September 15, 2023
SENT BY E-MAIL
XXXX
Re: 2023-APP-00002; Appeal of Response 23-FOI-00100
Dear XXXX:
On July 21, 2023, the Consumer Financial Protection Bureau (CFPB) referred part of your Freedom of Information Act (FOIA) request to the National Credit Union Administration (NCUA). Your request, initially received by the CFPB on March 22, 2023, sought the contact information for all Home Mortgage Disclosure Act (HMDA) reporters for (NCUA) 2022, including “LEI,” “Company Name,” “Contact Name,” “Contact Phone,” and “Contact email.”
By letter of August 18, 2023 (Response Letter), counsel in the NCUA’s Office of General Counsel (FOIA Counsel) responded to your request and advised that your request was granted in part. All responsive agency records, consisting of a total of 1464 entries in a Microsoft Excel spreadsheet, were produced to you, with some redactions.1 FOIA Counsel stated in the Response Letter that the foreseeable harm standard was considered when reviewing records and in applying FOIA exemptions. FOIA Counsel also indicated the redacted and withheld information was exempt under the FOIA exemption at 5 U.S.C. § 552(b)(6) (Exemption 6), explaining that Exemption 6 protects information about individuals when its disclosure would constitute a clearly unwarranted invasion of personal privacy.
You appealed this determination in a correspondence dated August 18, 2023. In your appeal, you noted that similar requests have been made to several agencies and the requests have been granted in full, including most recently by the CFPB in response to your March 22, 2023 request.
Upon review, we find that the requested contact name, contact phone, and contact email information for all HMDA reporters for (NCUA) 2022 was properly withheld pursuant to Exemption 6 of the FOIA. Therefore, your appeal is denied, as discussed more fully below.
Exemption 6
Under the FOIA, Exemption 6 protects information about individuals in “personnel and medical files and similar files” when the disclosure of such information would constitute a clearly unwarranted invasion of personal privacy.2 Determining whether information warrants protection under Exemption 6 requires a four-step analysis: (1) determine whether the information is a personnel, medical, or “similar” file;3 (2) determine whether there is a significant privacy interest in the requested information;4 (3) evaluate the requester’s asserted FOIA public interest in disclosure;5 and (4) if there is a significant privacy interest in non-disclosure and a FOIA public interest in disclosure, balance those competing interests to determine whether disclosure “would constitute a clearly unwarranted invasion of personal privacy.”6
Exemption 6 is interpreted broadly, and all information that “applies to a particular individual” meets the threshold requirement of falling within the category of “personnel and medical files and similar files” to warrant protection under Exemption 6.7 In this case, the requested contact name, contact phone, and contact email data is personally identifying information (PII) that applies to a particular individual employed at a credit union. Thus, the threshold requirement is satisfied.
Additionally, there is a significant privacy interest in the requested PII. PII is vulnerable to phishing, spoofing, identity theft, and other cybersecurity attacks and has been found to implicate a substantial privacy interest cognizable under the FOIA.8
Since a substantial privacy interest may be infringed by the disclosure of the requested PII, the next steps of the analysis require an assessment of the asserted public interest followed by a “balancing of the public interest served by disclosure against the harm resulting from the invasion of privacy.”9 When the disclosure of requested information could result in the invasion of personal privacy, the burden is on the requester to establish that disclosure would serve a public interest.10 The only relevant public interest in disclosure is the extent to which disclosure would serve the “core purpose of the FOIA,” which is “contributing significantly to public understanding of the operations or activities of the government.”11 “That purpose, however, is not fostered by disclosure of information about private citizens that is accumulated in various governmental files but that reveals little or nothing about an agency’s own conduct.”12
As noted above, your appeal argues that similar requests have been made to other agencies and those requests have been granted without redactions for PII. However, the NCUA is not bound by another federal regulatory agency’s FOIA determination,13 and you have failed to assert that any FOIA public interest would be served by disclosure of the redacted PII. If a significant privacy interest is found to exist, but there is no FOIA public interest in disclosure, the information should be protected because “something, even a modest privacy interest, outweighs nothing every time.”14 Here, in the absence of any FOIA public interest in disclosure, the invocation of Exemption 6 to withhold the requested PII was proper.
Moreover, in balancing the competing interests, “the extent to which there are alternative sources of information available that could serve the public interest in disclosure”15 may offset a FOIA public interest in disclosure. Contact information for any federally insured credit union is available on the NCUA’s public website at https://mapping.ncua.gov/ResearchCreditUnion.aspx. Thus, there is an alternative, less intrusive means to contact a credit union reporting HMDA data, without requiring the disclosure of credit union employee PII that would cause a clearly unwarranted invasion of personal privacy.
For these reasons, the requested contact name, contact phone, and contact email information for (NCUA) HMDA reporters for 2022 was properly redacted and withheld under Exemption 6. Your FOIA appeal is therefore denied.
Pursuant to 5 U.S.C. §552(a)(4)(B) of FOIA, you may seek judicial review of this determination by filing suit against the NCUA. Such a suit may be filed in the United States District Court where you reside, where your principal place of business is located, the District of Columbia, or where the documents are located (the Eastern District of Virginia).
The 2007 FOIA amendments created the Office of Government Information Services (OGIS) to offer mediation services to resolve disputes between FOIA requesters and Federal agencies as a non-exclusive alternative to litigation. Using OGIS services does not affect your right to pursue litigation. You may contact OGIS in any of the following ways:
Office of Government Information Services
National Archives and Records Administration
8601 Adelphi Road - OGIS
College Park, MD 20740-6001
E-mail: ogis@nara.gov
Web: https://ogis.archives.gov
Telephone: 202.741.5770; Toll-free: 877.684.6448
Fax: 202.741.5769
Sincerely,
/s/
Frank Kressman
General Counsel
2023-APP-00002; NCUA 23-FOI-00100 (referral); CFPB-2023-0265-F
Footnotes
1 The spreadsheet entries produced to you on August 18, 2023 consisted of LEI (column 1) and company name (column 2) information for HMDA reporters for (NCUA) 2022. Requested contact name, contact phone, and contact email information was redacted and withheld under Exemption 6.
2 5 U.S.C. § 552(b)(6).
3 Id.
4 See Multi Ag Media LLC v. USDA, 515 F.3d 1224, 1229 (D.C. Cir. 2008).
5 See NARA v. Favish, 541 U.S. 157, 172 (2004).
6 5 U.S.C. §552(b)(6); see also Favish, 541 U.S. 157 at 172.
7 U.S. Dep’t of State v. Washington Post Co., 456 U.S. 595, 602 (1982).
8 See, e.g., Wadhwa v. VA, 707 F. App’x 61, 63-64 (3d Cir. 2017) (protecting personally identifying information, including names, phone numbers, and email addresses, concerning individuals involved in adjudication of discrimination complaints in absence of any FOIA public interest); Int’l Brotherhood of Elec. Workers Loc. Union No. 5 v. HUD, 852 F.2d 87, 89 (3d Cir. 1988) (perceiving no public interest in disclosure and therefore protecting employees’ social security numbers); Pubien v. EOUSA, No. 18-0172, 2018 WL 5923917, at *5 (D.D.C. Nov. 13, 2018) (finding names subject to withholding because plaintiff failed to identify any FOIA public interest in disclosure); Maryland v. VA, 130 F. Supp. 3d 342, 353 (D.D.C. 2015) (protecting identifying portions of email addresses of individuals whose businesses were not selected for inclusion in small business database because public interest in such information was “practically nonexistent”).
9 Int’l Brotherhood of Elec. Workers Loc. Union No. 5, 852 F.2d at 89.
10 See NARA v. Favish, 541 U.S. 157 (2004).
11 Sheet Metal Workers Int’l Ass’n, Local Union No. 19 v. U.S. Dep't of Veterans Affairs, 135 F.3d 891, 897 (3d Cir. 1998) (citing U.S. Dep’t of Defense et al. v. Federal Labor Relations Auth., 510 U.S. 487, 495–496 (1994)); see also Dep’t of the Air Force v. Rose, 425 U.S. 352, 372 (1976) (noting information that serves the “basic purpose” of the FOIA to “open agency action to the light of public scrutiny” constitutes a FOIA public interest in disclosure).
12 Dep’t of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 773 (1989) (quoting Rose, 425 U.S. at 360–361).
13 The NCUA’s FOIA regulations are codified at 12 C.F.R. Part 792, Subpart A. Pursuant to these regulations, the NCUA’s Freedom of Information Officer or designee is responsible for making an initial determination whether to grant or deny a request for information submitted under the FOIA. See 12 C.F.R. § 792.14. The authority to determine FOIA appeals rests with the NCUA’s General Counsel or designee. See 12 C.F.R. § 792.28.
14 Nat'l Ass'n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 879 (D.C. Cir. 1989).
15 DOD v. FLRA, 964 F.2d 26, 29-30 (D.C. Cir. 1992).