Next Story

Changes Proposed by Congress
FOIA: Delicate Dance of Public Disclosure and Privacy

By Carla Garnett

On the Front Page...

Try talking about the Freedom of Information Act with your coworker and you can probably expect stifled yawns and glazed-over eyes. But strike up a conversation about it with NIH FOI Officer Susan Cornell and the reaction will be vastly different. On the job a little more than a year now, Cornell so warms to her work that even to an untutored outsider the legalities and intricacies of it become fascinating.

Continued...

Most folks may only have a vague idea about FOIA, thinking it some obscure law giving the public access to federal documents. That FOIA is a way the public can request government information is true, but the law's obscurity is complete myth. Consider that NIH spent more than half a million dollars handling 1,200 FOIA requests in 1998. And although 100 requests a month may not seem like a huge amount, consider that a single request can generate thousands of pages in response. Providing the information can take as long as a year, a month or a day, depending on the nature of the request and the amount of review required. As Cornell's predecessor was fond of saying, "Anyone with a 33-cent postage stamp is capable of paralyzing the office." But that's how the FOIA business has been since its enactment in 1966.

NIH FOI Officer Susan Cornell

"Without a doubt it's the requesters that make the work so interesting," admits Cornell, an attorney and former Navy Judge Advocate General who developed an expertise in FOIA while working at the Commodity Futures Trading Commission.

Last fall, Cornell and the rest of the federal government learned from Congress that a new law could require the FOIA expertise of legions more than are currently in the field. A provision enacted with the October 1998 omnibus appropriation could widely expand FOIA: It might not only increase exponentially the FOIA workload of federal grantmaking agencies, but also could threaten patient privacy rights, impede partnerships between government, academia and private industry, and undermine competition by offering possibly unrestricted access to research data. On July 15, NIH director Dr. Harold Varmus testified on Capitol Hill in support of a measure to repeal the provision.

The Right to Know

Did you know that your grade level, salary and last promotion as a federal employee are a matter of public record, as is the email you dashed off to a colleague this morning? That means the information may be available to anyone who requests it, under FOIA. Indeed, the amount of your recent cash award, the 171 you filled out to apply for your job, the notes (and wisecracking cartoons) you scribbled at staff meetings, and, in some cases, even the investment portfolios of certain employees may be accessible to anyone who asks. Surprising? Perhaps. But, as Cornell explains, "Because you are a federal employee and the public is paying your salary, you are fair game. Deciding whether we can deny a request requires a balancing of government interest and private interest."

In most cases, the only things preventing full disclosure of sensitive information are Cornell and the nine exemptions identified in the original FOIA. The FOIA is a disclosure statute. If NIH has records that respond to a request, those records must be released unless one or more of the exemptions applies.

"By regulation, only the NIH FOI officer has the authority to deny access to information under the FOIA," she says. "Routine information about employees that we don't release includes Social Security number, date of birth and date of high school graduation, home address and phone number, retirement and life insurance specifics, criminal conviction history and veteran's preference and military service data. We also protect information relating to an employee's annual or sick leave. All that falls under exemption 6 [protection of information the release of which could result in a clearly unwarranted invasion of personal privacy] and gets expunged from the documents we eventually release."

Also denied to requesters are comments by grant/contract application reviewers, who would probably not be as candid if they knew their reviews were not confidential.

Besides Cornell, her office has a staff of three FOIA specialists who handle requests involving information in the Office of the Director, requests about sensitive information and those that will result in a denial. Many times this involves working closely with the Office of the General Counsel. The FOI office also is responsible for justifying any denials that result in appeals, and assisting with cases that end up in court. Each institute and center also has an FOI coordinator who handles requests directed to a specific IC.

Requests under FOIA for NIH licensing agreements and cooperative research and development agreements (CRADAs) are on the rise these days, according to Cornell. "More and more we're responding to requests dealing with the business of NIH," she added. "Reviewing these complicated and sensitive documents requires intense attention to detail and internal consistency. I can't emphasize enough that institute leaders need to be committed to complying with the FOIA. The coordinators have to have the cooperation of the program officials, especially when responding to these requests."

Besides exemption 6, others commonly cited by NIH to deny information include exemption 3 (which prohibits disclosure of information protected by another law), exemption 4 (which protects trade secrets and financial or commercial information that is privileged or confidential), and exemption 5 (which protects memos or letters within the agency or among agencies that would not be available in a lawsuit).

"We also provide training — both formally and informally — to groups who want or need to learn more about FOIA," Cornell says. "And we advise FOIA coordinators on a daily basis."

Too Much Openness?

Essentially, the new provision broadens the application of FOIA to include not only the federal government, but also all of the government's partners in research. That would mean, for instance, that the public could possibly have unlimited access to even the most preliminary research data by NIH's grantee scientists. It could mean that patients who were promised confidentiality to participate in research might find their cases discussed in the media. Although unintended, the new provision could make patenting and licensing new products extremely difficult, as the data for developing the products would already be in the public domain.

Aware of the provision's potential for harm, the Office of Management and Budget has drafted clarifying changes to the regulation, called "A-110," and is accepting public comments about its revisions until Sept. 10.

"I too am an advocate for openness in scientific research," said Varmus, in his testimony before the House subcommittee on government management, information and technology, which is considering a bill to overturn A-110. "Exchanging ideas and sharing data are absolutely vital to the success of biomedical research...But a word of caution. I think it would be a mistake to open all underlying scientific data to public scrutiny simply because of the concept that all openness is good. There are pitfalls in unrestrained openness, including unwarranted violations of privacy, the potential harassment of scientific investigators and the chilling effect that inappropriate public scrutiny could have on the free exchange of ideas and the willingness to take risks to find answers."

Who Wants to Know?

Although anyone can request information under FOIA, in general the requests come from one of several categories: Unsuccessful grant or contract applicants who want to know about the person who was awarded the grant or contract, law firms, people with an interest in a specific disease who want access to NIH research on the disorder, pharmaceutical companies, animal rights organizations, congressional offices and people who wish to challenge a patent or who think they deserve part of the royalty payments from an invention.

Much of the staff's time is spent trying to respond to requests that are outside the purview of FOIA.

"We provide what are called identifiable documents," explains Cornell. "We do not answer questions on program issues. The distinction between program issues and identifiable documents is lost on a lot of people. Nevertheless, we have to try to respond to every request that comes in the door."

Cornell urges NIH'ers to keep proper records.

Members of the media who are researching news stories also account for a large number of FOIA requests. In fact, Cornell's office is currently collecting 6 years' worth of public financial statements (the Form-278 filled out by certain NIH employees) for a Los Angeles Times reporter. This spring, Cornell released 950 pages of documents, all first carefully reviewed and properly expunged, to the reporter; over 1,300 pages more for the same writer under the same request were released in July. Each page had to be gone over with a fine-tooth comb by FOIA specialists, a painstaking and time-consuming procedure — and that's only for one of the more than a thousand requests that will cross Cornell's desk this year.

"One thing that would make it easier," she advises, "is for employees to learn to keep their records properly. How you keep your records is very important. For example, there are record retention schedules determined by NIH and the National Archives that tell us how long we have to keep certain documents. Employees should get acquainted with this schedule, because as long as you've got it, we've got to review it and possibly release it."

Once the retention period has passed, employees should discard the documents. That reduces the amount of material FOIA officials must examine. If the documents are kept and then requested under FOIA, they must be located, reviewed and perhaps eventually released to the requester — even though they could have been discarded according to the schedule.

"It would also help if more program officials understood FOIA better," Cornell says. "We're finding that requesters are getting more sophisticated all the time. They know their rights and they take advantage of them. Overall, program officials' cooperation and commitment of resources to FOIA are crucial, especially for handling requests for proprietary information about the science here."

Regardless of the outcome of A-110, a fair number of FOIA requests will continue to arrive daily, and Cornell and her staff will weigh the merits of public disclosure against privacy for each one. However, knowing now the kinds of material they may be scanning — your 171, an email you wrote as a joke or the notes you took while on the phone — you may not be so quick to write off FOIA as dull.