March 19, 2025
SENT BY E-MAIL
XXXX
Re: 2025-APP-00011 (Appeal of Response 2025-FOI-109)
Dear XXXX:
On January 9, 2025, you submitted a Freedom of Information Act (FOIA) request (2025-FOI-109) to the National Credit Union Administration (NCUA) for the following: “Complaints received by the NCUA from January 1, 2020 to December 31, 2024 concerning depository institutions under the NCUA’s jurisdiction or supervision (e.g., federally-chartered or federally-insured credit unions) about the holder of a checking or savings account with the depository institution or check cashing transaction by non-account holder in which: (1) a complainant describes themselves as being a member of a racial, ethnic, minority group: Black, African American, Hispanic, Latino, Latina, Asian, Native American, Pacific Islander, Middle Eastern, Arabic, or (2) a complainant mentions one or more of the following words or phrases: race, racial, racially, racism, racist, redlining, slur, minority, minorities, ethnic, ethnicity, ancestry, national origin, skin color, color of skin, people of color, person of color, man of color, woman of color, or banking while . . .”
By letter of February 6, 2025, the NCUA FOIA Processing Center (FOIA Office) granted your FOIA request in part. Two spreadsheets containing all records responsive to your request were provided to you, with partial redactions to certain information pursuant to FOIA exemption 5 U.S.C. §552 (b)(6) (Exemption 6). The FOIA Office explained that Exemption 6 protects information about individuals in personnel and medical files, or similar files, when the disclosure of such information would constitute a clearly unwarranted invasion of personal privacy. The FOIA Office also explained that, in determining whether to withhold information, the NCUA determined that the harm from disclosure is reasonably foreseeable.
You appealed this determination in a February 27, 2025, correspondence. In your appeal, you contend that the NCUA’s application of Exemption 6 is overly broad. You argue that the full redaction of information from a description field and a free form subject field is not necessary to protect the privacy interests of complainants.
Upon a full and independent review, your appeal is denied, as discussed more fully below.
Exemption 6
The FOIA provides that an agency may withhold responsive records if the agency reasonably foresees that disclosure would harm an interest protected by one of the nine exemptions that the FOIA enumerates or disclosure is prohibited by law.1
Exemption 6 protects information about individuals in “personnel and medical files and similar files” when the disclosure of such information would constitute a clearly unwarranted invasion of personal privacy.2 Determining whether information warrants protection under Exemption 6 requires a four-step analysis. First, determine whether the information is a personnel, medical, or “similar” file.3 Second, determine whether there is a significant privacy interest in the requested information.4 Third, evaluate the requester’s asserted FOIA public interest in disclosure.5 Fourth, if there is a significant privacy interest in non-disclosure and a FOIA public interest in disclosure, balance those competing interests to determine whether disclosure “would constitute a clearly unwarranted invasion of personal privacy."6
Exemption 6 is interpreted broadly, and all information that “applies to a particular individual” meets the threshold requirement of falling within the category of “personnel and medical files and similar files” to warrant protection under Exemption 6.7 Here, the threshold requirement is satisfied. The requested records include personally identifying information (PII) that applies to private citizens participating in the NCUA Consumer Assistance Center complaint process. There is a significant privacy interest in PII. PII is vulnerable to phishing, spoofing, identity theft, and other cybersecurity attacks and has been found to implicate a substantial privacy interest cognizable under the FOIA.8
Since a substantial privacy interest may be infringed by the disclosure of the requested PII, the next steps of the analysis require an assessment of the asserted public interest followed by a “balancing of the public interest served by disclosure against the harm resulting from the invasion of privacy."9 When the disclosure of requested information could result in the invasion of personal privacy, the burden is on the requester to establish that disclosure would serve a public interest.10 The only relevant public interest in disclosure is the extent to which disclosure would serve the “core purpose of the FOIA,” which is “contributing significantly to public understanding of the operations or activities of the government.”11 “That purpose, however, is not fostered by disclosure of information about private citizens that is accumulated in various governmental files but that reveals little or nothing about an agency’s own conduct.”12
In your appeal you acknowledge that certain categories of PII, such as name, account number, mailing address, email address, social security number, tax identification, and telephone number should be redacted. However, you “do not believe that the identity of the complainants would be disclosed by providing text that describes the nature of the complaint,” or “text that alleges discrimination.” Moreover, you argue that to the extent that “disclosure of such text poses a risk to the complainants’ privacy interest, it is outweighed by the public benefits of the extent of allegations of discrimination against credit unions.”
We disagree. The responsive spreadsheets’ description fields and the free form subject fields contain narrative text describing allegations of discrimination by credit unions that include sensitive personal details from private citizens. Savvy cybercriminals are adept at culling together various bits and pieces of information to discern the identities of individuals for nefarious ends. Complaints shared candidly by consumers may be rich with descriptive or personal detail about the nature and circumstances of alleged discriminatory activity and could be easily exploited by bad actors to bring harm to private consumers.
Moreover, the redacted information you received is already sufficiently detailed to glean insight about the overall number and general nature of allegations brought by consumers against credit unions, and the agency’s response to those complaints. Full disclosure of redacted narrative details from complainants would reveal little more about the agency’s conduct in responding to those consumers’ complaints.
On balance, particularly given the growing prevalence of sophisticated cyberattacks, the public benefit from disclosure of narrative details about allegations of discrimination by credit unions is outweighed by complainants’ privacy interests. The full disclosure of redacted information would constitute a clearly unwarranted invasion of personal privacy. Accordingly, upon review, the February 6, 2025, response is affirmed.
For these reasons, your FOIA appeal is denied. Pursuant to 5 U.S.C. §552(a)(4)(B) of the FOIA, you may seek judicial review of this determination by filing suit against the NCUA. Such a suit may be filed in the United States District Court where you reside, where your principal place of business is located, the District of Columbia, or where the documents are located (the Eastern District of Virginia).
The 2007 FOIA amendments created the Office of Government Information Services (OGIS) to offer mediation services to resolve disputes between FOIA requesters and Federal agencies as a non-exclusive alternative to litigation. Using OGIS services does not affect your right to pursue litigation. You may contact OGIS in any of the following ways:
Office of Government Information Services
National Archives and Records Administration
8601 Adelphi Road - OGIS
College Park, MD 20740-6001 E-mail: ogis@nara.gov
Web: https://ogis.archives.gov
Telephone: 202-741-5770; Toll-free: 877-684-6448
Fax: 202-741-5769
Sincerely,
/s/
Frank Kressman
General Counsel
GC/PY
2025-APP-00011; 2025-FOI-109
Footnotes
1 5 U.S.C. § 552(a)(8)(A)(i).
2 5 U.S.C. § 552(b)(6).
3 Id.
4 See Multi Ag Media LLC v. USDA, 515 F.3d 1224, 1229 (D.C. Cir. 2008).
5 See NARA v. Favish, 541 U.S. 157, 172 (2004).
6 5 U.S.C. §552(b)(6); see also Favish, 541 U.S. 157 at 172.
7 U.S. Dep’t of State v. Washington Post Co., 456 U.S. 595, 602 (1982).
8 See, e.g., Wadhwa v. VA, 707 F. App’x 61, 63-64 (3d Cir. 2017) (protecting personally identifying information, including names, phone numbers, and email addresses, concerning individuals involved in adjudication of discrimination complaints in absence of any FOIA public interest); Int’l Brotherhood of Elec. Workers Loc. Union No. 5 v. HUD, 852 F.2d 87, 89 (3d Cir. 1988) (perceiving no public interest in disclosure and therefore protecting employees’ social security numbers); Pubien v. EOUSA, No. 18-0172, 2018 WL 5923917, at *5 (D.D.C. Nov. 13, 2018) (finding names subject to withholding because plaintiff failed to identify any FOIA public interest in disclosure); Maryland v. VA, 130 F. Supp. 3d 342, 353 (D.D.C. 2015) (protecting identifying portions of email addresses of individuals whose businesses were not selected for inclusion in small business database because public interest in such information was “practically nonexistent”).
9 Int’l Brotherhood of Elec. Workers Loc. Union No. 5, 852 F.2d at 89.
10 See NARA v. Favish, 541 U.S. 157 (2004).
11 Sheet Metal Workers Int’l Ass’n, Local Union No. 19 v. U.S. Dep't of Veterans Affairs, 135 F.3d 891, 897 (3d Cir. 1998) (citing U.S. Dep’t of Defense et al. v. Federal Labor Relations Auth., 510 U.S. 487, 495–496 (1994)); see also Dep’t of the Air Force v. Rose, 425 U.S. 352, 372 (1976) (noting information that serves the “basic purpose” of the FOIA to “open agency action to the light of public scrutiny” constitutes a FOIA public interest in disclosure).
12 Dep’t of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 773 (1989) (quoting Rose, 425 U.S. at 360–361).