Justice Roberts: "This Isn't Personal, and Neither Are Your Corporate Records"

In a unanimous decision on March 1, 2011, the Supreme Court held in Federal Communications Commission v. AT&T Inc. that corporations do not have personal privacy rights under the Freedom of Information Act (FOIA), reversing a 2009 Third Circuit decision (which we blogged about here).

The case arose because AT&T sought to block the disclosure of documents under the FOIA that it disclosed to the Federal Communications Commission (FCC) during a 2004 investigation relating to AT&T’s alleged overbilling of public schools under a program created to enhance telecommunications and information services access for public schools and libraries.  Comptel, a trade association that represented some of AT&T’s competitors, submitted an FOIA request to access these documents.  The FCC complied with the request, but removed information that was considered “trade secrets and commercial or financial information” (5 U.S.C. § 552(b)(4)) and information that “could be expected to constitute an unwarranted invasion of personal privacy.” (5 U.S.C. § 552(b)(7)(C), “Exemption 7(C)”).  However, the FCC did not remove information that was sensitive to AT&T.  

AT&T argued that no information should be disclosed under FOIA because the word personal as used under Exemption 7(C) applies to corporations.  AT&T argued that the definition of the word person includes legal entities, and therefore the definition of personal privacy should as well.  The Court rejected this proposition, deferring to the ordinary meaning of the word personal and holding that the word referred only to individuals.  The Court also indicated that when used together, the words personal privacy “suggests a type of privacy evocative of human concerns- not the sort associated with an entity like, say, AT&T.”  To lend further support to its decision, the Court also studied the rest of the statute and concluded that the existence of other exemptions available to entities under FOIA limited the scope of Exemption 7(C).     

Fittingly, Justice Roberts, who penned the opinion, closed with his hope that AT&T would not take the decision personally.

Since when does a legal entity have "privacy" rights?

Since the Third Circuit said so, in its September 22, 2009 decision in AT&T v. Federal Communications Commission (No. 084024).

Most privacy practitioners would not consider a legal entity to have privacy rights. Rather, a legal entity may have trade secrets or contractual confidentiality protections. However, in its novel holding, the Third Circuit found that a corporation (AT&T) was protected by an exemption in the Freedom of Information Act (FOIA) that applies to “unwarranted invasions of personal privacy.” Specifically, FOIA exempts “records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information … could reasonably be expected to constitute an unwarranted invasion of personal privacy…”(emphasis added). This exemption, combined with FOIA’s definition of “person” to include legal entities, enabled AT&T to successfully argue that a corporation has a right to privacy. (After all, the court said, “it would be very odd indeed for an adjectival form of a defined term not to refer back to that defined term.”) As a result, AT&T’s competitors have not been able to obtain information about an FCC investigation of AT&T regarding AT&T’s alleged overcharging of some of its customers.

Whether this ruling will be followed in other FOIA cases, or used to expand the concept of privacy rights under other statutes, remains to be seen. For now, when submitting information to regulators in connection with investigations, companies should consider submitting such information as confidential, since doing so could help the company to later challenge attempts by competitors or other third parties to obtain such information from the regulator under FOIA.