Freedom of Information and open records: what becomes public and when

Oversight bodies differ too. In the US, the Department of Justice's Office of Information Policy issues federal FOIA guidance, and disputes go to federal court. In the UK, the Information Commissioner's Office (ICO) enforces both FOI and data protection law and can order agencies to release records.

Tracing a request: the five stages

1. Intake. A request arrives, often by email or an online portal, asking for records "related to" a topic, a date range, or a named official. Under federal FOIA, agencies must respond within 20 business days (extendable by 10 more for "unusual circumstances"), though real-world backlogs routinely stretch this to months. The FOIA.gov portal tracks average processing times by agency; some agencies report multi-year backlogs for complex requests, per the Justice Department's own annual reports.

2. Search. Records officers identify likely custodians: staff whose files, inboxes, and shared drives might contain responsive material. This is where scope matters enormously. A request for "all communications regarding the downtown rezoning project" can sweep in emails, text messages on government-issued phones, Slack or Teams messages, meeting notes, and draft memos, not just final reports. Courts have repeatedly held that format doesn't matter: if it's a government record, capturing agency business, it's usually in scope regardless of the app used to create it.

3. Review for exemptions. Not everything found gets released. US federal FOIA has nine exemptions, the most commonly invoked include:

• Exemption 5: inter-agency deliberative process privilege, protecting draft opinions and internal give-and-take before a final decision (this is why "let's not say that in writing" often doesn't save you, drafts are frequently still disclosable).
• Exemption 4: confidential commercial or financial information (trade secrets submitted by contractors).
• Exemption 6: personal privacy (protects home addresses, medical details, Social Security numbers).
• Exemption 7: law enforcement records that could interfere with proceedings or reveal techniques.

Agencies apply exemptions line by line, not document by document, which is why released files often arrive with black bars over specific sentences rather than being withheld entirely.

4. Redaction and release. Approved portions go out, typically as PDFs. Requesters can appeal a denial administratively, and then in court.

5. Litigation risk. If an agency withholds too much or too slowly, the requester can sue. Nonprofit newsrooms and watchdog groups (MuckRock, the Reporters Committee for Freedom of the Press) routinely litigate FOIA denials, and their track record shapes how conservatively agencies redact going forward.

What this means for how you write

Three practical habits follow directly from this process:

Assume discoverability by default. Any record created on a government email account, government phone, or government-funded contractor system is presumptively subject to request. Personal Gmail used for government business doesn't fully escape this either; courts have held that using a private account to conduct public business doesn't exempt those records if they relate to agency action (this became a high-profile issue in several state and federal cases over the past decade).

Separate analysis from editorializing. Write "traffic study shows X deficiency; recommend requesting revised data" rather than commentary about the study's authors or motives. The deliberative process exemption protects the analytical back-and-forth, not sarcasm or personal attacks, and sarcasm reads very differently printed out of context two years later.

Know your agency's retention schedule. Records retention schedules (governed in the US by the National Archives and Records Administration, NARA, for federal agencies, and by state archives for state/local government) dictate how long you must keep, versus when you may lawfully destroy, records. You cannot delete something specifically to dodge a pending request; that's spoliation and carries legal consequences. But routine, policy-compliant deletion before any request exists is generally lawful.

Where FOIA meets other compliance regimes

FOIA doesn't operate in isolation. A few overlaps matter for cross-functional teams:

• Privacy law tension: A request for personnel files runs into the Privacy Act of 1974 (US), which restricts disclosure of records tied to individuals. Agencies must balance FOIA's presumption of openness against Privacy Act protections, often resolving in favor of redaction.
• Procurement records: Contract proposals submitted to government agencies (a core interest for nonprofit and private-sector vendors) can become subject to FOIA once submitted, particularly cost and pricing data, unless properly marked confidential under Exemption 4 and the Trade Secrets Act.
• State sunshine laws and open meetings acts: Related but distinct: open meetings laws (like the federal Government in the Sunshine Act) govern when officials can meet privately versus in public session, complementing FOIA's document-focused rules.

For international teams, remember that a US-style request has no direct EU equivalent in scope; EU access-to-documents rules apply narrowly to formal institutional documents, while GDPR access requests (a different mechanism entirely, letting individuals see their own personal data) are frequently confused with FOI requests by non-specialists. Know which regime someone is actually invoking before you respond.

🎬 [VIDEO: "How the Freedom of Information Act Works" - https://www.youtube.com/results?search_query=how+freedom+of+information+act+works - a primer on FOIA mechanics, exemptions, and the request-to-release timeline, useful for building a mental model before handling a real request]

Key Takeaways

• FOIA (US federal, 1966, amended 2016) and its state, UK, and EU equivalents create a legal right to request government records, with response deadlines (20 business days federally) that agencies routinely miss in practice.
• Exemptions (deliberative process, personal privacy, commercial confidentiality, law enforcement) are applied line by line, not document by document; expect redactions, not blanket denials, on most releases.
• Draft every work email, memo, and text on government systems as if it could become a public document; separate substantive analysis from personal commentary.
• Retention schedules (NARA-governed federally) set legal deletion timelines; deleting records to dodge a live request is spoliation and carries legal risk, but routine scheduled deletion before any request exists is lawful.
• GDPR and EU access-to-documents rules add a privacy-filtering layer that US FOIA generally lacks; don't assume US disclosure norms transfer directly to European requests.