IKUTA, Circuit Judge

Michael W. Pearson (argued), Curry Pearson & Wooten PLC, Phoenix, Arizona, for Plaintiff-Appellant.

Paul A. Bullis (argued), Assistant United States Attorney; Krissa M. Lanham, Deputy Appellate Chief; Elizabeth A. Strange, First Assistant United States Attorney; United States Attorney’s Office, Phoenix, Arizona; for Defendants-Appellees.

Before: Richard R. Clifton, Sandra S. Ikuta, and Michelle T. Friedland, Circuit Judges.

IKUTA, Circuit Judge: Plaintiff Jorge Rojas filed several requests under the Freedom of Information Act, 5 U.S.C. § 552 (FOIA), and the Privacy Act of 1974, 5 U.S.C. § 552a, with the Federal Aviation Administration (FAA), seeking records related to the Biographical Assessment, a screening tool introduced by the FAA in 2014 as part of the air traffic controller hiring process. In response to Rojas’s requests, the FAA produced hundreds of pages of records, but withheld scoring information for the Biographical Assessment; the personal, non-FAA email addresses of FAA employees; and hundreds of emails that it concluded fell within exemptions to FOIA and the Privacy Act, or were not agency records. The district court held that the FAA properly withheld information and documents. For the reasons that follow, we affirm in part, reverse in part, and vacate and remand in part.

I

Although FOIA and the Privacy Act are different in design and scope, they both contemplate that members of the public will have access to public records, subject to specified exemptions.

FOIA was enacted in 1966 to facilitate public access to "any and all records not exempt from disclosure." Exner v. Fed. Bureau of Investigation , 612 F.2d 1202, 1203 (9th Cir. 1980) ; see also Forest Serv. Emps. for Envtl. Ethics v. U.S. Forest Serv. , 524 F.3d 1021, 1023 (9th Cir. 2008). Under FOIA, "each agency, upon any request for records which (i) reasonably describes such records and (ii) is made in accordance with published rules stating the time, place, fees (if any), and procedures to be followed, shall make the records promptly available to any person." 5 U.S.C. § 552(a)(3)(A). A district court "has jurisdiction to enjoin the agency from withholding agency records and to order the production of any agency records improperly withheld." Id. § 552(a)(4)(B). Therefore, when an agency withholds documents, a threshold inquiry is whether they constitute "agency records." U.S. Dep’t of Justice v. Tax Analysts , 492 U.S. 136, 142, 109 S.Ct. 2841, 106 L.Ed.2d 112 (1989) (quoting Kissinger v. Reporters Comm. for Freedom of Press , 445 U.S. 136, 150, 100 S.Ct. 960, 63 L.Ed.2d 267 (1980) ). "The burden is on the agency to demonstrate, not the requester to disprove, that the materials sought are not ‘agency records’ or have not been ‘improperly’ ‘withheld.’ " Id. at 142 n.3, 109 S.Ct. 2841.

While FOIA "establishes a judicially enforceable public right" to secure access to government records, it also "contemplates that some information may legitimately be kept from the public." Elec. Frontier Found. v. Office of the Dir. of Nat’l Intelligence , 639 F.3d 876, 882–83 (9th Cir. 2010) (internal quotation marks omitted), abrogated on other grounds by Animal Legal Def. Fund v. U.S. Food & Drug Admin. , 836 F.3d 987, 989 (9th Cir. 2016) (en banc) (per curiam) ("ALDF "). The statute contains nine exemptions, pursuant to which federal agencies can withhold information otherwise subject to FOIA’s disclosure requirement. Id. at 883 ; 5 U.S.C. § 552(b)(1)–(9). Exemption 2 provides that the disclosure requirement "does not apply to matters that are ... related solely to the internal personnel rules and practices of an agency." Id. § 552(b)(2). Exemption 6 provides that FOIA does not apply to "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy." Id. § 552(b)(6).

Because of FOIA’s "strong presumption in favor of disclosure," U.S. Dep’t of State v. Ray , 502 U.S. 164, 173, 112 S.Ct. 541, 116 L.Ed.2d 526 (1991), these exemptions must be "given a narrow compass." Tax Analysts , 492 U.S. at 151, 109 S.Ct. 2841. "[A]n agency that invokes one of the statutory exemptions to justify the withholding of any requested documents or portions of documents bears the burden of demonstrating that the exemption properly applies to the documents." Lahr v. Nat’l Transp. Safety Bd. , 569 F.3d 964, 973 (9th Cir. 2009).

Though "the Privacy Act and FOIA substantially overlap ... the two statutes are not completely coextensive." Greentree v. U.S. Customs Serv. , 674 F.2d 74, 78 (D.C. Cir. 1982). While "FOIA was intended to increase the public’s access to governmental information and was drafted with a strong presumption for disclosure to allow public scrutiny of government processes," Pierce v. Dep’t of U.S. Air Force , 512 F.3d 184, 191 (5th Cir. 2007), the Privacy Act’s primary goal is to "protect the privacy of individuals through regulation of the collection, maintenance, use, and dissemination of information by federal agencies," Rouse v. U.S. Dep’t of State , 567 F.3d 408, 413 (9th Cir. 2009) (internal quotation marks omitted); see also 5 U.S.C. § 552a. The Privacy Act accordingly "provides agencies with ‘detailed instructions for managing their records.’ " Rouse , 567 F.3d at 413 (quoting Doe v. Chao , 540 U.S. 614, 618, 124 S.Ct. 1204, 157 L.Ed.2d 1122 (2004) ). Nevertheless, as part of the effort to give individuals more control over information about themselves, the Privacy Act gives individuals a right to gain access to government records concerning themselves "upon request." 5 U.S.C. § 552a(d)(1).

As with the public access right granted by FOIA, the Privacy Act’s private access right is subject to numerous exemptions. One of these exemptions provides that an agency may refrain from disclosing records comprised of "testing or examination material used solely to determine individual qualifications for appointment or promotion in the Federal service the disclosure of which would compromise the objectivity or fairness of the testing or examination process." Id. § 552a(k)(6) ("Exemption (k)(6)"). As with FOIA, if an agency seeks to invoke an exemption under the Privacy Act, "the burden is on the agency" to show that withholding the document was justified. Id. § 552a(g)(3)(A).

II

We now turn to the facts giving rise to this appeal.

A

The FAA is responsible for regulating civil aviation, including air traffic management, throughout the United States. It retains more than 14,000 air traffic control specialists who work around the clock, communicating with pilots, monitoring the flow of airplanes, and maintaining safe airways for 2.7 million passengers who fly each day. See Fed. Aviation Admin., Aviation Careers (last modified July 31, 2019), https://www.faa.gov/jobs/career_fields/aviation_careers. Because an air traffic controller’s work contains no margin for error and requires unbroken concentration, the job can be grueling. Working as an air traffic controller is considered to be among the highest pressure jobs in America. For this reason, the FAA puts new air traffic controllers through an intense training regimen and requires that air traffic controllers retire by age 56.

Before changing its hiring system in 2014, the FAA gave hiring preference to air traffic controller applicants who earned aviation degrees from FAA-accredited schools (called Collegiate Training Initiative, or CTI, schools) and who scored highly on the Air Traffic Selection and Training examination (AT-SAT test), a proctored, eight-hour examination that tested cognitive skills related to working as an air traffic controller. In 2013, there were about 3,000 college graduates with FAA accredited degrees. These individuals were placed on the FAA’s Qualified Applicant Register and were therefore eligible to apply for air traffic controller job openings.

Around this time, the FAA projected that there would be a surge in retirement of the air traffic controllers who had been hired in 1981 in the wake of the Professional Air Traffic Controllers Association strike. See James L. Outtz & Paul J. Hanges, FAA, Barrier Analysis of the Air Traffic Control Specialists Centralized Hiring Process 14 (2013). Some 11,000 air traffic controllers were expected to leave the agency by 2014, and the FAA developed a plan to hire some 12,500 controllers during the period from 2013 to 2023. Id. In connection with this planned hiring surge, the FAA commissioned a report, the "Barrier Analysis of the Air Traffic Control Specialists (ATCS) Centralized Hiring Process" ("Barrier Analysis"), to determine whether its workplace was "free of barriers that impede full opportunities to all persons in the workplace." Id. After reviewing the FAA’s current hiring practices and levels of diversity in its workforce, the Barrier Analysis recommended that the FAA place less weight on the AT-SAT as a qualifying metric because parts of the test showed "substantial problems with regard to [race and national origin] and gender diversity." Id. at 20, 23–24.

Based on the results of the Barrier Analysis, the FAA announced "an historic commitment to transform the Federal Aviation Administration (FAA) into a more diverse and inclusive workplace that reflects, understands, and relates to the diverse customers we serve." Id. at 1. Consequently, in 2014, the FAA significantly changed its hiring system in order to recruit more diverse candidates. The FAA eliminated the approximately 3,000 existing applicants from its Qualified Applicant Register. Going forward, the FAA would not consider applicants’ "well-qualified" designations on the AT-SAT or their CTI qualifications, which had previously given applicants a hiring preference. Instead, as part of the initial screening of applicants, the FAA stated it would deem candidates to be qualified if they had a high school diploma, spoke English, and passed the FAA’s new test, called the Biographical Assessment.

The Biographical Assessment is a 62-question multiple choice test designed to assess candidates based on their aviation aptitude and likelihood of completing air traffic controller training. According to press reports, the Biographical Assessment includes multiple choice questions about such topics as: "[t]he number of different high school sports" a candidate played, or the age at which the candidate first started to earn money. Other questions included: "How would you describe your ideal job? What has been the major cause of your failures? More classmates would remember me as humble or dominant?" Unlike the AT-SAT testing process, applicants took the Biographical Assessment on their personal computers, without proctoring. Passage rates for the Biographical Assessment were low; of 28,000 applicants who took the Biographical Assessment in 2015, fewer than 10% passed. The scoring information for this test was confidential; the FAA did not release the minimum passing score for the Biographical Assessment, and individual applicants were told only if they had passed or failed and were not informed of their individual scores. The FAA required that an applicant pass the Biographical Assessment to take the AT-SAT.

The FAA’s new hiring system generated significant press attention. Several newspapers discussed the FAA’s "mov[e] away from merit-based hiring criteria in order to increase the number of women and minorities who staff airport control towers." Jason L. Riley, Opinion, Affirmative Action Lands in the Air Traffic Control Tower , Wall St. J. (June 2, 2015). Flying Magazine reported that the FAA’s new hiring system resulted in the rejection of "top ranked students from highly respected [air traffic controller] programs .... based on the bio-data assessment results." Pia Bergovist, Is the FAA Rejecting the Best Controllers? , Flying Magazine (Dec. 2, 2014).

In addition, one news network reported (after a six-month investigation) that an FAA employee who was a member of the National Black Coalition of Federal Aviation Employees (NBCFAE) was leaking Biographical Assessment answers to student members of the NBCFAE. Trouble in the Skies , Fox Business News (May 20, 2015). According to the "Trouble in the Skies" report, a few days after the FAA hiring process started, a candidate for an air traffic controller job received a recorded voice-text message from Shelton Snow, an FAA air traffic controller and then-president of the NBCFAE’s Washington Suburban Chapter. In the recorded message, Snow stated he was aware that candidates "have been getting rejection notices" due to failing the Biographical Assessment test. To prevent NBCFAE applicants from failing the Biographical Assessment, Snow offered "some valuable pieces of information that [he had] taken a screen shot of and [that he was] going to send that to you via email." The screen shots were intended to show the correct answers to the Biographical Assessment; Snow explained he was sharing these screen shots so that as candidates "progress through the stages [of the test]," the candidates could "refer to those images so you will know which icons you should select." Snow stated he was "about 99 point 99 percent sure that it is exactly how you need to answer each question in order to get through the first phase." In addition, the recorded message stated that FAA "HR Representatives" could "sign off on [the Biographical Assessment] before you actually click it."

The FAA’s changes to its hiring system also captured the attention of legislators and public officials. In June 2014, ten members of Congress sent a letter to the FAA expressing concerns and asking for information, including "metrics on how the new hiring process has enhanced aviation safety overall." After "Trouble in the Skies" was published, fourteen members of Congress sent a follow-up letter asking the FAA to investigate "the report of possible cheating in the latest hiring process, facilitated by the actions of an FAA employee." Finally, a member of the U.S. Commission on Civil Rights expressed concerns that the FAA’s new hiring procedures discriminated on the basis of race against applicants in the prior pool.

B

Jorge Rojas was enrolled at an accredited CTI school when the FAA changed its hiring system. Pursuant to the FAA’s new screening process, Rojas took the Biographical Assessment, and was one of the many applicants who failed the test. This made him ineligible to apply for an air traffic controller position. Suspecting that the FAA was engaging in discriminatory practices and that agency employee Shelton Snow was engaged in misconduct, Rojas sought to shed light on the FAA’s conduct by obtaining more information about the FAA’s change in hiring practices, its use of the Biographical Assessment, and the cheating that had reportedly taken place during the testing process.

On June 25, 2015, Rojas submitted a FOIA request to the FAA (FOIA Request No. 9300), seeking all emails and chats sent to and from Shelton Snow for the periods from December 1, 2013, to March 30, 2014, and from January 1, 2015, to June 24, 2015. A few days later, Rojas submitted a second FOIA request (FOIA Request No. 9333) and a Privacy Act request, in which he requested the minimum passing score for the Biographical Assessment, his own Biographical Assessment score, and a copy of applicant information for a particular air traffic controller opening.

The FAA failed to respond to these requests within the 20 days provided by statute. See 5 U.S.C. § 552(a)(6)(A)(i). In August 2015, Rojas sued the FAA, alleging that it had violated FOIA by failing to produce responsive documents. In October 2015, the FAA provided a response to FOIA Request No. 9333, stating that it was withholding the minimum passing score and Rojas’s score on the Biographical Assessment under FOIA Exemption 2, which exempts from disclosure materials "related solely to the internal personnel rules and practices of an agency." 5 U.S.C. § 552(b)(2). The FAA also denied Rojas’s Privacy Act request for the score Rojas had received on the Biographical Assessment, citing Exemption (k)(6), which exempts specified testing and examination material.

In February 2016, the FAA gave Rojas a number of documents in response to Request 9300, which had sought Shelton Snow’s emails and chats. The FAA redacted the personal email addresses of FAA employees from the documents provided, citing FOIA Exemption 6, which exempts from disclosure "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy." 5 U.S.C. § 552(b)(6). At least two of the redacted documents produced under seal indicated that FAA employees sent emails relating to FAA’s changes to its hiring system to other FAA employees at their personal email addresses. One email from an FAA employee asked other employees to refer any calls from the investigative reporter who authored "Trouble in the Skies" to FAA Public Affairs. This email was forwarded to other FAA employees, one of whom forwarded the email to Shelton Snow at his FAA account as well as to two redacted email accounts. In another email, Snow sent the Barrier Analysis from his FAA account to two redacted email addresses.

The FAA also withheld 202 emails and attachments on the ground that they were not agency records subject to FOIA. The withheld emails and attachments included emails sent to or received from Snow in his capacity as a member of the NBCFAE, emails to Snow from the National Air Traffic Controllers Association (the exclusive bargaining representative for air traffic controllers employed by the FAA), personal emails between Snow and his friends or acquaintances, and unsolicited advertisements. One of the withheld documents contained an inquiry about whether study information for the FAA’s new aptitude test was available online. The FAA stated that each withheld document was "[n]ot an agency record."

After providing these documents to Rojas, the FAA moved for summary judgment on the ground that the information it redacted was statutorily exempt from disclosure and the emails and attachments it withheld were not agency records subject to FOIA. In support of its claim that disclosing Rojas’s test scores would compromise the fairness of the Biographical Assessment, the FAA submitted a sworn declaration from Rickie Cannon, the Deputy Assistant Administrator for Human Resources at the FAA, which described the FAA’s discovery of a cheating scheme by air traffic controller applicants. These applicants had compiled their answers to specific Biographical Assessment questions to determine which answers to specific questions were correlated with passing the Biographical Assessment. According to Cannon, "[a]n applicant’s knowledge of his or her test score is critical to this approach," and therefore providing test scores to applicants could further a cheating scheme. Rojas opposed the summary judgment motion and brought a cross-motion for summary judgment arguing that the FAA’s claimed exemptions failed as a matter of law. After an in camera review of the unredacted documents, the court agreed with the FAA’s invocation of FOIA Exemptions 2 and 6 and Privacy Act Exemption (k)(6), and held that the withheld documents were "personal emails regarding Snow that do not respond to Rojas’s FOIA requests or the mission of the FAA." Accordingly, the court granted summary judgment in favor of the FAA. Rojas timely appealed.

III

We review de novo the district court’s order granting summary judgment. ALDF , 836 F.3d at 990. "[W]e view the evidence in the light most favorable to the nonmoving party, determine whether there are any genuine issues of material fact, and decide whether the district court correctly applied the relevant substantive law." Id. at 989. We have jurisdiction to review the district court’s grant of summary judgment under 28 U.S.C. § 1291.

A

We first consider Rojas’s argument that the district court erred in holding that the Biographical Assessment’s minimum passing score and his own personal score were exempt from disclosure under FOIA Exemption 2 and Privacy Act Exemption (k)(6) as a matter of law.

Under Exemption 2, FOIA’s access requirements do not apply to matters that are "related solely to the internal personnel rules and practices" of the FAA. 5 U.S.C. § 552(b)(2). The Supreme Court has construed this exemption in detail, defining most of the individual words. See Milner v. Dep’t of Navy , 562 U.S. 562, 569, 131 S.Ct. 1259, 179 L.Ed.2d 268 (2011). According to Milner , the word "solely" has its dictionary definition of "exclusively or only." Id. at 570 n.4, 131 S.Ct. 1259 (internal quotation marks omitted). Again using the dictionary, the word "internal" means that "the agency must typically keep the records to itself for its own use." Id. (internal quotation marks omitted). The term "personnel" refers to "the selection, placement, and training of employees." Id. at 569, 131 S.Ct. 1259 (internal quotation marks omitted). And "personnel rules and practices" means the agency’s "rules and practices dealing with employee relations or human resources," including "such matters as hiring and firing, work rules and discipline, compensation and benefits." Id. at 570, 131 S.Ct. 1259. Milner did not define the word "related," but following the Supreme Court’s lead, we look to its dictionary definition, which is "connected by reason of an established or discoverable relation." Related , Webster’s Third New International Dictionary 1916 (3d ed. 2002) (hereinafter Webster’s). Reading these definitions together, Exemption 2 applies to internal rules and practices exclusively connected with "the selection, placement, and training of employees," including "hiring and firing." Milner , 562 U.S. at 569–70, 131 S.Ct. 1259.

Applying this definition, we conclude that the FAA’s rules and practices for scoring tests relating to the selection of employees, including its rules and practices regarding the minimum passing score and the score for a particular test, qualify under Exemption 2. It is undisputed that the FAA’s rules and practices for scoring the Biographical Assessment are internal and that the test is used solely as one step in the process of selecting individual employees. Although Rojas argues that we must construe Exemption 2 narrowly, see id. at 571, 131 S.Ct. 1259, Rojas fails to explain why the plain language of Exemption 2 does not include internal practices for selecting employees. Because Rojas has not raised a genuine issue of material fact as to whether the minimum passing score and Rojas’s own score fall under the scope of Exemption 2, the district court properly granted summary judgment to the FAA on this issue.

We next turn to Rojas’s arguments that he was entitled to his individual score and the minimum passing score under the Privacy Act.

The Privacy Act allows individuals to obtain certain records relating to themselves. Specifically, 5 U.S.C. § 552a(a)(4) defines the term "record" as "any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph." And subsection (d) governs access to such records, stating that agencies shall "upon request by any individual to gain access to his record or to any information pertaining to him which is contained in the system, permit him ... to review the record and have a copy made of all or any portion thereof in a form comprehensible to him. § 552a(d)(1).

Exemption (k)(6), however, exempts from these access provisions "testing or examination material used solely to determine individual qualifications for appointment or promotion in the Federal service the disclosure of which would compromise the objectivity or fairness of the testing or examination process." 5 U.S.C. § 552a(k)(6). The parties do not dispute whether the scores constitute "information about an individual" that may be obtained under the Privacy Act. Nor do they dispute that the Biographical Assessment constitutes "testing or examination material" that is used to determine whether an applicant qualifies for the next step in the selection process to become an air traffic controller. Instead, Rojas argues that the minimum passing score for the Biographical Assessment, and his own test score, do not qualify for Exemption (k)(6) because they are not testing material, but rather are the end product of the testing process.

We disagree. Assuming both scores may be requested under the Privacy Act in the first instance, Exemption (k)(6) exempts them from disclosure. The term "testing material" refers to the items needed to conduct a test or examination to determine an individual’s proficiency or knowledge. See Testing , Webster’s 2362 (defining "testing" as "an act or process of subjecting to test"); Test , id. (defining "test" as "a technique for measuring objectively an individual’s personal characteristics, potentialities, or accomplishments" or "an examination to determine factual knowledge or mental proficiency"); Material , id. at 1392 (defining "material" as an "apparatus (as tools or other articles) necessary for doing or making something"). Test scores are part of the material necessary to evaluate an individual’s proficiency or knowledge. We therefore conclude that test scores are part of the "testing or examination material" used to determine individual qualifications for purposes of Exemption (k)(6).

We must next consider whether disclosing the requested scores would "compromise the objectivity or fairness of the testing or examination process" that the FAA uses to evaluate applicants. 5 U.S.C. § 552a(k)(6). The district court relied on the FAA’s affidavit from Deputy Assistant Administrator for Human Resources Rickie Cannon to conclude that a release of the test scores would have such an effect. Rojas argues that this was an error, because the affidavit submitted by the FAA failed to explain how release of Rojas’s raw test score could be used to cheat, and that the affidavit relied on mere speculation that applicants would or could engage in a cheating conspiracy.

We reject these arguments. The FAA’s detailed affidavit provided evidence that prior applicants had worked together to examine the correlation between their answers to the Biographical Assessment and their passing or failing scores in an effort to determine which answers were more likely to be correct. The affidavit also asserted that the Biographical Assessment’s scoring key could be determined based on a large enough pool of applicant scoring information. Although Rojas argues that his request is limited to his own score, the FAA expresses the concern that other applicants could rely on the same arguments to obtain their own scores and asserts that the history of the cheating scandal here indicates they would be likely to do so. Rojas did not offer any evidence contradicting this affidavit, so the district court did not err in accepting the FAA’s factual assertions. Accordingly, Rojas has not raised a genuine dispute as to whether applicants could use their test scores to undermine the integrity of the Biographical Assessment. Because such a result would "compromise the objectivity or fairness of the testing or examination process," 5 U.S.C. § 552a(k)(6), we affirm the district court’s grant of summary judgment to the FAA based on Exemption (k)(6) of the Privacy Act, which allowed the FAA to withhold from Rojas the minimum passing score and his own score on the Biographical Assessment.

B

Rojas next argues that the district court erred in ruling that the FAA could redact the personal email addresses of FAA employees that appeared in Snow’s emails because those addresses were exempt from disclosure under FOIA Exemption 6.

Exemption 6 provides that FOIA does not apply to "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy." Id. § 552(b)(6). We employ a two-prong inquiry to determine whether the government has correctly withheld records under Exemption 6. First, we determine "whether the information is contained in a personnel, medical, or similar file." Elec. Frontier Found ., 639 F.3d at 886 (internal quotation marks omitted). Second, we determine "whether release of the information would constitute a clearly unwarranted invasion of the person’s privacy." Id.

We begin by considering whether the redacted email addresses here are contained in a "similar file." As construed by the Supreme Court, "similar file" applies broadly to government records containing information "which can be identified as applying to that individual." U.S. Dep’t of State v. Wash. Post Co. , 456 U.S. 595, 602, 102 S.Ct. 1957, 72 L.Ed.2d 358 (1982) (internal quotation marks omitted). Therefore, "[g]overnment records containing information that applies to particular individuals satisfy the threshold test of Exemption 6." Van Bourg, Allen, Weinberg & Roger ex rel. Carpet, Linoleum, & Soft Tile Workers Union, Local 1288 v. N.L.R.B. , 728 F.2d 1270, 1273 (9th Cir. 1984). Because "personnel and medical files" are likely to contain information that is not intimate, "such as place of birth, date of birth, date of marriage, employment history, and comparable data," the term "similar files" is likewise not "limited to files containing intimate details and highly personal information." Wash. Post Co. , 456 U.S. at 600, 102 S.Ct. 1957 (internal quotation marks omitted). In light of the Supreme Court’s interpretation of "similar files," we conclude that government records containing personal email addresses constitute "similar files," because a personal email address "can be identified as applying to [a particular] individual." See id. at 602, 102 S.Ct. 1957 (internal quotation marks omitted).

Second, we consider whether the disclosure of the personal email addresses would amount to "a clearly unwarranted invasion of that person’s privacy." Id. A privacy interest is cognizable under Exemption 6 if it is "nontrivial," that is, "more than ... de minimis." Yonemoto v. Dep’t of Veterans Affairs , 686 F.3d 681, 693 (9th Cir. 2012) (alteration in original) (internal quotation marks omitted), overruled on other grounds by ALDF , 836 F.3d at 989. This is not a demanding standard; rather, a disclosure implicates a cognizable privacy interest if it affects either "the individual’s control of information concerning his or her person," U.S. Dep’t of Justice v. Reporters Comm. for Freedom of the Press , 489 U.S. 749, 763, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989), or would possibly expose the individual to harassment, see Ray , 502 U.S. at 176–77, 112 S.Ct. 541. There is at least a "minor privacy interest" in personal email addresses, Elec. Frontier Found. , 639 F.3d at 888, and we conclude that the FAA employees have such an interest here.

If the agency establishes a nontrivial privacy interest, the burden shifts to the requester to establish that the public interest in the information outweighs the privacy interest. See Cameranesi v. U.S. Dep’t of Def. , 856 F.3d 626, 637 (9th Cir. 2017). "[T]he only relevant public interest in the FOIA balancing analysis is the extent to which disclosure of the information sought would shed light on an agency’s performance of its statutory duties or otherwise let citizens know what their government is up to." Bibles v. Or. Nat. Desert Ass’n , 519 U.S. 355, 355–56, 117 S.Ct. 795, 136 L.Ed.2d 825 (1997) (per curiam) (alterations omitted). The information requested must "appreciably further" the asserted public interest. U.S. Dep’t of Def. v. Fed. Labor Relations Auth. , 510 U.S. 487, 497, 114 S.Ct. 1006, 127 L.Ed.2d 325 (1994). If the requestor fails to meet the burden of showing that the public interest outweighs the privacy interest, then "the invasion of privacy is unwarranted," and Exemption 6 applies. Cameranesi , 856 F.3d at 637 (internal quotation marks omitted) (quoting Nat’l Archives & Records Admin. v. Favish , 541 U.S. 157, 172, 124 S.Ct. 1570, 158 L.Ed.2d 319 (2004) ).

When a requester asserts only the public interest in demonstrating "that responsible officials acted negligently or otherwise improperly in the performance of their duties," Tuffly v. U.S. Dep’t of Homeland Sec. , 870 F.3d 1086, 1095 (9th Cir. 2017) (internal quotation marks omitted) (quoting Favish , 541 U.S. at 174, 124 S.Ct. 1570 ), "the requester must establish more than a bare suspicion" that the officials behaved improperly, Favish , 541 U.S. at 174, 124 S.Ct. 1570. The evidence must "warrant a belief by a reasonable person that the alleged Government impropriety might have occurred"; otherwise, there is no "counterweight on the FOIA scale for the court to balance against the cognizable privacy interests in the requested records." Id. at 174–75, 124 S.Ct. 1570.

We have also recognized that "[t]here is a clear public interest in public knowledge of the methods through which well-connected corporate lobbyists wield their influence." Elec. Frontier Found. , 639 F.3d at 887. This is an example of "[o]fficial information that sheds light on an agency’s performance of its statutory duties," id. (alteration in original) (quoting Reporters Comm. , 489 U.S. at 773, 109 S.Ct. 1468 ), because "[w]ith knowledge of the lobbyists’ identities, the public will be able to determine how the Executive Branch used advice from particular individuals and corporations in reaching its own policy decisions," id. at 888. Due to the strong public interest in knowing the identities of lobbyists, we noted that disclosure of "a particular email address" would be allowed if such disclosure "is the only way to identify" the person lobbying an agency regarding its public business. Id. In that circumstance, the privacy interest in that email address may not counterbalance the public’s "robust interest" in knowing who is "seeking to influence" an agency. Id. at 888–89.

Here, because the FAA has established a nontrivial privacy interest in its employees’ email addresses, the burden shifts to Rojas to establish that the public interest in the information outweighs the privacy interest. Rojas argues that there is a substantial public interest in evaluating whether FAA officials intentionally acted in a manner that compromised the fairness of the hiring process for air traffic controllers. Without the addresses, Rojas asserts, it is impossible to determine which employees were involved in the alleged conspiracy to help certain applicants or to understand the information flow regarding the alleged conspiracy within the agency. Further, Rojas argues that government employees have diminished privacy interests where the information sought may disclose misconduct.

Although this issue is quite close, FOIA’s "strong presumption in favor of disclosure," Ray , 502 U.S. at 173, 112 S.Ct. 541, leads us to conclude that where FAA employees used personal email addresses to receive information relating to the FAA’s change in selecting air traffic controllers, Rojas has carried his burden of showing that the FAA employees’ privacy interest in their personal email addresses is outweighed by the "robust interest of citizens’ right to know ‘what their government is up to’ " in making the changes it did. Elec. Frontier Found. , 639 F.3d at 888 (quoting Reporters Comm. , 489 U.S. at 773, 109 S.Ct. 1468 ). There is a clear public interest in assessing FAA employees’ use of information relating to the FAA’s selection of air traffic controllers. Further, in this case, providing the "particular email address" receiving the information from the FAA email account "is the only way to identify" the FAA employees involved in discussing these issues.

Because the email in which Snow forwarded the Barrier Analysis to personal email accounts relates to the FAA’s change in hiring practices, we conclude that the public interest in identifying the individuals receiving this information outweighs the privacy interests of those individuals. However, the email that requests employees to refer calls from the reporter who authored "Trouble in the Skies" to FAA Public Affairs does not relate to the FAA’s change in selecting air traffic controllers. Therefore, the privacy interests of the individuals receiving this information are not outweighed by the public interest in what the FAA was "up to" when it changed its hiring practices.

Moreover, although Rojas is required to show more than a "bare suspicion in order to obtain disclosure," he has overcome that hurdle to the extent he asserts the public’s interest of shedding light on potential official misconduct. Favish , 541 U.S. at 174, 124 S.Ct. 1570. Based on the evidence provided, a reasonable person would believe that "the alleged Government impropriety might have occurred" in the FAA’s decision to change its hiring practices. Id. ; see also Union Leader Corp. v. U.S. Dep’t of Homeland Sec. , 749 F.3d 45, 56 (1st Cir. 2014) (noting that evidence of misconduct was "hardly conclusive evidence of negligence, or other wrongdoing," but was enough to satisfy the standard set out in Favish ). Because Rojas has overcome "the presumption of legitimacy accorded to official conduct," Cameranesi , 856 F.3d at 640, we conclude there is no genuine issue of material fact that Exemption 6 does not apply to the personal email addresses of the recipients of the Barrier Analysis document containing FAA information relating to the selection of air traffic controllers. That said, the public’s interest is limited to learning their identity. Therefore, the FAA could satisfy its obligation under FOIA by identifying the email recipients by name, instead of revealing the recipients’ personal email addresses.

C

We next turn to the question whether the 202 emails withheld by the FAA were "agency records" subject to FOIA’s disclosure requirements. If the emails are not "agency records," the district court lacked authority to compel their disclosure. See Tax Analysts , 492 U.S. at 142, 109 S.Ct. 2841. The agency bears the burden of showing that the materials sought are not "agency records." Id. at 142 n.3, 109 S.Ct. 2841.

Congress "did not provide any definition of ‘agency records’ in [FOIA]." Forsham v. Harris , 445 U.S. 169, 178, 100 S.Ct. 977, 63 L.Ed.2d 293 (1980). The Supreme Court has provided a two-prong test: a document is an agency record if (1) the agency "either create[d] or obtain[ed] the requested materials," and (2) the agency is "in control of the requested materials at the time the FOIA request is made." Tax Analysts , 492 U.S. at 144–45, 109 S.Ct. 2841 (internal quotation marks omitted).

The withheld emails at issue here were either sent to or received by Snow, an FAA employee, using his official FAA email account, and were maintained in the FAA’s computer servers. The parties do not dispute that these emails were created or obtained by the FAA. Consequently, the first prong of the Tax Analysts test is satisfied. See id. at 144, 109 S.Ct. 2841.

We therefore turn to the second prong, whether an agency is in "control" of the requested documents. Rojas argues that this prong is satisfied because all the withheld emails exist on the FAA’s servers and were generated while Snow was an FAA employee. In Rojas’s view, the FAA’s possession of the emails in its servers is sufficient to show that FAA has control of the emails. We reject a categorical rule that any document created by an agency employee and stored on an agency server is in the agency’s control. Rather, the question whether an agency is in "control" of requested documents requires a more complex analysis. In Tax Analysts , the Court determined that copies of judicial opinions and orders kept in official files for use by Department of Justice (DOJ) staff attorneys were controlled by DOJ because the agency obtained the opinions and maintained them in official case files. Id. at 146–47, 109 S.Ct. 2841. In reaching this conclusion, Tax Analysts provided guidance on what constitutes "control" for purposes of FOIA.

First, the agency must be "in control of the requested materials at the time the FOIA request is made." Id. at 145, 109 S.Ct. 2841. In this context, "control" means "in the agency’s possession," id. at 146, 109 S.Ct. 2841, although the Court held open the possibility that an agency might "control" documents that had been "purposefully routed" to another agency in order to avoid a FOIA request, id. at 146 n.6, 109 S.Ct. 2841. Tax Analysts rejected arguments that an agency lacked "control" ’ if it lacked authority to modify the document, stating that the "control inquiry focuses on an agency’s possession of the requested materials, not on its power to alter the content of the materials it receives." Id. at 147, 109 S.Ct. 2841. It also held that the purpose for which a record is created is not relevant to whether it is controlled by the agency; the definition of "agency records" may not turn "on the intent of the creator" because "[s]uch a mens rea requirement is nowhere to be found in the Act." Id. To the extent this first factor in the control prong of Tax Analysts focuses solely on the agency’s possession of a document, it resembles Rojas’s proposed rule.

But Tax Analysts did not define the term "control" merely as "possession." It also defined "control" to mean "that the materials have come into the agency’s possession in the legitimate conduct of its official duties," or "in connection with the transaction of public business." Id. at 145, 109 S.Ct. 2841 (emphasis omitted). This aspect of "control," the Court explained, accords with the holding from its prior opinion in Kissinger v. Reporters Committee for Freedom of the Press that "the term ‘agency records’ is not so broad as to include personal materials in an employee’s possession, even though the materials may be physically located at the agency." Id. Kissinger considered whether the notes that Henry Kissinger made while serving in the Office of the President (which is not an "agency" under FOIA) became "agency records" when Kissinger physically brought them to the State Department (which is an "agency" under FOIA) when he became Secretary of State. See 445 U.S. at 155–57, 100 S.Ct. 960. Because "[t]he papers were not in the control of the State Department at any time," were not "generated in the State Department," "never entered the State Department’s files, and they were not used by the Department for any purpose," the Court held they were not agency records. Id. at 157, 100 S.Ct. 960.

Relying primarily on Kissinger , the D.C. Circuit adopted a four-factor test for determining whether a document is in the control of an agency in connection with its official business. Judicial Watch, Inc. v. U.S. Secret Serv. , 726 F.3d 208, 218 (D.C. Cir. 2013). The first factor is "the intent of the document’s creator to retain or relinquish control over the records"; the second factor is "the ability of the agency to use and dispose of the record as it sees fit"; the third factor is "the extent to which agency personnel have read or relied upon the document"; and the fourth factor is "the degree to which the document was integrated into the agency’s record system or files." Tax Analysts v. U.S. Dep’t of Justice , 845 F.2d 1060, 1069 (D.C. Cir. 1988), aff’d , 492 U.S. 136, 109 S.Ct. 2841, 106 L.Ed.2d 112 (1989) (internal quotation marks omitted). Although the FAA asks us to adopt this test and use it to determine whether the emails at issue are agency records, we cannot fully embrace it. First, it was originally developed before the Supreme Court’s decision in Tax Analysts , see id. , and its first factor is in tension with the Court’s conclusion that "the intent of the creator of a document" is not relevant to a determination of whether the document is an agency record, Tax Analysts , 492 U.S. at 147, 109 S.Ct. 2841. Second, some of the D.C. Circuit’s factors are less helpful when applied to emails and other electronic records, as opposed to physical records more common when the factors were developed. For instance, whether an email is "integrated" into the agency’s record system or files is less meaningful today because email and other electronic records may be automatically stored on an agency’s server, and not "filed" in a record system in any formal way.

Rather than adopting the D.C. Circuit’s four-factor test, we hold that a court may consider a range of evidence to determine whether specified records are in the agency’s possession in connection with agency-related business, or instead involve personal matters not related to the agency’s "transaction of public business." See id. at 145, 109 S.Ct. 2841 (emphasis omitted). As suggested by the D.C. Circuit, evidence relating to the agency’s use of documents (including its system for preserving, retrieving, or disposing of the documents, and any reliance on the documents by agency employees) may be relevant to this inquiry. Agency records are not limited to documents that are preserved according to agency directions, however. Given that the term "record" includes electronic records, 5 U.S.C. § 552(f)(2), emails sent or received for agency-related business may be agency records, even if not stored in agency files in any formal sense. By contrast, emails or other documents that are unrelated to agency business are not agency records, even if they are stored on the agency’s server and used by an agency employee. See Kissinger , 445 U.S. at 155–56, 100 S.Ct. 960. Moreover, because there is no mens rea requirement for whether materials constitute agency records, Tax Analysts , 492 U.S. at 147, 109 S.Ct. 2841, agency records may include documents used by agency employees in connection with agency business, even if the employees were engaging in misconduct, cf. Restatement (Second) of Agency § 229 (1958) (listing factors to consider when determining whether an unauthorized action is nevertheless within the scope of an agent’s duties).

Applying the second prong of Tax Analysts (whether the agency is in control of the withheld materials at the time the FOIA request is made) to the facts of this case, we have no trouble concluding that the FAA possessed the withheld materials, because they were discovered in the FAA’s computer system. See 492 U.S. at 144, 109 S.Ct. 2841. But it is less clear whether the FAA possessed any of the documents in the conduct of its official duties or public business. Our independent review suggests that some of the withheld documents were not purely personal. For instance, because the FAA’s official business includes selecting and hiring air traffic controllers, the withheld email relating to study information for the FAA’s examination of applicants, may be in the FAA’s possession in connection with the transaction of public business. See id. at 145, 109 S.Ct. 2841. Nor is it clear that documents containing communications between an FAA employee and the NBCFAE (an association of FAA employees), or the National Air Traffic Controllers Association, are merely personal. If the FAA communicates or works with the NBCFAE or the NATCA in the conduct of its official duties or public business, for instance, then such communications could be in the FAA’s "control" as defined in Tax Analysts . See id. For example, should the FAA jointly sponsor programs or engage in bargaining with these organizations, communications regarding such matters may relate to public business.

The district court provided little explanation of its grant of summary judgment in favor of the FAA on this issue, stating only that the withheld documents were "personal emails regarding Snow that do not respond to Rojas’s FOIA requests or the mission of the FAA." Without more explanation, we cannot tell whether the district court appropriately considered the factors we set out today. Because in FOIA cases, a district court must provide sufficiently detailed disclosure of the factual and legal basis for its decision, see Van Bourg, Allen, Weinberg & Roger v. NLRB , 656 F.2d 1356, 1358 (9th Cir. 1981) (per curiam); Couveau v. Am. Airlines, Inc. , 218 F.3d 1078, 1081 n.3 (9th Cir. 2000) (per curiam), we think it prudent to remand to the district court to address this issue under the appropriate standards in the first instance. We therefore vacate the district court’s order granting summary judgment with respect to the 202 withheld emails and remand to the district court to apply Tax Analysts ’s second prong consistent with this opinion. See Van Bourg , 656 F.2d at 1358.

AFFIRMED IN PART, REVERSED IN PART, AND VACATED AND REMANDED IN PART.