In this Freedom of Information Act (FOIA) case, Stephen Sherman appeals the district court's grant of summary judgment in favor of the United States Department of the Army (Army) with respect to the Army's decision, pursuant to exemption 6 of the FOIA, to redact the social security numbers of service personnel from portions of Sherman's information request. Because we (1) reject Sherman's argument that the Army has the power to waive the privacy interest of service personnel in limiting the disclosure of their social security numbers, and (2) find that fulfillment of Sherman's request, absent the redaction of social security numbers, would constitute a clearly unwarranted intrusion into the privacy interests of Army service personnel, we AFFIRM the judgment of the district court.

When Army officials approve individual or unit decorations, that action is announced through an award order. Such orders may reference an award approved for a single soldier or the awards approved for multiple soldiers. Typically, orders contain a soldier's name, rank and unit, as well as specific information relating the details of the conduct giving rise to the award. The awards also contain an identification number for each soldier listed within. Prior to 1968, personnel named in award orders were identified by Army serial number (ASN). Beginning in 1968 and continuing through the 1990s, the Army identified personnel by social security number (SSN). Thus, award orders issued after 1968 contain the SSNs of Army personnel, as opposed to ASNs.1

The Army recently hired a contractor to compile award orders issued during the Vietnam era in a computerized database: the Awards and Decorations Computer Assisted Retrieval System (ADCARS).2 Paper versions of most award orders, including those issued between 1965 and 1973, are still available to the public through the Army or the National Archives. Yet, the Army now relies on the ADCARS to investigate Vietnam era award inquiries and fulfill related information requests.

In 1997, Stephen Sherman requested computer-tape copies of the ADCARS database containing the roughly 611,000 general orders issued between 1965 and 1973. The Army eventually responded to Sherman's request by offering computer copies of the orders issued from 1964 to 1967 at the cost of reproduction, estimated at $5000. With respect to orders issued from 1968 to 1973, the Army found it necessary to redact all SSNs, pursuant to exemption 6 of the FOIA and the corresponding Army regulation, to avoid a clearly unwarranted invasion of the privacy interests of Army personnel. The Army offered Sherman a redacted version of the database records provided he pay the cost of the redaction, estimated at $350,000 to $1,000,000.3 Sherman complained to the Army that redaction was unnecessary, improper and prohibitively expensive. Additionally, Sherman sought a waiver of the fees associated with reproduction of the unredacted tapes pursuant to the FOIA fee waiver provisions.4

Sherman filed the present action in the district court for the Southern District of Texas seeking an injunctive order requiring the Army to produce the requested documents without redaction. On cross-motions for summary judgment, the district court found that release of personnel SSNs included in the orders would constitute an unwarranted invasion of the personal privacy interests of Army personnel, and thus redaction of the requested documents was proper pursuant to exemption 6. This appeal followed in which Sherman raises two primary issues for review: (1) Did the Army waive its authority to exercise exemption 6 by publicly releasing the SSNs of service personnel to the public in other instances, and (2) Did the district court properly balance the public interest in disclosure of the materials contained in Sherman's FOIA request against the privacy interest of service personnel in limiting the disclosure of their SSNs.

Through the FOIA, Congress created a regime "designed to pierce the veil of administrative secrecy and to open agency action to the light of public scrutiny." United States v. Ray, 502 U.S. 164, 173 (1991). When a citizen requests public information from a government agency through the FOIA, the agency is generally required to make a full disclosure. See id.; 5 U.S.C. 552. However, the FOIA also reflects Congress' awareness that various public or private concerns could outweigh the need for public disclosure of certain information. See Department of Air Force v. Rose, 425 U.S. 352, 360-61 (1976); Avondale Indus., Inc. v. NLRB, 90 F.3d 955, 958 (5th Cir. 1996). In this regard, Congress created nine exemptions through which federal agencies may restrict public disclosure of information that would threaten broader societal concerns. See 5 U.S.C. 552(b). The informational privacy interests of private citizens are among those concerns recognized and addressed by Congress in these exemptions.5

Exemption 6 to the FOIA allows agencies to exempt from disclosure information contained in "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy." Id. at 552 (b)(6).6 Pursuant to exemption 6, an agency may delete personal details within a document, provided the details to be deleted are reasonably severable and the overall privacy interests of the individual clearly outweigh the presumption of public disclosure. Avondale Indus., Inc. v. NLRB, 90 F.3d 955, 958 (5th Cir. 1996). We review a district court's summary judgment with respect to the application of exemption 6 de novo. Id. The agency relying on the exemption to prevent disclosure of information bears the burden of establishing that application of the exemption is appropriate. Id.

The threshold inquiry in exemption 6 cases is whether the information requested includes "files" within the meaning of section 552(b)(6). United States Dept. of State v. Washington Post Co., 456 U.S. 595, 602 (1982). The Supreme Court has interpreted exemption 6 "files" broadly to include any "information which applies to a particular individual." United States Dept. of State v. Washington Post Co., 456 U.S. 595, 602 (1982). If the request includes such personal information, "courts must determine whether release of the information would constitute a clearly unwarranted invasion of that person's privacy." Id. This determination, in turn, depends on a balancing of "'the individual's right of privacy' against the basic policy of opening 'agency action to the light of public scrutiny.'" Ray, 502 U.S. at 175 (quoting Rose, 425 U.S. at 372); United States Dep't of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 776 (1989)

The Supreme Court has narrowly defined the "public interest" relevant to exemption 6 balancing as "the extent to which disclosure would serve the core purpose of the FOIA, which is contribut[ing] significantly to the public understanding of the operations or activities of the government." Dep't of Defense, 510 U.S. at 495 (quotations and emphasis omitted). That interest is not implicated by disclosure of information about private citizens that has accumulated in various government files but reveals little or nothing about an agency's own conduct. Reporters Comm., 109 S. Ct. at 1472-73. Moreover, in considering the public's interest in the disclosure of requested information, the professed intentions of the requestor are irrelevant. Reporters Comm., 109 S. Ct. at 1480 ("[W]hether an invasion of privacy is warranted cannot turn on the purposes for which the request for information is made."). Instead, the court must consider only whether the requested information sheds light on agency action. Id. This benefit should flow directly from disclosure, as "[m]ere speculation about hypothetical public benefits cannot outweigh a demonstrably significant invasion of privacy." Ray, 502 U.S. at 179.

Where the public interest in exemption 6 balancing has been defined narrowly, the privacy interest protected by the exemption is more broad and "encompasses [an] individual's control of information concerning his or her person." Dept. of Defense, 510 U.S. at 500 (quoting Reporters Comm., 489 U.S. at 763). Just as a court should disregard the intentions of the requestor when considering the public interest in a FOIA disclosure, it must also look beyond the requestor's good intentions when considering the scope of personal privacy interests implicated by a FOIA request. Id at 501-02 (considering privacy interest in light of fact "that other parties, such as commercial advertisers and solicitors, must have the same access under FOIA" as the party requesting the information). At the same time, we should again avoid speculation on privacy interests that may or may not be implicated by disclosure of government documents. See Rose, 425 U.S. at 380 n. 19 (requiring "threats to privacy interests more palpable than mere possibilities."). Finally, we note that "the fact that an event is not wholly 'private' does not mean that an individual has no interest in limiting disclosure or dissemination of the information." Reporters Comm., 489 U.S. at 770 (quotations omitted); Halloran, 874 F.2d at 322.

To justify the application of exemption 6 in this case, the Army must demonstrate that release of SSNs would constitute a clearly unwarranted invasion of the privacy interests of Army personnel. While the Army has no objection to publicly disclosing the basic content of the award orders requested by Sherman, it maintains that "social security numbers linked to individuals' names and other identifying information increasingly provide ready access to numerous personal details about an individual, creating a very real danger of identity theft and other significant intrusions on personal privacy." As a consequence, the Army believes that it must exempt personnel SSNs from disclosure and require their redaction.7 Sherman counters that redaction is inappropriate for two reasons: (1) the Army waived its authority to rely on exemption 6 for this purpose when it publicly disclosed personnel SSNs on prior occasions, and (2) the public interest in allowing disclosure of the database outweighs the informational privacy interest that service personnel have in their SSNs.

Sherman does not contest that exemption 6 analysis is generally appropriate since the requested files do contain personal information - SSNs. Rather, Sherman argues initially that the Army's consistent practice of disregarding an individual's privacy right in her SSN effectively waives the Army's authority to rely on exemption 6. Sherman points out that use of SSNs in the Army has been pervasive, and often public. SSNs were included with any reference to an individual. Often, recreational passes or other orders contained the names and SSNs of multiple service members; those orders were then distributed to other service members, as well as airlines, hotels and other public organizations. As late as 1995, the SSNs of officers whose promotion required congressional confirmation were published in the Congressional Register. According to Sherman, the Army has even sold lists of officers, together with their SSNs and birth dates, through the Government Printing Office. Finally, Sherman points out that the very award orders he seeks were typically published in hometown newspapers at the time of their issuance.

Sherman contends that this pervasive public use of SSNs by the Army constitutes a waiver of any privacy interest protected by exemption 6. As support for this position, Sherman relies on two district court cases: Kimberlin v. Dept. of Justice, 921 F.Supp 833 (D.D.C. 1996) and Shell Oil Co. v. I.R.S., 772 F. Supp. 202 (D. Del. 1991). Neither case involves exemption 6 to the FOIA. Indeed, as the district court noted, Shell Oil is wholly inapposite, involving an application of the FOIA's exemption 5,8 which does not implicate informational privacy concerns.9 The court in Kimberlin, however, considered the role of waiver in the more analagous context of exemption 7(C). The Kimberlin court concluded that the Justice Department could not rely on exemption 7(C) to prevent disclosure of sensitive files that had been previously released to the press because the prior disclosure eradicated any privacy interest in the information.10 Id. at 836 (citing Nation Magazine v. United States Customs Service, 71 F.3d 885 (D.C. Cir. 1995). The court feared that, if the Justice Department were allowed to rely on the exemption, it "could selectively disclose non-public information to favored sources and then invoke FOIA exemptions to prevent disclosure to press sources not in their favor." Id. at 835. Similarly, Sherman argues that if we allow the Army to exempt material that it has previously released publicly, we will effectively allow the Army to selectively control disclosure of any documents containing SSNs.

While we share the Kimberlin court's concern regarding selective disclosure with respect to those exemptions that protect the government's interest in non-disclosure of information, we conclude that this concern, and the related waiver analysis, are not implicated when a government agency relies on exemption 6 to prevent disclosure of personal information. The Supreme Court has explained that the privacy interest at stake in FOIA exemption analysis belongs to the individual, not the agency holding the information. Reporter's Comm., 489 U.S. at 763-65. Moreover, as noted, the fact that otherwise private information at one time or in some way may have been placed the public domain does not mean that a person irretrievably loses his or her privacy interest in the information. Id. at 770; Halloran, 874 F.2d at 322. Consistent with these established principles, we hold that only the individual whose informational privacy interests are protected by exemption 6 can effect a waiver of those privacy interests when they are threatened by an FOIA request. For that reason, we do not accept Sherman's argument that the Army has waived its authority to implement exemption 6.11

Our position squares with the reasoning of other circuits that have considered waiver arguments in the FOIA context. Though no circuit court has expressly analyzed waiver in a case involving exemption 6, those circuits that have considered a waiver argument with respect to the analogous exemption 7(C) have reached results similar to ours.12 In contrast, circuit courts that have found that an agency waived its right to an exemption have done so only where the government's own interests in confidentiality, as opposed to the privacy interest of an individual, were at stake.13

That Sherman's waiver argument fails does not end our analysis. We must still determine whether the Army has carried its burden in demonstrating that invasion of the personal privacy interest in preventing disclosure of SSNs would be clearly unwarranted by the public interest in disclosure of those SSNs. We begin the necessary balancing by considering the nature and extent of an individual's privacy interest in his or her SSN.

Both Congress and other circuits have discussed the significant privacy concerns surrounding the dissemination of SSNs. Congress acknowledged those concerns in the Privacy Act of 1974, which barred government agencies from discriminating against individuals that refuse to release their SSNs. Privacy Act of 1974, Pub.L. 93-579, 7, 88 Stat. 1896, 1909 (1974), reprinted in 5 U.S.C. 552a (1996). The Senate Report supporting adoption of the Act described the universal use of SSNs as identifiers as "one of the most serious manifestations of privacy concerns in the Nation." S.Rep. No. 1183, 93d Cong., 2d Sess., reprinted in 1974 U.S. Code Cong. & Admin. News 6916, 6943.

Other circuits, relying in part on these Congressional statements, have concluded that the privacy interest in SSNs is significant, and thus public dissemination of information containing SSNs must be monitored scrupulously. See Crawford, 194 F.3d at 958-59 (recognizing that "indiscriminate public disclosure of SSNs, especially when accompanied by names and addresses" can implicate informational privacy rights); Greidinger v. Davis, 988 F.2d 1344, 1353 (4th Cir. 1993) ("[T]he harm that can be inflicted from the disclosure of a social security number to an unscrupulous individual is alarming and potentially financially ruinous."). Indeed, two of our sister circuits have held that public disclosure of SSNs in files requested under the FOIA constituted a clearly unwarranted invasion of personal privacy under exemption 6. See Norwood v. FAA, 993 F.2d 570, 575 (6th Cir. 1993)(determining that redaction of SSNs from FOIA documents necessary to protect identities of individuals discussed in documents); Int'l Bhd. of Elec. Workers Local Union No. 5 v. HUD, 852 F.2d 87, 89 (3d Cir. 1988)(holding that redaction of social security numbers necessary because requestor failed to demonstrate any public interest in disclosure of the SSNs).

As both our sister circuits and Congress have suggested, an individual's informational privacy interest in his or her SSN is substantial. The privacy concern at issue is not, of course, that an individual will be embarrassed or compromised by the particular SSN that she has been assigned. Rather, the concern is that the simultaneous disclosure of an individual's name and confidential SSN exposes that individual to a heightened risk of identity theft and other forms of fraud. See generally, Flavio L. Komuves, We've Got Your Number: An Overview of Legislation and Decisions to Control the Use of Social Security Numbers As Personal Identifiers, 16 J. Marshall J. Computer & Info. L. 529 (1998). In considering the scope of the informational privacy right, this Court has previously recognized the need to look beyond the specific nature of information which an agency seeks to redact as private, and consider the nexus between the information to be redacted and other details which an individual would not want publicly disclosed. Halloran, 874 F.2d at 321. ("In both the FOIA and other contexts involving privacy concerns, it has long been the rule that our concern is not with . . . identifying information per se, but with the connection between such information and some other detail . . . which the individual would not wish to be publicly disclosed.") In this regard, we are comfortable measuring the scope of the privacy interest in a SSN in terms of the dire consequences of identity theft and other forms of fraud which are associated with SSN disclosure.14 That said, we also believe that "[t]o weigh properly the privacy interest involved, the dire consequences of identity theft must be discounted by the probability of its occurrence." Crawford, 194 F.3d at 959. Thus, the relatively low risk of identity theft may sufficiently diminish the privacy interest in SSNs to warrant their disclosure where a strong public interest in disclosure exists. See id. (holding requirement that individuals filing for bankruptcy submit their social security numbers with bankruptcy application is warranted by government's strong public interest in preventing bankruptcy fraud and facilitating transparent bankruptcy process). Nevertheless, we recognize that individual citizens have a substantial informational privacy right to limit the disclosure of their SSNs, and consequently reduce the risk that they will be affected by various identity fraud crimes.

Against this substantial privacy interest, Sherman fails to articulate clearly a competing public interest in disclosure of the SSNs. Sherman implies that the SSNs, when combined with the names of servicemen, might assist him and other historians to identify individuals fraudulently claiming to have received meritorious service awards during the Vietnam War. While we do not dispute the merit of this activity, the Supreme Court has limited our consideration of "public interest" to those types of information that shed light on the nature of agency action, not those that shed light on fraudulently-claimed military honors. See Reporters Comm., 109 S. Ct. at 1472-73.

More generally, Sherman seems to admit that he has less interest in the SSNs themselves, than the descriptive content of the award orders that the SSNs happen to be mingled within. He maintains that the historical value of the award orders does contribute to public awareness of how the Army conducted the Vietnam War. We agree that Sherman has articulated a public interest that supports disclosure of the content of the award orders. Indeed, as Sherman points out, the Army itself has recognized the historical import of the awards and requires that they be carefully prepared. Yet, the presence of the SSNs among the award orders does not elucidate investigation into the Army's conduct of the Vietnam War or the types of conduct that gave rise to awards for meritorious service. Stated differently, redaction of the SSNs does not meaningfully detract from the public utility of the award orders. See Ray, 502 U.S. at 178-79 (concluding that the public interest in requested documents had been "adequately served" by redacted version of the documents and "that disclosure of the unredacted documents would therefore constitute a clearly unwarranted invasion of [personal] privacy."). Thus, we reiterate our conclusion that Sherman has failed to identify a public interest in the SSNs that would warrant their disclosure.

Generally, Sherman argues in his brief that the cost of redacting the SSNs renders his FOIA request untenable. Perhaps as a consequence, he balances the public interest in disclosure of all information contained in the requested database against the privacy interest of an individual soldier in his SSN. As noted, however, this is not the relevant inquiry for the purpose of determining the propriety of the redaction pursuant to exemption 6. See, e.g., Ray, 502 U.S. at 549 (balancing public interest in disclosure of the redacted information against privacy interest in the redacted information). In this sense, Sherman's approach resembles an argument in favor waiving the redaction fee, not against the redaction. To the extent that Sherman ever made a fee waiver request, however, he has expressly abandoned it in this appeal.

The increasing prevalence of identity fraud, as reflected in various federal statutes, demands that federal agencies take particular care when publicly disclosing documents that contain SSNs. We believe that the Army has acted properly in fulfilling this responsibility. Because we conclude that invasion of the informational privacy interest of individual soldiers in disclosure of their SSNs would clearly be unwarranted in the absence of any public interest in those SSNs, the Army appropriately decided to redact the numbers from the award orders requested by Sherman. Though the Army may previously have been less diligent in preventing unnecessary public disclosure of soldiers' SSNs, such disclosure cannot waive the soldiers' privacy interest in them. For these reasons, we AFFIRM the district court's summary judgment in favor of the Army.