FOIA Exemptions 6 and 7(C), and where privacy leaks in released records

FOIA's two privacy exemptions let a federal agency withhold personal information from the records it releases. Exemption 6 covers personnel, medical and similar files whose disclosure would constitute a clearly unwarranted invasion of personal privacy. Exemption 7(C) covers records compiled for law enforcement purposes whose disclosure could reasonably be expected to constitute an unwarranted invasion of personal privacy. Both weigh that privacy interest against the public's interest in seeing how the government does its job.

The tests fit in a sentence each. Applying them is harder, because a released file names far more people than the request was about.

Exemption 6 and 7(C) side by side

Both exemptions are in 5 U.S.C. 552(b). The Supreme Court has read 7(C) as broader than 6 in two respects: it drops the word "clearly", and it asks whether disclosure "could reasonably be expected to" invade privacy rather than whether it "would" (DOJ v. Reporters Committee).

The reading of "similar files" comes from Department of State v. Washington Post, which held that protection doesn't depend on the label of the file the information sits in.

What counts as a public interest

The Department of Justice's Guide to the FOIA sets out four steps for Exemption 6, and the same four apply to 7(C): whether the threshold applies, whether there is a substantial privacy interest, whether there is a FOIA public interest and which of the two outweighs the other. With no real privacy interest, the record is released. With a privacy interest and no public interest, it is withheld.

The public interest is narrow. In Reporters Committee the Court limited it to information that sheds light on an agency's performance of its statutory duties, and held that the requester's identity and purpose have no bearing. Information about private citizens that reveals little or nothing about the agency's own conduct doesn't qualify.

NARA v. Favish added two points. Once there is disclosure, the information belongs to the general public, so a release to one requester is a release to all. And where privacy is at stake, the requester must show a significant public interest, more specific than wanting the information, that the records are likely to advance. The same case recognized that surviving family members have a privacy interest in images of a relative's death.

Who stays and who goes

According to the Guide, civilian federal employees outside law enforcement and sensitive occupations generally have no expectation of privacy in their names, titles, grades, salaries and duty stations. Their purely personal details are another matter: home addresses and personal email addresses can be withheld. Law enforcement personnel, military members and employees in sensitive jobs have substantial privacy interests in their identities.

Law enforcement files carry the most weight. The Guide's Exemption 7(C) chapter notes that courts treat a name in a law enforcement file as stigmatizing, and that 7(C) is regularly applied to people merely mentioned in a file as well as to suspects and others of investigative interest. Confidential sources have their own exemption, 7(D).

Segregating and marking what you remove

Section 552(b) requires an agency to release any reasonably segregable portion of a record once the exempt parts are deleted. Since the FOIA Improvement Act of 2016, agencies must also consider partial disclosure whenever full disclosure isn't possible, and may withhold only where they reasonably foresee harm to an interest an exemption protects (5 U.S.C. 552(a)(8)).

The released record has to show what was taken out. The amount of information deleted and the exemption relied on must be indicated on the released portion, and at the place of each deletion if technically feasible, unless the marking itself would harm the interest the exemption protects.

Where personal information leaks from released records

Privacy is most of a FOIA office's redaction work. In fiscal year 2025, Exemption 6 accounted for 36.02% of the exemptions agencies cited and 7(C) for 25.07%, together 61.09%, according to the Department of Justice's annual summary. Those withholdings come from records like these.

Email headers and threads

An email names people before its first sentence: sender, recipients, the cc line and the signature block. Forwarded threads carry every earlier message, so a resident's details redacted at the top can reappear three messages down: "resident Mark Feld (214 Oak St) called again about standing water at the culvert".

Public employees' private lives

An official's name and title usually stay, but the same email can carry their health and home life: "I'm out for knee surgery May 12 to 26. Reach me on my cell at (330) 555-0148." Those details are protected even for a public employee.

People named in passing

Investigative files name people who were never the subject: neighbors interviewed at the door, a witness's employer, the caller who reported the incident. They are easy to miss because the request was about someone else.

Old typewritten and scanned files

Older investigations survive as typewritten carbons, microfilm prints and photocopies of photocopies, often with handwritten notes in the margin. A text search finds nothing on them until OCR reads the page, and faint or skewed pages are where OCR misses the most.

The file itself

Released PDFs can carry author names, comments, tracked changes and earlier versions, and attachments travel with the email they came on. A redaction on the visible page reaches none of them.

A checklist before records are released

• Every person in the records has been considered, not only the one the request is about.
• Officials' names and titles stay where they acted in their official role; their home addresses, personal phones and medical details are gone.
• Private citizens, witnesses and people merely mentioned in law enforcement records are protected.
• Every message in a forwarded thread and every attachment has been reviewed.
• Scanned and typewritten pages have been read by OCR, and handwritten notes checked.
• Nonexempt information has been segregated and released.
• Each deletion is marked with its exemption, at the place it was made where technically feasible.
• Redacted text is removed, not covered, and document properties, comments and earlier versions are clean.

Where DocArmor fits

DocArmor's FOIA & Public Records Exemptions template has 15 fields across Exemptions 1, 4, 5, 6, 7, 8 and 9. For privacy, Citizen & Personal Identifiers, Minor & Juvenile Information and Personal Medical, Financial & Personnel Data follow Exemption 6, while Confidential Sources & Witnesses and Protected Personnel & People at Risk cover the people in law enforcement records. Context-aware detection keeps public officials' names and official business while it catches the same official's surgery dates and personal cell, and OCR reads typewritten pages and degraded scans. Every redaction is proposed by the AI and confirmed by a person, because both exemptions turn on a balance no pattern can strike. Redacted content is removed and checked on every page, and metadata, attachments and form values are stripped, so released records can't be un-redacted.

This post is general information about the federal FOIA, not legal advice. State public records laws have their own exemptions, so check yours and your agency's FOIA regulations.