approach. In drafting disclosure provisions, consideration should be given to the feasibility of a three-tiered classification system, which would permit interagency transfers, with appropriate confidentiality and security safeguards, of some information that would not be available for public disclosure.

The Commission recognizes that these general principles are subject to exceptions and that they constitute only a bare outline of the basic principles of fair information practices. We recognize, further, that comprehensive legislation to establish fair information practices cannot be hastily drafted. This will require not only intensive and extensive study by the legislative branch but close cooperation with the executive branch as well. Input must also be sought from State and local governments and all segments of the reporting public.

Obviously, then, the enactment of a Fair Information Practices Act is a somewhat long-range goal. Fortunately, however, because of the need to treat different categories of information separately, at least for certain purposes, the policies to be embodied in such legislation can be enacted on a step-by-step basis.

The recommendations discussed in the remainder of this section outline some of the preliminary steps that the Commission believes should be taken pending enactment of a comprehensive Fair Information Practices Act.

Amendments to the Freedom of Information Act

Exemption (b)(3). The Freedom of Information Act spells out, in eight of its nine exemptions, the specific kinds of information which may be withheld in order to protect the overriding concerns of personal privacy and "national interests". In only one exemption, (b)(3), is the information not defined. This exemption, for matters "specifically exempted from disclosure by statute", was included in the 1966 Act as a catch-all and as an expedient way of preserving a wide range of existing confidentiality statutes. With the steady increase in such legislation and in administratively bestowed pledges of confidentiality, which could gradually erode the body of information available to the public, the Congress recently substantially narrowed this exemption when it enacted the Government in the Sunshine Act. This was consistent with the policy, embodied in the FOIA, of defining as precisely as practicable the kinds of data which may be withheld from disclosure.

The Commission believes, however, that, despite its recent amendment, serious consideration should be given to repealing subsection (b)(3) of the FOIA. The Commission study found at least 200 separate statutory provisions which impose some limitations on the public disclosure of data twice as many as there were in 1966, when the FOIA was enacted.5 Some require that certain kinds of information be withheld; others establish criteria pursuant to which data must or may be withheld. It is not yet clear how many of these

5 See FAA Administrator v. Robertson, 422 U.S. 255, 266 (1975). See also Section II, n. 54, supra.

155

156

would be encompassed within the recently narrowed (b)(3) exemption as specifically exempting information from disclosure. It is clear, however, that, although some of the material covered by these laws would fall within one or another of the other exemptions to the Act, much of this information would not otherwise be exempt from public disclosure. Thus, these laws may be operating to withhold from the public and often from other Federal agencies — a substantial quantity of information collected and maintained with Federal funds.

It is, in fact, this body of "confidentiality" legislation which has produced the often inconsistent, confused state of our present Federal information policy. The nature of the legislative process is such that nondisclosure provisions have been written into laws, often in reaction to the pressures of special interest groups, with little, if any, consideration of the effects of these provisions on overall Federal information practices. Approximately half these laws predate the promulgation of general information policies. Whether such legislation should continue to be operative in limiting the amount of information available to the public is a question which needs to be examined, and we propose that the appropriate committees of Congress do so.

What is urgently needed as a preliminary step to the repeal of subsection (b)(3) and of the unnecessary or outdated confidentiality provisions of other laws falling within this exemption is the comprehensive review of all laws limiting the disclosure of information, including, of course, laws restricting the disclosure of personal information about individuals. The Commission has already proposed, in Recommendation No. 2, that executive branch agencies undertake a similar review of their confidentiality laws, regulations, and policies and report to the President on the need for the continued withholding of such information from the public and from other Federal agencies. The Commission expects that the agency proposed in Recommendation No. 3 will also be involved in assessing the need for continued restrictions on disclosure. Confidentiality provisions should, of course, be retained for any information warranting continued protection. If any such information does not fall within one of the other FOIA exemptions (apart from exemption (b)(3)), the Congress should enact the necessary specific exemptions for those categories of information. Any new exemptions should be narrowly drawn and enacted only after full consideration by the committees of the Congress which have responsibility for setting government information policies.

New FOIA Exemptions. If, in fact, exemption (b)(3) were repealed, at least one additional FOIA exemption would be necessary to protect the anonymity of the subjects of information collected or

The former (b)(3) exemption provided for matters "specifically exempted from disclosure by statute." The amended subsection (b)(3) added the following proviso: "that such statute (A) requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue, or (B) establishes particular criteria for withholding or refers to particular types of matters to be withheld; ././."

maintained solely for statistical purposes. Although this Commission disapproves generally of the expansion of FOIA exemptions or other legislation which unnecessarily limits the amount of information available to the public, this exemption would not have that effect. The Commission believes that confidentiality guarantees and safeguards are essential to any successful statistical program, to protect statistical data from being used for any other purpose and to protect the identity of data sources. Legislation proposed in Recommendation No. 7 would provide such safeguards. Yet the identity of data sources is never a factor in the final results of statistical studies. Accordingly, the public interest to be served by the disclosure of the findings, compilations, surveys, or other reports based on statistical activities does not require that it be effected in a form that would identify the data furnished or the source of the data.

If the legislation proposed in Recommendation No. 7 were enacted, exemption (b)(3) would operate to protect the identity of such data sources from public disclosure. Following the repeal of subsection (b)(3), however, no other exemption would afford such protection. Exemption (b)(6), which applies to information whose disclosure "would constitute a clearly unwarranted invasion of personal privacy", might afford adequate protection for individual data subjects. As mentioned earlier, however, it is well established that this exemption applies solely to the privacy rights of individuals and affords no protection to business entities or other organizations. Some commentators have suggested providing the business community with a parallel privacy exemption. The Congress may want to consider such a proposal when considering additional necessary FOIA exemptions after the repeal of subsection (b)(3), particularly in light of the effect such an exemption might have on discouraging the use of the Act to serve private, commercial purposes. An alternative exemption, and one this Commission would prefer, would be narrowly defined and limited to identifiable statistical data. Such an exemption would apply to "information collected or maintained solely for statistical purposes, but only to the extent that the disclosure of such information would reveal the identity of any person reporting such data."

As the need for additional FOIA exemptions can be determined only after reviewing and studying the entire compendium of confidentiality laws, the Commission believes it would be premature to recommend any specific new exemptions at this time. Nevertheless, we urge that consideration be given, at the appropriate time, to the need for protecting from public disclosure the identity of sources of data used solely for statistical or research purposes.

Recommendation No. 6

As a preliminary step toward the enactment of a Fair Information Practices Act, Congress, through its appropriate committees, should undertake a comprehensive review of the confidentiality laws now encompassed within subsection (b)(3) of the Freedom

7 See discussion in Section IV, n. 45 and accompanying text, supra.

158

of Information Act with a view toward repealing 5 U.S.C. §552 (b)(3) and, if necessary, enacting additional exemptions defining the specific categories of information which may be withheld from public disclosure.

Amendment to Subsection (d). The 1974 amendments to the FOIA included a requirement that agencies report annually to the Congress on their compliance with the Act's (a)(3) provisions—that is, agency responses to specific requests for disclosure of information. No similar reporting has been required on agency compliance with subsections (a)(1) and (a)(2), which call for self-initiated disclosure through publication or other means. Yet, as pointed out in Section III of this report, it is with these latter provisions, and particularly with the (a) (2) requirements, that agency compliance has been particularly poor.

The Commission believes, therefore, that the reporting requirements of the FOIA, contained in subsection (d), should be amended to include annual reporting by Federal agencies of the steps they have taken to comply with subsection (a)(2) of the Act. In addition to providing congressional oversight, such an amendment might also act as a stimulus to agency compliance.

Criminal Law Enforcement Data

As mentioned earlier, time and staff limitations precluded the Commission from conducting a thorough study of the many complex issues involved in the collection, maintenance, use, and dissemination of criminal law enforcement data. Accordingly, the Commission believes it is not equipped to make any substantive recommendations in this area.

Yet even our rather superficial study convinced us that legislative controls are urgently needed. The broad, unsupervised dissemination of these data among all levels of government, the lack of effective confidentiality and security safeguards, the largely unregulated manner in which information is collected, the use of sophisticated computer systems, and the recently recommended reorganization of statistical and research components all raise issues which need to be promptly resolved. For several years, one or more committees of the Congress has been considering legislation in this area. The Commission - in agreement with the PPSC-urges that this matter be given immediate attention.

National Security Data

Although the Commission conducted a comprehensive study of information classified in the interests of national defense and foreign policy, the secret nature of the data under consideration precluded any reliable assessment of the quantity or kinds of information currently classified. Nevertheless, indications of frequent classification abuses came from staff interviews, court cases (arising under exemption (b)(1) of the FOIA), and the most recent report of the Interagency Classification Review Committee. Moreover, the very nature of the classification system with its extensive dissemination of classification authority, its disincentives to avoid overclassification or misclassification, and its self-policing aspects—demonstrates its lack of accountability and its need for improvement. At the

least, the number of agencies and of agency personnel authorized to classify data should be markedly decreased; standards for classification should be defined; penalties for classification abuses should be made as severe as those for unauthorized disclosures; and an independent entity should be established to review and monitor classification and declassification decisions and procedures, with authority to enforce its recommendations.

It is virtually impossible to estimate the impact of the classification system on Federal reporting requirements. Although it is known that the classification of national security data substantially inhibits data sharing among Federal agencies, there is no way to determine how must of that information could be useful to other Federal agencies in satisfying their own information needs. What is known is that citizens can now challenge classification markings pursuant to the recently amended (b)(1) exemption of the FOIA, yet other Federal agencies have no alternative mechanism for doing so.

Undoubtedly, much of the information currently classified "in the interest of national defense or foreign policy" must be kept secret. There are indications, however, that a significant amount of this material could be disclosed without any harm to national interests. Even within the perimeters of that information which is justifiably classified, there may be a considerable amount of information, collected at great cost to the Federal Government and with a substantial burden on the reporting public, which could be made available to and could be useful to other Federal agencies. The Atomic Energy Act specifically provides for limited interagency sharing of classified data. Executive Order 1165Z is silent on this point.

If Congress should consider legislation to replace Executive Order 11652, it should focus on the need to make available to other Federal agencies, with appropriate confidentiality and security safeguards, all but the most highly classified information. Similarly, as citizens can now challenge classification labels in the courts, some provision should be made to enable Federal agencies to question these markings before an impartial, independent entity: Statistical Data

Although individual identity is not a factor in the final results of statistical research, statistical records often contain identifying particulars. Thus, the same needs - or pressures for confidentiality exist with respect to statistical information as with other information submitted to the Federal Government. In fact, agencies engaged solely or primarily in statistical activities such as the Census Bureau · are much more protective of the data they collect than other Federal agencies, claiming that confidentiality guarantees are essential to any successful statistical program.

Information collected for statistical purposes affects every type of reporting unit - individuals, commercial establishments, organizations, governments. The term "statistical", then, does not define the source of the data, as some other categories of information do, but rather the purpose for which the information is collected and the form in which it is maintained, used, and disclosed.

159