Sherman v. United States Department of the Army

244 F.3d 357, 2001 U.S. App. LEXIS 3423, 2001 WL 224654

• Court: Court of Appeals for the Fifth Circuit
• Decided: March 7, 2001
• Docket: 00-20401
• Status: Published

Opinion

BENAVIDES, Circuit Judge:

In this Freedom of Information Act (FOIA) case, Stephen Sherman appeals the district court’s grant of summary judgment in favor of the United States Department of the Army (Army) with respect to the Army’s decision, pursuant to exemption 6 of the FOIA, to redact the social security numbers of service personnel from portions of Sherman’s information request. Because we (1) reject Sherman’s argument that the Army has the power to waive the privacy interest of service personnel in limiting the disclosure of their social security numbers, and (2) find that fulfillment of Sherman’s request, absent the redaction of social security numbers, would constitute a clearly unwarranted intrusion into the privacy interests of Army service personnel, we AFFIRM the judgment of the district court.

Factual and Procedural Background

When Army officials approve individual or unit decorations, that action is announced through an award order. Such orders may reference an award approved for a single soldier or the awards approved for multiple soldiers. Typically, orders contain a soldier’s name, rank and unit, as well as specific information relating the details of the conduct giving rise to the award. The awards also contain an identification number for each soldier listed within. Prior to 1968, personnel named in award orders were identified by Army serial number (ASN). Beginning in 1968 and continuing through the 1990s, the Army identified personnel by social security number (SSN). Thus, award orders issued after 1968 contain the SSNs of Army personnel, as opposed to ASNs. 1

The Army recently hired a contractor to compile award orders issued during the Vietnam era in a computerized database: the Awards and Decorations Computer Assisted Retrieval System (ADCARS). 2 Paper versions of most award orders, including those issued between 1965 and 1973, are still available to the public through the Army or the National Archives. Yet, the Army now relies on the ADCARS to investigate Vietnam era award inquiries and fulfill related information requests.

In 1997, Stephen Sherman requested computer-tape copies of the ADCARS database containing the roughly 611,000 general orders issued between 1965 and 1973. The Army eventually responded to Sherman’s request by offering computer copies of the orders issued from 1964 to 1967 at the cost of reproduction, estimated at $5000. With respect to orders issued from 1968 to 1973, the Army found it necessary to redact all SSNs, pursuant to exemption 6 of the FOIA and the corresponding Army regulation, to avoid a clearly unwarranted invasion of the privacy interests of Army personnel. The Army offered Sherman a redacted version of the database records provided he pay the cost of the redaction, estimated at $350,000 to $1,000,000. 3 Sherman complained to the Army that redaction was unnecessary, improper and prohibitively expensive. Additionally, Sherman sought a waiver of the fees associated with reproduction of the unredacted tapes pursuant to the FOIA fee waiver provisions. 4

Sherman filed the present action in the district court for the Southern District of Texas seeking an injunctive order requiring the Army to produce the requested documents without redaction. On cross-motions for summary judgment, the district court found that release of personnel SSNs included in the orders would constitute an unwarranted invasion of the personal privacy interests of Army personnel, and thus redaction of the requested documents was proper pursuant to exemption 6. This appeal followed in which Sherman raises two primary issues for review: (1) Did the Army waive its authority to exercise exemption 6 by publicly releasing the SSNs of service personnel to the public in other instances, and (2) Did the district court properly balance the public interest in disclosure of the materials contained in Sherman’s FOIA request against the privacy interest of service personnel in limiting the disclosure of their SSNs.

Discussion

Through the FOIA, Congress created a regime “designed to pierce the veil of administrative secrecy and to open agency action to the light of public scrutiny.” United States v. Ray, 502 U.S. 164, 173, 112 S.Ct. 541, 116 L.Ed.2d 526 (1991). When a citizen requests public information from a government agency through the FOIA, the agency is generally required to make a full disclosure. See id.; 5 U.S.C. § 552. However, the FOIA also reflects Congress’ awareness that various public or private concerns could outweigh the need for public disclosure of certain information. See Department of Air Force v. Rose, 425 U.S. 352, 360-61, 96 S.Ct. 1592, 48 L.Ed.2d 11 (1976); Avondale Indus., Inc. v. NLRB, 90 F.3d 955, 958 (5th Cir.1996). In this regard, Congress created nine exemptions through which federal agencies may restrict public disclosure of information that would threaten broader societal concerns. See 5 U.S.C. § 552(b). The informational privacy interests of private citizens are among those concerns recognized and addressed by Congress in these exemptions. 5

Exemption 6 to the FOIA allows agencies to exempt from disclosure information contained in “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” Id. at § 552(b)(6). 6 Pursuant to exemption 6, an agency may delete personal details within a document, provided the details to be deleted are reasonably severable and the overall privacy interests of the individual clearly outweigh the presumption of public disclosure. Avondale Indus., Inc. v. NLRB, 90 F.3d 955, 958 (5th Cir.1996). We review a district court’s summary judgment with respect to the application of exemption 6 de novo. Id. The agency relying on the exemption to prevent disclosure of information bears the burden of establishing that application of the exemption is appropriate. Id.

The threshold inquiry in exemption 6 cases is whether the information requested includes “files” within the meaning of section 552(b)(6). United States Dept. of State v. Washington Post Co., 456 U.S. 595, 602, 102 S.Ct. 1957, 72 L.Ed.2d 358 (1982). The Supreme Court has interpreted exemption 6 “files” broadly to include any “information which applies to a particular individual.” United States Dept, of State v. Washington Post Co., 456 U.S. 595, 602, 102 S.Ct. 1957, 72 L.Ed.2d 358 (1982). If the request includes such personal information, “courts must determine whether release of the information would constitute a clearly unwarranted invasion of that person’s privacy.” Id. This determination, in turn, depends on a balancing of “ ‘the individual’s right of privacy’ against the basic policy of opening ‘agency action to the light of public scrutiny.’ ” Ray, 502 U.S. at 175, 112 S.Ct. 541 (quoting Rose, 425 U.S. at 372, 96 S.Ct. 1592); United States Dep’t of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 776, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989)

The Supreme Court has narrowly defined the “public interest” relevant to exemption 6 balancing as “the extent to which disclosure would serve the core purpose of the FOIA, which is contributing] significantly to the public understanding of the operations or activities of the government.” Dep’t of Defense, 510 U.S. at 495, 114 S.Ct. 1006 (quotations and emphasis omitted). That interest is not implicated by disclosure of information about private citizens that has accumulated in various government files but reveals little or nothing about an agency’s own conduct. Reporters Comm., 109 S.Ct. at 1472-73. Moreover, in considering the public’s interest in the disclosure of requested information, the professed intentions of the re-questor are irrelevant. Reporters Comm., 109 S.Ct. at 1480 (“[WJhether an invasion of privacy is warranted cannot turn on the purposes for which the request for information is made.”). Instead, the court must consider only whether the requested information sheds light on agency action. Id. This benefit should flow directly from disclosure, as “[mjere speculation about hypothetical public benefits cannot outweigh a demonstrably significant invasion of privacy.” Ray, 502 U.S. at 179, 112 S.Ct. 541.

Where the public interest in exemption 6 balancing has been defined narrowly, the privacy interest protected by the exemption is more broad and “encompasses [an] individual’s control of information concerning his or her person.” Dept. of Defense, 510 U.S. at 500, 114 S.Ct. 1006 (quoting Reporters Comm., 489 U.S. at 763, 109 S.Ct. 1468). Just as a court should disregard the intentions of the requestor when considering the public interest in a FOIA disclosure, it must also look beyond the requestor’s good intentions when considering the scope of personal privacy interests implicated by a FOIA request. Id. at 501-02, 109 S.Ct. 1468 (considering privacy interest in light of fact “that other parties, such as commercial advertisers and solicitors, must have the same access under FOIA” as the party requesting the information). At the same time, we should again avoid speculation on privacy interests that may or may not be implicated by disclosure of government documents. See Rose, 425 U.S. at 380 n. 19, 96 S.Ct. 1592 (requiring “threats to privacy interests more palpable than mere possibilities.”). Finally, we note that “the fact that an event is not wholly ‘private’ does not mean that an individual has no interest in limiting disclosure or dissemination of the information.” Reporters Comm., 489 U.S. at 770, 109 S.Ct. 1468 (quotations omitted); Hallaran, 874 F.2d at 322.

To justify the application of exemption 6 in this case, the Army must demonstrate that release of SSNs would constitute a clearly unwarranted invasion of the privacy interests of Army personnel. While the Army has no objection to publicly disclosing the basic content of the award orders requested by Sherman, it maintains that “social security numbers linked to individuals’ names and other identifying information increasingly provide ready access to numerous personal details about an individual, creating a very real danger of identity theft and other significant intrusions on personal privacy.” As a consequence, the Army believes that it must exempt personnel SSNs from disclosure and require their redaction. 7 Sherman counters that redaction is inappropriate for two reasons: (1) the Army waived its authority to rely on exemption 6 for this purpose when it publicly disclosed personnel SSNs on prior occasions, and (2) the public interest in allowing disclosure of the database outweighs the informational privacy interest that service personnel have in their SSNs.

A. The Waiver Argument

Sherman does not contest that exemption 6 analysis is generally appropriate since the requested flies do contain personal information — SSNs. Rather, Sherman argues initially that the Army’s consistent practice of disregarding an individual’s privacy right in her SSN effectively waives the Army’s authority to rely on exemption 6. Sher man points out that use of SSNs in the Army has been pervasive, and often public. SSNs were included with any reference to an individual. Often, recreational passes or other orders contained the names and SSNs of multiple service members; those orders were then distributed to other service members, as well as airlines, hotels and other public organizations. As late as 1995, the SSNs of officers whose promotion required congressional confirmation were published in the Congressional Register. According to Sherman, the Army has even sold lists of officers, together with their SSNs and birth dates, through the Government Printing Office. Finally, Sherman points out that the very award orders he seeks were typically published in hometown newspapers at the time of their issuance.

Sherman contends that this pervasive public use of SSNs by the Army constitutes a waiver of any privacy interest protected by exemption 6. As support for this position, Sherman relies on two district court cases: Kimberlin v. Dept. of Justice, 921 F.Supp. 833 (D.D.C.1996) and Shell Oil Co. v. I.R.S., 772 F.Supp. 202 (D.Del.1991). Neither case involves exemption 6 to the FOIA. Indeed, as the district court noted, Shell Oil is wholly inapposite, involving an application of the FOIA’s exemption 5, 8 which does not implicate informational privacy concerns. 9 The court in Kimberlin, however, considered the role of waiver in the more analogous context of exemption 7(C). The Kimberlin court concluded that the Justice Department could not rely on exemption 7(C) to prevent disclosure of sensitive files that had been previously released to the press because the prior disclosure eradicated any privacy interest in the information. 10 Id. at 836 (citing Nation Magazine v. United States Customs Service, 71 F.3d 885 (D.C.Cir.1995)). The court feared that, if the Justice Department were allowed to rely on the exemption, it “could selectively disclose nonpublic information to favored sources and then invoke FOIA exemptions to prevent disclosure to press sources not in their favor.” Id. at 835. Similarly, Sherman argues that if we allow the Army to exempt material that it has previously released publicly, we will effectively allow the Army to selectively control disclosure of any documents containing SSNs.

While we share the Kimberlin court’s concern regarding selective disclosure with respect to those exemptions that protect the government’s interest in nondisclosure of information, we conclude that this concern, and the related waiver analysis, are not implicated when a government agency relies on exemption 6 to prevent disclosure of personal information. The Supreme Court has explained that the privacy interest at stake in FOIA exemption analysis belongs to the individual, not the agency holding the information. Reporter’s Comm., 489 U.S. at 763-65, 109 S.Ct. 1468. Moreover, as noted, the fact that otherwise private information at one time or in some way may have been placed the public domain does not mean that a person irretrievably loses his or her privacy interest in the information. Id. at 770, 109 5.Ct. 1468; Halloran, 874 F.2d at 322. Consistent with these established principles, we hold that only the individual whose informational privacy interests are protected by exemption 6 can effect a waiver of those privacy interests when they are threatened by an FOIA request. For that reason, we do not accept Sherman’s argument that the Army has waived its authority to implement exemption 6. 11

Our position squares with the reasoning of other circuits that have considered waiver arguments in the FOIA context. Though no circuit court has expressly analyzed waiver in a case involving exemption 6, those circuits that have considered a waiver argument with respect to the analogous exemption 7(C) have reached results similar to ours. 12 In contrast, circuit courts that have found that an agency waived its right to an exemption have done so only where the government’s own interests in confidentiality, as opposed to the privacy interest of an individual, were at stake. 13

B. Exemption 6 Balancing

That Sherman’s waiver argument fails does not end our analysis. We must still determine whether the Army has carried its burden in demonstrating that invasion of the personal privacy interest in preventing disclosure of SSNs would be clearly unwarranted by the public interest in disclosure of those SSNs. We begin the necessary balancing by considering the nature and extent of an individual’s privacy interest in his or her SSN.

Both Congress and other circuits have discussed the significant privacy concerns surrounding the dissemination of SSNs. Congress acknowledged those concerns in the Privacy Act of 1974, which barred government agencies from discriminating against individuals that refuse to release their SSNs. Privacy Act of 1974, Pub.L. 93-579, § 7, 88 Stat. 1896, 1909 (1974), reprinted in 5 U.S.C. § 552a (1996). The Senate Report supporting adoption of the Act described the universal use of SSNs as identifiers as “one of the most serious manifestations of privacy concerns in the Nation.” S.Rep. No. 1183, 93rd Cong., 2d Sess., reprinted in 1974 U.S.Code Cong. & Admin. News 6916, 6943.

Other circuits, relying in part on these Congressional statements, have concluded that the privacy interest in SSNs is significant, and thus public dissemination of information containing SSNs must be monitored scrupulously. See Crawford, 194 F.3d at 958-59 (recognizing that “indiscriminate public disclosure of SSNs, especially when accompanied by names and addresses” can implicate informational privacy rights); Greidinger v. Davis, 988 F.2d 1344, 1353 (4th Cir.1993) (“[T]he harm that can be inflicted from the disclosure of a social security number to an unscrupulous individual is alarming and potentially financially ruinous.”). Indeed, two of our sister circuits have held that public disclosure of SSNs in files requested under the FOIA constituted a clearly unwarranted invasion of personal privacy under exemption 6. See Norwood v. FAA, 993 F.2d 570, 575 (6th Cir.1993) (determining that redaction of SSNs from FOIA documents necessary to protect identities of individuals discussed in documents); Int’l Bhd. of Elec. Workers Local Union No. 5 v. HUD, 852 F.2d 87, 89 (3d Cir.1988) (holding that redaction of social security numbers necessary because requestor failed to demonstrate any public interest in disclosure of the SSNs).

As both our sister circuits and Congress have suggested, an individual’s informational privacy interest in his or her SSN is substantial. The privacy concern at issue is not, of course, that an individual will be embarrassed or compromised by the particular SSN that she has been assigned. Rather, the concern is that the simultaneous disclosure of an individual’s name and confidential SSN exposes that individual to a heightened risk of identity theft and other forms of fraud. See generally, Flavio L. Komuves, We’ve Got Your Number: An Overview of Legislation and Decisions to Control the Use of Social Security Nti/mbers As Personal Identifiers, 16 J. Marshall J. Computes & Info. L. 529 (1998). In considering the scope of the informational privacy right, this Court has previously recognized the need to look beyond the specific nature of information which an agency seeks to redact as private, and consider the nexus between the information to be redacted and other details which an individual would not want publicly disclosed. Halloran, 874 F.2d at 321. (“In both the FOIA and other contexts involving privacy concerns, it has long been the rule that our concern is not with ... identifying information per se, but with the connection between such information and some other detail ... which the individual would not wish to be publicly disclosed.”) In this regard, we are comfortable measuring the scope of the privacy interest in a SSN in terms of the dire consequences of identity theft and other forms of fraud which are associated with SSN disclosure. 14 That said, we also believe that “[t]o weigh properly the privacy interest involved, the dire consequences of identity theft must be discounted by the probability of its occurrence.” Crawford, 194 F.3d at 959. Thus, the relatively low risk of identity theft may sufficiently diminish the privacy interest in SSNs to warrant their disclosure where a strong public interest in disclosure exists. See id. (holding requirement that individuals filing for bankruptcy submit their social security numbers with bankruptcy application is warranted by government’s strong public interest in preventing bankruptcy fraud and facilitating transparent bankruptcy process). Nevertheless, we recognize that individual citizens have a substantial informational privacy right to limit the disclosure of their SSNs, and consequently reduce the risk that they will be affected by various identity fraud crimes.

Against this substantial privacy interest, Sherman fails to articulate clearly a competing public interest in disclosure of the SSNs. Sherman implies that the SSNs, when combined with the names of servicemen, might assist him and other historians to identify individuals fraudulently claiming to have received meritorious service awards during the Vietnam War. While we do not dispute the merit of this activity, the Supreme Court has limited our consideration of “public interest” to those types of information that shed light on the nature of agency action, not those that shed light on fraudulently-claimed military honors. See Reporters Comm., 109 S.Ct. at 1472-73.

More generally, Sherman seems to admit that he has less interest in the SSNs themselves, than the descriptive content of the award orders that the SSNs happen to be mingled within. He maintains that the historical value of the award orders does contribute to public awareness of how the Army conducted the Vietnam War. We agree that Sherman has articulated a public interest that supports disclosure of the content of the award orders. Indeed, as Sherman points out, the Army itself has recognized the historical import of the awards and requires that they be carefully prepared. Yet, the presence of the SSNs among the award orders does not elucidate investigation into the Army’s conduct of the Vietnam War or the types of conduct that gave rise to awards for meritorious service. Stated differently, redaction of the SSNs does not meaningfully detract from the public utility of the award orders. See Ray, 502 U.S. at 178-79, 112 S.Ct. 541 (concluding that the public interest in requested documents had been “adequately served” by redacted version of the documents and “that disclosure of the unre-dacted documents would therefore constitute a clearly unwarranted invasion of [personal] privacy.”). Thus, we reiterate our conclusion that Sherman has failed to identify a public interest in the SSNs that would warrant their disclosure.

Generally, Sherman argues in his brief that the cost of redacting the SSNs renders his FOIA request untenable. Perhaps as a consequence, he balances the public interest in disclosure of all information contained in the requested database against the privacy interest of an individual soldier in his SSN. As noted, however, this is not the relevant inquiry for the purpose of determining the propriety of the redaction pursuant to exemption 6. See, e.g., Ray, 502 U.S. at 177-79, 112 S.Ct. 541 (balancing public interest in disclosure of the redacted information against privacy interest in the redacted information). In this sense, Sherman’s approach resembles an argument in favor waiving the redaction fee, not against the redaction. To the extent that Sherman ever made a fee waiver request, however, he has expressly abandoned it in this appeal.

Conclusion

The increasing prevalence of identity fraud, as reflected in various federal statutes, demands that federal agencies take particular care when publicly disclosing documents that contain SSNs. We believe that the Army has acted properly in fulfilling this responsibility. Because we con- elude that invasion of the informational privacy interest of individual soldiers in disclosure of their SSNs would clearly be unwarranted in the absence of any public interest in those SSNs, the Army appropriately decided to redact the numbers from the award orders requested by Sherman. Though the Army may previously have been less diligent in preventing unnecessary public disclosure of soldiers’ SSNs, such disclosure cannot waive the soldiers’ privacy interest in them. For these reasons, we AFFIRM the district court’s summary judgment in favor' of the Army.

1 . Since 1992, the Army has redacted portions of a soldier’s SSN on documents. Depending on the circumstances, only the last 4 or 5 digits of an SSN are used currently.

2 . The ADCARS database has two aspects. First, each order in the system has been scanned into the database, creating a virtual image of the original document. Additionally, the database includes a text file of each order that facilitates key word searches for information.

3 . The Army maintains that this figure reflects the estimated cost for responding to Sherman’s entire request, 1965 to 1973, but redacting the SSNs. Absent the redaction, the Army estimates the cost of reproducing the necessary tapes to be about $15,000. The high cost of the redaction is caused by the need to manually redact a paper version of each award order, then re-scan the redacted order into the database.

4 . Sherman has waived any argument that he is entitled to a fee waiver and now argues "only that the redaction of social security numbers is inappropriate." At the same time, Sherman maintains that the Army's quoted price for providing the unredacted copy of the ADCARS database is three times higher than a bid by a third party contractor. Should he prevail in this appeal, Sherman claims that he should only be required to pay the lower price.

5 . The Supreme Court has divided the right to privacy into two related strands: "One is the interest in avoiding disclosure of personal matters, and another is the interest in independence in making certain kinds of important decisions." Whalen v. Roe, 429 U.S. 589, 599-600, 97 S.Ct. 869, 51 L.Ed.2d 64 (1977). This Court has interpreted the first strand to confer a right to protect from disclosure confidential or sensitive information held by the government. Fadjo v. Coon, 633 F.2d 1172, 1175 (5th Cir.1981). This right is sometimes referred to as the right to "informational privacy.” See, e.g., Crawford v. Trustee (In re Rausch), 194 F.3d 954, 958-59 (9th Cir.1999).

6 . The FOIA also exempts from disclosure "records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information ... (C) could reasonably be expected to constitute an unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(7)(C). While both exemptions 6 and 7(C) protect informational privacy interests, exemption 7(C) provides broader protection because it does not require that an invasion be "clearly” unwarranted. See United States Dep't of Defense v. Federal Labor Relations Auth., 510 U.S. 487, 496 n. 6, 114 S.Ct. 1006, 127 L.Ed.2d 325 (1994); Halloran v. Veterans Admin., 874 F.2d 315, 319 (5th Cir.1989). In this regard, "[ejxemptions 7(C) and 6 differ in the magnitude of the public interest that is required to override the respective privacy interests protected by the exemptions.” Dep’t of Defense, 510 U.S. at 496 n. 6, 114 S.Ct. 1006. That difference aside, the manner in which courts analyze the applicability of exemption 7(C) is the same as that used with respect to exemption 6. See id.

7 . The Army has not argued that the Privacy Act bars disclosure of the SSNs in this case. We note that incorporation of the Privacy Act into our analysis would not alter our resolution of the case. The Privacy Act bars a government agency from disclosing SSNs unless, inter alia, disclosure is required by the FOIA. See 5 U.S.C. § 552a(b)(2). The FOIA requires disclosure of Sherman’s entire request unless an exemption supports redaction of SSNs. Hence, even starting from the Privacy Act, the focus of our analysis properly falls on the applicability of exemption 6 of the FOIA.

8 . Exemption 5 applies to "inter-agency or in-tra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation with the agency." 5 U.S.C. § 552(b)(5).

9 . .The district court in Shell Oil determined that the IRS could not rely on exemption 5 of the FOIA to prevent disclosure of IRS interpretations of the term "tar sand,” as defined in the Crude Oil Windfall Profit Tax Act of 1980, when the IRS had previously released its interpretation publicly. Shell Oil, 772 F.Supp. at 206. Like the court in Kimberlin, the Shell Oil court was animated by a fear of empowering agencies to selectively disclose materials publicly. See id. at 210. Thus, the court held that when an agency makes a voluntary, authorized disclosure of public information, whether the disclosure involved the actual release of documents or some sort of "off the record” statement or public reading, the relevant agency "waives any claim that the information is exempt from disclosure under the deliberate process privilege.” Id. at 209-10.

10 .The plaintiff sought copies of all DEA files that related to an investigation of former Vice President Dan Quayle and had been previously released to the press.

11 . We do not understand Sherman to argue that individual soldiers have waived their privacy interest in the public disclosure of their SSNs. Nevertheless, Sherman points out that Army regulations after 1968 required individuals drafted into or volunteering for service to submit their SSN. Sherman also refers to Army officials as stating that, to their knowledge, no service member ever objected to the use of an SSN. To the extent that Sherman suggests this evidence proves individual soldiers have consented to the public dissemination of their SSN, he is mistaken because the Army only purported to use SSNs for official purposes, not disclose them publicly.

12 . See, e.g., Fiduccia v. U.S. Dept. of Justice, 185 F.3d 1035, 1047 (9th Cir.1999) (concluding that Justice Department did not waive individual's privacy interest in investigation files recognized in exemption 7(C) by notifying public of ongoing criminal investigation involving individual); Halpem v. FBI, 181 F.3d 279, 297 (2d Cir.1999) ("Confidentiality interests [under exemption 7(C)] cannot be waived through prior public disclosure or the passage of time.”); Computer Professionals for Social Responsibility v. U.S. Secret Service, 72 F.3d 897, 904 (D.C.Cir.1996) (recognizing that only individual with privacy interest in information could waive that interest for purposes of section 7(C) exemption); Massey v. F.B.I., 3 F.3d 620, 624 (2nd Cir.1993) ( "[W]e are not convinced that the doctrine of waiver applies to exemption (b)(7)(C).”) Kiraly v. F.B.I., 728 F.2d 273, 279 (6th Cir.1984) (rejecting argument that by testifying in a trial related to a police investigation, an individual waived any privacy interest in FBI investigation records protected from public dissemination by exemption 7(C)).

13 .See, e.g., Cottone v. Reno, 193 F.3d 550, 553 (D.C.Cir.1999) (stating that materials otherwise exempt pursuant to exemption 3 lose their privileged status under FOIA once they find their way into the public domain); City of Virginia Beach, Va. v. United States Dep't of Commerce, 995 F.2d 1247, 1253 (4th Cir.1993) (agency may waive exemption 3 protection of documents protected by the deliberative process privilege through voluntary, authorized release of material to a nongovernmental recipient); U.S. v. Metropolitan St. Louis Sewer Dist. (MSD), 952 F.2d 1040, 1045 (8th Cir.1992) (recognizing that government could waive its own privacy interest in confidential documents, protected in exemption 5, by publicly disclosing them).

14 . We take notice of the fact that the Supreme Court has reserved judgment on the role of the so-called "derivative-use theory” in exemption 6 balancing. See Ray, 502 U.S. at 179, 112 S.Ct. 541; id. at 179-81, 112 S.Ct. 541 (Scalia, J. concurring). Under the derivative use theory, a court could consider whether information, which standing alone is not private, might nevertheless be used to uncover information that is private. Id. at 177-79, 112 S.Ct. 541 (majority opinion). Similarly, information requested might not be of general public concern, but could be used to locate or create information that is of public concern. Id. Our analysis does not implicate the derivative use theory. In assessing the Army's claim our focus is "solely upon what the requested information reveals, not what it might lead to.” Id. (Scalia, J. concurring) (citing Arieff v. United States Dept. of Navy, 712 F.2d 1462, 1468 (D.C.Cir.1983) (Scalia, J.)). Sherman’s FOIA request reveals SSNs. Those SSNs are substantially private because of the identity fraud issues that they implicate.