Digital media law update: Courts have long recognized that corporations have rights that are at least akin to individual privacy rights. Recognized corporate privacy rights include trade secrets and the exercise of the attorney-client privilege. However, the scope of corporate privacy rights is not nearly as broad as the scope of individual privacy rights. Many federal and state privacy laws only apply to individuals, not corporations. For example, the Federal Privacy Act only prohibits the government from collecting and disclosing certain types of information about “individuals” — a term defined to only include U.S. citizens and permanent resident aliens. See 5 U.S.C. § 552a(a)(2).

When dealing with a law that provides protection for privacy rights, attorneys and judges are often unsure whether the law applies only to individuals or covers corporations, as well. An opportunity for such line-drawing has recently arisen as to the scope of a “personal privacy” exception to the Freedom of Information Act (FOIA). 5 U.S.C. §552(b)(7).
Under FOIA, a government agency is generally obligated to produce any records in its possession upon a request form any person. 5 U.S.C. § 552(a)(3). However, there are many exceptions to this rule. Among these are, matters that are:

• Exception 4: trade secrets and commercial or financial information obtained from a person and privileged or confidential (5 U.S.C. § 552(b)(4));

• Exception 6: personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy (Id. at § 552(b)(6));

• Exception 7(C): records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information . . . (C) could reasonably be expected to constitute an unwarranted invasion of personal privacy (Id. at § 552(b)(7)(C)).
Prior decisions in the D.C. Circuit, which handles the plurality of FOIA appeals, have held that Exception 4, for “trade secrets,” does apply to business entities, such as corporations. Judicial Watch, Inc. v. U.S. Dept. of Energy, 310 F.Supp.2d 271 (D.D.C. 2004), affm’d in part, 412 F.3d 125 (D.D.C. 2004) (§(b)(4) exemption “serves the interest of the government in operating efficiently and effectively by enabling it to obtain necessary commercial and financial information from private persons and business entities”).

However, Exception 6, for “personal and medical files,” has so far only been applied to individuals. For example, in Multi Ag Media LLC v. Dept. of Agriculture, 515 F.3d 1224 (D.D.C. 2008), the Court stated that “Exemption 6 “has not been extended to protect the privacy interests of businesses or corporations”. Of course, this statement does not necessarily mean that Exception 6 might not also one day be extended to cover corporations as well.
Similar laconic statements have been made about Exception 7(C). However, the restriction of Exception 7(C) to individuals has now been soundly rejected by the 3rd Circuit.
The case is AT&T, Inc. v. FCC, 3rd Cir., No. 08-4024 (Sept. 22, 2009). AT&T had participated in a federal program administered by the FCC called E-Rate. Under this program, AT&T provided telecommunications equipment to elementary and secondary schools and then billed the government for the cost. In August 2004, AT&T discovered that it might have overcharged the government for work for a Connecticut school district. It voluntarily reported the matter and the FCC conducted an investigation. The matter was resolved, like many FCC enforcement actions, with a consent decree.
During the course of the investigation, the FCC ordered AT&T to produced invoices, internal emails and billing information, responses to interrogatories, names of employees involved in the alleged overbilling, and AT&T’s own assessment of the extent to which its employees’ actions violated its internal code of conduct.

In 2005, a trade association of AT&T’s competitors submitted a FOIA request that demanded “all pleadings and correspondence” in the FCC’s AT&T E-rate investigation file. The FCC collected the documents that AT&T had produced. AT&T objected to the disclosure based on Exception 7(C).
The FCC rejected AT&T’s objection on public policy grounds. The FCC argued that a corporation lacks personal privacy under FOIA Exception 7(C). A corporation might have privacy interests in other contexts, such as under Fourth Amendment search and seizure law and under the Federal Rules of Civil Procedure (e.g., for trade secrets). However, those privacy interests had no bearing on Exception 7(C), which was primarily enacted to protect key players in an investigation from the “literal embarrassment and danger” than an individual would suffer, rather than the “more abstract danger” that a corporation might suffer.”
On appeal, the 3rd Circuit disagreed. The 3rd Circuit’s reasoning was based on simple statutory construction grounds: Exception 7(C) shields from disclosure, “records or information compiled for law enforcement purposes” to the extent that the production “could reasonably be expected to constitute an unwarranted invasion of personal privacy.” FOIA does not define “personal privacy.” But it does specifically define “person” to include “an individual, partnership, corporation, association, or public or private organization other than an agency.” 5 U.S.C. § 551(2). The 3rd Circuit reasoned that “[i]t would be very odd indeed for an adjectival form of a defined term not to refer back to that defined term.” Moreover, when Congress wanted to limit a FOIA exception just to individuals, it specifically did so — as in Exception 7(F), which exempts law enforcements records from disclosure to protect the “life and safety of any individual.” Accordingly, the 3rd Circuit found that Exception 7(C) can be applied to business corporations like AT&T.

While the 3rd Circuit did not rule on policy grounds, it noted that there were solid policy grounds for extending the reach of Exception 7(C) to corporations: “Corporations, like human beings, are routinely involved in law enforcement investigations. Corporations, like human beings, face public embarrassment, harassment, and stigma because of their involvement. Reading “personal privacy” to exclude corporations would disserve Exception 7(C)’s purpose of encouraging corporations – like human beings — to cooperate and be forthcoming in investigations.”
While this ruling was a victory for corporate privacy rights, it was a victory only in principle. Because the FCC had rejected AT&T’s request for an exemption on purely statutory grounds, it had never made a factual determination as to whether the records in question would have qualified for Exception 7(C). Accordingly, the 3rd Circuit remanded the case to the FCC for a reconsideration as to whether the requested documents qualified for the exception.
This ruling provides corporations with one more arrow in their quiver that they can use to protect corporation documents from competitors or other who might do them harm.
David johnson is a business lawyer whose practice focuses on litigation and other issues relating to digital media and consumer electronics companies. David can be contacted at (310) 785-5371 or DJohnson@jmbm.com.