Will the CUI Program cause an expansion of the use of Exemption 3 of the Freedom of Information Act (FOIA)?

The full implementation of CUI is unlikely to cause an expansion of the use of Exemption 3 statutes by agencies, and in fact is more likely to produce the opposite effect by prohibiting agencies from marking and controlling information unless a valid law, Federal regulation, or Government-wide policy authorizes it. The CUI Program, for the first time, establishes a clear distinction between a marking purporting to control information under the Freedom of Information Act (FOIA) and the substantive decision by a FOIA reviewer to withhold or disclose the information based on the true content of the document.

• Executive Order 13556, “Controlled Unclassified Information,” dated November 4, 2010, states the following:

“The mere fact that information is designated as CUI shall not have a bearing on determinations pursuant to any law requiring the disclosure of information or permitting disclosure as a matter of discretion, including disclosures to the legislative or judicial branches.”

• The CUI implementing regulation at 32 CFR 2002 reinforces this point, stating:

“Agencies must not cite the FOIA as a CUI safeguarding or disseminating control authority for CUI. When an agency is determining whether to disclose information in response to a FOIA request, the agency must base its decision on the content of the information and applicability of any FOIA statutory exemptions, regardless of whether an agency designates or marks the information as CUI.”

• Joint guidance issued by the CUI Executive Agent and the Department of Justice (DOJ) Office of Information Policy (OIP), dated July 3, 2014, states:

“Neither CUI markings nor any other markings are dispositive of a FOIA reviewer’s disclosure determination. Decisions to disclose or withhold information must be made based on the applicability of the statutory exemptions contained in the FOIA, not on a marking or designation. To provide further clarification, when reviewing records, no markings of any kind, whether CUI or others that may appear in the same document, shall be applied to require that unclassified information must be considered exempt from disclosure under the FOIA. No marking or statement may be paired with a CUI marking to circumvent the provision of the Executive Order that designation as CUI does not control disclosure under the FOIA.”

It is an important tenet of the CUI Program to carefully balance the need to protect some types of information with the right of the public to know and have access to the workings of their Government. The CUI Program established a Registry of approximately 400 laws, Federal regulations, and Government-wide policies that authorize safeguarding or dissemination controls to be applied to unclassified information. Each of these authorities existed prior to establishment of the CUI Program and is thus not a new requirement for controlling information. Agencies have long relied on many laws to protect information from public access. A fuller accounting and understanding of those information control authorities that already exist better serves the public interest through increased openness and transparency. In a similar manner, DOJ has worked to compile a list of statutes that have been determined by a Federal court to qualify under Exemption 3 of the FOIA, which authorizes a Federal agency to withhold from disclosure information in response to a FOIA request because a statute permits such nondisclosure.  The current DOJ listing from December 2016 includes about 72 such Exemption 3 statutes. Additionally, this does not include statutes that agencies may be using to withhold information under Exemption 3 that have not yet been considered by a court as a possible Exemption 3 statute one way or another, making the number of statutes likely even greater than 72. Even further, some agency personnel have long used markings to indicate FOIA exemptions should be applied to block public access to the information prior to a FOIA reviewer making such a determination based on the content of the document itself.

Also to note, many of the 400 authorities for controlling CUI are regulations or Government-wide policies, not statutes, so they could not be cited as Exemption 3 authorities for withholding information from the public. Further, some statutes have been determined not to be Exemption 3 statutes by courts, so while agencies may control information pursuant to them internally, once a FOIA request is made for that information, it would have to be disclosed to the public.