administration, 874 F.2d 315 (5th Cir. 1989) (withheld names in investigation of federal contractor); Fitzgibbon v. CIA, 911 F.2d 755 (D.C. Cir. 1990)(third party name removed from FBI report); KTVY-TV v. United States, 919 F.2d 1465 (10th Cir. 1990) (withholding names of interviewees and persons identified in their statements, where investigatory records were sought following post office shooting).

³¹ The Privacy Act of 1974 (5 U.S.C. §552a) provides for the confidential treatment of records of individuals which are maintained by a federal agency according to either the individual's name or some other identifier. This law also requires that such records are to be protected from uses other than those purposes for which they were collected. No provision in the new data access law supersedes or limits the effect of the Privacy Act.