This is the accessible text file for GAO report number GAO-05-648T entitled 'Information Management: Implementation of the Freedom of Information Act' which was released on May 11, 2005. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: For Release on Delivery Expected at 2:00 p.m. EDT on Wednesday, May 11, 2005: GAO: Testimony before the Subcommittee on Government Management, Finance and Accountability, Committee on Government Reform, House of Representatives: GAO-05-648T: GAO Highlights: Highlights of GAO-05-648T, a testimony before the Subcommittee on Government Management, Finance, and Accountability, Committee on Government Reform, House of Representatives: Why GAO Did This Study: The Freedom of Information Act (FOIA) establishes that federal agencies must provide the public with access to government information, thus enabling them to learn about government operations and decisions. To help ensure appropriate implementation, the act requires that agencies report annually to the Attorney General, providing specific information about their FOIA operations. GAO has reported previously on the contents of these annual reports for 25 major agencies. GAO was asked to describe the FOIA process and discuss the reported implementation of FOIA. What GAO Found: Although the specific details of processes for handling FOIA requests vary among agencies, the major steps in handling a request are similar across the government. Agencies receive requests, usually in writing (although they may accept requests by telephone or electronically), which can be submitted by any organization or member of the public. Once requests are received, the agency responds through a process that includes several phases: initial processing, searching for and retrieving responsive records, preparing responsive records for release, approving the release of the records, and releasing the records to the requester. Figure 1 is an overview of the FOIA process, from the receipt of a request to the release of records. According to data reported by agencies in their annual FOIA reports, citizens have been requesting and receiving an ever-increasing amount of information from the federal government through FOIA. The number of requests that agencies received increased by 71 percent from 2002 to 2004. Further, agencies reported they have been processing more requests—68 percent more from 2002 to 2004. For 92 percent of requests processed in 2004, agencies reported that responsive records were provided in full to requesters. However, the number of pending requests carried over from year to year—known as the backlog—has also been increasing, rising 14 percent since 2002. Figure 1: Overview of Generic FOIA Process: [See PDF for image] [End of figure] www.gao.gov/cgi-bin/getrpt?GAO-05-648T. To view the full product, including the scope and methodology, click on the link above. For more information, contact Linda Koontz at 202-512- 6240, or koontzl@gao.gov. [End of section] Information Management: Implementation of the Freedom of Information Act: Statement of Linda D. Koontz: Director, Information Management Issues: Mr. Chairman and Members of the Subcommittee: I appreciate the opportunity to participate in the Subcommittee's hearing on the implementation of the Freedom of Information Act (FOIA).[Footnote 1] Generally speaking, FOIA establishes that federal agencies must provide the public with access to government information, thus enabling them to learn about government operations and decisions. Specific requests by the public for information through the act have led to disclosure of waste, fraud, abuse, and wrongdoing in the government, as well as the identification of unsafe consumer products, harmful drugs, and serious health hazards. To help ensure appropriate implementation, the act requires that agencies report annually to the Attorney General, providing specific information about their FOIA operations. As requested, in my remarks today, I will describe the FOIA process at federal agencies and discuss the implementation of FOIA. To develop a description of the FOIA process at federal agencies, we compiled and analyzed information from Department of Justice documentation and from our previous reports.[Footnote 2] To assess implementation of FOIA, we examined, consolidated, and analyzed annual report data for fiscal years 2002 through 2004 from 25 major agencies[Footnote 3] (herein we refer to this scope as governmentwide). We did not independently verify the accuracy of the data provided in agency annual reports. We discussed the content of this statement with an official of the Department of Justice's Office of Information and Privacy to confirm the accuracy of our information. We performed our work from April 2005 to May 2005, in accordance with generally accepted government auditing standards. Results in Brief: Although the specific details of processes for handling FOIA requests vary among agencies, the major steps in processing a request are similar across the government. Agencies receive requests, usually in writing (although they may accept requests by telephone or electronically), which can be submitted by any organization or member of the public. Once received, the request goes through several phases, which include initial processing, searching for and retrieving responsive records, preparing responsive records for release, approving the release of the records, and releasing the records to the requester. Citizens have been requesting and receiving an ever-increasing amount of information from the federal government through FOIA. Based on data reported by agencies in their annual FOIA reports, the number of requests received by agencies increased by 71 percent from 2002 to 2004. As more and more requests come in, agencies also report that they have been processing more of them--68 percent more from 2002 to 2004. For 92 percent of requests processed in 2004, agencies reported that responsive records were provided in full to requesters. However, the number of pending requests carried over from year to year--known as the backlog--has also been increasing, rising 14 percent since 2002. Background: FOIA, which was originally enacted in 1966 and subsequently amended several times, establishes a legal right of access to government records and information, on the basis of the principles of openness and accountability in government. Before the act, an individual seeking access to federal records had faced the burden of establishing a right to examine them. FOIA established a "right to know" standard for access, instead of a "need to know," and shifted the burden of proof from the individual to the government agency seeking to deny access. The act has been amended several times, including in 1974, 1976, 1986, 1996, and 2002. FOIA provides the public with access to government information either through "affirmative agency disclosure"--publishing information in the Federal Register or making it available in reading rooms--or in response to public requests for disclosure. Public requests for disclosure of records are the best known type of FOIA disclosure. Any member of the public may request access to information held by federal agencies, without showing a need or reason for seeking the information. The act prescribes nine specific categories of information that is exempt from disclosure; agencies may cite these exemptions in denying access to material (see table 1). The act also includes provisions for excluding specific sensitive records held by law enforcement agencies. The act requires agencies to notify requesters of the reasons for any adverse determination and grants requesters the right to appeal agency decisions to deny access. Table 1: Freedom of Information Act Exemptions: Exemption number: (1); Matters that are exempt from FOIA: (A) Specifically authorized under criteria established by an Executive Order to be kept secret in the interest of national defense or foreign policy and (B) are in fact properly classified pursuant to such Executive Order. Exemption number: (2); Matters that are exempt from FOIA: Related solely to the internal personnel rules and practices of an agency. Exemption number: (3); Matters that are exempt from FOIA: Specifically exempted from disclosure by statute (other than section 552b of this title), provided that such statute (A) requires that matters be withheld from the public in such a manner as to leave no discretion on the issue, or (B) establishes particular criteria for withholding or refers to particular types of matters to be withheld. Exemption number: (4); Matters that are exempt from FOIA: Trade secrets and commercial or financial information obtained from a person and privileged or confidential. Exemption number: (5); Matters that are exempt from FOIA: Inter-agency or intra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation with the agency. Exemption number: (6); Matters that are exempt from FOIA: Personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy. Exemption number: (7A); Matters that are exempt from FOIA: Records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information: could reasonably be expected to interfere with enforcement proceedings. Exemption number: (7B); Matters that are exempt from FOIA: Records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information: would deprive a person of a right to a fair trial or impartial adjudication. Exemption number: (7C); Matters that are exempt from FOIA: Records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information: could reasonably be expected to constitute an unwarranted invasion of personal privacy. Exemption number: (7D); Matters that are exempt from FOIA: Records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information: could reasonably be expected to disclose the identity of a confidential source, including a State, local, or foreign agency or authority or any private institution which furnished information on a confidential basis, and, in the case of a record or information compiled by a criminal law enforcement authority in the course of a criminal investigation or by an agency conducting a lawful national security intelligence investigation, information furnished by confidential source. Exemption number: (7E); Matters that are exempt from FOIA: Records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information: would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law; or. Exemption number: (7F); Matters that are exempt from FOIA: Records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information: could reasonably be expected to endanger the life or physical safety of an individual. Exemption number: (8); Matters that are exempt from FOIA: Contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation of supervision of financial institutions. Exemption number: (9); Matters that are exempt from FOIA: Geological and geophysical information and data, including maps, concerning wells. Source: 5 U.S.C. § 552(b)(1) through (b)(9). [End of table] In addition, agencies are required to meet certain time frames for making key determinations: whether to comply with requests (20 business days from receipt of the request), responses to appeals of adverse determinations (20 business days from filing of the appeal), and whether to provide expedited processing of requests (10 business days from receipt of the request). Congress did not establish a statutory deadline for making releasable records available, but instead required agencies to make them available promptly. We have reported several times in the past on the contents of the annual reports of 25 major agencies, covering fiscal years 1998 through 2002. We first reported information in 2001[Footnote 4] on the implementation of the 1996 amendments to FOIA. At that time we recommended that Justice (1) encourage agencies to make material electronically available and (2) review agency annual reports to address specific data quality issues. Since our report was issued, Justice has taken steps to implement both of these recommendations. In 2002, we reported[Footnote 5] that the number of requests received and processed appeared for most agencies--except the Department of Veterans Affairs--to peak in fiscal year 2000 and decline slightly in fiscal year 2001. In our 2004 report,[Footnote 6] we reported that between 2000 and 2002, the number of requests received and processed declined when the Department of Veterans Affairs is excluded. We also reported that agencies' backlogs of pending requests were declining, and that the number of FOIA requests denied governmentwide had dropped dramatically between 2000 and 2001 and remained low in 2002. Roles of Justice and OMB in FOIA Implementation: The Department of Justice and the Office of Management and Budget (OMB) both have roles in the implementation of FOIA. The Department of Justice oversees agencies' compliance with FOIA and is the primary source of policy guidance for agencies. OMB is responsible for issuing guidelines on the uniform schedule of fees. Specifically, Justice's requirements under the act are to: * make agencies' annual FOIA reports available through a single electronic access point and notify Congress as to their availability; * in consultation with OMB, develop guidelines for the required annual agency reports, so that all reports use common terminology and follow a similar format; and: * submit an annual report on FOIA statistics and the efforts undertaken by Justice to encourage agency compliance. Within the Department of Justice, the Office of Information and Privacy (OIP) has lead responsibility for providing guidance and support to federal agencies on FOIA issues. OIP first issued guidelines for agency preparation and submission of annual reports in the spring of 1997 and periodically issued additional guidance. OIP also periodically issues guidance on compliance, provides training, and maintains a counselors service to provide expert, one-on-one assistance to agency FOIA staff. Further, it also makes a variety of FOIA and Privacy Act resources available to agencies and the public via the Justice Web site and on- line bulletins. In addition, the act requires OMB to issue guidelines to "provide for a uniform schedule of fees for all agencies."[Footnote 7] In charging fees for responding to requests, agencies are required to conform to the OMB guidelines. Further, in 1987, the Department of Justice issued guidelines on waiving fees when requests are determined to be in the public interest. Under the guidelines, requests for waivers or reduction of fees are to be considered on a case-by-case basis, taking into account both the public interest and the requester's commercial interests. The 1996 FOIA amendments, referred to as e-FOIA, require that agencies submit a report to the Attorney General on or before February 1 of each year that covers the preceding fiscal year and includes information about agencies' FOIA operations.[Footnote 8] The following are examples of information that is to be included in these reports: * number of requests received, processed, and pending; * median number of days taken by the agency to process different types of requests; * determinations made by the agency not to disclose information and the reasons for not disclosing the information; * disposition of administrative appeals by requesters; * information on the costs associated with handling of FOIA requests; and: * full-time-equivalent staffing information. In addition to providing their annual reports to the Attorney General, agencies are to make them available to the public in electronic form. The Attorney General is required to make all agency reports available on line at a single electronic access point and report to Congress no later than April 1 of each year that these reports are available in electronic form. Disposition of Agency Requests: As agencies process FOIA requests, they generally place them in one of four possible disposition categories: grants, partial grants, denials, and "not disclosed for other reasons." These categories are defined as follows: * Grants: agency decisions to disclose all requested records in full. * Partial grants: decisions to withhold some records in whole or in part, because such information was determined to fall within one or more exemptions. * Denials: agency decisions not to release any part of the requested records because all information in the records is determined to be exempt under one or more statutory exemptions. * Not disclosed for other reasons: agency decisions not to release requested information for any of a variety of reasons other than statutory exemptions from disclosing records. The categories and definitions of these "other" reasons for nondisclosure are shown in table 2. Table 2: "Other" Reasons for Nondisclosure: Category: No records; Definition: The agency searched and found no record responsive to the request. Category: Referrals; Definition: The agency referred records responsive to the request to another agency. Category: Request withdrawn; Definition: The requester withdrew the request. Category: Fee-related reasons; Definition: The requester refused to commit to pay fees (or other reasons related to fees). Category: Records not reasonably described; Definition: The requester did not describe the records sought with sufficient specificity to allow them to be located with a reasonable amount of effort. Category: Not a proper FOIA request; Definition: The request was not a FOIA request for one of several procedural reasons. Category: Not an agency record; Definition: The requested record was not within the agency's control. Category: Duplicate request; Definition: The request was submitted more than once by the same requester. Source: Department of Justice. [End of table] When a FOIA request is denied in full or in part, or the requested records are not disclosed for other reasons, the requester is entitled to be told the reason for the denial, to appeal the denial, and to challenge it in court. Fee Structure and Fee Waivers: FOIA also authorizes agencies to recoup certain direct costs associated with processing requests, and agencies also have the discretion to reduce or waive fees under various circumstances. Agency determinations about fees and fee waivers are complex decisions that include determining (1) a requester's fee category, (2) whether a fee waiver is to be granted, and (3) the actual fees to be charged. FOIA stipulates three types of fee categories for requesters: (1) commercial; (2) educational or noncommercial scientific institutions and representatives of the news media; and (3) other. Further, fees can be charged for three types of FOIA-related activities--search, duplication, and review--depending on the requester's fee category. In addition, fees may not be charged to a requester in certain situations, such as when a fee waiver is granted or when the applicable fees are below a certain threshold. Commercial users can be charged for the broadest range of FOIA-related activities, including document search, review, and duplication. Commercial use is defined in the OMB fee schedule guidelines as "a use or purpose that furthers the commercial, trade or profit interests of the requester or the person on whose behalf the request is being made." The second category exempts search and review fees for documents sought for noncommercial use by educational or noncommercial scientific institutions, and for documents sought by representatives of the news media. The third category of fees, which applies to all requesters who do not fall within either of the other two categories, allows for "reasonable" charges for document search and duplication. Table 3 shows the FOIA-related activities for which agencies can charge by fee category, as stipulated in the act. Table 3: FOIA Charges by Category: Category of requester: Category 1: Commercial requester; Activities for which agencies can charge: Search: Yes; Activities for which agencies can charge: Review: Yes; Activities for which agencies can charge: Duplication: Yes. Category of requester: Category 2: Educational or noncommercial scientific institutions and representatives of the news media; Activities for which agencies can charge: Search: No; Activities for which agencies can charge: Review: No; Activities for which agencies can charge: Duplication: Yes (100 pages free). Category of requester: Category 3: Other; Activities for which agencies can charge: Search: Yes (2 hours free); Activities for which agencies can charge: Review: No; Activities for which agencies can charge: Duplication: Yes (100 pages free). Source: GAO analysis of 5 U.S.C. § 552 (a)(4)(A)(iv). [End of table] Although the act generally requires that requesters pay fees to cover the costs of processing their requests, in certain circumstances, fees are not to be charged. For example, as stipulated in the act, fees may not be charged when the government's cost of collecting and processing the fee is likely to equal or exceed the amount of the fee itself. Further, under certain circumstances, the act requires an agency to furnish documents without charge, or at reduced charges. This is commonly referred to as the FOIA fee-waiver provision. Based on this provision, an agency must provide a fee waiver if two conditions are met: * disclosure of the requested information is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government, and: * disclosure of the information is not primarily in the commercial interest of the requester. Under the act and guidance, when these requirements are both satisfied, based upon information supplied by a requester or otherwise made known to the agency, the fee waiver or reduction is to be granted by the FOIA officer. When one or both of these requirements are not satisfied, a fee waiver is not warranted. As these criteria suggest, fee waivers are to be granted on a case-by-case basis. Individuals who receive fee waivers in some cases may not necessarily receive them in other cases. Relationship of FOIA and the Privacy Act: In addition to FOIA, the Privacy Act of 1974[Footnote 9] includes provisions granting individuals the right to gain access to and correct information about themselves held by federal agencies. Thus the Privacy Act serves as a second major legal basis, in addition to FOIA, for the public to use in obtaining government information. The Privacy Act also places limitations on agencies' collection, disclosure, and use of personal information. Although the two laws differ in scope, procedures in both FOIA and the Privacy Act permit individuals to seek access to records about themselves--known as "first-party" access. Depending on the individual circumstances, one law may allow broader access or more extensive procedural rights than the other, or access may be denied under one act and allowed under the other. Subsequently, the Department of Justice's Office of Information and Privacy (OIP) issued guidance that it is "good policy for agencies to treat all first-party access requests as FOIA requests (as well as possibly Privacy Act requests), regardless of whether the FOIA is cited in a requester's letter." This guidance was intended to help ensure that requesters receive the fullest possible response to their inquiries, regardless of which law they cite. For more information about FOIA and the Privacy Act, see appendix I. The FOIA Process at Federal Agencies: Although the specific details of processes for handling FOIA requests vary among agencies, the major steps in handling a request are similar across the government. Agencies receive requests, usually in writing (although they may accept requests by telephone or electronically), which can come from any organization or member of the public. Once received, the request goes through several phases, which include initial processing, searching for and retrieving responsive records, preparing responsive records for release, approving the release of the records, and releasing the records to the requester. Figure 1 is an overview of the process, from the receipt of a request to the release of records. Figure 1: Overview of Generic FOIA Process: [See PDF for image] [End of figure] During the initial processing phase, a request is logged into the agency's FOIA system, and a case file is started. The request is then reviewed to determine its scope, estimate fees, and provide an initial response to the requester. After this point, the FOIA staff begins its search to retrieve responsive records. This step may include searching for records from multiple locations and program offices. After potentially responsive records are located, the documents are reviewed to ensure that they are within the scope of the request. During the next two phases, the agency ensures that appropriate information is to be released under the provisions of the act. First, the agency reviews the responsive records to make any redactions based on the statutory exemptions. Once the exemption review is complete, the final set of responsive records is turned over to the FOIA office, which calculates appropriate fees, if applicable. Before release, the redacted responsive records are then given a final review, possibly by the agency's general counsel, and then a response letter is generated, summarizing the agency's actions regarding the request. Finally, the responsive records are released to the requester. Some requests are relatively simple to process, such as requests for specific pieces of information that the requester sends directly to the appropriate office. Other requests may require more extensive processing, depending on their complexity, the volume of information involved, the need for the agency FOIA office to work with offices that have relevant subject-matter expertise to find and obtain information, the need for a FOIA officer to review and redact information in the responsive material, the need to communicate with the requester about the scope of the request, and the need to communicate with the requester about the fees that will be charged for fulfilling the request (or whether fees will be waived). Specific details of agency processes for handling requests vary, depending on the agency's organizational structure and the complexity of the requests received. While some agencies centralize processing in one main office, other agencies have separate FOIA offices for each agency component and field office. Agencies also vary in how they allow requests to be made. Depending on the agency, requesters can submit requests by telephone, fax, letter, or e-mail or through the Web. In addition, agencies may process requests in two ways, known as "multitrack" and "single track." Multitrack processing involves dividing requests into two groups: (1) simple requests requiring relatively minimal review, which are placed in one processing track, and (2) more voluminous and complex requests, which are placed in another track. In contrast, single-track processing does not distinguish between simple and complex requests. With single-track processing, agencies process all requests on a first-in/first-out basis. Agencies can also process FOIA requests on an expedited basis when a requester has shown a compelling need or urgency for the information. FOIA Implementation: Citizens have been requesting and receiving an ever-increasing amount of information from the federal government, as reflected in the increasing number of FOIA requests that have been received and processed in recent years. In fiscal year 2004, the 25 agencies we reviewed reported receiving and processing about 4 million requests, an increase of 25 percent compared to 2003. From 2002 to 2004, the number of requests received increased by 71 percent, and the number of requests processed increased by 68 percent. The 25 agencies we reviewed handle over 97 percent of FOIA requests governmentwide. They include the 24 major agencies covered by the Chief Financial Officers Act, as well as the Central Intelligence Agency and, beginning in 2003, the Department of Homeland Security (DHS) in place of the Federal Emergency Management Agency (FEMA). While the creation of DHS in fiscal year 2003 led to a shift in some FOIA requests from agencies affected by the creation of the new department, the same major component entities are reflected in all 3 years that we reviewed. For example, in 2002, before DHS was formed, FEMA independently reported on its FOIA requests, and its annual report is reflected in our analysis. However, beginning in 2003, FEMA became part of DHS, and thus its FOIA requests are reflected in DHS figures for 2003 and 2004. In recent years, Veterans Affairs (VA) has accounted for a large portion--about half--of governmentwide FOIA requests received and processed. This is because the agency includes in its totals the many first-party medical records requests that it processes. However, VA's numbers have not driven the large increases in FOIA requests. In fact, in 2004, the agency had a decline in the number of requests received, processed, and pending compared to 2003. Thus, when VA is excluded from governmentwide[Footnote 10] FOIA request totals, the increase between 2003 and 2004 changes from 25 percent to 61 percent. Figure 2 shows total requests reported governmentwide for fiscal years 2002 through 2004, with VA's share shown separately. Figure 2: Total FOIA Requests with VA Shown Separately, Fiscal Years 2002-2004: [See PDF for image] Note: For 2004, data were unavailable for the Agency for International Development and the Environmental Protection Agency. [End of figure] In 2004, most dispositions of FOIA requests (92 percent) were reported to have been granted in full, as shown in table 4. Only relatively small numbers were partially granted (3 percent), denied (1 percent), or not disclosed for other reasons (5 percent). When VA is excluded from the totals, the percentages remain roughly comparable. Table 4: Disposition of Processed Requests for Fiscal Year 2004: Disposition: Grants; Number of requests (all): 3.6 million; Percentage of requests (all): 92%; Number of requests (without VA): 1.9 million; Percentage of requests (without VA): 87%. Disposition: Partial grants; Number of requests (all): 113,000; Percentage of requests (all): 3%; Number of requests (without VA): 105,000; Percentage of requests (without VA): 5%. Disposition: Denial; Number of requests (all): 22,000; Percentage of requests (all): 1%; Number of requests (without VA): 15,000; Percentage of requests (without VA): 1%. Disposition: Not disclosed for other reasons; Number of requests (all): 196,000; Percentage of requests (all): 5%; Number of requests (without VA): 158,000; Percentage of requests (without VA): 7%. Source: FOIA annual reports for 2004 (self-reported data). Note: Totals are rounded. Because of rounding, the total percentage of requests processed exceeds 100 percent. [End of table] Agencies other than VA that reported receiving large numbers of requests in fiscal year 2004 included the Social Security Administration (SSA), the Department of Health and Human Services (HHS), and the Department of Homeland Security (DHS), as shown in figure 3. Agencies other than VA, SSA, HHS, and DHS accounted for only 9 percent of all requests. Figure 3: Number of Requests Received by Agency for 2004: [See PDF for image] Note: Because of rounding, the total percentage received exceeds 100 percent. [End of figure] Remaining agencies include the Central Intelligence Agency, Commerce, Energy, Interior, Labor, Transportation, Education, the General Services Administration, Housing and Urban Development, the National Aeronautics and Space Administration, the Nuclear Regulatory Commission, the National Science Foundation, the Office of Personnel Management, the Small Business Administration, and State. Information was not available for the Agency for International Development or the Environmental Protection Agency at the time of our review. Three of the four agencies that handled the largest numbers of requests--VA, SSA, and HHS--also granted the largest percentages of requests in full. However, as shown in figure 4, the numbers of fully granted requests varied widely among agencies in fiscal year 2004. For example, three agencies--State, the Central Intelligence Agency, and the National Science Foundation--made full grants of requested records in less than 20 percent of the cases they processed. Eight of the 25 agencies we reviewed made full grants of requested records in over 60 percent of their cases.[Footnote 11] This variance among agencies in the disposition of requests has been evident in prior years as well.[Footnote 12] Figure 4: Disposition of Processed Requests, by Agency (Fiscal Year 2004): [See PDF for image] Note: Abbreviations are as follows: CIA: Central Intelligence Agency; DHS: Department of Homeland Security; DOC: Department of Commerce; DOD: Department of Defense; DOE: Department of Energy; DOI: Department of Interior; DOJ: Department of Justice; DOL: Department of Labor; DOT: Department of Transportation; ED: Department of Education; GSA: General Services Administration; HHS: Health and Human Services; HUD: Housing and Urban Development; NASA: National Aeronautics and Space Administration; NRC: Nuclear Regulatory Commission; NSF: National Science Foundation; OPM: Office of Personnel Management; SBA: Small Business Administration; SSA: Social Security Administration; State: Department of State; Treas: Department of the Treasury; USDA: Department of Agriculture; VA: Veterans Affairs. Reports were not available for the Agency for International Development (AID) or the Environmental Protection Agency (EPA). [End of figure] Agency Backlogs Have Increased: In addition to processing greater numbers of requests, many agencies (13 of 25) also reported that their backlogs of pending requests-- requests carried over from one year to the next--have increased since 2002. In 2002, pending requests governmentwide were reported to number about 140,000; whereas in 2004, about 160,000--14 percent more--were reported. Mixed results were reported in reducing backlogs at the agency level-- some backlogs decreased while others increased, as reported from 2002 through 2004. The number of requests that an agency processes relative to the number it receives is an indicator of whether an agency's backlog is increasing or decreasing. Six of the 25 agencies we reviewed reported processing fewer requests than they received each year for fiscal years 2002, 2003, and 2004--therefore increasing their backlogs (see fig. 4). Nine additional agencies also processed less than they received in two of these three years. In contrast, five agencies (CIA, Energy, Labor, SBA, and State) had processing rates above 100 percent in all three years, meaning that each made continued progress in reducing their backlogs of pending cases. Thirteen agencies were able to make at least a small reduction in their backlogs in 1 or more years between fiscal years 2002 and 2004. Figure 5: Agency Processing Rate for 25 Agencies: [See PDF for image] Note: Abbreviations are as in figure 3. The agency processing rate is defined as the number of requests processed in a given year compared with the requests received, expressed as a percentage. In 2002, FEMA data were used, and for 2003 and 2004 DHS data were used. For 2004, data were unavailable for the Agency for International Development and the Environmental Protection Agency. [End of figure] FOIA does not require agencies to make records available within a specific amount of time. As I mentioned earlier, Congress did not establish a statutory deadline for making releasable records available, but instead required agencies to make them available promptly. Agencies, however, are required to inform requesters within 20 days of receipt of a request as to whether the agency will comply with the request. For 2004, the reported time required to process requests by track varied considerably among agencies (see table 5). Eleven agency components reported processing simple requests in less than 10 days, as evidenced by the lower value of the reported ranges. These components are part of the Departments of Energy, Education, Homeland Security, Health and Human Services, the Interior, Justice, Labor, Transportation, the Treasury, and Agriculture. On the other hand, some organizations are taking much more time to process simple requests, such as components of Energy, Interior, and Justice. This can be seen in upper end values of the median ranges greater than 100 days. Components of four agencies (Interior, Education, Treasury, and VA) reported processing complex requests quickly--in less than 10 days. In contrast, several other agencies (DHS, Energy, Justice, Transportation, Education, HHS, HUD, State, Treasury, and Agriculture) reported components taking longer to process complex requests, with median days greater than 100. Four agencies (HHS, NSF, OPM, and SBA) reported using single-track processing. The processing times for single track varied from 5 days (at SBA) to 182 days (at an HHS component). Table 5: Median Days to Process Requests for 2004, by Track: Agency: AID; Type of request processing track: Simple: --; Type of request processing track: Complex: --; Type of request processing track: Single: --; Type of request processing track: Expedited: --. Agency: CIA; Type of request processing track: Simple: 7; Type of request processing track: Complex: 63; Type of request processing track: Single: --; Type of request processing track: Expedited: 10. Agency: DHS; Type of request processing track: Simple: 8-84; Type of request processing track: Complex: 5-111; Type of request processing track: Single: --; Type of request processing track: Expedited: 3-45. Agency: DOC; Type of request processing track: Simple: 13; Type of request processing track: Complex: 41; Type of request processing track: Single: --; Type of request processing track: Expedited: 5. Agency: DOD; Type of request processing track: Simple: 17; Type of request processing track: Complex: 59; Type of request processing track: Single: --; Type of request processing track: Expedited: 1. Agency: DOE; Type of request processing track: Simple: 1-158; Type of request processing track: Complex: 18-916; Type of request processing track: Single: --; Type of request processing track: Expedited: 5-7. Agency: DOI; Type of request processing track: Simple: 3-834; Type of request processing track: Complex: 0-99; Type of request processing track: Single: --; Type of request processing track: Expedited: 2-64. Agency: DOJ; Type of request processing track: Simple: 0-137; Type of request processing track: Complex: 6-636; Type of request processing track: Single: --; Type of request processing track: Expedited: 1-195. Agency: DOL; Type of request processing track: Simple: 2-30; Type of request processing track: Complex: 18-60; Type of request processing track: Single: --; Type of request processing track: Expedited: 2-25. Agency: DOT; Type of request processing track: Simple: 1-68; Type of request processing track: Complex: 23-135; Type of request processing track: Single: --; Type of request processing track: Expedited: 5-57. Agency: ED; Type of request processing track: Simple: 0-30; Type of request processing track: Complex: 2-134; Type of request processing track: Single: --; Type of request processing track: Expedited: 3-21. Agency: EPA; Type of request processing track: Simple: --; Type of request processing track: Complex: --; Type of request processing track: Single: --; Type of request processing track: Expedited: --. Agency: GSA; Type of request processing track: Simple: --; Type of request processing track: Complex: 14; Type of request processing track: Single: --; Type of request processing track: Expedited: --. Agency: HHS; Type of request processing track: Simple: 9-25; Type of request processing track: Complex: 60-325; Type of request processing track: Single: 5-182; Type of request processing track: Expedited: 2-66. Agency: HUD; Type of request processing track: Simple: 21-95; Type of request processing track: Complex: 30-161; Type of request processing track: Single: --; Type of request processing track: Expedited: 9-42. Agency: NASA; Type of request processing track: Simple: 18; Type of request processing track: Complex: 33; Type of request processing track: Single: --; Type of request processing track: Expedited: 26. Agency: NRC; Type of request processing track: Simple: 11; Type of request processing track: Complex: 47; Type of request processing track: Single: --; Type of request processing track: Expedited: 60. Agency: NSF; Type of request processing track: Simple: --; Type of request processing track: Complex: --; Type of request processing track: Single: 20; Type of request processing track: Expedited: --. Agency: OPM; Type of request processing track: Simple: --; Type of request processing track: Complex: --; Type of request processing track: Single: 9; Type of request processing track: Expedited: --. Agency: SBA; Type of request processing track: Simple: --; Type of request processing track: Complex: --; Type of request processing track: Single: 5; Type of request processing track: Expedited: --. Agency: SSA; Type of request processing track: Simple: 19; Type of request processing track: Complex: 37; Type of request processing track: Single: --; Type of request processing track: Expedited: --. Agency: State; Type of request processing track: Simple: 6; Type of request processing track: Complex: 209; Type of request processing track: Single: --; Type of request processing track: Expedited: 184. Agency: Treas; Type of request processing track: Simple: 2-10; Type of request processing track: Complex: 4-172; Type of request processing track: Single: --; Type of request processing track: Expedited: 5-10. Agency: USDA; Type of request processing track: Simple: 1-77; Type of request processing track: Complex: 12-800; Type of request processing track: Single: --; Type of request processing track: Expedited: 1-53. Agency: VA; Type of request processing track: Simple: --; Type of request processing track: Complex: 4-49; Type of request processing track: Single: --; Type of request processing track: Expedited: 1-18. Source: FOIA annual reports for fiscal years 2004 (self-reported data). Note: For agencies that reported processing times by component, the table indicates the range of reported component median times. A dash indicates that the agency did not report any median time for a given track in a given year. For 2004, EPA and AID annual reports were not available. [End of table] Based on the data in agency annual reports, it was not feasible to determine trends at the agency level in the amount of time taken to process requests (reported annually as the median number of days to process requests). This is largely because many agencies have reported median processing times at a component level, making it difficult to derive overall agency median processing times. Nearly half (12 of 25) of the agencies reported median times at a component level. Although this practice does not provide agency-level indicators, it provides visibility into differences in processing times among the various components of agencies, which can sometimes be substantial. In summary, FOIA continues to be a valuable tool for citizens to obtain information about the operation and decisions of the federal government. Agencies have received steadily increasing numbers of requests and have also continued to increase the number of requests that they process. Despite this increase in processing requests, the backlog of pending cases continues to grow. Given this steadily increasing workload, it will remain critically important that strong oversight of FOIA implementation continue in order to ensure that agencies remain responsive to the needs of citizens. Mr. Chairman, this completes my prepared statement. I would be happy to respond to any questions you or other Members of the Subcommittee may have at this time. Contact and Acknowledgements: If you should have questions about this testimony, please contact me at (202) 512-6240 or via e-mail at koontzl@gao.gov. Other major contributors included Barbara Collier, John de Ferrari, and Elizabeth Zhao. [End of section] Appendix I: Relationship of FOIA and the Privacy Act of 1974: In addition to rights under the Freedom of Information Act (FOIA), individuals also have rights of access to government information under the Privacy Act of 1974. The Privacy Act restricts the federal government's use of personal information. More precisely, it governs use of information about an individual that is maintained in a "system of records," which is any group of records containing information about an individual from which information is retrieved by individual identifier. With regard to access, the Privacy Act gives individuals the right to have access to information about themselves that is maintained in a system of records so that they can review, challenge, and correct the accuracy of personal information held by the government. While both laws generally give individuals the right of access to information (subject to exemptions), there are several important differences: * While FOIA generally gives a right of access to all federal government records, the Privacy Act applies only to records pertaining to an individual that are retrieved by individual identifier. * While FOIA generally gives "any person" a right of access to records, the Privacy Act gives access to only the subject of a particular record and only if that person is a U.S. citizen or a lawfully admitted permanent resident alien. * While FOIA exempts categories of records from public release, including where disclosure would constitute an unwarranted invasion of personal privacy,[Footnote 13] the Privacy Act's exemptions pertain to a variety of the act's requirements, not just access (e.g., that agencies account for all disclosures of personal information, that they maintain only relevant and necessary personal information, and that they notify the public of their sources for obtaining records of personal information). Under current Department of Justice guidance, agencies are to treat an individual's requests for his or her own records as a request under FOIA as well as the Privacy Act. This is intended to ensure that individuals are fully afforded their rights under both laws. As a practical matter, it appears that agencies generally consider requests for access to one's own records as FOIA requests, without any separate accounting as Privacy Act requests. These requests are referred to as "first-party requests" and their addition to agency FOIA statistics can been seen, for example, in the large numbers of FOIA requests reported by agencies such as VA and SSA. Apart from questions about the role of the Privacy Act in FOIA decisions, privacy questions are often dealt with independently under FOIA. The act's two privacy exemptions [(b)(6) & (7)] protect from public release information about individuals in "personnel and medical files and similar files" and "information compiled for law enforcement purposes," the disclosure of which would constitute an "unwarranted invasion of personal privacy." These statutory provisions have resulted in an analysis that involves a "balancing of the public's right to disclosure against the individual's right to privacy."[Footnote 14] This approach led, for example, the Supreme Court to decide that there is a significant private interest in the "practical obscurity" of criminal history records even though they are officially public records.[Footnote 15] The development and refinement of such privacy principles continues as agencies and the courts make new "balancing" decisions in FOIA cases. Accordingly, it is difficult to definitively describe the extent of privacy protection under FOIA, or to characterize federal privacy protection as limited to the terms of the Privacy Act. FOOTNOTES [1] See 5 U.S.C. § 552. [2] GAO, Information Management: Progress in Implementing the 1996 Electronic Freedom of Information Act Amendments, GAO-01-378 (Washington, D.C.: Mar. 16, 2001); Information Management: Update on Implementation of the 1996 Electronic Freedom of Information Act Amendments, GAO-02-493 (Washington, D.C.: Aug. 30, 2002); and Information Management: Update on Freedom of Information Act Implementation Status, GAO-04-257 (Washington, D.C.: Feb. 18, 2004). [3] The agencies included the 24 agencies covered by the Chief Financial Officers Act and the Central Intelligence Agency. These 24 departments and agencies are the Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, Homeland Security, Housing and Urban Development, the Interior, Justice, Labor, State, Transportation, the Treasury, and Veterans Affairs; Environmental Protection Agency; General Services Administration; National Aeronautics and Space Administration; National Science Foundation; Nuclear Regulatory Commission; Office of Personnel Management; Small Business Administration; Social Security Administration; and U.S. Agency for International Development. For fiscal year 2002, we included the Federal Emergency Management Agency. For fiscal years 2003 and 2004, we included the Department of Homeland Security, which then incorporated the Federal Emergency Management Agency. [4] GAO, Information Management: Progress in Implementing the 1996 Electronic Freedom of Information Act Amendments, GAO-01-378 (Washington, D.C.: Mar. 16, 2001). [5] GAO, Information Management: Update on Implementation of the 1996 Electronic Freedom of Information Act Amendments, GAO-02-493 (Washington, D.C.: Aug. 30, 2002). [6] GAO, Information Management: Update on Freedom of Information Act Implementation Status, GAO-04-257 (Washington, D.C.: Feb. 18, 2004). [7] This provision was added by the Freedom of Information Reform Act of 1986 (Pub. L. 99-570). See OMB, Uniform Freedom of Information Act Fee Schedule and Guidelines, 52 FR 10011 (Mar. 27, 1987), effective April 27, 1987. [8] 5 U.S.C.§ 552(e). [9] See 5 U.S.C. § 552a. [10] For 2004, data were unavailable for the Agency for International Development and the Environmental Protection Agency. [11] Information for the Agency for International Development and the Environmental Protection Agency was not available for fiscal year 2004. [12] See GAO, Information Management: Progress in Implementing the 1996 Electronic Freedom of Information Act Amendments, GAO-01-378 (Washington, D.C.: Mar. 16, 2001); and Information Management: Update on Freedom of Information Act Implementation Status, GAO-04-257 (Washington, D.C.: Feb. 18, 2004). [13] 5 U.S.C. § 552(b)(6) and (b)(7). [14] Dept. of the Air Force v. Rose, 425 U.S. 352, 372; U.S. Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (1989). [15] Reporters Committee, at 780.