Summary

  • GAO found that military personnel centers processed more than 390,000 FOIA and Privacy Act requests in fiscal years 2021–2025 while reporting 49 potential or confirmed improper releases of personal information affecting more than 1,000 service members. The 49 reports include incidents outside records-request processing.
  • Navy Personnel Command had one civilian processing FOIA requests during GAO's review; Navy data showed average processing time rising from 1.64 days in fiscal 2018 to 55.5 in fiscal 2024 and 77.4 by July 2025. Navy later hired another assistant. GAO called for workforce plans and a review of the Defense Health Agency's complex request workflow.

The file belongs to a person. The queue belongs to the custodian.

The GAO's October 2026 report describes a hard public duty. The Department of Defense and other custodians hold personnel and health records accumulated over a military career. A requester may be the service member, a representative or an unrelated third party. The custodian must determine what can be disclosed, obscure what cannot and deliver the permitted part without an indefinite wait. The file may run for years and include scanned pages; the redaction is still largely manual.

From fiscal years 2021 through 2025, military personnel centers processed more than 390,000 requests under the Freedom of Information Act and Privacy Act. The services reported 49 potential or confirmed breaches involving improper disclosure of personally identifiable information, affecting more than 1,000 service members. The figure is self-reported. It also covers more than errors in answering record requests: Navy officials said 15 of the 17 incidents reported for its personnel center involved unsecured email, not request processing. Treating 49 as a FOIA failure count would assign the wrong mechanism to many people whose data was exposed.

GAO tested the request process separately. Investigators submitted 26 deliberately flawed third-party personnel-record requests in a non-generalizable covert test. Eighteen had been processed for the result GAO analysed; one of those 18 improperly released information that should have been redacted. That one case is an observed failure of a particular control. It is not a population error rate. The test matters because the requester was a stranger and the mistake was a disclosure that review should have caught.

A desk with one worker and two clocks

At the time of GAO's review, Navy Personnel Command had one federal civilian handling its FOIA requests after a more senior colleague retired. Navy-provided data show average processing time rising from 1.64 days in fiscal 2018 to 55.5 days in fiscal 2024, then 77.4 days as of July 2025. These are historical averages, not a November 2026 stopwatch. Navy hired an assistant in late December 2025. By April 2026 it reported a backlog reduction plan involving two civilian employees and additional internal support. The later staffing action changes the situation; its measured effect on turnaround and accuracy is the next piece of evidence.

The agency has two clocks to watch. One tracks how long a lawful requester waits. The other counts the minutes available for a careful review before a document leaves the building. Slashing the second to improve the first invites an improper release. Treating a slow queue as the price of perfect caution gives the record keeper an incentive to leave the file untouched. GAO's recommendations ask each service to compare current and projected demand with the number of people available to process it. That analysis is less dramatic than a new portal and more likely to expose where the work actually piles up.

The full official report notes that 44 of the 49 reported breaches cited failure to follow policy or human error in the records. DOD said more than 90 percent were low-risk administrative errors; GAO did not independently verify severity for each case. Neither description erases the operating problem: a manual system with sensitive information crossing desks, email and disclosure decisions requires enough trained reviewers and a traceable second check. The 49 incidents cannot be collapsed into a single cause, but the custodian can still measure where each pathway failed.

Health records are a maze before anyone reaches the redaction

The Defense Health Agency faces a different choke point. Processors find health records in multiple data systems, assemble the responsive material and review it for disclosure. Officials said the workflow and system problems impede timely processing; large files and scanned pages make redaction especially burdensome. DHA has not assessed the current framework specifically for health-record request processing to find ways to simplify it. GAO recommended adding that assessment to a broader health-informatics study. Consolidation or automation might emerge from the study; the report does not establish either as an already proven fix.

GAO issued five recommendations: workforce planning for the Army, Navy, Marine Corps and Air Force, plus the DHA process assessment. DOD generally agreed. The practical outcome is not a memo saying the files are protected. It is service-by-service evidence of request volume, staffed capacity, turnaround and redaction accuracy, along with a map of where health records are retrieved and reviewed. A more complete staff roster without an observed reduction in delay and error would settle only the easiest part of the question.

Heng Lu's argument that control over an asset carries duties toward its user is a lens on the record keeper's position, not a source of military facts. A requested record has a custodian, even when a career's files are scattered across agencies. That custodian has a precise obligation: deliver the rightful record without giving its subject a privacy problem to solve later. The queue and the black marker sit on the same desk for a reason.

Sources