Freedom of Information and open records: what becomes public and when

# Freedom of Information and open records: what becomes public and when

A city planner emails a colleague: "This developer's traffic study is garbage, but let's not say that in writing." Eighteen months later, a local journalist files a records request, and that email lands in a folder titled "Responsive Documents," printed out, redacted in parts, and posted to the city's website. The planner never imagined that sentence would be read by anyone outside the office. That is the lesson: in the public sector, almost anything you write on a government system can become public record, and you should draft accordingly.

This lesson traces how a Freedom of Information Act (FOIA) request actually moves through an agency, so you understand what gets captured, what gets withheld, and how long the clock runs.

The legal backbone: FOIA and its cousins

FOIA (Freedom of Information Act, US federal law, enacted 1966, most recently amended by the FOIA Improvement Act of 2016) gives any person the right to request records from federal executive branch agencies. No reason required. The requester doesn't need to be a US citizen or explain why they want the documents.

Each US state has its own equivalent, commonly called "open records" or "sunshine" laws (examples: California's Public Records Act, Texas Public Information Act, New York's Freedom of Information Law). Rules on fees, timelines, and exemptions vary by state, so a compliance officer working across jurisdictions cannot assume federal FOIA timelines apply locally.

In the EU, the comparable framework is Regulation (EC) No 1049/2001, governing public access to European Parliament, Council, and Commission documents, alongside member-state laws (for example, the UK's Freedom of Information Act 2000, which survived Brexit as domestic law). The EU adds a second layer: the GDPR (General Data Protection Regulation), which restricts releasing personal data even when a document is otherwise disclosable. A FOIA-style release in Europe often requires redacting names, emails, and identifying details that US disclosure would leave visible.

Oversight bodies differ too. In the US, the Department of Justice's Office of Information Policy issues federal FOIA guidance, and disputes go to federal court. In the UK, the Information Commissioner's Office (ICO) enforces both FOI and data protection law and can order agencies to release records.

Tracing a request: the five stages

1. Intake. A request arrives, often by email or an online portal, asking for records "related to" a topic, a date range, or a named official. Under federal FOIA, agencies must respond within 20 business days (extendable by 10 more for "unusual circumstances"), though real-world backlogs routinely stretch this to months. The FOIA.gov portal tracks average processing times by agency; some agencies report multi-year backlogs for complex requests, per the Justice Department's own annual reports.

2. Search. Records officers identify likely custodians: staff whose files, inboxes, and shared drives might contain responsive material. This is where scope matters enormously. A request for "all communications regarding the downtown rezoning project" can sweep in emails, text messages on government-issued phones, Slack or Teams messages, meeting notes, and draft memos, not just final reports. Courts have repeatedly held that format doesn't matter: if it's a government record, capturing agency business, it's usually in scope regardless of the app used to create it.

3. Review for exemptions. Not everything found gets released. US federal FOIA has nine exemptions, the most commonly invoked include:

• Exemption 5: inter-agency deliberative process privilege, protecting draft opinions and internal give-and-take before a final decision (this is why "let's not say that in writing" often doesn't save you, drafts are frequently still disclosable).
• Exemption 4: confidential commercial or financial information (trade secrets submitted by contractors).
• Exemption 6: personal privacy (protects home addresses, medical details, Social Security numbers).
• Exemption 7: law enforcement records that could interfere with proceedings or reveal techniques.

Agencies apply exemptions line by line, not document by document, which is why released files often arrive with black bars over specific sentences rather than being withheld entirely.

4. Redaction and release. Approved portions go out, typically as PDFs. Requesters can appeal a denial administratively, and then in court.

5. Litigation risk. If an agency withholds too much or too slowly, the requester can sue. Nonprofit newsrooms and watchdog groups (MuckRock, the Reporters Committee for Freedom of the Press) routinely litigate FOIA denials, and their track record shapes how conservatively agencies redact going forward.

What this means for how you write

Three practical habits follow directly from this process:

Assume discoverability by default. Any record created on a government email account, government phone, or government-funded contractor system is presumptively subject to request. Personal Gmail used for government business doesn't fully escape this either; courts have held that using a private account to conduct public business doesn't exempt those records if they relate to agency action (this became a high-profile issue in several state and federal cases over the past decade).

Separate analysis from editorializing. Write "traffic study shows X deficiency; recommend requesting revised data" rather than commentary about the study's authors or motives. The deliberative process exemption protects the analytical back-and-forth, not sarcasm or personal attacks, and sarcasm reads very differently printed out of context two years later.

Know your agency's retention schedule. Records retention schedules (governed in the US by the National Archives and Records Administration, NARA, for federal agencies, and by state archives for state/local government) dictate how long you must keep, versus when you may lawfully destroy, records. You cannot delete something specifically to dodge a pending request; that's spoliation and carries legal consequences. But routine, policy-compliant deletion before any request exists is generally lawful.

Where FOIA meets other compliance regimes

FOIA doesn't operate in isolation. A few overlaps matter for cross-functional teams:

• Privacy law tension: A request for personnel files runs into the Privacy Act of 1974 (US), which restricts disclosure of records tied to individuals. Agencies must balance FOIA's presumption of openness against Privacy Act protections, often resolving in favor of redaction.
• Procurement records: Contract proposals submitted to government agencies (a core interest for nonprofit and private-sector vendors) can become subject to FOIA once submitted, particularly cost and pricing data, unless properly marked confidential under Exemption 4 and the Trade Secrets Act.
• State sunshine laws and open meetings acts: Related but distinct: open meetings laws (like the federal Government in the Sunshine Act) govern when officials can meet privately versus in public session, complementing FOIA's document-focused rules.

For international teams, remember that a US-style request has no direct EU equivalent in scope; EU access-to-documents rules apply narrowly to formal institutional documents, while GDPR access requests (a different mechanism entirely, letting individuals see their own personal data) are frequently confused with FOI requests by non-specialists. Know which regime someone is actually invoking before you respond.

🎬 [VIDEO: "How the Freedom of Information Act Works" - https://www.youtube.com/results?search_query=how+freedom+of+information+act+works - a primer on FOIA mechanics, exemptions, and the request-to-release timeline, useful for building a mental model before handling a real request]

Key Takeaways

• FOIA (US federal, 1966, amended 2016) and its state, UK, and EU equivalents create a legal right to request government records, with response deadlines (20 business days federally) that agencies routinely miss in practice.
• Exemptions (deliberative process, personal privacy, commercial confidentiality, law enforcement) are applied line by line, not document by document; expect redactions, not blanket denials, on most releases.