FOIA Requests and Regulatory Agencies
The Freedom of Information Act gives the public a statutory right to access records held by federal executive branch agencies, making it one of the primary legal tools for scrutinizing how regulatory agencies operate. This page covers how FOIA functions within the regulatory context, the procedural steps agencies must follow, the types of records most commonly requested from regulators, and the legal boundaries that determine what agencies must disclose versus what they may lawfully withhold.
Definition and scope
The Freedom of Information Act, codified at 5 U.S.C. § 552, was enacted in 1966 and establishes that any person — regardless of citizenship or stated purpose — may request records from federal executive branch agencies. The statute applies to cabinet departments, independent regulatory agencies such as the Federal Trade Commission and the Securities and Exchange Commission, and most other entities within the executive branch. It does not apply to Congress, federal courts, or the Executive Office of the President in its purely advisory functions.
FOIA is foundational to regulatory agency transparency requirements because it creates an enforceable, judicially reviewable right rather than a discretionary disclosure policy. Agencies are legally required to respond within 20 business days of receiving a request (5 U.S.C. § 552(a)(6)(A)(i)), though complex requests routinely extend beyond that window through statutory multi-track processing systems.
The scope of covered records is broad: any document, file, electronic communication, database, or other material created, obtained, or controlled by an agency in the conduct of official business qualifies as an agency record subject to FOIA unless a specific statutory exemption applies. The major federal regulatory agencies each maintain dedicated FOIA offices responsible for processing incoming requests and coordinating with program offices to locate responsive documents.
How it works
A FOIA request is initiated by submitting a written request — in most cases electronically through an agency's FOIA portal — that describes the records sought with reasonable specificity. Agencies are not required to create new records, conduct research, or answer questions; they must only search for and produce existing documents that match the request description.
The standard processing sequence involves five stages:
- Receipt and acknowledgment — The agency logs the request, assigns a tracking number, and places it in a processing queue (simple, complex, or expedited).
- Search — Relevant program offices, record centers, and electronic systems are queried for responsive materials.
- Review — Responsive records are reviewed line by line to identify information covered by one of FOIA's nine statutory exemptions.
- Consultation and referral — If records originated with another agency, the processing office may refer or consult before releasing.
- Production — Non-exempt records are disclosed; withheld portions are identified with specific exemption codes; a Vaughn index may be required in litigation to justify each withholding.
FOIA's nine exemptions, enumerated at 5 U.S.C. § 552(b), cover classified national security information (Exemption 1), internal agency personnel rules (Exemption 2), records protected by other statutes (Exemption 3), trade secrets and confidential commercial information (Exemption 4), inter-agency deliberative process documents (Exemption 5), personal privacy (Exemption 6), law enforcement records (Exemption 7), financial institution supervisory records (Exemption 8), and geological data (Exemption 9). Exemptions 4 and 5 are the ones most frequently invoked by regulatory agencies.
Requesters who believe a response is inadequate may file an administrative appeal within the same agency before pursuing judicial review in federal district court. The process for appealing a regulatory agency decision under FOIA follows a distinct procedural track from enforcement appeals but shares the same basic exhaustion requirement.
Common scenarios
FOIA requests directed at regulatory agencies cluster around several recurring use cases.
Inspection and audit records — Journalists, advocacy organizations, and regulated entities submit requests for inspection reports, audit findings, and compliance examination results. The Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA) receive high volumes of requests for facility inspection records and enforcement case files.
Rulemaking records — Requesters seek the underlying technical studies, internal agency communications, and cost-benefit analyses that informed a final rule. These records can reveal whether regulatory cost-benefit analysis processes were followed and how OIRA and regulatory review shaped the final outcome. Exemption 5's deliberative process privilege is frequently asserted to shield pre-decisional drafts from disclosure.
Enforcement case materials — Parties involved in or affected by regulatory agency enforcement actions request investigative files, warning letters, and correspondence. Exemption 7(A) allows agencies to withhold records when disclosure could reasonably interfere with an ongoing enforcement proceeding.
Lobbying and communications records — Researchers investigating regulatory agency capture and conflicts of interest request calendars, meeting logs, and correspondence between agency officials and regulated industry representatives.
Financial supervisory records — Requests to agencies like the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency for bank examination materials are almost universally withheld under Exemption 8, which the Supreme Court interpreted broadly in Exemption 8 litigation to protect the supervisory relationship.
Decision boundaries
The central legal distinction in FOIA administration is between discretionary disclosure and mandatory withholding. Exemptions are permissive — agencies may withhold covered records but are not always required to. The Department of Justice's Office of Information Policy (DOJ OIP) has issued guidance since 2009 encouraging agencies to apply a "foreseeable harm" standard: withholding is appropriate only when the agency can identify a specific, articulable harm that disclosure would cause, not merely because an exemption technically applies (DOJ OIP Guidance on the Foreseeable Harm Standard).
A second critical boundary separates agency records from personal staff records. Documents created by agency employees for personal use, stored outside agency systems, and never used in agency business are not agency records subject to FOIA — a distinction litigated extensively in cases involving emails on personal accounts.
The contrast between Exemption 4 and Exemption 5 illustrates how different confidentiality interests compete in the regulatory context. Exemption 4 protects confidential commercial or financial information submitted by regulated entities to the agency — think emission data, chemical formulations, or financial filings. Exemption 5 protects the agency's own internal deliberative materials. The Supreme Court's 2019 decision in Food Marketing Institute v. Argus Leader Media (587 U.S. 365) broadened Exemption 4 by removing the requirement that requesters show competitive harm before confidential commercial information can be withheld.
Agencies are also required under 5 U.S.C. § 552(a)(2) to proactively post records that have been requested three or more times — the "reading room" obligation — which increasingly intersects with the regulatory agencies frequently asked questions framework that agencies maintain for public guidance.
For a broader orientation to how federal oversight mechanisms structure agency accountability, the regulatory agencies authority index maps the full landscape of statutory and institutional controls that govern regulatory conduct.