Jorge Alejandro Rojas v. Federal Aviation Administration

Plaintiff Jorge Rojas filed several requests under the

Freedom of Information Act, 5 U.S.C. § 552 (FOIA), and the

Privacy Act of 1974, 5 U.S.C. § 552a, with the Federal

Aviation Administration (FAA), seeking records related to

the Biographical Assessment, a screening tool introduced by

the FAA in 2014 as part of the air traffic controller hiring

process. In response to Rojas’s requests, the FAA produced

hundreds of pages of records, but withheld scoring

information for the Biographical Assessment; the personal,

non-FAA email addresses of FAA employees; and hundreds

of emails that it concluded fell within exemptions to FOIA

and the Privacy Act, or were not agency records. The district

court held that the FAA properly withheld information and

documents. For the reasons that follow, we affirm in part,

reverse in part, and vacate and remand in part.

I

Although FOIA and the Privacy Act are different in

design and scope, they both contemplate that members of the

public will have access to public records, subject to specified

exemptions.

FOIA was enacted in 1966 to facilitate public access to

“any and all records not exempt from disclosure.” Exner v.

Fed. Bureau of Investigation, 612 F.2d 1202, 1203 (9th Cir.

1980); see also Forest Serv. Emps. for Envtl. Ethics v. U.S.

Forest Serv., 524 F.3d 1021, 1023 (9th Cir. 2008). Under

FOIA, “each agency, upon any request for records which (i)

reasonably describes such records and (ii) is made in

6 ROJAS V. FAA

accordance with published rules stating the time, place, fees

(if any), and procedures to be followed, shall make the

records promptly available to any person.” 5 U.S.C.

§ 552(a)(3)(A). A district court “has jurisdiction to enjoin the

agency from withholding agency records and to order the

production of any agency records improperly withheld.” Id.

§ 552(a)(4)(B). Therefore, when an agency withholds

documents, a threshold inquiry is whether they constitute

“agency records.” U.S. Dep’t of Justice v. Tax Analysts,

492 U.S. 136, 142 (1989) (quoting Kissinger v. Reporters

Comm. for Freedom of Press, 445 U.S. 136, 150 (1980)).

“The burden is on the agency to demonstrate, not the

requester to disprove, that the materials sought are not

‘agency records’ or have not been ‘improperly’ ‘withheld.’”

Id. at 142 n.3.

While FOIA “establishes a judicially enforceable public

right” to secure access to government records, it also

“contemplates that some information may legitimately be

kept from the public.” Elec. Frontier Found. v. Office of the

Dir. of Nat’l Intelligence, 639 F.3d 876, 882–83 (9th Cir.

2010) (internal quotation marks omitted), abrogated on other

grounds by Animal Legal Def. Fund v. U.S. Food & Drug

Admin., 836 F.3d 987, 989 (9th Cir. 2016) (en banc) (per

curiam) (“ALDF”). The statute contains nine exemptions,

pursuant to which federal agencies can withhold information

otherwise subject to FOIA’s disclosure requirement. Id. at

883; 5 U.S.C. § 552(b)(1)–(9). Exemption 2 provides that the

disclosure requirement “does not apply to matters that are . . .

related solely to the internal personnel rules and practices of

an agency.” Id. § 552(b)(2). Exemption 6 provides that

FOIA does not apply to “personnel and medical files and

similar files the disclosure of which would constitute a clearly

unwarranted invasion of personal privacy.” Id. § 552(b)(6).

ROJAS V. FAA 7

Because of FOIA’s “strong presumption in favor of

disclosure,” U.S. Dep’t of State v. Ray, 502 U.S. 164, 173

(1991), these exemptions must be “given a narrow compass.”

Tax Analysts, 492 U.S. at 151. “[A]n agency that invokes one

of the statutory exemptions to justify the withholding of any

requested documents or portions of documents bears the

burden of demonstrating that the exemption properly applies

to the documents.” Lahr v. Nat’l Transp. Safety Bd.,

569 F.3d 964, 973 (9th Cir. 2009).

Though “the Privacy Act and FOIA substantially overlap

. . . the two statutes are not completely coextensive.”

Greentree v. U.S. Customs Serv., 674 F.2d 74, 78 (D.C. Cir.

1982). While “FOIA was intended to increase the public’s

access to governmental information and was drafted with a

strong presumption for disclosure to allow public scrutiny of

government processes,” Pierce v. Dep’t of U.S. Air Force,

512 F.3d 184, 191 (5th Cir. 2007), the Privacy Act’s primary

goal is to “protect the privacy of individuals through

regulation of the collection, maintenance, use, and

dissemination of information by federal agencies,” Rouse v.

U.S. Dep’t of State, 567 F.3d 408, 413 (9th Cir. 2009)

(internal quotation marks omitted); see also 5 U.S.C. § 552a.

The Privacy Act accordingly “provides agencies with

‘detailed instructions for managing their records.’” Rouse,

567 F.3d at 413 (quoting Doe v. Chao, 540 U.S. 614, 618

(2004)). Nevertheless, as part of the effort to give individuals

more control over information about themselves, the Privacy

Act gives individuals a right to gain access to government

8 ROJAS V. FAA

records concerning themselves “upon request.” 5 U.S.C.

§ 552a(d)(1).1

As with the public access right granted by FOIA, the

Privacy Act’s private access right is subject to numerous

exemptions. One of these exemptions provides that an

agency may refrain from disclosing records comprised of

“testing or examination material used solely to determine

individual qualifications for appointment or promotion in the

Federal service the disclosure of which would compromise

the objectivity or fairness of the testing or examination

process.” Id. § 552a(k)(6) (“Exemption (k)(6)”).2 As with

1 5 U.S.C. § 552a(d)(1) provides:

Each agency that maintains a system of records shall—

(1) upon request by any individual to gain access to his

record or to any information pertaining to him which is

contained in the system, permit him and upon his

request, a person of his own choosing to accompany

him, to review the record and have a copy made of all

or any portion thereof in a form comprehensible to him,

except that the agency may require the individual to

furnish a written statement authorizing discussion of

that individual’s record in the accompanying person’s

presence.

2 5 U.S.C. § 552a(k)(6) provides:

(k) Specific exemptions.–The head of any agency may

promulgate rules, in accordance with the requirements

[of specified sections], to exempt any system of records

within the agency from [specified requirements,

including the disclosure requirement] if the system of

records is

. . .

ROJAS V. FAA 9

FOIA, if an agency seeks to invoke an exemption under the

Privacy Act, “the burden is on the agency” to show that

withholding the document was justified. Id. § 552a(g)(3)(A).

II

We now turn to the facts giving rise to this appeal.

A

The FAA is responsible for regulating civil aviation,

including air traffic management, throughout the United

States. It retains more than 14,000 air traffic control

specialists who work around the clock, communicating with

pilots, monitoring the flow of airplanes, and maintaining safe

airways for 2.7 million passengers who fly each day. See

Fed. Aviation Admin., Aviation Careers (last modified

July 31, 2019), https://www.faa.gov/jobs/career_fields/

aviation_careers. Because an air traffic controller’s work

contains no margin for error and requires unbroken

concentration, the job can be grueling. Working as an air

traffic controller is considered to be among the highest

pressure jobs in America. For this reason, the FAA puts new

air traffic controllers through an intense training regimen and

requires that air traffic controllers retire by age 56.

Before changing its hiring system in 2014, the FAA gave

hiring preference to air traffic controller applicants who

(6) testing or examination material used solely to

determine individual qualifications for appointment or

promotion in the Federal service the disclosure of

which would compromise the objectivity or fairness of

the testing or examination process.

10 ROJAS V. FAA

earned aviation degrees from FAA-accredited schools (called

Collegiate Training Initiative, or CTI, schools) and who

scored highly on the Air Traffic Selection and Training

examination (AT-SAT test), a proctored, eight-hour

examination that tested cognitive skills related to working as

an air traffic controller. In 2013, there were about 3,000

college graduates with FAA accredited degrees. These

individuals were placed on the FAA’s Qualified Applicant

Register and were therefore eligible to apply for air traffic

controller job openings.

Around this time, the FAA projected that there would be

a surge in retirement of the air traffic controllers who had

been hired in 1981 in the wake of the Professional Air Traffic

Controllers Association strike. See James L. Outtz & Paul J.

Hanges, FAA, Barrier Analysis of the Air Traffic Control

Specialists Centralized Hiring Process 14 (2013). Some

11,000 air traffic controllers were expected to leave the

agency by 2014, and the FAA developed a plan to hire some

12,500 controllers during the period from 2013 to 2023. Id.

In connection with this planned hiring surge, the FAA

commissioned a report, the “Barrier Analysis of the Air

Traffic Control Specialists (ATCS) Centralized Hiring

Process” (“Barrier Analysis”), to determine whether its

workplace was “free of barriers that impede full opportunities

to all persons in the workplace.” Id. After reviewing the

FAA’s current hiring practices and levels of diversity in its

workforce, the Barrier Analysis recommended that the FAA

place less weight on the AT-SAT as a qualifying metric

because parts of the test showed “substantial problems with

regard to [race and national origin] and gender diversity.” Id.

at 20, 23–24.

ROJAS V. FAA 11

Based on the results of the Barrier Analysis, the FAA

announced “an historic commitment to transform the Federal

Aviation Administration (FAA) into a more diverse and

inclusive workplace that reflects, understands, and relates to

the diverse customers we serve.” Id. at 1. Consequently, in

2014, the FAA significantly changed its hiring system in

order to recruit more diverse candidates. The FAA

eliminated the approximately 3,000 existing applicants from

its Qualified Applicant Register. Going forward, the FAA

would not consider applicants’ “well-qualified” designations

on the AT-SAT or their CTI qualifications, which had

previously given applicants a hiring preference. Instead, as

part of the initial screening of applicants, the FAA stated it

would deem candidates to be qualified if they had a high

school diploma, spoke English, and passed the FAA’s new

test, called the Biographical Assessment.

The Biographical Assessment is a 62-question multiple

choice test designed to assess candidates based on their

aviation aptitude and likelihood of completing air traffic

controller training. According to press reports, the

Biographical Assessment includes multiple choice questions

about such topics as: “[t]he number of different high school

sports” a candidate played, or the age at which the candidate

first started to earn money. Other questions included: “How

would you describe your ideal job? What has been the major

cause of your failures? More classmates would remember me

as humble or dominant?” Unlike the AT-SAT testing

process, applicants took the Biographical Assessment on their

personal computers, without proctoring. Passage rates for the

Biographical Assessment were low; of 28,000 applicants who

took the Biographical Assessment in 2015, fewer than 10%

passed. The scoring information for this test was

confidential; the FAA did not release the minimum passing

12 ROJAS V. FAA

score for the Biographical Assessment, and individual

applicants were told only if they had passed or failed and

were not informed of their individual scores. The FAA

required that an applicant pass the Biographical Assessment

to take the AT-SAT.

The FAA’s new hiring system generated significant press

attention. Several newspapers discussed the FAA’s “mov[e]

away from merit-based hiring criteria in order to increase the

number of women and minorities who staff airport control

towers.” Jason L. Riley, Opinion, Affirmative Action Lands

in the Air Traffic Control Tower, Wall St. J. (June 2, 2015).

Flying Magazine reported that the FAA’s new hiring system

resulted in the rejection of “top ranked students from highly

respected [air traffic controller] programs . . . . based on the

bio-data assessment results.” Pia Bergovist, Is the FAA

Rejecting the Best Controllers?, Flying Magazine (Dec. 2,

2014).

In addition, one news network reported (after a six-month

investigation) that an FAA employee who was a member of

the National Black Coalition of Federal Aviation Employees

(NBCFAE) was leaking Biographical Assessment answers to

student members of the NBCFAE. Trouble in the Skies, Fox

Business News (May 20, 2015). According to the “Trouble

in the Skies” report, a few days after the FAA hiring process

started, a candidate for an air traffic controller job received a

recorded voice-text message from Shelton Snow, an FAA air

traffic controller and then-president of the NBCFAE’s

Washington Suburban Chapter. In the recorded message,

Snow stated he was aware that candidates “have been getting

rejection notices” due to failing the Biographical Assessment

test. To prevent NBCFAE applicants from failing the

Biographical Assessment, Snow offered “some valuable

ROJAS V. FAA 13

pieces of information that [he had] taken a screen shot of and

[that he was] going to send that to you via email.” The screen

shots were intended to show the correct answers to the

Biographical Assessment; Snow explained he was sharing

these screen shots so that as candidates “progress through the

stages [of the test],” the candidates could “refer to those

images so you will know which icons you should select.”

Snow stated he was “about 99 point 99 percent sure that it is

exactly how you need to answer each question in order to get

through the first phase.” In addition, the recorded message

stated that FAA “HR Representatives” could “sign off on [the

Biographical Assessment] before you actually click it.”

The FAA’s changes to its hiring system also captured the

attention of legislators and public officials. In June 2014, ten

members of Congress sent a letter to the FAA expressing

concerns and asking for information, including “metrics on

how the new hiring process has enhanced aviation safety

overall.” After “Trouble in the Skies” was published,

fourteen members of Congress sent a follow-up letter asking

the FAA to investigate “the report of possible cheating in the

latest hiring process, facilitated by the actions of an FAA

employee.” Finally, a member of the U.S. Commission on

Civil Rights expressed concerns that the FAA’s new hiring

procedures discriminated on the basis of race against

applicants in the prior pool.

B

Jorge Rojas was enrolled at an accredited CTI school

when the FAA changed its hiring system. Pursuant to the

FAA’s new screening process, Rojas took the Biographical

Assessment, and was one of the many applicants who failed

the test. This made him ineligible to apply for an air traffic

14 ROJAS V. FAA

controller position. Suspecting that the FAA was engaging in

discriminatory practices and that agency employee Shelton

Snow was engaged in misconduct, Rojas sought to shed light

on the FAA’s conduct by obtaining more information about

the FAA’s change in hiring practices, its use of the

Biographical Assessment, and the cheating that had

reportedly taken place during the testing process.

On June 25, 2015, Rojas submitted a FOIA request to the

FAA (FOIA Request No. 9300), seeking all emails and chats

sent to and from Shelton Snow for the periods from

December 1, 2013, to March 30, 2014, and from January 1,

2015, to June 24, 2015. A few days later, Rojas submitted a

second FOIA request (FOIA Request No. 9333) and a Privacy

Act request, in which he requested the minimum passing

score for the Biographical Assessment, his own Biographical

Assessment score, and a copy of applicant information for a

particular air traffic controller opening.

The FAA failed to respond to these requests within the

20 days provided by statute. See 5 U.S.C. § 552(a)(6)(A)(i).

In August 2015, Rojas sued the FAA, alleging that it had

violated FOIA by failing to produce responsive documents.

In October 2015, the FAA provided a response to FOIA

Request No. 9333, stating that it was withholding the

minimum passing score and Rojas’s score on the

Biographical Assessment under FOIA Exemption 2, which

exempts from disclosure materials “related solely to the

internal personnel rules and practices of an agency.” 5 U.S.C.

§ 552(b)(2). The FAA also denied Rojas’s Privacy Act

request for the score Rojas had received on the Biographical

Assessment, citing Exemption (k)(6), which exempts

specified testing and examination material.

ROJAS V. FAA 15

In February 2016, the FAA gave Rojas a number of

documents in response to Request 9300, which had sought

Shelton Snow’s emails and chats. The FAA redacted the

personal email addresses of FAA employees from the

documents provided, citing FOIA Exemption 6, which

exempts from disclosure “personnel and medical files and

similar files the disclosure of which would constitute a clearly

unwarranted invasion of personal privacy.” 5 U.S.C.

§ 552(b)(6). At least two of the redacted documents

produced under seal indicated that FAA employees sent

emails relating to FAA’s changes to its hiring system to other

FAA employees at their personal email addresses. One email

from an FAA employee asked other employees to refer any

calls from the investigative reporter who authored “Trouble

in the Skies” to FAA Public Affairs. This email was

forwarded to other FAA employees, one of whom forwarded

the email to Shelton Snow at his FAA account as well as to

two redacted email accounts. In another email, Snow sent the

Barrier Analysis from his FAA account to two redacted email

addresses.

The FAA also withheld 202 emails and attachments on

the ground that they were not agency records subject to

FOIA. The withheld emails and attachments included emails

sent to or received from Snow in his capacity as a member of

the NBCFAE, emails to Snow from the National Air Traffic

Controllers Association (the exclusive bargaining

representative for air traffic controllers employed by the

FAA), personal emails between Snow and his friends or

acquaintances, and unsolicited advertisements.3 One of the

3 The FAA provided its justification for not disclosing emails in an

index, commonly known as a Vaughn index, see Vaughn v. Rosen,

484 F.2d 820 (D.C. Cir. 1973), to identify “the documents withheld, the

16 ROJAS V. FAA

withheld documents contained an inquiry about whether

study information for the FAA’s new aptitude test was

available online. The FAA stated that each withheld

document was “[n]ot an agency record.”

After providing these documents to Rojas, the FAA

moved for summary judgment on the ground that the

information it redacted was statutorily exempt from

disclosure and the emails and attachments it withheld were

not agency records subject to FOIA. In support of its claim

that disclosing Rojas’s test scores would compromise the

fairness of the Biographical Assessment, the FAA submitted

a sworn declaration from Rickie Cannon, the Deputy

Assistant Administrator for Human Resources at the FAA,

which described the FAA’s discovery of a cheating scheme

by air traffic controller applicants. These applicants had

compiled their answers to specific Biographical Assessment

questions to determine which answers to specific questions

were correlated with passing the Biographical Assessment.

According to Cannon, “[a]n applicant’s knowledge of his or

her test score is critical to this approach,” and therefore

providing test scores to applicants could further a cheating

scheme.4 Rojas opposed the summary judgment motion and

brought a cross-motion for summary judgment arguing that

the FAA’s claimed exemptions failed as a matter of law.

FOIA exemptions claimed, and a particularized explanation of why each

document falls within the claimed exemption.” Yonemoto v. Dep’t of

Veterans Affairs, 686 F.3d 681, 688 (9th Cir. 2012), (internal quotation

marks omitted) (quoting Lion Raisins v. U.S. Dep’t of Agric., 354 F.3d

1072, 1082 (9th Cir. 2004)), overruled on other grounds by ALDF,

836 F.3d at 989.

4 The FAA also submitted the document that the cheating ring created,

which compiled 359 responses from the 2014 Biographical Assessment.

ROJAS V. FAA 17

After an in camera review of the unredacted documents, the

court agreed with the FAA’s invocation of FOIA Exemptions

2 and 6 and Privacy Act Exemption (k)(6), and held that the

withheld documents were “personal emails regarding Snow

that do not respond to Rojas’s FOIA requests or the mission

of the FAA.” Accordingly, the court granted summary

judgment in favor of the FAA. Rojas timely appealed.

III

We review de novo the district court’s order granting

summary judgment. ALDF, 836 F.3d at 990. “[W]e view the

evidence in the light most favorable to the nonmoving party,

determine whether there are any genuine issues of material

fact, and decide whether the district court correctly applied

the relevant substantive law.” Id. at 989. We have

jurisdiction to review the district court’s grant of summary

judgment under 28 U.S.C. § 1291.

A

We first consider Rojas’s argument that the district court

erred in holding that the Biographical Assessment’s minimum

passing score and his own personal score were exempt from

disclosure under FOIA Exemption 2 and Privacy Act

Exemption (k)(6) as a matter of law.

Under Exemption 2, FOIA’s access requirements do not

apply to matters that are “related solely to the internal

personnel rules and practices” of the FAA. 5 U.S.C.

§ 552(b)(2). The Supreme Court has construed this

exemption in detail, defining most of the individual words.

See Milner v. Dep’t of Navy, 562 U.S. 562, 569 (2011).

According to Milner, the word “solely” has its dictionary

18 ROJAS V. FAA

definition of “exclusively or only.” Id. at 570 n.4 (internal

quotation marks omitted). Again using the dictionary, the

word “internal” means that “the agency must typically keep

the records to itself for its own use.” Id. (internal quotation

marks omitted). The term “personnel” refers to “the

selection, placement, and training of employees.” Id. at 569

(internal quotation marks omitted). And “personnel rules and

practices” means the agency’s “rules and practices dealing

with employee relations or human resources,” including

“such matters as hiring and firing, work rules and discipline,

compensation and benefits.” Id. at 570. Milner did not

define the word “related,” but following the Supreme Court’s

lead, we look to its dictionary definition, which is “connected

by reason of an established or discoverable relation.”

Related, Webster’s Third New International Dictionary 1916

(3d ed. 2002) (hereinafter Webster’s). Reading these

definitions together, Exemption 2 applies to internal rules and

practices exclusively connected with “the selection,

placement, and training of employees,” including “hiring and

firing.” Milner, 562 U.S. at 569–70.

Applying this definition, we conclude that the FAA’s

rules and practices for scoring tests relating to the selection of

employees, including its rules and practices regarding the

minimum passing score and the score for a particular test,

qualify under Exemption 2. It is undisputed that the FAA’s

rules and practices for scoring the Biographical Assessment

are internal and that the test is used solely as one step in the

process of selecting individual employees. Although Rojas

argues that we must construe Exemption 2 narrowly, see id.

at 571, Rojas fails to explain why the plain language of

Exemption 2 does not include internal practices for selecting

employees. Because Rojas has not raised a genuine issue of

material fact as to whether the minimum passing score and

ROJAS V. FAA 19

Rojas’s own score fall under the scope of Exemption 2, the

district court properly granted summary judgment to the FAA

on this issue.

We next turn to Rojas’s arguments that he was entitled to

his individual score and the minimum passing score under the

Privacy Act.

The Privacy Act allows individuals to obtain certain

records relating to themselves. Specifically, 5 U.S.C.

§ 552a(a)(4) defines the term “record” as “any item,

collection, or grouping of information about an individual

that is maintained by an agency, including, but not limited to,

his education, financial transactions, medical history, and

criminal or employment history and that contains his name,

or the identifying number, symbol, or other identifying

particular assigned to the individual, such as a finger or voice

print or a photograph.” And subsection (d) governs access to

such records, stating that agencies shall “upon request by any

individual to gain access to his record or to any information

pertaining to him which is contained in the system, permit

him . . . to review the record and have a copy made of all or

any portion thereof in a form comprehensible to him.

§ 552a(d)(1).

Exemption (k)(6), however, exempts from these access

provisions “testing or examination material used solely to

determine individual qualifications for appointment or

promotion in the Federal service the disclosure of which

would compromise the objectivity or fairness of the testing or

examination process.” 5 U.S.C. § 552a(k)(6). The parties do

not dispute whether the scores constitute “information about

an individual” that may be obtained under the Privacy Act.

Nor do they dispute that the Biographical Assessment

20 ROJAS V. FAA

constitutes “testing or examination material” that is used to

determine whether an applicant qualifies for the next step in

the selection process to become an air traffic controller.

Instead, Rojas argues that the minimum passing score for the

Biographical Assessment, and his own test score, do not

qualify for Exemption (k)(6) because they are not testing

material, but rather are the end product of the testing process.

We disagree. Assuming both scores may be requested

under the Privacy Act in the first instance, Exemption (k)(6)

exempts them from disclosure.5 The term “testing material”

refers to the items needed to conduct a test or examination to

determine an individual’s proficiency or knowledge. See

Testing, Webster’s 2362 (defining “testing” as “an act or

process of subjecting to test”); Test, id. (defining “test” as “a

technique for measuring objectively an individual’s personal

characteristics, potentialities, or accomplishments” or “an

examination to determine factual knowledge or mental

proficiency”); Material, id. at 1392 (defining “material” as an

“apparatus (as tools or other articles) necessary for doing or

making something”). Test scores are part of the material

necessary to evaluate an individual’s proficiency or

5 It is an open question whether a minimum passing score constitutes

“information about an individual” that is disclosable under the Privacy

Act. See 5 U.S.C. § 552a(a)(4) (defining a “record” as “information about

an individual that is maintained by an agency, including, but not limited

to, his education, financial transactions, medical history, and criminal or

employment history”) (emphasis added); id. § 552a(d)(1) (stating that

agencies shall “upon request by any individual to gain access to his record

or to any information pertaining to him which is contained in the system,

permit him . . . to review the record and have a copy made of all or any

portion thereof in a form comprehensible to him”) (emphasis added). We

need not address this issue, however, because even assuming the

minimum passing score constitutes “information about an individual,” it

is exempt from disclosure here.

ROJAS V. FAA 21

knowledge. We therefore conclude that test scores are part of

the “testing or examination material” used to determine

individual qualifications for purposes of Exemption (k)(6).

We must next consider whether disclosing the requested

scores would “compromise the objectivity or fairness of the

testing or examination process” that the FAA uses to evaluate

applicants. 5 U.S.C. § 552a(k)(6). The district court relied

on the FAA’s affidavit from Deputy Assistant Administrator

for Human Resources Rickie Cannon to conclude that a

release of the test scores would have such an effect. Rojas

argues that this was an error, because the affidavit submitted

by the FAA failed to explain how release of Rojas’s raw test

score could be used to cheat, and that the affidavit relied on

mere speculation that applicants would or could engage in a

cheating conspiracy.

We reject these arguments. The FAA’s detailed affidavit

provided evidence that prior applicants had worked together

to examine the correlation between their answers to the

Biographical Assessment and their passing or failing scores

in an effort to determine which answers were more likely to

be correct. The affidavit also asserted that the Biographical

Assessment’s scoring key could be determined based on a

large enough pool of applicant scoring information.

Although Rojas argues that his request is limited to his own

score, the FAA expresses the concern that other applicants

could rely on the same arguments to obtain their own scores

and asserts that the history of the cheating scandal here

indicates they would be likely to do so. Rojas did not offer

any evidence contradicting this affidavit, so the district court

did not err in accepting the FAA’s factual assertions.

Accordingly, Rojas has not raised a genuine dispute as to

whether applicants could use their test scores to undermine

22 ROJAS V. FAA

the integrity of the Biographical Assessment. Because such

a result would “compromise the objectivity or fairness of the

testing or examination process,” 5 U.S.C. § 552a(k)(6), we

affirm the district court’s grant of summary judgment to the

FAA based on Exemption (k)(6) of the Privacy Act, which

allowed the FAA to withhold from Rojas the minimum

passing score and his own score on the Biographical

Assessment.

B

Rojas next argues that the district court erred in ruling

that the FAA could redact the personal email addresses of

FAA employees that appeared in Snow’s emails because

those addresses were exempt from disclosure under FOIA

Exemption 6.

Exemption 6 provides that FOIA does not apply to

“personnel and medical files and similar files the disclosure

of which would constitute a clearly unwarranted invasion of

personal privacy.” Id. § 552(b)(6). We employ a two-prong

inquiry to determine whether the government has correctly

withheld records under Exemption 6. First, we determine

“whether the information is contained in a personnel,

medical, or similar file.” Elec. Frontier Found., 639 F.3d

at 886 (internal quotation marks omitted). Second, we

determine “whether release of the information would

constitute a clearly unwarranted invasion of the person’s

privacy.” Id.

We begin by considering whether the redacted email

addresses here are contained in a “similar file.” As construed

by the Supreme Court, “similar file” applies broadly to

government records containing information “which can be

ROJAS V. FAA 23

identified as applying to that individual.” U.S. Dep’t of State

v. Wash. Post Co., 456 U.S. 595, 602 (1982) (internal

quotation marks omitted). Therefore, “[g]overnment records

containing information that applies to particular individuals

satisfy the threshold test of Exemption 6.” Van Bourg, Allen,

Weinberg & Roger ex rel. Carpet, Linoleum, & Soft Tile

Workers Union, Local 1288 v. N.L.R.B., 728 F.2d 1270, 1273

(9th Cir. 1984). Because “personnel and medical files” are

likely to contain information that is not intimate, “such as

place of birth, date of birth, date of marriage, employment

history, and comparable data,” the term “similar files” is

likewise not “limited to files containing intimate details and

highly personal information.” Wash. Post Co., 456 U.S.

at 600 (internal quotation marks omitted). In light of the

Supreme Court’s interpretation of “similar files,” we

conclude that government records containing personal email

addresses constitute “similar files,” because a personal email

address “can be identified as applying to [a particular]

individual.” See id. at 602 (internal quotation marks

omitted).

Second, we consider whether the disclosure of the

personal email addresses would amount to “a clearly

unwarranted invasion of that person’s privacy.” Id. A

privacy interest is cognizable under Exemption 6 if it is

“nontrivial,” that is, “more than . . . de minimis.” Yonemoto

v. Dep’t of Veterans Affairs, 686 F.3d 681, 693 (9th Cir.

2012) (alteration in original) (internal quotation marks

omitted), overruled on other grounds by ALDF, 836 F.3d at

989. This is not a demanding standard; rather, a disclosure

implicates a cognizable privacy interest if it affects either “the

individual’s control of information concerning his or her

person,” U.S. Dep’t of Justice v. Reporters Comm. for

Freedom of the Press, 489 U.S. 749, 763 (1989), or would

24 ROJAS V. FAA

possibly expose the individual to harassment, see Ray,

502 U.S. at 176–77. There is at least a “minor privacy

interest” in personal email addresses, Elec. Frontier Found.,

639 F.3d at 888, and we conclude that the FAA employees

have such an interest here.

If the agency establishes a nontrivial privacy interest, the

burden shifts to the requester to establish that the public

interest in the information outweighs the privacy interest. See

Cameranesi v. U.S. Dep’t of Def., 856 F.3d 626, 637 (9th Cir.

2017). “[T]he only relevant public interest in the FOIA

balancing analysis is the extent to which disclosure of the

information sought would shed light on an agency’s

performance of its statutory duties or otherwise let citizens

know what their government is up to.” Bibles v. Or. Nat.

Desert Ass’n, 519 U.S. 355, 355–56 (1997) (per curiam)

(alterations omitted). The information requested must

“appreciably further” the asserted public interest. U.S. Dep’t

of Def. v. Fed. Labor Relations Auth., 510 U.S. 487, 497

(1994). If the requestor fails to meet the burden of showing

that the public interest outweighs the privacy interest, then

“the invasion of privacy is unwarranted,” and Exemption 6

applies. Cameranesi, 856 F.3d at 637 (internal quotation

marks omitted) (quoting Nat’l Archives & Records Admin. v.

Favish, 541 U.S. 157, 172 (2004)).

When a requester asserts only the public interest in

demonstrating “that responsible officials acted negligently or

otherwise improperly in the performance of their duties,”

Tuffly v. U.S. Dep’t of Homeland Sec., 870 F.3d 1086, 1095

(9th Cir. 2017) (internal quotation marks omitted) (quoting

Favish, 541 U.S. at 174), “the requester must establish more

than a bare suspicion” that the officials behaved improperly,

Favish, 541 U.S. at 174. The evidence must “warrant a belief

ROJAS V. FAA 25

by a reasonable person that the alleged Government

impropriety might have occurred”; otherwise, there is no

“counterweight on the FOIA scale for the court to balance

against the cognizable privacy interests in the requested

records.” Id. at 174–75.

We have also recognized that “[t]here is a clear public

interest in public knowledge of the methods through which

well-connected corporate lobbyists wield their influence.”

Elec. Frontier Found., 639 F.3d at 887. This is an example

of “[o]fficial information that sheds light on an agency’s

performance of its statutory duties,” id. (alteration in original)

(quoting Reporters Comm., 489 U.S. at 773), because “[w]ith

knowledge of the lobbyists’ identities, the public will be able

to determine how the Executive Branch used advice from

particular individuals and corporations in reaching its own

policy decisions,” id. at 888. Due to the strong public interest

in knowing the identities of lobbyists, we noted that

disclosure of “a particular email address” would be allowed

if such disclosure “is the only way to identify” the person

lobbying an agency regarding its public business. Id. In that

circumstance, the privacy interest in that email address may

not counterbalance the public’s “robust interest” in knowing

who is “seeking to influence” an agency. Id. at 888–89.

Here, because the FAA has established a nontrivial

privacy interest in its employees’ email addresses, the burden

shifts to Rojas to establish that the public interest in the

information outweighs the privacy interest. Rojas argues that

there is a substantial public interest in evaluating whether

FAA officials intentionally acted in a manner that

compromised the fairness of the hiring process for air traffic

controllers. Without the addresses, Rojas asserts, it is

impossible to determine which employees were involved in

26 ROJAS V. FAA

the alleged conspiracy to help certain applicants or to

understand the information flow regarding the alleged

conspiracy within the agency. Further, Rojas argues that

government employees have diminished privacy interests

where the information sought may disclose misconduct.

Although this issue is quite close, FOIA’s “strong

presumption in favor of disclosure,” Ray, 502 U.S. at 173,

leads us to conclude that where FAA employees used

personal email addresses to receive information relating to

the FAA’s change in selecting air traffic controllers, Rojas

has carried his burden of showing that the FAA employees’

privacy interest in their personal email addresses is

outweighed by the “robust interest of citizens’ right to know

‘what their government is up to’” in making the changes it

did. Elec. Frontier Found., 639 F.3d at 888 (quoting

Reporters Comm., 489 U.S. at 773). There is a clear public

interest in assessing FAA employees’ use of information

relating to the FAA’s selection of air traffic controllers.

Further, in this case, providing the “particular email address”

receiving the information from the FAA email account “is the

only way to identify” the FAA employees involved in

discussing these issues.

Because the email in which Snow forwarded the Barrier

Analysis to personal email accounts relates to the FAA’s

change in hiring practices, we conclude that the public

interest in identifying the individuals receiving this

information outweighs the privacy interests of those

individuals. However, the email that requests employees to

refer calls from the reporter who authored “Trouble in the

Skies” to FAA Public Affairs does not relate to the FAA’s

change in selecting air traffic controllers. Therefore, the

privacy interests of the individuals receiving this information

ROJAS V. FAA 27

are not outweighed by the public interest in what the FAA

was “up to” when it changed its hiring practices.

Moreover, although Rojas is required to show more than

a “bare suspicion in order to obtain disclosure,” he has

overcome that hurdle to the extent he asserts the public’s

interest of shedding light on potential official misconduct.

Favish, 541 U.S. at 174. Based on the evidence provided, a

reasonable person would believe that “the alleged

Government impropriety might have occurred” in the FAA’s

decision to change its hiring practices. Id.; see also Union

Leader Corp. v. U.S. Dep’t of Homeland Sec., 749 F.3d 45,

56 (1st Cir. 2014) (noting that evidence of misconduct was

“hardly conclusive evidence of negligence, or other

wrongdoing,” but was enough to satisfy the standard set out

in Favish). Because Rojas has overcome “the presumption of

legitimacy accorded to official conduct,” Cameranesi,

856 F.3d at 640, we conclude there is no genuine issue of

material fact that Exemption 6 does not apply to the personal

email addresses of the recipients of the Barrier Analysis

document containing FAA information relating to the

selection of air traffic controllers. That said, the public’s

interest is limited to learning their identity. Therefore, the

FAA could satisfy its obligation under FOIA by identifying

the email recipients by name, instead of revealing the

recipients’ personal email addresses.

C

We next turn to the question whether the 202 emails

withheld by the FAA were “agency records” subject to

FOIA’s disclosure requirements. If the emails are not

“agency records,” the district court lacked authority to

compel their disclosure. See Tax Analysts, 492 U.S. at 142.

28 ROJAS V. FAA

The agency bears the burden of showing that the materials

sought are not “agency records.” Id. at 142 n.3.

Congress “did not provide any definition of ‘agency

records’ in [FOIA].” Forsham v. Harris, 445 U.S. 169, 178

(1980).6 The Supreme Court has provided a two-prong test:

a document is an agency record if (1) the agency “either

create[d] or obtain[ed] the requested materials,” and (2) the

agency is “in control of the requested materials at the time the

FOIA request is made.” Tax Analysts, 492 U.S. at 144–45

(internal quotation marks omitted).

The withheld emails at issue here were either sent to or

received by Snow, an FAA employee, using his official FAA

email account, and were maintained in the FAA’s computer

servers. The parties do not dispute that these emails were

created or obtained by the FAA.7 Consequently, the first

prong of the Tax Analysts test is satisfied. See id. at 144.

6 FOIA does, however, define the term “record” as “any information”

that is “maintained by an agency in any format, including an electronic

format,” as well as any such information “maintained for an agency by an

entity under Government contract, for the purposes of records

management.” 5 U.S.C. § 552(f)(2)(A)–(B).

7 On appeal, the FAA did not address the issue whether an agency

“create[s] or obtain[s]” emails under these circumstances. Instead, it

focused its argument on whether the withheld emails “[came] into the

agency’s possession in the legitimate conduct of its official duties” or

included “personal materials in an employee’s possession,” which are

factors considered in determining whether an agency is “in control of the

requested materials at the time the FOIA request is made.” Tax Analysts,

492 U.S. at 144–45.

ROJAS V. FAA 29

We therefore turn to the second prong, whether an agency

is in “control” of the requested documents. Rojas argues that

this prong is satisfied because all the withheld emails exist on

the FAA’s servers and were generated while Snow was an

FAA employee. In Rojas’s view, the FAA’s possession of

the emails in its servers is sufficient to show that FAA has

control of the emails. We reject a categorical rule that any

document created by an agency employee and stored on an

agency server is in the agency’s control. Rather, the question

whether an agency is in “control” of requested documents

requires a more complex analysis.

In Tax Analysts, the Court determined that copies of

judicial opinions and orders kept in official files for use by

Department of Justice (DOJ) staff attorneys were controlled

by DOJ because the agency obtained the opinions and

maintained them in official case files. Id. at 146–47. In

reaching this conclusion, Tax Analysts provided guidance on

what constitutes “control” for purposes of FOIA.

First, the agency must be “in control of the requested

materials at the time the FOIA request is made.” Id. at 145.

In this context, “control” means “in the agency’s possession,”

id. at 146, although the Court held open the possibility that an

agency might “control” documents that had been

“purposefully routed” to another agency in order to avoid a

FOIA request, id. at 146 n.6. Tax Analysts rejected

arguments that an agency lacked “control”’ if it lacked

authority to modify the document, stating that the “control

inquiry focuses on an agency’s possession of the requested

materials, not on its power to alter the content of the materials

it receives.” Id. at 147. It also held that the purpose for

which a record is created is not relevant to whether it is

controlled by the agency; the definition of “agency records”

30 ROJAS V. FAA

may not turn “on the intent of the creator” because “[s]uch a

mens rea requirement is nowhere to be found in the Act.” Id.

To the extent this first factor in the control prong of Tax

Analysts focuses solely on the agency’s possession of a

document, it resembles Rojas’s proposed rule.

But Tax Analysts did not define the term “control” merely

as “possession.” It also defined “control” to mean “that the

materials have come into the agency’s possession in the

legitimate conduct of its official duties,” or “in connection

with the transaction of public business.” Id. at 145 (emphasis

omitted). This aspect of “control,” the Court explained,

accords with the holding from its prior opinion in Kissinger

v. Reporters Committee for Freedom of the Press that “the

term ‘agency records’ is not so broad as to include personal

materials in an employee’s possession, even though the

materials may be physically located at the agency.” Id.

Kissinger considered whether the notes that Henry Kissinger

made while serving in the Office of the President (which is

not an “agency” under FOIA) became “agency records” when

Kissinger physically brought them to the State Department

(which is an “agency” under FOIA) when he became

Secretary of State. See 445 U.S. at 155–57. Because “[t]he

papers were not in the control of the State Department at any

time,” were not “generated in the State Department,” “never

entered the State Department’s files, and they were not used

by the Department for any purpose,” the Court held they were

not agency records. Id. at 157.

Relying primarily on Kissinger, the D.C. Circuit adopted

a four-factor test for determining whether a document is in

the control of an agency in connection with its official

business. Judicial Watch, Inc. v. U.S. Secret Serv., 726 F.3d

208, 218 (D.C. Cir. 2013). The first factor is “the intent of

ROJAS V. FAA 31

the document’s creator to retain or relinquish control over the

records”; the second factor is “the ability of the agency to use

and dispose of the record as it sees fit”; the third factor is “the

extent to which agency personnel have read or relied upon the

document”; and the fourth factor is “the degree to which the

document was integrated into the agency’s record system or

files.” Tax Analysts v. U.S. Dep’t of Justice, 845 F.2d 1060,

1069 (D.C. Cir. 1988), aff’d, 492 U.S. 136 (1989) (internal

quotation marks omitted). Although the FAA asks us to

adopt this test and use it to determine whether the emails at

issue are agency records, we cannot fully embrace it. First,

it was originally developed before the Supreme Court’s

decision in Tax Analysts, see id., and its first factor is in

tension with the Court’s conclusion that “the intent of the

creator of a document” is not relevant to a determination of

whether the document is an agency record, Tax Analysts,

492 U.S. at 147. Second, some of the D.C. Circuit’s factors

are less helpful when applied to emails and other electronic

records, as opposed to physical records more common when

the factors were developed. For instance, whether an email

is “integrated” into the agency’s record system or files is less

meaningful today because email and other electronic records

may be automatically stored on an agency’s server, and not

“filed” in a record system in any formal way.

Rather than adopting the D.C. Circuit’s four-factor test,

we hold that a court may consider a range of evidence to

determine whether specified records are in the agency’s

possession in connection with agency-related business, or

instead involve personal matters not related to the agency’s

“transaction of public business.” See id. at 145 (emphasis

omitted). As suggested by the D.C. Circuit, evidence relating

to the agency’s use of documents (including its system for

preserving, retrieving, or disposing of the documents, and any

32 ROJAS V. FAA

reliance on the documents by agency employees) may be

relevant to this inquiry. Agency records are not limited to

documents that are preserved according to agency directions,

however. Given that the term “record” includes electronic

records, 5 U.S.C. § 552(f)(2), emails sent or received for

agency-related business may be agency records, even if not

stored in agency files in any formal sense. By contrast,

emails or other documents that are unrelated to agency

business are not agency records, even if they are stored on the

agency’s server and used by an agency employee. See

Kissinger, 445 U.S. at 155–56. Moreover, because there is no

mens rea requirement for whether materials constitute agency

records, Tax Analysts, 492 U.S. at 147, agency records may

include documents used by agency employees in connection

with agency business, even if the employees were engaging

in misconduct, cf. Restatement (Second) of Agency § 229

(1958) (listing factors to consider when determining whether

an unauthorized action is nevertheless within the scope of an

agent’s duties).

Applying the second prong of Tax Analysts (whether the

agency is in control of the withheld materials at the time the

FOIA request is made) to the facts of this case, we have no

trouble concluding that the FAA possessed the withheld

materials, because they were discovered in the FAA’s

computer system. See 492 U.S. at 144. But it is less clear

whether the FAA possessed any of the documents in the

conduct of its official duties or public business. Our

independent review suggests that some of the withheld

documents were not purely personal. For instance, because

the FAA’s official business includes selecting and hiring air

traffic controllers, the withheld email relating to study

information for the FAA’s examination of applicants, may be

in the FAA’s possession in connection with the transaction of

ROJAS V. FAA 33

public business. See id. at 145. Nor is it clear that documents

containing communications between an FAA employee and

the NBCFAE (an association of FAA employees), or the

National Air Traffic Controllers Association, are merely

personal. If the FAA communicates or works with the

NBCFAE or the NATCA in the conduct of its official duties

or public business, for instance, then such communications

could be in the FAA’s “control” as defined in Tax Analysts.

See id. For example, should the FAA jointly sponsor

programs or engage in bargaining with these organizations,

communications regarding such matters may relate to public

business.

The district court provided little explanation of its grant

of summary judgment in favor of the FAA on this issue,

stating only that the withheld documents were “personal

emails regarding Snow that do not respond to Rojas’s FOIA

requests or the mission of the FAA.” Without more

explanation, we cannot tell whether the district court

appropriately considered the factors we set out today.

Because in FOIA cases, a district court must provide

sufficiently detailed disclosure of the factual and legal basis

for its decision, see Van Bourg, Allen, Weinberg & Roger v.

NLRB, 656 F.2d 1356, 1358 (9th Cir. 1981) (per curiam);

Couveau v. Am. Airlines, Inc., 218 F.3d 1078, 1081 n.3 (9th

Cir. 2000) (per curiam), we think it prudent to remand to the

district court to address this issue under the appropriate

standards in the first instance. We therefore vacate the

district court’s order granting summary judgment with respect

34 ROJAS V. FAA

to the 202 withheld emails and remand to the district court to

apply Tax Analysts’s second prong consistent with this

opinion.8 See Van Bourg, 656 F.2d at 1358.



* * *



8 The parties shall bear their own costs on appeal.

AFFIRMED IN PART, REVERSED IN PART, AND

VACATED AND REMANDED IN PART.