FOIA Update: OIP Guidance: The Bifurcation Requirement for Privacy "Glomarization"

FOIA Update
Vol. XVII, No. 2
1996

OIP Guidance

Within the overall realm of Freedom of Information Act administration, few decisions made by FOIA officers can be as difficult as those involving matters of personal privacy. Under either Exemption 6 or Exemption 7(C) of the FOIA, personal privacy interests must be weighed very carefully against any countervailing public interest in disclosure. See United States Dep't of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 776 (1989). Striking this careful balance, in order to ensure proper privacy protection while serving the goal of maximum responsible disclosure, is a vital part of day-to-day FOIA administration.

This is especially important in the area of law enforcement records, in which agencies holding law enforcement responsibilities must ensure that they properly apply the strong privacy protections of Exemption 7(C). Because of the unique sensitivity of law enforcement files, where the mere "mention" of an individual in a record can be indelibly stigmatizing if it is publicly disclosed, law enforcement agencies must take special pains to safeguard personal privacy interests. SeeFitzgibbon v. CIA, 911 F.2d 755, 767 (D.C. Cir. 1990) (recognizing "stigmatizing connotation").

There is no greater example of this than privacy "Glomarization" -- a law enforcement agency's practice refusing to confirm or deny that it even maintains an investigative record pertaining named individual. The colloquial term "Glomarization" came into use when "neither confirm nor deny" FOIA principle originated in national security case involving CIA Glomar Explorer submarine-retrieval ship, a case that initially involved a highly classified fact. See Attorney General's Memorandum on the 1986 Amendments to the Freedom of Information Act 26 (Dec. 1987) (describing origin of "Glomarization" principle in national security context). Under the FOIA, this principle can be used when necessary to protect a sensitive "abstract fact," cognizable under a FOIA exemption, that would be revealed by any other response to a particular FOIA request. Id. Though the principle originated in Exemption 1 FOIA cases, it can be applied in cases involving other FOIA exemptions as well. See FOIA Update, Spring 1986, at 2; FOIA Update, Spring 1983, at 5.

In the context of law enforcement records, entities such as the FBI have been employing the "neither confirm nor deny" principle for many years, in conjunction with Exemption 7(C), when responding to third-party FOIA requests. See, e.g., FOIA Update, Sept. 1982, at 2. They do so based upon the foundation principle that "disclosure of the mere fact that an individual is mentioned in an agency's law enforcement files carries a stigmatizing connotation, one certainly cognizable under FOIA Exemption 7(C)." FOIA Update, Winter 1986, at 3 ("OIP Guidance: Privacy 'Glomarization'"). (In fact, the landmark Reporters Committee case was a "Glomarization" case.) Because of the inherent sensitivity of the files maintained by law enforcement agencies, any FOIA request received by them for records on a named individual potentially raises a threshold privacy concern. See id. (citing "strict nondisclosure requirements" of Privacy Act of 1974, 5 U.S.C. § 552a).

In employing privacy "Glomarization" under Exemption 7(C), of course, law enforcement agencies are mindful that there are cases in which that special response to a third-party FOIA request is not necessary. First, where it is shown that the individual in question is deceased or has consented to a requested disclosure, the basis for privacy "Glomarization" does not exist. See FOIA Update, Winter 1986, at 3-4. Further, if it is determined that a federal investigation involving the individual is so well known to the public that his or her privacy interest is diminished, or that it was conducted under such circumstances that the privacy interest is outweighed by the public interest, then the "neither confirm nor deny" response should not be given. See id.; see also FOIA Update, Summer 1989, at 5 (supplementing guidance in light of Reporters Committee "practical obscurity" and "workable rules" standards).

Likewise, in employing privacy "Glomarization," agencies must be careful not to use it to an extent that is not warranted by the terms of the particular FOIA request at hand. The first duty of any agency handling a FOIA request is to read the request carefully, so that it can give a proper response to it. See, e.g., FOIA Update, Fall 1995, at 3 ("OIP Guidance: Determining the Scope of a FOIA Request"). When it comes to the potential use of privacy "Glomarization," this means making sure that the only possible response that the agency can give to the request is to neither confirm nor deny that any responsive record exists. If the request merely seeks any existing law enforcement file on a named individual, this can be so. If the request is broader than that, however, a simple "Glomarization" response simply will not cover it. See FOIA Update, Spring 1991, at 6 ("Glomarization" only "avoids the privacy invasion that would otherwise occur"). For a request that involves more than just a law enforcement file, the agency should take a bifurcation approach to it -- separating the extraordinarily sensitive part of the request from the rest of it.

The obligation to take such an approach is incumbent upon any agency that wishes to avail itself of the extraordinary protection that "Glomarization" affords. For example, in the first case to adjudicate an agency's use of the "Glomarization" defense, Gardels v. CIA, 510 F. Supp. 977, 979 (D.D.C. 1981), aff'd, 689 F.2d 1100 (D.C. Cir. 1982), the CIA took such a bifurcation approach. In responding to a FOIA request that sought any CIA records reflecting its contacts with a named university, the CIA distinguished between "covert" contacts, the existence of which was classified in each case, and "overt" ones, which were not; it "Glomarized" only as to the former category, processing records that responded to the remainder of the request in a conventional way. See 689 F.2d at 1102-03.

So, too, should agencies distinguish between any law enforcement records responsive to a third-party request, the very existence of which can be privacy-sensitive, and any non-law enforcement records that might be responsive to that FOIA request. This was illustrated in a recent decision by the Court of Appeals for the D.C. Circuit, Nation Magazine v. United States Customs Serv., 71 F.3d 885 (D.C. Cir. 1995). In that case, the FOIA requesters submitted a third-party request to the Customs Service that in general terms sought any records on a named individual -- former presidential candidate H. Ross Perot -- but that went on to specify that the requesters "were 'especially interested in documents and records that pertain to [reported] offers by Mr. Perot to assist the Customs Service in the interdiction of illegal drugs.'" 71 F.3d at 888. Toward that end, they even identified one particular document that they believed existed in that latter category. See id. at 888 n.1, 890. Given such a request, the D.C. Circuit found an across-the-board "Glomarization" response to be inappropriate, observing that "records discussing offers of assistance may implicate a less substantial privacy interest than any records associating Perot with criminal activity." Id. at 894. In other words, part of the request was not so very sensitive. See also Nation Magazine v. Department of State, No. 92-2303, slip op. at 23-24 (D.D.C. Aug. 18, 1995) (FBI required to search for any "noninvestigative" files on Perot); accord Reporters Committee, 489 U.S. at 757 (involving "Glomarization" bifurcation along "public interest" lines).

In order to meet their full obligations to FOIA requesters and ensure that they do not use privacy "Glomarization" more than is necessary and warranted in any case, law enforcement agencies should follow these general rules for possible bifurcation of third-party requests:

• General requests. FOIA requests that merely seek records pertaining to a named individual, without any elaboration, can be given a standard "Glomarization" response.
• Specific non-law enforcement requests. At the other end of the spectrum, any request that is specifically and exclusively directed to an agency's non-law enforcement files (e.g., one aimed at personnel files only) should receive purely conventional treatment, without "Glomarization."
• Mixed requests. Most importantly, FOIA requests that do more than simply seek law enforcement records on a named individual -- and therefore do not solely implicate the abstract fact and attendant privacy interests that underlie privacy "Glomarization" -- must be bifurcated. Simply put, a "Glomarization" response is appropriate only insofar as a FOIA request requires it. Insofar as any particular request seeks more than just information from an agency's investigative files pertaining to an individual, that request should be handled in two separate parts -- one part with a "neither confirm nor deny" response and the other part with a conventional record-processing one. See, e.g., Tanks v. Huff, No. 95-568, 1996 U.S. Dist. LEXIS 7266, at *4 (D.D.C. May 28, 1996) (upholding privacy "Glomarization" after agency bifurcated between aspects of request). And if there is any doubt about the scope of a request in this regard, the agency should "seek additional information from the requester to assist in resolving questions." FOIA Update, Winter 1986, at 4 (advising such step for purposes of privacy "Glomarization"); see also FOIA Update, Fall 1995, at 4-5 (advising such step for any question of request's scope).

These rules apply most directly to the federal law enforcement agencies and agency components whose principal function is criminal law enforcement. Because the touchstone principle for privacy "Glomarization" is the right not to be unfairly "tarr[ed] with the brush of criminal activity," Nation Magazine v. United States Customs Serv., 71 F.3d at 894 n.8, these agencies are the principal users of this special response. In the case of other agencies for whom law enforcement is but one component of their overall function, bifurcation might be required more on a component-by-component basis than along the lines of different parts of a FOIA request. See, e.g., Grove v. Department of Justice, 802 F. Supp. 506, 510-14 (D.D.C. 1992) (upholding privacy "Glomarization" by Department of the Navy after it bifurcated between "administrative documents" and those held by its investigative component, Naval Investigative Service).

In sum, any agency that ever uses privacy "Glomarization" must remember that it applies only within the realm of law enforcement files and can be used only with close attention to the form and phrasing of the FOIA request at hand. Because an agency should construe the terms of a FOIA request broadly, see FOIA Update, Fall 1995, at 3, and because, as has been recognized in the "Glomarization" context, the scopes of FOIA requests "are limited only by the ingenuity brought to bear to fashion them," Gardels v. CIA, 510 F. Supp. at 980, special care is required to ensure that this exceptional privacy-protection tool is not overused.

Go to: FOIA Update Home Page