September 10, 2026
SENT BY EMAIL
XXXX
Re: 2026-APP-00010 (Appeal of Response 2026-FOI-169)
Dear XXXX:
On June 8, 2026, you submitted a Freedom of Information Act (FOIA) request (2026-FOI-169) to the National Credit Union Administration (NCUA). You requested the following records:
- XXXX — Application, HMDA, and Complaint Records
- All Consumer and Discrimination Complaints Received by NCUA Since January 20, 2025
- NCUA Merger and Acquisition Application Policy Records Since January 20, 2025
In an interim response dated August 4, 2026, the NCUA FOIA Processing Center (FOIA Office) granted your request in part. Thirty-two pages of responsive records were released to you in full and 11 pages were withheld. The FOIA Office also provided you with two spreadsheets responsive to your request. Information was withheld pursuant to FOIA exemptions 5 U.S.C. §552 (b)(4) (Exemption 4), (b)(5) (Exemption 5), (b)(6) (Exemption 6), and (b)(8) (Exemption 8). Exemption 4 protects from disclosure records related to trade secrets and other confidential business information. Exemption 5 protects from disclosure information under the deliberative process privilege. Exemption 6 protects information about individuals in personnel and medical files, or similar files, when the disclosure of such information would constitute a clearly unwarranted invasion of personal privacy. Exemption 8 protects from disclosure records relating to the examination of banks and other financial institutions by agencies that regulate or supervise them. The FOIA Office explained that, in determining whether to withhold information, NCUA determined that the harm from disclosure is reasonably foreseeable. You were also notified that additional records responsive to your request require consultation with another federal agency and will be addressed in a separate response letter once they have been reviewed.
You appealed this interim determination in a correspondence received on August 13, 2026. In your appeal, you argue that the redactions to the spreadsheets are overly broad. You also ask for confirmation that a true entry-by-entry segregability review was performed.
Upon a full and independent review, your appeal is denied, as discussed more fully below.
Exemption 6
Exemption 6 protects information about individuals in personnel and medical files and similar files when the disclosure of such information would constitute a clearly unwarranted invasion of personal privacy.1 Determining whether information warrants protection under Exemption 6 requires a four-step analysis. First, determine whether the information is a personnel, medical, or similar file.2 Second, determine whether there is a significant privacy interest in the requested information.3 Third, evaluate the requester’s asserted FOIA public interest in disclosure.4 Fourth, if there is a significant privacy interest in non-disclosure and a FOIA public interest in disclosure, balance those competing interests to determine whether disclosure would constitute a clearly unwarranted invasion of personal privacy.5
Exemption 6 is interpreted broadly, and all information that “applies to a particular individual” meets the threshold requirement of falling within the category of personnel and medical files and similar files to warrant protection under Exemption 6.6 Here, the threshold requirement is satisfied. The requested records include personally identifiable information (PII) that applies to private citizens participating in the NCUA Consumer Assistance Center complaint process. There is a significant privacy interest in PII. PII is vulnerable to identity theft and other cybersecurity attacks and has been found to implicate a substantial privacy interest cognizable under the FOIA.7
Because a substantial privacy interest may be infringed by the disclosure of the requested PII, the next steps of the analysis require an assessment of the asserted public interest followed by a “balancing of the public interest served by disclosure against the harm resulting from the invasion of privacy.”8 When the disclosure of requested information could result in the invasion of personal privacy, the burden is on the requester to establish that disclosure would serve a public interest.9 The only relevant public interest in disclosure is the extent to which disclosure would serve the “core purpose of the FOIA,” which is “contributing significantly to public understanding of the operations or activities of the government.”10 “That purpose, however, is not fostered by disclosure of information about private citizens that is accumulated in various governmental files but that reveals little or nothing about an agency’s own conduct.”11
In your appeal, you argue that the redaction of the “Subject” and “Description” fields in the two spreadsheets you received is overly broad. You note that every entry in both spreadsheets has both of those fields redacted in full pursuant to Exemption 6, while the “Problem,” “Account or Loan Type,” “Credit Union Name,” and “Location” fields remain unredacted. You assert that Exemption 6 does not justify wholesale redaction of a complaint's substantive narrative where the nature of the complaint (e.g., “Credit Denial,” “Auto Repossession,” “Billing Dispute”) is already disclosed in an adjacent, unredacted column. Further, you contend NCUA has not explained what personal privacy interest is protected by redacting the narrative, nor why a segregability review could not separate identifying details, such as a complainant’s name or account number, from the substance of the complaint. You request that NCUA reprocess both spreadsheets, redacting only information that would identify an individual complainant, and disclose the nonexempt narrative information in the “Subject” and “Description” fields.
The responsive spreadsheets’ “Subject” and “Description” fields contain narrative text describing consumer complaints that include sensitive personal details from private citizens. Savvy cybercriminals are adept at culling together various bits and pieces of information to discern the identities of individuals for nefarious ends. Complaints shared candidly by consumers may be rich with descriptive or personal detail about the nature and circumstances of the complaint and could be easily exploited by bad actors to bring harm to private consumers.
Moreover, the information you received is already sufficiently detailed to glean insight into the overall number and general nature of complaints brought by consumers against credit unions, and the agency’s response to those complaints. You concede that other adjacent fields remain unredacted and already disclose the “nature of the complaint,” and other substantive details. Full disclosure of the redacted narrative details from complainants would reveal little more about the agency’s conduct in responding to those consumers’ complaints.
You have not asserted that any FOIA public interest would be served by disclosure of the PII in the requested records. If a significant privacy interest is found to exist, but there is no FOIA public interest in disclosure, the information should be protected because “something, even a modest privacy interest, outweighs nothing every time.”12 In the absence of any FOIA public interest in disclosure, the use of Exemption 6 to withhold PII is proper.
In this case, there is no asserted FOIA public interest in disclosure, yet a significant privacy interest exists. Particularly given the growing prevalence of sophisticated cyberattacks, the complainants’ privacy interest in protecting their PII weighs in favor of withholding the narrative details of their respective complaints. The full disclosure of redacted information would constitute a clearly unwarranted invasion of personal privacy. Accordingly, upon review, Exemption 6 was properly applied.
Reasonable Segregability
Your appeal also argues that a reasonably foreseeable harm determination cannot be applied categorically across thousands of field entries and you ask for confirmation that the agency conducted a genuine segregability review.
If an agency determines that it cannot or should not make full disclosure of a requested record, the FOIA calls for agencies to “consider whether partial disclosure of information is possible” and “take reasonable steps necessary to segregate and release nonexempt information.”13 However, NCUA is not required to disclose information “inextricably intertwined with exempt portions,”14 and “need not disclose a redacted version of [a record] if the unredacted markings would have minimal or no information content.”15
The requested records that were withheld are fully exempt under one or more of Exemptions 4, 5, 6, or 8,16 or inextricably intertwined with exempt portions of the records. Based on a good-faith review, there are no reasonably segregable portions of the agency’s responsive records that can be disclosed without causing reasonably foreseeable harm to the subject credit unions, agency decision-making and public confidence, agency relations with supervised entities, or cause a clearly unwarranted invasion of personal privacy. Accordingly, the requested information is properly withheld as fully exempt pursuant to one or more FOIA exemptions.
For these reasons, your FOIA appeal is denied. Pursuant to 5 U.S.C. §552(a)(4)(B) of the FOIA, you may seek judicial review of this determination by filing suit against the NCUA. Such a suit may be filed in the United States District Court where you reside, where your principal place of business is located, the District of Columbia, or where the documents are located (the Eastern District of Virginia).
The 2007 FOIA amendments created the Office of Government Information Services (OGIS) to offer mediation services to resolve disputes between FOIA requesters and Federal agencies as a non-exclusive alternative to litigation. Using OGIS services does not affect your right to pursue litigation. You may contact OGIS in any of the following ways:
Office of Government Information Services
National Archives and Records Administration
8601 Adelphi Road - OGIS
College Park, MD 20740-6001
E-mail: ogis@nara.gov
Web: https://www.archives.gov/ogis
Telephone: 202.741.5770; Toll-free: 877.684.6448
Fax: 202.741.5769
Sincerely,
/s/
Frank Kressman
General Counsel
OGC/PY
SSIC: 3212
2026-APP-00009; 2026-FOI-169
Footnotes
1 5 U.S.C. § 552(b)(6).
2 Id.
3 See Multi Ag Media LLC v. USDA, 515 F.3d 1224, 1229 (D.C. Cir. 2008).
4 See NARA v. Favish, 541 U.S. 157, 172 (2004).
5 5 U.S.C. §552(b)(6); see also Favish, 541 U.S. 157 at 172.
6 U.S. Dep’t of State v. Washington Post Co., 456 U.S. 595, 602 (1982).
7 See, e.g., Wadhwa v. VA, 707 F. App’x 61, 63-64 (3d Cir. 2017) (protecting personally identifiable information, including individuals’ names, phone numbers, and email addresses in absence of any FOIA public interest); Int’l Brotherhood of Elec. Workers Loc. Union No. 5 v. HUD, 852 F.2d 87, 89 (3d Cir. 1988) (perceiving no public interest in disclosure and therefore protecting employees’ social security numbers); Pubien v. EOUSA, No. 18-0172, 2018 WL 5923917, at *5 (D.D.C. Nov. 13, 2018) (finding names subject to withholding because plaintiff failed to identify any FOIA public interest in disclosure); Maryland v. VA, 130 F. Supp. 3d 342, 353 (D.D.C. 2015) (protecting identifying portions of email addresses of individuals because public interest in such information was “practically nonexistent”).
8 Int’l Brotherhood of Elec. Workers Loc. Union No. 5, 852 F.2d at 89.
9 See NARA v. Favish, 541 U.S. 157 (2004).
10 Sheet Metal Workers Int’l Ass’n, Local Union No. 19 v. U.S. Dep't of Veterans Affairs, 135 F.3d 891, 897 (3d Cir. 1998) (citing U.S. Dep’t of Defense et al. v. Federal Labor Relations Auth., 510 U.S. 487, 495–496 (1994)); see also Dep’t of the Air Force v. Rose, 425 U.S. 352, 372 (1976) (noting information that serves the “basic purpose” of the FOIA to “open agency action to the light of public scrutiny” constitutes a FOIA public interest in disclosure).
11 Dep’t of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 773 (1989) (quoting Rose, 425 U.S. at 360–361).
12 Nat'l Ass'n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 879 (D.C. Cir. 1989); see also Int’l Brotherhood of Elec. Workers Loc. Union No. 5 v. HUD, 852 F.2d 87, 89 (3d Cir. 1988) (perceiving no public interest in disclosure and therefore protecting employees’ social security numbers); Pubien v. EOUSA, No. 18-0172, 2018 WL 5923917, at *5 (D.D.C. Nov. 13, 2018) (finding names subject to withholding because plaintiff failed to identify any FOIA public interest in disclosure); Maryland v. VA, 130 F. Supp. 3d 342, 353 (D.D.C. 2015) (protecting identifying portions of email addresses of individuals whose businesses were not selected for inclusion in small business database because public interest in such information was “practically nonexistent”).
13 5 U.S.C. § 552(a)(8)(A)(ii).
14 Mead Data Cent., Inc. v. United States Dep't of the Air Force, 566 F.2d 242, 260 (D.C. Cir. 1977).
15 Perioperative Servs. & Logistics, LLC v. U.S. Dep’t of Veterans Affairs, 57 F.4th 1061, 1069 (D.C. Cir. 2023) (citing Mead Data Center, Inc. v. Dep’t of the Air Force, 566 F.2d 242, 261 n.55 (D.C. Cir. 1977)).
16 Your appeal does not challenge the applicability of FOIA Exemptions 4, 5, and 8; therefore, discussion of the remaining FOIA exemptions is unnecessary.