Does FOIA Exemption 3 require Congress to name a specific statute, and how do I find which statutes qualify?

The short answer

FOIA Exemption 3 is unusual: it does not protect a category of information on its own. Instead, it acts as a bridge, allowing an agency to withhold records when a separate federal statute requires or permits that information to be kept secret. So Exemption 3 itself does not name any single statute. The protection comes from the outside law, and Exemption 3 simply incorporates it into FOIA.

What the outside statute must do

For another law to qualify as an Exemption 3 “withholding statute,” it generally must do one of two things:

• Require that the matter be withheld from the public in a way that leaves the agency no discretion, or
• Establish particular criteria for withholding, or refer to particular types of matters to be withheld.

In other words, Congress does not have to say the magic words “this is a FOIA Exemption 3 statute.” But the law must be specific enough that it clearly directs or authorizes withholding, rather than just generally discussing confidentiality. A vague reference to keeping things private usually will not qualify.

How to find which statutes qualify

There is no single permanent list fixed in law, because Congress can pass new qualifying statutes over time. Practical ways to identify them:

• Read the agency’s response and any Vaughn index. When an agency invokes Exemption 3, it must identify the specific underlying statute it is relying on.
• Consult Department of Justice guidance. The DOJ Office of Information Policy publishes detailed guidance and case-law summaries on Exemption 3 and the statutes courts have accepted.
• Check the agency’s published FOIA reports and rules, which often cite the statutes they commonly use.

Your rights as a requester

If you believe an Exemption 3 claim is wrong, you can administratively appeal, and the agency must justify both the statute and how it applies to your records. You can also explore related guidance under foia-public-records.

Remember that the federal FOIA generally gives agencies 20 business days to respond. State public-records laws have their own exemptions and timelines, so verify the rules for the jurisdiction you are dealing with.