II.2 FOIA Exemptions Provide Broad Protection Against Harmful Disclosures

The new data access law provides that data are to be "made available to the public through the procedures established under the Freedom of Information Act." FOIA contains a number of statutory exemptions and exclusions that allow the government to withhold disclosure of certain sensitive information or information which would be harmful to the public, the government, or private individuals if publicly disseminated.

Federal agency practices and regulations implementing FOIA have protected disclosure of such data for years. Unless agencies were to implement the revisions to Circular A-110 in a way that would protect agency data, but not protect similarly sensitive awardee data (an unlikely result, and contrary to FOIA), then FOIA will continue to protect privacy, property, and other rights as discussed below.

The FOIA provisions requiring government disclosure of information do not apply, for example, to "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy." Other key records protected under FOIA, for purposes of these comments, are "trade secrets and commercial or financial information obtained from a person and privileged or confidential." 5 U.S.C. § 552(b)(4). FOIA also contains another relevant exemption for data affecting national security interests. 5 U.S.C. § 552(b)(1).

In choosing FOIA as the procedural vehicle through which data access is to be accomplished, Congress necessarily intended that the FOIA's protections against harmful disclosures would apply. OMB should state expressly that the proposed revisions to Circular A-110 would exempt from disclosure all material that is exempt from disclosure under FOIA. As noted above, nothing in the new data access laws requires federal agencies to disclose material that the agencies would otherwise not be required to disclose under existing FOIA laws if the material is in the agencies' possession. The question therefore becomes how FOIA ought to be applied to a wider collection of data not previously in the government's possession. This section of comments examines that issue, particularly with respect to the three exemptions noted above affecting (1) medical records and privacy rights; (2) confidential commercial information; and (3) national security.