FOIA Exemptions: The Nine Categories Explained

How do FOIA exemptions work?

Congress wrote nine exemptions into the Freedom of Information Act ^[1]. They cover certain categories of information. They exist to guard against harms such as an invasion of personal privacy or harm to law enforcement investigations ^[1].

The key word is "permit." The exemptions allow agencies to withhold information. They do not require it ^[2]. The Justice Department's Office of Information Policy says agencies generally have discretion to decide whether to assert an exemption. The exception is information that must be protected because of classification or another law outside FOIA. ^[3]

Courts start from the other direction. The D.C. Circuit has said agencies may only withhold information that falls within one of the nine exemptions ^[4]. It has also said that disclosure, not secrecy, is the dominant objective of the Act ^[4]. The Supreme Court has directed that the exemptions be narrowly construed ^[2].

One limit on scope matters for local reporters. FOIA.gov says the FOIA does not apply to the courts, Congress, or state and local governments ^[1]. For records from a city or state agency, check your state's law.

Video from The Justice Department (official YouTube channel). Open at youtube.com. Content from youtube.com loads only if you click.

What must an agency prove before it withholds?

The agency carries the burden. The D.C. Circuit stated that the burden of proving an exemption applies falls on the agency ^[4]. You do not have to prove the record is public.

The statute adds a second test. An agency may withhold information only if it reasonably foresees that disclosure would harm an interest protected by an exemption, or if disclosure is prohibited by law ^[5]. This is the foreseeable harm standard. The Office of Information Policy says it applies to all exemptions except Exemption 3 ^[3].

Fear alone does not meet the test. The Office of Information Policy says agencies may not withhold information based merely on speculative or abstract fears or fears of embarrassment ^[3]. It says agencies should explain both the nature of the harm and the link between that harm and the specific information withheld ^[3].

The Reporters Committee for Freedom of the Press makes the same point. It says an agency cannot simply claim an exemption without justifying how disclosure would actually harm a protected interest ^[6].

A 2021 D.C. Circuit case shows how this plays out. In Reporters Committee v. FBI, the court held the government had not met its burden for some documents withheld under Exemption 5. It had not shown they were deliberative or that release would cause foreseeable harm ^[4]. The same court held the government properly withheld certain emails in which FBI leadership deliberated about responses to media and legislative pressure ^[4]. Some withholding stood and some did not.

Video from Freedom of the Press Foundation. Open at youtube.com. Content from youtube.com loads only if you click.

What do Exemptions 1, 2, and 3 cover?

Exemption 1 covers national security and foreign policy material. It reaches matters that an Executive order authorizes to be kept secret in the interest of national defense or foreign policy ^[5]. The material must also be in fact properly classified under that order ^[5].

Exemption 2 covers internal personnel rules and practices ^[5]. The Supreme Court has held that these are rules that address employee relations or human resources ^[2]. The Court has also directed that exemptions be read narrowly, so do not treat Exemption 2 as a shield for anything internal ^[2].

Exemption 3 covers matters that another statute specifically exempts from disclosure. The other statute must meet the conditions Congress set out in the FOIA itself ^[5]. Exemption 3 is the one exemption where the foreseeable harm standard does not apply ^[3].

What does Exemption 4 protect?

Exemption 4 covers trade secrets and commercial or financial information. The information must have been obtained from a person and be privileged or confidential ^[5].

The word "confidential" matters here. In Food Marketing Institute v. Argus Leader Media, the Supreme Court described commercial or financial information as confidential at least where the owner customarily and actually treats it as private and it was given to the government under an assurance of privacy ^[2].

If an agency cites Exemption 4, you can ask what the company did to keep the information private. You can also ask what assurance the government gave. Those questions track the conditions the Court described in Argus Leader ^[2].

How do Exemption 5 and the deliberative process privilege work?

Exemption 5 covers inter-agency or intra-agency memorandums or letters that would not be available by law to a party other than an agency in litigation with the agency ^[5].

One part of Exemption 5 is the deliberative process privilege. The D.C. Circuit described it as shielding documents that reflect advisory opinions, recommendations, and deliberations. These must be part of the process by which governmental decisions and policies are formulated ^[4].

The Reporters Committee says material must be both predecisional and deliberative to qualify for the privilege ^[6]. It also says purely factual information that was merely used in a deliberative process generally cannot be withheld under this privilege ^[6].

Agencies often invoke the privilege when they believe disclosure could chill agency candor ^[6]. An agency still has to meet the foreseeable harm test to withhold ^[5].

The statute also sets a time limit. The deliberative process privilege does not apply to records created 25 years or more before the date they were requested ^[5]. If you are digging into old decisions, this matters.

What do Exemptions 6 and 7 cover?

Exemption 6 covers personnel and medical files and similar files. It applies when disclosure would constitute a clearly unwarranted invasion of personal privacy ^[5].

Exemption 7 covers records or information compiled for law enforcement purposes. It protects them only to the extent that producing them would cause one of the harms listed in subparagraphs (A) through (F) ^[5]. A record does not become secret just because police or investigators hold it ^[5].

Several of those harms are worth knowing:

• Subparagraph (A): disclosure that could reasonably be expected to interfere with enforcement proceedings ^[5]. Courts have held that this applies to a pending or prospective enforcement proceeding ^[2].
• Subparagraph (C): disclosure that could reasonably be expected to constitute an unwarranted invasion of personal privacy ^[5].
• Subparagraph (F): disclosure that could reasonably be expected to endanger the life or physical safety of any individual ^[5].

Exemptions 6 and 7(C) overlap, but they are not equal. The Congressional Research Service reports that, as the Supreme Court has explained, Exemption 7(C) provides more protection for covered materials than Exemption 6 does ^[2]. Privacy-based withholding may therefore be stronger in law enforcement files ^[2].

Courts do not agree on every detail of Exemption 7. For one subexemption, the Congressional Research Service says courts are split on whether the circumvention requirement applies to both types of materials or only to the "guidelines" mentioned in the second clause ^[2]. If you hit that issue, the answer may depend on the court that hears your case.

What do Exemptions 8 and 9 cover?

These two cover narrow subject areas. Exemption 8 covers material in or related to examination, operating, or condition reports. The reports must be prepared by, for, or on behalf of an agency responsible for regulating or supervising financial institutions ^[5].

Exemption 9 covers geological and geophysical information and data, including maps, concerning wells ^[5]. If your story involves financial institution supervision reports or geological data on wells, an agency may cite these exemptions.

For the full legal detail, the Justice Department's Guide describes itself as a comprehensive legal treatise on the FOIA. ^[7] The Congressional Research Service report below also describes FOIA's nine exemptions as permitting, but not requiring, withholding ^[2].

What should a partial release look like?

An agency cannot withhold a whole record just because part of it is exempt. The statute requires the agency to provide any reasonably segregable portion after deleting the exempt parts ^[5]. FOIA.gov says the agency will redact, or black out, information protected by one of the nine exemptions ^[1].

The Office of Information Policy says agencies should review records with an eye toward what can be disclosed, rather than what can be withheld ^[3]. If you get a page that is blacked out end to end, ask why no part could be released.

FOIA.gov says the agency will tell you the specific exemption it applied to any withheld portion ^[1]. That label is your starting point. Match it to the text above.

Exclusions are a separate matter. Records falling within an exclusion are not subject to the requirements of the FOIA. ^[1] For example, the third exclusion is limited to the FBI. It protects the existence of foreign intelligence, counterintelligence, or international terrorism records when the existence of those records is classified ^[1].

What should you do when a request is denied under an exemption?

Work through these steps in order.

1. Find the exemption. FOIA.gov says the agency will tell you the specific exemption it applied to any withheld portion ^[1]. Write down the number.
2. Read the exemption's text. Does the record actually fit? Exemption 6, for example, needs a clearly unwarranted invasion of privacy ^[5]. The deliberative process privilege needs material that is both predecisional and deliberative ^[6].
3. Check foreseeable harm. Except for Exemption 3, the agency must reasonably foresee harm to a protected interest ^[3]. Speculation or embarrassment is not enough ^[3].
4. Check for segregable material. Ask whether the agency released every reasonably separable portion ^[5].
5. File an administrative appeal. FOIA.gov says you may appeal if you are not satisfied with an agency's initial response ^[1]. In your appeal, name the exemption and explain why the record does not fit.

Keep your appeal short and specific. Point to the exemption the agency named, the missing harm explanation, or the unreleased portions ^[3].

The Reporters Committee notes that exhausting administrative remedies is usually a necessary prerequisite to litigation, so an appeal may matter if you might sue later ^[6]. The Reporters Committee notes that exhausting your administrative remedies is usually a necessary prerequisite to litigation ^[6]. If a lawsuit is on the table, talk to a lawyer first.

Keep copies of everything. Save your request, the agency's response, and the exemption it cited. If you want to be part of a press association, you can join the National Press Association. The NPA is not a government body, and membership does not give you any legal right to records.

You can also read our guide to press credentials for independent reporters to see how a credential can document your work. A credential is not government-issued, and it does not promise access.