Third Party Access to Public Records and FOIA
Third-party access to government-held information is governed by a layered framework of federal statutes, agency regulations, and court-interpreted exemptions that determine what records are releasable, to whom, and under what conditions. The Freedom of Information Act (5 U.S.C. § 552) is the primary federal mechanism through which any person — not limited to citizens or direct parties — can obtain records from executive branch agencies. Understanding how third parties fit into this framework matters because requesters frequently seek records about other individuals or entities, triggering privacy statutes that directly constrain disclosure.
Definition and scope
A "third party" in the public records context is any person or organization seeking government records about someone other than themselves. This stands in contrast to first-party requests, where an individual seeks records about their own file — typically governed by the Privacy Act of 1974 (5 U.S.C. § 552a) — and second-party requests, where the subject agency itself accesses records internally.
FOIA grants any person the right to request existing agency records (5 U.S.C. § 552(a)(3)(A)). The statute does not require requesters to explain their purpose, demonstrate need, or establish a legal interest in the subject matter. This broad standing is what makes third-party access structurally different from most civil discovery processes, where standing to compel production is tied to litigation interest.
The scope of "public records" extends beyond FOIA at the federal level. State sunshine laws — all 50 states have enacted public records statutes — follow varying standards, with some states like Florida operating under a presumption of openness codified in Art. I, § 24 of the Florida Constitution, while others impose narrower default disclosure rules. For the full landscape of how third-party relationships intersect across civic and governmental contexts, the key dimensions and scopes of third party reference covers cross-domain variation.
How it works
A third-party FOIA request follows a structured administrative process:
- Identify the agency: Only federal executive branch agencies are subject to FOIA. Congress, the federal judiciary, and the President's immediate staff are excluded (5 U.S.C. § 552(f)).
- Submit a written request: The request must reasonably describe the records sought. Agencies are required to assign a tracking number to requests that will take more than 10 working days to process (5 U.S.C. § 552(a)(7)(A)).
- Agency review and exemption analysis: The agency determines whether any of FOIA's 9 statutory exemptions apply and whether segregable non-exempt portions can be released.
- Response deadline: Agencies must respond within 20 business days of receipt, though backlogs frequently extend this window in practice (5 U.S.C. § 552(a)(6)(A)(i)).
- Administrative appeal: If records are withheld or a request is denied, the requester may file an administrative appeal before seeking judicial review in federal district court.
For third-party requests specifically, the most consequential step is exemption analysis. Exemption 6 withholds personnel and medical files whose disclosure would constitute a "clearly unwarranted invasion of personal privacy." Exemption 7(C) applies a parallel privacy protection to law enforcement records. Courts apply a balancing test between the public interest in disclosure and the subject's privacy interest, as interpreted in DOJ v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (1989).
Common scenarios
Third-party FOIA and public records requests arise across a defined set of recurring contexts:
- Journalists and researchers seeking agency correspondence, inspection reports, or enforcement actions involving named companies or officials. This is the most litigated category, with news organizations filing suits to obtain records withheld under deliberative process exemptions.
- Businesses conducting due diligence on contractors or counterparties by requesting procurement records, debarment lists, or federal audit findings from the Government Accountability Office or agency inspector general offices.
- Attorneys and legal advocates requesting agency files related to a client's case, particularly immigration records, federal benefits determinations, or regulatory enforcement records. Third-party legal standing in U.S. law addresses when parties can act on behalf of another in these administrative proceedings.
- Advocacy organizations requesting aggregate data on agency performance, grant awards, or regulatory compliance rates. These requests frequently implicate Exemption 5, the deliberative process privilege, when pre-decisional agency communications are involved.
- Private individuals requesting records about family members, particularly deceased relatives, where the Privacy Act's protections diminish after death but agencies still apply Exemption 6 balancing.
For requests touching federal program data, including benefits administration and interagency data sharing, third-party data sharing in government covers the statutory frameworks that govern how agencies transfer records to outside parties. The hub at thirdpartyauthority.com provides orientation across all civic and governmental third-party topics.
Decision boundaries
Agencies apply distinct rules depending on whether the request is first-party or third-party, and whether the subject has consented to disclosure.
| Scenario | Governing Statute | Default Position |
|---|---|---|
| First-party request for own records | Privacy Act, 5 U.S.C. § 552a | Disclosure presumed; withholding requires specific exemption |
| Third-party request, no subject consent | FOIA, 5 U.S.C. § 552 | Disclosure subject to 9 exemptions; privacy balancing required |
| Third-party request with subject's written consent | Privacy Act § 552a(b)(1) | Agency may release records consistent with consent scope |
| Third-party request for law enforcement records | FOIA Exemption 7(C) | Higher privacy threshold; strong presumption against disclosure of identifying details |
A key boundary is whether the requested records pertain to a private individual versus a government official acting in their official capacity. Courts have consistently held that officials' exercise of public authority carries reduced privacy protection. In Favish v. DOI (541 U.S. 157, 2004), the Supreme Court held that family members of deceased federal figures retain cognizable privacy interests in personal records even when the subject was a public official, requiring requesters to demonstrate more than a bare public interest.
Three additional decision boundaries govern practical outcomes:
- Specificity: Requests that cannot reasonably describe the records sought may be returned as insufficient without triggering the 20-day response clock.
- Fee waivers: News media, educational institutions, and noncommercial scientific requesters qualify for fee waivers under 5 U.S.C. § 552(a)(4)(A)(ii); commercial requesters pay search, duplication, and review fees.
- Proactive disclosure: Agencies must post frequently requested records online under 5 U.S.C. § 552(a)(2), reducing the need for formal third-party requests in high-demand categories.
Third-party privacy rights under federal law extends this analysis to situations where privacy statutes independently restrict what agencies may disclose regardless of FOIA's disclosure mandates.