The D.C. Circuit recently held public employees’ browsing history is not an “agency record” subject to the Freedom of Information Act (“FOIA”). (Cause of Action Institute v. Office of Management and Budget (D.C. Cir. Aug. 20, 2021, No. 20-5006) ___ F.4th ____ [2021 WL 3699794] (Cause of Action Institute).) Cause of Action Institute sued the Office of Management and Budget (“OMB”) and the Department of Agriculture (“USDA”) to obtain browser histories of the OMB Director, the OMB’s Associate Director of Strategic Planning and Communications, the Secretary of Agriculture, and the USDA Director of Communications.
Under FOIA, an “agency record” is a document the agency both (1) creates or obtains and (2) controls at the time the FOIA request was made. (Cause of Action Institute, supra, 2021 WL 3699794 at p. *3.) In Cause of Action Institute, the parties did not “dispute the agencies created the browsing histories,” so the court treated the first element as conceded. (Cause of Action Institute, supra, 2021 WL 3699794 at p. *3, fn. 2.) However, the court stated “It is far from clear … that the agencies created the browsing histories within the meaning of FOIA. Agency employees in some sense create a history through their internet browsing, but the browser automatically generates the history.” (Ibid.) This suggests not all records created by automated processes are public records – there must be some intent to create a record for it to fall under FOIA
Whether browser histories are agency records depends on the “totality of the circumstances,” control being one consideration. “Factors that determine whether an agency controls a document may include: ‘(1) the intent of the document’s creator to retain or relinquish control over the records; (2) the ability of the agency to use and dispose of the record as it sees fit; (3) the extent to which agency personnel have read or relied upon the document; and (4) the degree to which the document was integrated into the agency’s record system or files.’ ” (Cause of Action Institute, supra, 2021 WL 3699794 at p. *3.) “Mere authority to control … is not enough. The relevant consideration is how much control the agencies actually asserted over the documents at issue.” (Id. at p. *4.) California applies the same rule to public records requests. (Anderson-Barker v. Superior Court (2019) 31 Cal.App.5th 528, 540 [contractual right to access data “data does not equate to a form of possession or control”].)
The Court held browser histories are not agency records. The agencies did not express intent to retain control over employees’ browser histories. (Cause of Action Institute, supra, 2021 WL 3699794 at p. *4.) Although both OMB and USDA extended the retention period for Internet Explorer, they left other browsers’ default settings in place and allowed employees to manage their browser histories on work and personal devices. (Ibid.) The agencies did not attempt to preserve the browser histories when performing updates or include them in their records retention system. (Id. at pp. *4, *6. [“agencies lacked the requisite intent to retain and to control the browsing histories”].) The Court also found the agencies restricted access to employees’ browser history and did not actually use browser history data. (Id. at p. *5 [“Actual use is often ‘ “the decisive factor” ’ when determining whether a requested document is an agency record”].)
This case is helpful to public agencies because it brushes back the argument that data created automatically is a public record. It shows the agency must actually exercise some control over the data or rely on it in making a decision. The mere existence of an automatically generated record is not enough to bring it within FOIA.