HUD must make more than assertions in FOIA case

The government must present evidence demonstrating which privacy interests are at stake and that there is a "substantial probability" that an invasion of privacy will occur when denying access to records under the federal Freedom of Information Act, a federal appellate court ruled last Thursday in Prudential Locations LLC v. U.S. Department of Housing and Urban Development.

The U.S. Department of Housing and Urban Development enforces the Real Estate Settlement Procedures Act, which prohibits "giving or accepting 'fee[s], kickback[s] or thing[s] of value' for referring 'business incident to or a part of a real estate settlement service involving a federally related mortgage loan.'"

After several complaints under the act, HUD launched an investigation into Prudential Locations, which ultimately led to a settlement agreement in 2005, when Prudential Locations paid a $48,000 penalty and promised not to violate the act again. In 2008, Prudential was again implicated in a complaint alleging violations, but HUD cleared Prudential Locations of any wrongdoing in its investigation.

During HUD's second investigation, Prudential Locations filed FOIA requests to gain access to the complaints against it. In a response to Prudential Locations' request, several lines from two documents — a letter and an email — were redacted, citing FOIA Exemption 6. The redactions were applied to names, contact information and other identifying information of the people who filed complaints against Prudential Locations.

HUD maintained it is its general policy to redact names of complainants in such situations to prevent internal retaliation, harassment or other adverse reactions. However, the court said this was not enough to show the information was properly withheld because it could not determine, based on these statements, if the complainants were actually at risk of retaliation in this particular instance.

The U.S. Court of Appeals in San Francisco (9th Cir.), sitting in Honolulu, held that HUD did not provide enough evidence for the court to determine if the two records in question were properly redacted under Exemption 6 because it could not determine the general identities of the complainants as to assess their risks from exposure, therefore limiting its ability to properly weigh the privacy interests as required by the law.

Exemption 6 allows for withholding when information contained within "personnel and medical files and similar files . . . would constitute a clearly unwarranted invasion of personal privacy." Agencies must conduct a balancing test to determine whether the privacy interests in the information outweigh the public interest in disclosure.

FOIA is a "disclosure statute," the court held, reiterating the finding of previous courts that the agency has the burden in court to "justify the withholding of any requested documents." As such, the court held that it "cannot take the government at its word when it claims an exemption applies."

When applying Exemption 6, "we must first confirm that some 'personal privacy' interest is at stake," the court held. Once that is established, "we must assess the likelihood that a privacy invasion will occur." Continuing further, the court held that "[a]t a minimum, and unsurprisingly given the emphatic 'would' requirement in the statutory text, the threat to privacy interests must be 'more palpable than [a] mere possibilit[y]."

The government must satisfy a "substantial probability" standard, which is more than a showing that a privacy invasion "could" occur, the court held. The evidence put forth by HUD — the statement of its policy against disclosure and the general risk of retaliation — does not satisfy this test, the court held. The court listed a number of circumstances where the redacted information may not invade someone's privacy, including if the complainants worked for competitors of Prudential or were government employees.

"[T]he disclosure of names and other identifying information is not 'inherently and always a significant threat to the privacy of the [named] individuals,'" the court held.

The court also discussed hypothetical circumstances where the disclosure of the information could, indeed, lead to the retaliation and stigma claimed by HUD. If the complainants were Prudential employees, the harm could be substantial and Exemption 6 could be properly applied, the court offered.

The court held that there was no way for it to determine if the complainants are those whose privacy would be invaded or whether their privacy interests would not be implicated at all. In addition, there was no evidence presented to properly conduct a balancing test to determine whether the public interest in disclosure would outweigh the privacy interests.

The court noted the facts of the case are unique, as many cases concerning personally-identifying information have clear privacy implications. However, it was impossible to determine the class or status of the complainants, or what their privacy interests were, from the redacted documents before the court.

"Courts armed with either type of information can make reasonably accurate predictions about how disclosure would affect the protected individuals, and, if privacy interests are determined to exist, can weigh those concerns against the public interests furthered by disclosure. Here, no analogous evidence exists."

The court remanded the case back to the district court to allow for the introduction of additional evidence "about who the informants are, or what privacy interests are likely infringed."