U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

44–117 PDF 2010

S. Hrg. 110–1025 

PROTECTING PERSONAL INFORMATION: IS THE 

FEDERAL GOVERNMENT DOING ENOUGH? 

HEARING 

BEFORE THE

COMMITTEE ON 

HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE 

ONE HUNDRED TENTH CONGRESS 

SECOND SESSION 

JUNE 18, 2008 

Available via http://www.gpoaccess.gov/congress/index.html 

Printed for the use of the 

Committee on Homeland Security and Governmental Affairs 

( 

(II) 

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

JOSEPH I. LIEBERMAN, Connecticut, Chairman 

CARL LEVIN, Michigan 

DANIEL K. AKAKA, Hawaii 

THOMAS R. CARPER, Delaware 

MARK L. PRYOR, Arkansas 

MARY L. LANDRIEU, Louisiana 

BARACK OBAMA, Illinois 

CLAIRE McCASKILL, Missouri 

JON TESTER, Montana 

SUSAN M. COLLINS, Maine 

TED STEVENS, Alaska 

GEORGE V. VOINOVICH, Ohio 

NORM COLEMAN, Minnesota 

TOM COBURN, Oklahoma 

PETE V. DOMENICI, New Mexico 

JOHN WARNER, Virginia 

JOHN E. SUNUNU, New Hampshire 

MICHAEL L. ALEXANDER, Staff Director 

HOLLY A. IDELSON, Counsel 

ADAM R. SEDGEWICK, Professional Staff Member 

BRANDON L. MILHORN, Minority Staff Director and Chief Counsel 

JOHN K. GRANT, Minority Counsel 

TRINA DRIESSNACK TYRER, Chief Clerk 

PATRICIA R. HOGAN, Publications Clerk and GPO Detailee 

LAURA W. KILBRIDE, Hearing Clerk 

(III) 

C O N T E N T S 

Opening statements: Page 

Senator Lieberman ........................................................................................... 1 

Senator Collins ................................................................................................. 4 

Senator Akaka .................................................................................................. 7 

Senator Carper ................................................................................................. 34 

WITNESSES 

WEDNESDAY, JUNE 18, 2008 

Linda D. Koontz, Director, Information Management Issues, U.S. Government 

Accountability Office ............................................................................................ 9 

Hugo Teufel III, Chief Privacy Officer, U.S. Department of Homeland Security ......................................................................................................................... 11 

Ari Schwartz, Vice President and Chief Operating Officer, Center for Democracy and Technology ............................................................................................ 13 

Peter P. Swire, C. William O’Neill Professor of Law, Moritz College of Law, 

The Ohio State University Senior Fellow, Center for American Progress ...... 15 

ALPHABETICAL LIST OF WITNESSES

Koontz, Linda D.: 

Testimony .......................................................................................................... 9 

Prepared statement .......................................................................................... 39 

Schwartz, Ari: 

Testimony .......................................................................................................... 13 

Prepared statement .......................................................................................... 75 

Swire, Peter P.: 

Testimony .......................................................................................................... 15 

Prepared statement .......................................................................................... 87 

Teufel, Hugo, III: 

Testimony .......................................................................................................... 11 

Prepared statement .......................................................................................... 64 

APPENDIX 

Susan E. Dudley, Administrator, Office of Information and Regulatory Affairs, 

and Karen Evans, Administrator, Office of E-Government and Information 

Technology, Office of Management and Budget, prepared statement ............. 95 

GAO Report to Congressional Requesters, ‘‘Privacy: Alternatives Exist for 

Enhancing Protection of Personally Identifiable Information,’’ GAO–08–526, 

May 2008 .............................................................................................................. 98 

(1) 

1The GAO Report on Privacy appears in the Appendix on page 98. 

PROTECTING PERSONAL INFORMATION: 

IS THE FEDERAL GOVERNMENT 

DOING ENOUGH? 

WEDNESDAY, JUNE 18, 2008 

U.S. SENATE, COMMITTEE ON HOMELAND SECURITY

AND GOVERNMENTAL AFFAIRS, Washington, DC. 

The Committee met, pursuant to notice, at 10:04 a.m., in room 

SD–342, Dirksen Senate Office Building, Hon. Joseph I. Lieberman, Chairman of the Committee, presiding. 

Present: Senators Lieberman, Akaka, Carper, and Collins. 

OPENING STATEMENT OF CHAIRMAN LIEBERMAN 

Chairman LIEBERMAN. Good morning and welcome to our hearing today on Federal efforts to protect personal privacy. I want to 

welcome our distinguished panel and also particularly commend 

the Government Accountability Office (GAO), Ms. Koontz, for your 

excellent work on the report that is being released today on the 

Federal Government’s privacy efforts.1 I also want to particularly 

thank our colleague and dear friend, Senator Akaka, who has 

taken a particular interest in government privacy issues and has 

encouraged Senator Collins and me to convene today’s hearing. 

We live in an age that really is defined by information. The explosion of new technologies to gather, share, and store huge quantities of information has made possible significant advances in 

every aspect of our lives, including more efficient and effective governmental programs. But these same technologies have also dramatically altered the privacy landscape. It is easier than ever for 

government and private entities to acquire large amounts of personal information about people—information that can cause harm 

to those people if improperly disclosed or used. 

Loss of privacy, for instance, can lead to crimes such as identify 

theft or stalking. The dissemination or misuse of certain private 

data can also result in the loss of employment, discrimination, harassment, or surveillance. So it is essential, obviously, for government to collect and use personal information—for example, to provide security, conduct law enforcement, or administer and extend 

governmental benefits. But we also have to do everything we possibly can to ensure that in collecting and using personal information, we tread very carefully because when dealing with the personal information of individual Americans, we have got to properly 

2 

balance our policy goals against potential incursions on their privacy. 

Congress constructed a foundation for respecting individual privacy within the Federal Government in the landmark Privacy Act 

of 1974 which seeks to prohibit unauthorized disclosure of personal 

information, ensure the accuracy and relevance of information collected by the government, and provide individuals with access to 

their information and a means of redressing errors. Six years ago, 

the law was strengthened by the Electronic Government Act of 

2002, the so-called E–Government Act, which went through this 

Committee on its way to becoming law. That Act now requires that 

agencies analyze in advance the potential privacy impacts of new 

information systems and data collections, and minimize those potential risks. One of the questions I want to ask today is whether 

governmental agencies are fulfilling their obligations under the E– 

Government Act. 

Obviously, notwithstanding these two pieces of legislation, we 

know that there is much more to do, and the GAO report makes 

that clear. 

New technologies and data practices have overtaken some of the 

core definitions of the Privacy Act of 1974. That is, in the world of 

information collection and dissemination, millennia ago. For instance, in 1974, Congress simply could not foresee the government’s use of what are now called ‘‘private data brokers’’—a totally 

unimagined line of enterprise in 1974—with access to extensive 

personal information about individuals. So we now need to ensure 

that this practice does not become an end run around the protections of the Privacy Act. I know that is not the intention. These private data brokers are of significant assistance both to the government and, of course, the private sector. But, still, we have to be 

concerned about privacy. 

New policy demands, including some of the homeland security efforts that have originated in this Committee, call for sharing information among a wider array of agencies. Security concerns combined with new technologies, such as biometrics, are driving the 

collection of new types of personal information. The American people may have justifiable concerns about sharing their personal information when the government is collecting and storing their fingerprints, retinal scans, even their DNA, and we have to reassure 

them. We need to look closely to see how these new programs and 

practices intersect with existing privacy law and what adjustments 

may be necessary. 

When we created the Department of Homeland Security, however, we did mandate the establishment of a Chief Privacy Officer 

within the Department to address what we knew would be challenging questions as to how to integrate privacy considerations— 

including implementation of government privacy law—into the critical mission, the new mission post-September 11, 2001, of homeland security. I am pleased that the second person to hold that position, Mr. Teufel, is one of our witnesses today. Incidentally, Senator Collins and I working closely together with other Members of 

the Committee, also created an expanded network of privacy officials as part of the two laws that originated in this Committee that 

enacted recommendations of the 9/11 Commission. 

3 

But the question remains whether we have adequate leadership 

and resources devoted to privacy at the government-wide level. In 

2003, in response to another request from this Committee, GAO 

concluded that the Office of Management and Budget (OMB) needed to assert more leadership on privacy questions to ensure that 

the agencies of our government were actually carrying out their responsibilities under the Privacy Act and other government privacy 

law. In fact, today there is no one in OMB, no office in the Federal 

Government, no high-level official, not even, as far as I can determine, a political appointee or member of the Senior Executive Service (SES), whose job it is to focus full time on government-wide privacy policy. This contrasts, interestingly enough, with many other 

countries, including those of our friends and allies in Europe, which 

have elevated privacy policy to the highest levels of their governments. This absence of leadership for privacy in the U.S. Government I know is a message we will hear loud and clear today. 

So I look forward to the testimony, and then to working together 

to ensure our privacy laws continue to provide appropriate and 

meaningful protections for our citizens. It sure does look to me, 

based on the GAO report, that it is time for us to do an updating 

and overall revision of the Privacy Act of 1974. 

[The prepared statement of Senator Lieberman follows:] 

PREPARED STATEMENT OF SENATOR LIEBERMAN 

Good morning and welcome to our hearing today on federal efforts to protect personal privacy. I want to welcome our distinguished panel and also commend the 

Government Accountability Office for its excellent work on this issue, as reflected 

in their report being released today on the federal government’s privacy efforts. I 

also want to thank my colleague, Senator Akaka, who has taken a particular interest in government privacy issues and encouraged Senator Collins and me to convene 

today’s hearing. 

We live in an ‘‘information age,’’ and the explosion of new technologies to gather, 

share, and store huge quantities of information has made possible huge advances 

in every aspect of our lives, including more efficient and effective government programs. But these same technologies have also dramatically altered the privacy landscape. It is easier than ever for government and private entities to acquire large 

amounts of personal information about people—information that can cause harm to 

those people if it is improperly used or disclosed. 

For the individual, loss of privacy can lead to crimes such as identify theft or 

stalking. The dissemination or misuse of certain private data can also result in 

other harms such as loss of employment, discrimination, or unwarranted harassment or surveillance. Certainly, it is essential for government to collect and use personal information—for example to provide security, conduct law enforcement, or administer benefits. But we must strive to ensure that we tread carefully when dealing with the personal information of individuals and that we properly balance our 

many policy goals against potential incursions on privacy. 

Congress constructed a foundation for respecting individual privacy within the 

federal government in the landmark Privacy Act of 1974 which seeks to prohibit unauthorized disclosure of personal information, ensure the accuracy and relevance of 

information collected by the government, and provide individuals with access to 

their information and a means of redress for errors. Six years ago, that law was 

buttressed by the Electronic Government Act of 2002, which I introduced and had 

the privilege of guiding through this Committee on its way to becoming law. The 

E-Government Act requires that agencies analyze in advance the potential privacy 

impacts of new information systems and data collections, and minimize those potential risks. But we know there is more to do. 

New technologies and data practices have overtaken some of the core definitions 

of the Privacy Act. For instance, the Act simply could not foresee the government’s 

use of private data brokers with access to extensive personal information about individuals, and we need to ensure this practice does not become a serious end-run 

around the protections of the Privacy Act. 

4 

New policy demands—including some of the homeland security efforts that are of 

vital concern to this Committee—call for sharing information among a wider array 

of agencies. Security concerns combined with new technologies, such as biometrics, 

are also driving the collection of new types of personal information. Americans may 

have justifiable concerns about sharing their personal information when the government is collecting and storing their fingerprints, retinal scans, even their DNA. We 

need to look closely to see how these new programs and practices intersect with existing privacy law, and what adjustments may be necessary. 

This Committee has recognized the need for dedicating officials and resources to 

address privacy concerns within government, particularly as we tackle challenging 

new missions such as homeland security. When we created the Department of 

Homeland Security, we mandated the establishment of a Chief Privacy Officer within the department to address what we knew would be challenging questions as to 

how to integrate privacy considerations—including implementation of government 

privacy law—into the critical mission of homeland security. I am pleased that the 

second individual to hold that position, Mr. Teufel, is one of our witnesses today. 

We also created an expanded network of privacy officials as part of the two laws 

enacting recommendations of the 9/11 Commission. 

But the question remains whether we have adequate leadership and resources devoted to privacy at the government-wide level. In 2003, in response to a request 

from this committee, GAO concluded that OMB needed to assert more leadership 

on privacy to ensure that agencies fulfilled the mandates of the Privacy Act and 

other government privacy law. In fact, there is no one in OMB, no office in the federal government, no high-level official, not even a political appointee or member of 

the Senior Executive Service, whose job it is to focus full-time on government-wide 

privacy policy. This stands in stark contrast to many other countries, including 

those in the European Union, which have elevated privacy policy to the highest levels of government. This absence of leadership is a message we will hear loud and 

clear today. 

I look forward to the testimony and to working together to ensure that our privacy 

laws continue to provide appropriate and meaningful protections for our citizens. 

Senator Collins. 

Senator LIEBERMAN. Senator Collins. 

OPENING STATEMENT OF SENATOR COLLINS 

Senator COLLINS. Thank you. Thank you, Mr. Chairman, for 

holding this important hearing. 

We live in a world of unprecedented access to information. Data 

are being collected and stored in quantities of almost unimaginable 

size by a wide range of public and private entities. People freely 

share personal information about themselves on blogs or social networking Web sites. At the same time, most Americans believe that 

protecting some degree of personal privacy is a fight worth waging 

in the Digital Age. 

In 1974, Congress passed the Privacy Act to establish rules for 

government’s use of computerized recordkeeping systems. To provide some context, in that same year, President Nixon resigned the 

presidency in the wake of the Watergate scandal. Gasoline cost 55 

cents per gallon. And an exciting new gadget—the pocket calculator—was just beginning to appear on store shelves. 

Thirty-four years later, as we hold this hearing, six presidents 

have occupied the Oval Office, the average cost of gasoline exceeds 

$4 per gallon, and the BlackBerrys that the Chairman and I depend so heavily on can do more than all but the most sophisticated 

computers of 1974. 

Yet with very few modifications, the 1974 Privacy Act has remained the primary law governing the Federal Government’s collection, storage, and use of personal information about its citizens. 

Obviously, technology has changed dramatically during the past 

34 years. The Federal Government can now gather, store, and 

5 

share information much more efficiently than was even contemplated 34 years ago. Yet it is a testament to the original drafters of the Privacy Act that, in spite of these significant advances 

in technology, many of the law’s provisions remain applicable to 

the technology in use today. 

Nevertheless, as the GAO and our other witnesses will testify, 

current law could be strengthened to improve assurances that personal information is legitimately collected and adequately secured. 

We should build on the success of the original law while ensuring 

that it is adequate to meet the new challenges of the Information 

Age. We can accomplish this by remaining true to the principles of 

openness, accuracy, transparency, and accountability that underpin 

the Fair Information Practices, which were developed by the U.S. 

Government and endure as guiding principles for protecting the 

privacy and security of personal data. 

This hearing will examine several important questions. First, are 

the rules governing the collection and use of personal information 

clear to both the officials who have access to it and the public that 

provides it? System of Records Notices, descriptions of routine uses 

of information, and other basic tools of the privacy regime are supposed to describe various information systems so that government 

officials and the public will know when and how personal information can be collected and shared. In many cases, however, the tools 

are worded so broadly that they really provide little clarity as to 

which rules govern any particular information system. 

Second, how can we ensure the security of personal information 

collected and maintained by the U.S. Government? Unfortunately, 

there are far too many recent examples that demonstrate the need 

for the Federal Government to better secure the sensitive information that it collects and maintains. 

For example, in 2006, the Veterans Affairs Department reported 

that the personal information of approximately 26.5 million veterans was compromised when a laptop containing departmental 

records was stolen. A 2007 study by the Inspector General for Tax 

Administration found that at least 490 laptops containing sensitive 

taxpayer data had been lost or stolen between 2003 and 2007. But 

lost or stolen laptops are not the only security concern, as is evidenced by a 2006 data compromise of employee information at the 

Department of Agriculture that was caused by unauthorized access 

to the agency’s systems. 

Beyond the physical and cyber security of sensitive data, we 

must also ask what is the best way to deal with innovative technologies—such as data mining—that seek to use information in entirely new ways. Technology develops so rapidly in this day and age 

that we will need to be more vigilant in ensuring that the wheels 

of progress are not inadvertently running over our basic privacy 

rights. 

And, finally, how can we continue to encourage the legitimate 

sharing of accurate information among government agencies for legitimate purposes while maintaining adequate controls to hold accountable those who might compromise an individual’s privacy by 

misusing their personal information? The recent inappropriate 

searches by State Department contractors of the passport files of 

Senators McCain, Obama, and Clinton highlight the need for imVerDate Nov 24 2008 09:50 Apr 08, 2010 Jkt 044117 PO 00000 Frm 00009 Fmt 6633 Sfmt 6601 P:\DOCS\44117.TXT SAFFAIRS PsN: PAT
6 

provements in this area. Prohibitions against unauthorized use of 

the passport system did not prevent these improper inquiries, although audit mechanisms did facilitate prompt administrative action against the contractors responsible. As the government 

searches for ways to improve the sharing and the analysis of the 

information it collects, we must develop effective security measures 

and consider whether our laws properly sanction those who use 

sensitive information for inappropriate purposes. 

This hearing is yet another step in a robust dialogue now occurring about privacy in our country. A strong privacy regime, built 

on the principles of transparency, accountability, and security, 

should inspire the confidence of the American people that the Federal Government is not compromising personal privacy but, rather, 

preserving and protecting it. Doing so, however, in the Digital Age 

is a new challenge. 

Thank you, Mr. Chairman. 

[The prepared statement of Senator Collins follows:] 

PREPARED STATEMENT OF SENATOR COLLINS 

We live in a world of unprecedented access to information. Data are being collected and stored in quantities of almost unimaginable size by a wide range of public and private entities. People freely share personal information about themselves 

on blogs or social networking Web sites. At the same time, most Americans believe 

that protecting some degree of personal privacy is a fight worth waging in the digital age. 

In 1974, Congress passed the Privacy Act to establish rules for government’s use 

of computerized record-keeping systems. In that same year, President Nixon resigned the presidency in the wake of the Watergate scandal. Gasoline cost 55 cents 

per gallon. And an exciting new gadget—the pocket calculator—was just beginning 

to appear on store shelves. 

Thirty-four years later, six presidents have occupied the Oval Office, the average 

cost of gasoline exceeds $4 per gallon, and the Blackberrys that the Chairman and 

I depend on can do more than all but the most sophisticated computers of 1974. Yet 

with very few modifications, the 1974 Privacy Act has remained the primary law 

governing the federal government’s collection, storage, and use of personal information about its citizens. 

Obviously, technology has changed dramatically since the Privacy Act was written. The federal government can now gather, store, and share information more efficiently than was even imagined possible 34 years ago. Yet it is a testament to the 

original drafters of the Privacy Act that in spite of these significant advances in 

technology, many of its provisions remain applicable to the technology in use today. 

Nonetheless, as the GAO and our other witnesses will testify, current law could 

be strengthened to improve assurances that personal information is legitimately collected and adequately secured. We should build on the success of the original laws 

while ensuring that they are adequate to meet the new challenges of the Digital 

Age. We can accomplish this by remaining true to the principles of openness, accuracy, transparency, and accountability that underpin the Fair Information Practices, 

which were developed by the U.S. government and endure as guiding principles for 

protecting the privacy and security of personal information. 

This hearing will examine several important questions. First, are the rules governing the collection and use of personal information clear to both the officials who 

have access to it and the public that provides it? System of Records Notices, descriptions of routine uses of information, and other basic tools of the privacy regime are 

supposed to describe various information systems so that government officials and 

the public will know when and how personal information can be collected and 

shared by the government. In many cases, however, these tools are worded so broadly that they provide little clarity as to what rules govern any particular information 

system. 

Second, how can we ensure the security of personal information collected and 

maintained by the U.S. government? Unfortunately, there are far too many recent 

examples that demonstrate the need for the federal government to better secure the 

sensitive information that it collects and maintains. 

7 

In 2006, the Department of Veterans Affairs reported that the personal information of approximately 26.5 million veterans was compromised when a laptop containing Department records was stolen. A 2007 study by the Inspector General for 

Tax Administration found that at least 490 laptops containing sensitive taxpayer 

data had been lost or stolen between 2003 and 2007. But lost or stolen laptops are 

not the only security concerns, as in a 2006 data compromise of employee information at the Department of Agriculture that was caused by unauthorized access to 

the agency’s systems. 

Beyond the physical- and cyber-security of sensitive data, we must also ask what 

is the best way to deal with innovative technologies—such as data mining—that 

seek to use information in entirely new ways. Technology develops so rapidly in this 

day and age that we will need to be vigilant to ensure that the wheels of progress 

are not inadvertently running over our basic privacy rights. 

And, finally, how can we continue to encourage the sharing of information among 

government agencies for legitimate purposes while maintaining adequate controls to 

hold accountable those who might compromise an individual’s privacy by misusing 

their personal information? The recent inappropriate searches by State Department 

contractors of the passport files of Senators McCain, Obama, and Clinton highlight 

the need for improvements in this area. Prohibitions against unauthorized use of 

the passport system did not prevent these improper inquiries—though audit mechanisms did facilitate prompt administrative action against the contractors responsible. As the government searches for ways to improve the sharing and analysis of 

the information it collects, we must develop effective security measures and consider 

whether our laws properly sanction those who use sensitive information for inappropriate purposes. 

This hearing is yet another step in a robust dialog now occurring about privacy 

in this country. A strong privacy regime, built on principles of transparency and accountability, should inspire the confidence of the American people that the federal 

government is not compromising personal privacy but rather preserving and protecting it. 

Chairman LIEBERMAN. Thank you, Senator Collins, for that excellent opening statement. 

Let me say again how much I appreciate the leadership role that 

Senator Akaka has played on these matters, and I would like now 

to ask him if he would like to make an opening statement. 

OPENING STATEMENT OF SENATOR AKAKA 

Senator AKAKA. Thank you very much, Mr. Chairman. I also 

want to welcome the panel and thank you and Ranking Member 

Collins for having this hearing today. 

Two years ago, following our joint hearing on the Department of 

Veterans Affairs (VA) data breach, I requested that this Committee 

take a closer look at the Privacy Act to see if it continued to protect 

Americans’ personal information in this increasingly electronic age. 

Systems and procedures to prevent loss or unauthorized disclosure 

are not enough. Data security also relies on a robust privacy framework that minimizes the collection, use, and sharing of personal information and provides individuals the opportunity to access their 

data and correct any mistakes. 

For the past few years, I have been looking into Federal data collection and privacy issues and asked GAO for several reports. And 

today GAO is releasing two reports which I and others requested: 

One on the need for updating the Privacy Act and another on the 

need to consolidate privacy functions with a Senior Privacy Officer. 

And I agree with the GAO’s findings, and I am glad to see that the 

Chairman also believes that the Privacy Act needs to be updated. 

Without strong privacy oversight, I fear that key privacy safeguards will fall through the cracks and Americans’ personal information will remain at risk. Furthermore, I believe that the framework for protecting privacy in the Federal Government needs to be 

8 

updated and loopholes closed. Failure to do so risks inaccurate information guiding our national security decisions as well as Americans’ access to government services and benefits. 

I look forward to working with the Chairman and Ranking Member on legislation to address these issues, and, Mr. Chairman, I 

would like to ask that my full statement be made part of the 

record. 

Chairman LIEBERMAN. Without objection, so ordered, and thank 

you very much, Senator Akaka, for those words. 

[The prepared statement of Senator Akaka follows:] 

PREPARED STATEMENT OF SENATOR AKAKA 

Thank you Chairman Lieberman and Ranking Member Collins for holding today’s 

hearing on the Privacy Act. 

Two years ago, following our joint hearing with the Veterans’ Affairs Committee 

on the data breach at the Department of Veterans Affairs—which risked the personal information of 26.5 million veterans and active duty military—I requested 

that this Committee take a closer look at the Privacy Act to see if it continued to 

protect American’s personal information in this increasingly electronic age. While 

our hearing at that time was focused on information security practices, I knew that 

we also needed to look at the safeguards for the collection, use, and sharing of personal information. 

Data security does not just rely on systems and procedures to prevent loss or unauthorized disclosure. It also relies on a robust privacy framework that minimizes 

the amount and use of personal information and provides individuals the opportunity to access their data and correct any mistakes. 

For the past few years I have been looking into federal data collection and privacy 

issues. At my request, the Government Accountability Office (GAO) conducted several investigations on federal data mining activities and found that federal agencies 

are not following all key privacy and information security practices. In its May 2004 

report, GAO found 122 data mining activities in the federal government that use 

personal data. Thirty-six of these activities mined personal information from the private sector and 46 activities mined it from other agencies. This included student 

loan application data, bank account numbers, credit card information, and taxpayer 

identification numbers. The use of private sector data and the failure of agencies 

to follow key privacy requirements limit the ability of the public to control their personal information and risks the denial of government services or benefits. 

I believed then, as I do now, that a strong privacy official at each federal agency 

would help ensure compliance with federal privacy and information security laws. 

Unfortunately, according to a report being released today by GAO, despite the fact 

that federal agencies are required to designate a senior official for privacy, some of 

these officials still do not have full responsibility for all of the major privacy functions. Without such oversight—from ensuring compliance with privacy laws to providing redress procedures and privacy training—I fear that key privacy safeguards 

will fall through the cracks and Americans’ public information will remain at risk. 

Today, however, our focus is on how the law is working. According to GAO and 

many privacy experts, the framework for protecting privacy in the federal government needs to be updated and loopholes closed. Whether it is the ineffective definition of System of Records or the ever expanding list of routine uses, we need to reexamine the Privacy Act and related privacy laws to ensure that they work in the 21st 

century. Failure to do so risks inaccurate information guiding our national security 

decisions as well as Americans’ access to government services and benefits. 

I believe that legislative changes are needed to the federal privacy framework and 

look forward to working with the Chairman and Ranking Member to address these 

issues. Thank you again for holding this hearing. 

Chairman LIEBERMAN. Let’s go right to the panel. Again, I would 

like to welcome you all. Our first witness is Linda Koontz, who is 

the Director for Information Management Issues at the Government Accountability Office, with responsibility for issues concerning the collection, use, and dissemination of government information. Ms. Koontz has recently directed studies on privacy, 

9 

1The prepared statement of Ms. Koontz appears in the Appendix on page 39. 

records management, data mining, information access and dissemination, and E–Government. 

It is a pleasure to have you. Please proceed with your testimony. 

STATEMENT OF LINDA D. KOONTZ,1 DIRECTOR, INFORMATION 

MANAGEMENT ISSUES, U.S. GOVERNMENT ACCOUNTABILITY 

OFFICE 

Ms. KOONTZ. Thank you, Mr. Chairman and Members of the 

Committee. I appreciate the opportunity to participate in today’s 

hearing on government protection of personally identifiable information. As you know, collecting such information is vital for the 

Federal Government to provide services and benefits, as well as to 

respond to threats such as terrorism. At the same time, government use of personal information raises privacy concerns, such as 

whether the legal mechanisms governing such use remains sufficient for protecting personal privacy in the context of modern information technology. 

In my remarks, I will present key results from a report that we 

are releasing today on this issue. For our review, we assessed the 

sufficiency of current laws and guidance for protecting personally 

identifiable information and identified alternatives for addressing 

issues raised by our assessment. 

The primary relevant statute is the Privacy Act of 1974, which 

is the major mechanism for controlling Federal collection, use, and 

disclosure of personally identifiable information. The Act’s provisions are largely based on a set of key privacy principles know as 

the Fair Information Practices, which call for such things as limiting the collection of personal information, ensuring that information is accurate when it is collected, and keeping the public informed of any such collections. These widely accepted principles, 

first proposed in 1973 by a U.S. Government Advisory Committee, 

are not legal requirements. However, they do provide a useful 

framework for balancing the need for privacy with other public policy interests, and they are used by numerous countries and organizations as the basis for privacy laws and policies. 

Besides the Privacy Act, another relevant statute is the E–Government Act of 2002, which requires agencies to conduct Privacy 

Impact Assessments (PIAs)—that is, analyses of how personal information is protected when it is collected, stored, shared, and 

managed in a government information system. 

The two statutes and related guidance from the Office of Management and Budget set minimum requirements for agencies. But 

our review showed that they may not consistently protect personally identifiable information and may not fully adhere to key privacy principles. Based on our analysis, extensive discussions with 

agency officials and the perspectives of privacy experts obtained 

through a panel convened for us by the National Academy of 

Sciences, we identified issues in three major areas: First, applying 

privacy protections consistently to all Federal collection and use of 

personal information; second, ensuring the use of personally identifiable information is limited to a stated purpose; and third, estabVerDate Nov 24 2008 09:50 Apr 08, 2010 Jkt 044117 PO 00000 Frm 00013 Fmt 6633 Sfmt 6601 P:\DOCS\44117.TXT SAFFAIRS PsN: PAT
10 

lishing effective mechanisms for informing the public about privacy 

protections. 

In the first area, applying protections consistently, issues arise 

primarily from the scope of the Privacy Act, which is limited to 

what are called ‘‘System of Records.’’ These are defined as any 

grouping of records containing personal information that is retrieved by an individual identifier. Thus, the Act covers personal 

information in a given information system if an agency uses an individual identifier for retrieval, but not if some other method is 

used, such as searching for all individuals with a certain medical 

condition or who apply for a certain benefit. 

The resulting inconsistency has led experts to agree that the definition of a System of Records is too narrow. The Congress could 

address this issue by revising the definition to cover all personally 

identifiable information collected, used, and maintained systematically by the Federal Government. 

The second area, ensuring that use of personally identifiable information is limited to a stated purpose, is based on the principles 

that collecting personal information should be disclosed beforehand, 

and use of this information should be limited to a specified purpose. When the government must define a specific purpose and use 

for personal information, individuals gain assurance that their privacy will be protected and the information will not be used in ways 

that could unfairly affect them. However, current laws and guidance impose only modest requirements for defining the purposes 

and use of personal information. Agencies may define purposes 

very generally which allows for unnecessarily broad ranges of uses 

without meaningful limitations. These issues could be addressed by 

requiring that specific limits be set on the use of information both 

within and among agencies. 

The third area, establishing effective mechanisms for informing 

the public, is related to both openness and accountability. These 

principles call for informing the public about privacy policies and 

practices and for holding agencies accountable for protecting privacy in their use of personal information. Currently, these principles are enforced through a System of Records Notices that agencies are required to publish in the Federal Register. However, it is 

questionable that such a publication effectively informs the public 

at large. First, the notices can be difficult to understand, as they 

are generally written in legalistic terms. Second, they do not always contain complete and useful information. And, finally, finding 

relevant notices and determining which ones are in force may be 

challenging. Options to address these issues include providing 

easy-to-understand, brief notices along with comprehensive versions, setting requirements to improve the content of privacy notices, and revising the Privacy Act to require that all notices be 

published on a central Web site. 

The challenge of how best to balance the Federal Government’s 

need to collect and use information with individuals’ privacy rights 

in the current environment merits a national debate on all relevant 

issues. In assessing such a balance, Congress should consider 

amending applicable laws according to the alternatives we have 

identified in our report. 

11 

1The prepared statement of Mr. Teufel appears in the Appendix on page 64. 

Mr. Chairman, that concludes my statement. I would be happy 

to answer questions at the appropriate time. 

Chairman LIEBERMAN. Thanks, Ms. Koontz. That is a good beginning. 

Our next witness is Hugo Teufel III, Chief Privacy Officer of the 

Department of Homeland Security, a position he has occupied since 

July 2006. Mr. Teufel has primary responsibility in his position for 

privacy policy at the Department, including compliance with the 

1974 Privacy Act and the privacy provisions of the E–Government 

Act. He previously served in the General Counsel’s office at the Department and, before that, was the Associate Solicitor for General 

Law at the Department of the Interior. 

Thanks for being here, Mr. Teufel. 

STATEMENT OF HUGO TEUFEL III,1 CHIEF PRIVACY OFFICER, 

U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. TEUFEL. Thank you very much, Chairman Lieberman, Ranking Member Collins, Senator Akaka, and Members of the Committee. It is an honor to testify before you here today, and I must 

confess that I am humbled in the presence of my co-panelists here. 

Linda Koontz and I have worked together for the last 2 years, and 

we take very seriously the recommendations in her reports. And we 

usually get it right, but sometimes there is room for improvement, 

and she lets us know, and we carry out her recommendations, by 

and large. Ari Schwartz is someone who we regularly reach out to, 

along with other members of the privacy advocacy community, and 

I often seek Mr. Schwartz’s advice and counsel on issues. And, of 

course, Peter Swire is someone from whom, since the very first 

week or two of my tenure in the Privacy Office, I have sought advice and counsel, and it is always great to see him and talk to him 

and be here. 

I read with interest the formal letter inviting me to come and 

testify, and I noted that this hearing was to consider the adequacy 

of laws and structures with respect to privacy. And, of course, this 

is a Congressional Committee, a Senate Committee, and so there 

will be a lot of talk on the law. I would like to spend just a little 

bit of time on structure before I conclude my opening remarks. 

In the 23 months that I have been in the office, I have thought 

a lot about the office and the position of Privacy Officer and what 

it is and what it should be and what it has been at other agencies. 

And so in my opinion, and what I have tried to do at the Department of Homeland Security, I have grouped our responsibilities 

into five functional categories: Policy, process, incidents and 

breaches, education, and outreach. 

The significance there is that if you look at other Privacy Officers—and I will put aside Census Bureau, Internal Revenue Service, and Postal Service—most other Privacy Officers and Privacy 

Offices within government often focus on the technical aspects and 

do not necessarily get involved with policy and with outreach. Policy is critical as part of Section 222 of the Homeland Security Act, 

and we are the primary privacy policy office—that is difficult to say 

fast early in the morning—at the Department of Homeland SecuVerDate Nov 24 2008 09:50 Apr 08, 2010 Jkt 044117 PO 00000 Frm 00015 Fmt 6633 Sfmt 6601 P:\DOCS\44117.TXT SAFFAIRS PsN: PAT
12 

rity. But outreach is also essential because there are a lot of external stakeholders who are concerned about what it is that government is doing with personally identifiable information. 

So policy, advice—it can be advice and counsel orally given or it 

can be written policy, as we have done with respect to Social Security numbers and mixed-use systems, administratively extending 

Privacy Act protections to non-U.S. citizens. 

Process, what we think about when we talk about Privacy Impact 

Assessments and System of Records Notices. 

Incidents and breaches—just as it sounds. 

Education, really undervalued but terribly important, because 

whenever humans are involved, people make mistakes. And you 

cannot get rid of mistakes, but you can minimize them, and the 

way to do that is education, education, education. 

And then the last is outreach—part of what we are doing today 

and what we regularly do in and around the D.C. area, and sometimes even internationally. 

So having said that, as I was preparing today, I was reminded 

of something that I had heard a couple of weeks ago. As you may 

know, I am going to be graduating this week from the Naval War 

College with a master’s in national security and strategic studies. 

The University of Connecticut had not started their master’s program in homeland security 41⁄2 years ago, or I would have probably 

entered that program. And 2 weeks ago, I was at the University 

of Virginia Law School for their National Security Law Institute. 

And, in fact, we were at the Pentagon, and we were listening to 

Judge Jamie Baker, who is the former legal adviser to the National 

Security Council and now is an associate judge on the Court of Appeals for the Armed Forces, and he was talking about his office and 

the importance of the legal adviser to the National Security Council. And he noted in his remarks that the law and structure are important, but they are not conclusive. Senior officials have to call on 

you, and they have to have trust and confidence in you as an adviser in order for you to be able to do your job effectively. 

And with that, I will stop, and thank you very much. 

Chairman LIEBERMAN. Very interesting. Thank you. The record 

will note that had you had the opportunity, you would have become 

a UConn Huskie. [Laughter.] 

Ari Schwartz is next, familiar with this Committee, but you have 

already received a good introduction from Mr. Teufel: Vice President and Chief Operating Officer at the Center for Democracy and 

Technology (CDT). Mr. Schwartz also serves as a member of the 

National Institute of Standards and Technology Information Security and Privacy Advisory Board and the State of Ohio Chief Privacy Officer Advisory Committee. 

At this time I will ask you to talk about the fact that you lead 

the Anti-Spyware Coalition. We welcome you today and look forward to your testimony, Mr. Schwartz. 

13 

1The prepared statement of Mr. Schwartz appears in the Appendix on page 75. 

STATEMENT OF ARI SCHWARTZ,1 VICE PRESIDENT AND CHIEF 

OPERATING OFFICER, CENTER FOR DEMOCRACY AND TECHNOLOGY 

Mr. SCHWARTZ. Thank you very much, Mr. Chairman, Ranking 

Member Collins, and Senator Akaka, for holding this hearing 

today. 

Thirty-four years ago, the U.S. Congress took the revolutionary 

step toward ensuring that U.S. citizens’ information in the hands 

of the Federal Government would be treated fairly and with respect. The Privacy Act of 1974 sets forth privacy protections that 

have been an example for governments at different levels around 

the world. While the Act reached for the goal of privacy, it was by 

no means perfect. And, in fact, Congress recognized its imperfections even at the time of passage, creating a study commission to 

report back on how, among other things, the Privacy Act could be 

improved. 

The GAO studies released today suggest that the major concerns 

of the Personal Privacy Study Commission of 1977 have not only 

never been addressed fully, but have even worsened with time. 

While the structure of the Act is still solid, technological advances 

have outdated many of the key definitions. The Privacy Act guidance from OMB has served to confuse as much as it clarified, and 

the Department of Justice has not released its Privacy Act Overview for agencies for 4 years. This important document had been 

issued at least every 2 years since the mid-1980s. 

While the Privacy Act implementation has been allowed to decay, 

Congress has created other protections to help ensure greater 

transparency over collections of personal information. The E–Government Act recognized that making more information available 

online was certain to raise new privacy concerns, and in order to 

address this problem, Congress took the step of requiring a Privacy 

Impact Assessment for all new and changed collections and new 

databases. The Privacy Impact Assessments were designed to provide greater transparency to how the government collects and uses 

personal information. 

Over the past 6 years, Privacy Impact Assessments have become 

an essential tool to help protect privacy. Unfortunately, as with 

other privacy laws, the Federal Government has unevenly implemented even the most basic transparency requirements of the PIAs 

across agencies. Like other directives issued by the Administration 

on privacy, the guidance was vague and has simply not provided 

agencies with the tools they need to successfully implement the 

Privacy Impact Assessment requirement unless they already had 

privacy experts on staff. 

Too few agencies have the kind of privacy expertise and leadership necessary to develop internal rules and best practices or even 

to comply with existing law. The Department of Homeland Security 

is one agency that has had that kind of leadership through its inception through Nuala Kelly, who started the privacy program, and 

now through Hugo Teufel, who has already shown us why he is a 

leader that can bring together this kind of program at the agency. 

14 

While privacy experts often focus on these major problems as if 

the only thing harmed is the privacy of Americans, it is important 

to note that they have an even greater impact on the effectiveness 

of the Federal Government. For example, one agency that CDT 

spoke to told us that the privacy audit revealed that they had lost 

track of half of their System of Records and, therefore, millions of 

the personal records held by the agency. At the time of the audit, 

they just did not know where this information was. 

As one retiring security official from the Department of Interior 

explained publicly earlier this month while discussing that agency’s 

constant failures in privacy and security reporting, he said, ‘‘We 

are promiscuous with our data. We don’t know where our data is.’’ 

You can call this a privacy concern, you can call this a security 

concern, or you can call this a data management concern. But to 

the American taxpayer, the loss of their personal information is 

certainly called a failure. 

To solve these problems, CDT suggests that Congress work with 

the Executive Branch on the five following areas: 

One, expanding Privacy Act coverage. CDT agrees with the 

GAO’s basic assertion that the Privacy Act key definition of System 

of Records is out of date. We believe that this issue must be addressed in legislation and urge the Committee to introduce such 

legislation in this Congress. We suggest a new definition that 

would ensure coverage of all information that reasonably can be expected to identify an individual. 

Two, closing Privacy Act loopholes. CDT also urges the Committee to consider legislation that would limit the ‘‘routine use’’ exemptions. As GAO found, there are simply no current standards 

across the government for this exemption, and agencies have filled 

the void with an array of confusing and overbroad loopholes. 

In addition, we urge the closing of another common loophole. 

Congress should make it clear that the Act’s core principles apply 

to commercial data used by government. 

Three, improving Privacy Impact Assessments. As we testified 

before this Committee last year, CDT supports the creation of best 

practices for Privacy Impact Assessments as called for in the E– 

Government Act Reauthorization Act, recently passed by this Committee. CDT urges the Committee to require PIAs for any program 

that uses commercial data, whether the personal information will 

be stored in the agency or kept outside of the agency. CDT also 

supports requiring PIAs for systems of government employee information. 

Four, improving privacy leadership. When Peter Swire was chief 

privacy counselor, privacy had a higher profile within the Federal 

Government than at any other time. While Professor Swire is a 

unique leader in this space, CDT believes that a similar permanent 

Chief Privacy Officer within OMB written into law would help ensure that agencies understand the importance of this issue to Congress, to the next Administration, and to the Americans that you 

represent. 

CDT also urges the creation of an independent Chief Privacy Officer (CPO) Council with a similar structure to the Chief Information Officers (CIO) Council and to the Chief Financial Officers 

(CFO) Council as well. 

15 

1The prepared statement of Mr. Swire appears in the Appendix on page 87. 

And five, increasing and improving privacy reporting and audits. 

OMB requirements for privacy reporting are a major leap forward 

in focusing attention on privacy issues, but getting the right implementation and accountability processes in place is an essential 

goal. Most importantly, OMB should be required to create standardized measurements for privacy-protecting processes. CDT also 

believes that the Committee should require that the systems of 

greatest privacy risk undergo regular audits by Inspectors General 

and/or, when the IGs are overwhelmed or not experts in privacy, 

by third-party audit firms. 

In conclusion, I would like to urge this Committee to act this 

year. In the past, CDT has called for the creation of a new 1-year 

commission to study the Privacy Act and privacy policy in the government and offer solutions. But with the release of these GAO reports and numerous hearings on this and related issues in this 

Congress, we believe that the basic work that would have been 

done by such a commission has already been completed. There is 

now consensus around a set of recommendations for action by Congress and the Executive Branch to fill gaps and loopholes in privacy law and policy. CDT urges this Committee to draft a bill with 

the recommendations outlined above and quickly bring it to the 

Senate floor so that the next President can have the right tools in 

place upon taking office and can get started immediately on 

strengthening privacy in the Federal Government. 

We look forward to working with you, and we thank you for your 

leadership on this important issue. 

Chairman LIEBERMAN. Thanks very much, Mr. Schwartz. Thanks 

for your specific proposals, too, which are very helpful to the Committee. 

The final witness this morning is Peter Swire, the C. William 

O’Neill Professor of Law at the Moritz College of Law of the Ohio 

State University. I want to express relief that I have been able to 

announce that when Senator Carper is not here because as a very 

zealous Ohio State graduate, he probably would have created a disruption of some kind. [Laughter.] 

Mr. SWIRE. There was some discussion of whether to make it—— 

Chairman LIEBERMAN. Yes, the Big O, right. Also, Professor 

Swire is a Senior Fellow at the Center for American Progress specializing in privacy issues. From 1999 to early 2001, during the 

Clinton Administration, he served as the Chief Counselor for Privacy in the U.S. Office of Management and Budget. 

Thanks very much for being here, and we welcome your testimony now. 

STATEMENT OF PETER P. SWIRE,1 C. WILLIAM O’NEILL PROFESSOR OF LAW, MORITZ COLLEGE OF LAW, THE OHIO 

STATE UNIVERSITY 

Mr. SWIRE. Thank you, Chairman Lieberman, Ranking Member 

Collins, and Senator Akaka, for your attention to these issues 

today. And thanks to your Committee and the E–Government Act 

of 2002 for really making Privacy Impact Assessments a major tool 

across the Federal Government. This Committee has been vital in 

16 

protecting and addressing these issues. And it is a pleasure, as we 

have heard across the panel today, being on this panel, that GAO 

has been really a major source of expertise in government-wide attention to privacy for a number of years. 

At Homeland Security, Hugo Teufel and his predecessor have 

really built what has become the leading office in any Federal 

agency on privacy issues, and Federal Computer Week, for instance, earlier this year recognized Becky Richards of the office for 

her outstanding achievements for compliance in privacy. And so it 

is good to see that kind of recognition from the outside world. 

And Ari Schwartz has been obviously a leader on these issues for 

quite a few years now, and we appreciate that. 

In my statement today, I am going to talk about two issues and 

then briefly mention a third. I am going to try to give some of my 

experiences at OMB and some lessons for what that means going 

forward. The main technical substantive issue today is on biometrics. I am going to talk about an emerging issues, fingerprints 

and things like that, where I think the Committee really should 

consider action. 

And then in my written testimony, we talk about a third issue 

that I could get to in questions, but I am not going to address it 

in detail. The Center for American Progress released a report earlier this month called ‘‘The ID Divide: Addressing the Challenges 

of Identification and Authentication in American Society.’’ We put 

together a working group over a period of a year to address a wide 

range of issues—homeland security, immigration, voting, privacy, 

and security. And so we have a series of recommendations about 

how a process to look at identification systems would be a good 

thing to bring into the Federal Government as they address this 

generally going forward. 

So turning to OMB and my 2 busy years there, I have five points 

to sort of bring up from that experience. And the overarching 

theme is that in an information-sharing world, we have tried to 

break down the data silos. We have tried to make sure that information gets shared across agencies. But, unfortunately, we have 

put the silos back in when it comes to privacy protection. So we 

have an agency over here and an agency over there with separate 

Privacy Officers, but no overarching structure for handling privacy 

across agencies. And I think that has really been a lack for the last 

number of years. 

So to get to my list of five things, during the time that I was at 

OMB as a political appointee, a policy official, the first thing we did 

was coordinate across agencies. For instance, Ari Schwartz of CDT 

released a study just a couple of months into my time showing we 

had forgotten to put privacy policies up on Federal agencies. And 

that was deeply embarrassing, but it was also deeply helpful because within 4 months we got all the major Federal agencies to 

have privacy policies up. We saw a problem and could fix it. 

During that time, at the CIO Council we created a Privacy Committee, which was active during that time, which made Privacy Impact Assessments a best practice at that time. And so the E–Government Act was able to build on some things that happened in the 

agencies when the time came. So the first point is to coordinate 

across agencies. 

17 

The second point is to act as a source of expertise. We answered 

Privacy Act questions from around the government. When the 

Health Insurance Portability and Accountability Act (HIPAA), the 

medical privacy rule, was happening, I served as White House coordinator for that, and the interagency issues were informed by 

somebody who does privacy across agencies. Similarly, when the 

Gramm-Leach-Bliley Act was being put into effect, there were 

many different agencies involved, and we served as a background 

source of expertise on privacy issues. 

A third point, which people in Congress and the government 

would appreciate, is our role in clearance. You know that in the 

Federal Government, the moment they decide to testify, it all goes 

through OMB. And I was in OMB, and when there was a privacy 

issue, it got routed to my office, and we were able to comment with 

a consistent, informed view on how to handle privacy issues. 

The way it works in Homeland Security is Mr. Teufel would get 

to see things as they are happening at DHS. But when it goes to 

OMB, that is somebody else’s job at that point. It is the next step 

in the process. So having somebody at the central White House 

level really makes that job work better. 

A fourth point is that I was available for special projects. In 

2000, the Chief of Staff, John Podesta, asked me to chair a White 

House task force on a tricky set of issues. How do you update our 

wiretap laws for the Internet age? We had telephone wiretap laws. 

How does it work for the Internet? And I chaired a 14-agency task 

force with all the intelligence agencies, but it meant there was 

some privacy expertise in the room to work together with the agencies who most were focused on gathering information. And we came 

up with recommendations that year. 

And then the fifth point about this OMB position was I could 

serve as a single point of contact. People knew who to yell at. The 

press knew who to call. The public could come to us. For the privacy groups, industry groups, and government agencies, there was 

one place to go for a forum and a way to talk about these issues 

going forward. 

So I think those five points suggest some real usefulness to having a policy official in the White House structure that focuses on 

privacy going forward. 

There is one lesson, I think, that I learned from that time—that 

it helps to have it be a statutory position. The position of the Administration when I was there was, because I was not statutory, 

I was not appropriate to testify in front of Congress. So I had to 

brief other people every time we had a privacy-related hearing. 

And I think that having a statutory position would help make sure 

that Congress would be well informed on these issues going forward. 

I am now going to shift to talking for the remainder of my time 

on biometric issues, which I think is a major emerging issue. It is 

vaguely covered by the Privacy Act but has not gotten the attention. We have new videos up today at the Center for American 

Progress Web site on this. But I highlight this in part because 

President Bush signed Homeland Security Presidential Directive 

24 (HSPD–24), his guidance on biometrics, on June 9, 2008, using 

words like ‘‘expanding’’ and ‘‘maximizing’’ the use of biometrics. 

18 

The guidance mentions privacy, but does not provide any implementation of what that is going to mean going forward. And here 

is the sort of background for concern. 

Computer scientist Terry Boult has raised an issue called the ‘‘biometric dilemma.’’ The more you use biometrics, the less secure 

they become. And the reason is the more you use secrets, the less 

secret they become. And so, in particular, when you think about 

fingerprints—Secretary Chertoff said not too long ago in a press 

availability that it is very difficult to fake a fingerprint. But that 

is not true. You can do a highly advanced research task. Go to 

Google or your favorite search engine and put in ‘‘fake fingerprint.’’ 

And on the first page, you will see multiple articles about how to 

do that for under $10. Unfortunate, but true. Go do it. You can do 

it on your BlackBerry probably while we are having the hearing. 

And how effective are these fake fingerprints? Well, Bruce 

Schneier, a famous security expert, tested one of the techniques, 

and he reported, ‘‘against 11 commercially available fingerprint biometric systems, it was able reliably to fool all of them.’’ 

And so we have a situation where fingerprints become the new 

data breach problem. If we have great big Federal databases full 

of fingerprints, those are data breaches waiting to happen. If you 

lose your Social Security number or your credit card number, you 

can, you hope, get a new one. You lose your fingerprint, it is very 

hard to get a new finger. And so we have this systematic security 

problem, data breach problem going forward if we have these huge 

government databases maximizing and expanding, as the recent directive said. 

There are things to do about this, but they have not been done 

yet. And so in my testimony, I suggest a couple of actions this 

Committee could consider immediately to start to do the work on 

biometrics that I think would be helpful. 

The first idea—and this is part of data breach laws generally— 

is to encourage encrypting transmission of things like this, biometrics, and encourage encryption when you store them. And so I 

suggest the E–Government Act of 2002 can be amended to provide 

a default for storing and transmitting biometrics in encrypted form. 

An exception to this ‘‘always encrypt’’ policy should be permitted 

only if it is justified in a Privacy Impact Assessment, only if it is 

really a good idea, and if it has received specific authorization from 

the Chief Privacy Officer for the agency. So I would like Mr. Teufel 

to have to sign off on it if we are going to have unencrypted uses 

of biometrics around the agency. And it may have to be considered 

whether in the private sector this should apply as well because if 

the private sector compromises these biometrics, then the government cannot use them either. 

A second point going forward is that access to biometric databases should be very well audited. We saw with the passport 

records of the Senators how audit can be helpful in sending a message and training people that they should not be messing around 

in people’s files. Biometrics going forward can be compromised, and 

we should audit the possibility. 

And then in the written testimony, I also talk about some promising new biometric technologies that are more privacy protective. 

One is called biometric encryption. And I suggest reports are apVerDate Nov 24 2008 09:50 Apr 08, 2010 Jkt 044117 PO 00000 Frm 00022 Fmt 6633 Sfmt 6601 P:\DOCS\44117.TXT SAFFAIRS PsN: PAT
19 

propriate. You could ask Homeland Security and the Justice Department Privacy Office to do reports on these technologies so that 

they have to say what works, what does not, whether pilot programs are appropriate to fix this. 

In conclusion, when it comes to biometrics, I will go back to an 

analogy I used when the Homeland Security Department was being 

created 6 years ago and I testified in Congress. Too often, we see 

this as if it is a truck where we only have an accelerator for some 

of these uses, but no brakes. And the concern with new technologies, if we simply expand biometrics without the brakes, is that 

we could compromise our fingerprints and our biometrics for a generation and we cannot get them back, so we should build them 

right in the first place. Thank you, Mr. Chairman. 

Chairman LIEBERMAN. Thanks, Mr. Swire. Very interesting and 

obviously informed and helpful testimony. We will do 6-minute 

rounds of questions and keep going until we are finished with our 

questions. 

Ms. Koontz, let me begin with you. The GAO report highlights 

a longstanding concern, which is that agencies are sharing and 

using personal data for purposes beyond the original stated purpose. I wanted to ask you to give us a few examples that you found 

in your work of that and indicate to us how widespread you think 

the practice is. 

Ms. KOONTZ. I think that what we were covering in our report 

is that there are only really very modest limitations in the law on 

sharing. Within an agency, the information may be shared as long 

as it is necessary for an employee to do their job. Outside of an 

agency, it can be shared pursuant to a routine use, but I think that 

all the panelists have commented that routine uses over time have 

become very numerous, very broad, and do not serve as a very useful way to limit the sharing of information. 

Chairman LIEBERMAN. And, again, this is sharing between agencies of the Federal Government. 

Ms. KOONTZ. Yes. I think we also make the point, though, that 

as we move toward an information-sharing environment, in the 

wake of September 11, 2001, we realize we need to share information better than we have in the past. In some cases, information 

also needs to be shared with State and local governments, and it 

needs sometimes to be shared with the private sector. 

One of the concerns that we raise in our report is that the Privacy Act does not ensure in all cases that the privacy protections 

travel with the data; that is, there are not onward transfer provisions that make sure that the protections travel with the data 

when they go outside the hands of the original collector and maintainer of the information. So I think that is a definite concern going 

forward that we need stronger protections because we foresee that 

there is going to be more sharing. We need stronger protections to 

ensure that the information is protected consistently as it travels. 

Chairman LIEBERMAN. You are quite right that a real focus for 

us on information sharing, again, started in this Committee with 

the legislation based on the 9/11 Commission Report, which found 

that, to use the familiar metaphor, there was no place where the 

dots were located together so that they could be connected to try 

to prevent September 11, 2001, from happening. So there is no 

20 

question that what we are trying to do is really encourage—and, 

insofar as possible, mandate—the sharing of information for national security or homeland security purposes. 

But is that the major area in which you are concerned? My own 

concern was that other agencies, unrelated to security work, are 

collecting information on American citizens and, beyond the stated 

purpose, sharing that information with other agencies for matters 

unrelated to security. 

Ms. KOONTZ. I am not sure that I can give you any examples 

where people actually exceeded the purposes for which it was originally collected. I think our concern is that it can be shared pursuant to all kinds of routine uses, and they are so numerous and 

broad that there are not really meaningful bounds on the sharing 

of information. 

Chairman LIEBERMAN. OK. What are possible solutions to this 

problem? 

Ms. KOONTZ. In terms of sharing? 

Chairman LIEBERMAN. Yes, sharing among agencies that goes beyond the original purpose for which the information was collected. 

Ms. KOONTZ. Right. It is a very important part of privacy that 

the information be only used in the way that is consistent with the 

purpose for which it was collected. So when the government told 

the person when they collected the information in the first place 

that this was the purpose, we need to handle that consistently over 

time. 

There are a couple things. First of all, in the System of Records 

Notices, in the public notices under the Privacy Act, there is not 

a requirement to state an overall purpose. Agencies are supposed 

to state purposes for each of the routine uses, but not an overall 

purpose. We think that requiring agencies to state the overall purpose of the collection is important. It is also important that they 

be very specific about that purpose so that it serves as a useful constraint. 

We also think that there should be mechanisms so that when information is shared outside an agency, that there are agreements 

with outside entities that will constrain the use of that information 

and provide protections to it. 

Chairman LIEBERMAN. That makes sense. Mr. Teufel, just to 

state again the obvious, in the case of a lot of information that the 

Department of Homeland Security and, obviously, the National 

Counterterrorism Center have, the original purpose, if you will, 

that Congress has mandated is that you share the information for 

the collective good. Why don’t you talk a little bit about how you 

react to this question about the original purpose being exceeded? 

Mr. TEUFEL. Sure. Well, first of all, I do not think I have an answer. Second, what I am going to tell you may run over my time, 

so with the Committee’s indulgence, I will do the best I can to answer the question. 

Chairman LIEBERMAN. Go ahead. 

Mr. TEUFEL. We think a lot about routine uses. You may be 

aware, and Ms. Koontz, in a report that she did on my office last 

year, mentions that we have 208 legacy agency System of Records 

Notices. So these are System of Records Notices that could be from 

Department of Energy, Department of Transportation, or DepartVerDate Nov 24 2008 09:50 Apr 08, 2010 Jkt 044117 PO 00000 Frm 00024 Fmt 6633 Sfmt 6601 P:\DOCS\44117.TXT SAFFAIRS PsN: PAT
21 

ment of Justice, and every agency approaches System of Records 

Notices differently. 

Chairman LIEBERMAN. Just for the record give us a brief definition of what that means, what a System of Records Notices is. 

Mr. TEUFEL. A System of Records Notice is a document that is 

required to be published under the Privacy Act of 1974 when an 

agency has a System of Records. A System of Records is a collection 

of information about U.S. citizens or legal permanent residents 

that is accessible by some unique identifier. So there are a lot of 

databases out there, and this is one of the things that others will 

talk about, that you can have a database that has personally identifiable information in it, but it will not be, under the definition in 

the Privacy Act, considered a System of Records. And, accordingly, 

there is not a System of Records Notice published in the Federal 

Register. We put them up on our Web site. 

So we have 208 legacy agency System of Records Notices 

(SORNs), and we are determined by the end of the year to update 

as many of those as possible. So the first thing that we did was 

we revised our guidance that is up on our Web site on how to conduct and prepare a System of Records Notice, and we looked at 

routine uses. And often there are routine uses that agencies will 

have, and they will just publish lists of routine uses that apply to 

every System of Records Notice at the agency. We do not do that. 

We do have a template where we list standard routine uses that 

one might see. Some may be for State and local information sharing. It might be for health purposes, law enforcement purposes, 

those sorts of things. But we do not have blanket routine uses that 

we have published. We look at each and every System of Records 

Notice when we decide which routine uses go into that particular 

document. 

So we have these 208 System of Records Notices out there, and 

over the last few months, my office and a contractor have gone 

through all of those to look at the different approaches and to see 

where we can harmonize and reduce. And this is something that 

Ms. Koontz had recommended in a report last year. There is a requirement under the Privacy Act, and I think it is OMB Circular 

A–130, that we, every 2 years, go through and look at System of 

Records Notices to make sure that we actually need the information and what are we doing with it. 

So we have made tremendous progress, and we have draft System of Records Notices for all 208. Many we will consolidate and 

go under government-wide, Executive Branch-wide System of 

Records Notices. Others will be DHS-wide, and for the remaining, 

they will be component-specific SORNs. So that is part of the answer. 

The other part of the answer is information sharing, and it is 

something that my office really has been grappling with, and in the 

remaining time in my office, it is one of two fairly major priorities, 

the other being cyber security. How do we do this? How do we do 

information sharing as Congress has mandated we do, but we do 

it in a way that is privacy sensitive? And I do not have an answer 

for you. We are working on this issue and working very closely 

with our colleagues at the Department of Justice and the Office of 

22 

the Director of National Intelligence, as well as the program manager for the information-sharing environment. 

Chairman LIEBERMAN. That is a good answer. Thank you. Senator Collins. 

Senator COLLINS. Thank you. 

Professor Swire, I want to follow up on some of your comments 

on biometrics. Biometrics have really been sold to Congress, and I 

think to the public and by the Department of Homeland Security, 

as the answer. I, therefore, was very interested in your comments 

about the ability to fake fingerprints, for example, because I believe 

as your testimony said and as I recall, Secretary Chertoff has been 

quoted as saying, that it is very difficult to fake a fingerprint. And 

I think you are telling us today that it is not. 

The U.S. Visa Waiver Program is based on having biometrics included in the exit program so that we can track who is here and 

who is leaving our country. So I am particularly interested in your 

analysis of the rush to embrace biometrics and whether they really 

will result in a better, more secure system, and also your red flags 

about the need for encryption. 

Do you know whether or not the Transportation Security Administration (TSA), for example, which is using biometrics for the new 

Clear system at airports to speed on the way travelers who have 

given the Department biometric information, do you know if that 

system is using encrypted data when it is being used at the test 

airports around the country? 

Mr. SWIRE. Thank you, Senator. I have not reviewed the Clear 

system in particular, so I do not have an answer on that. 

I think that when it comes to biometrics, there are vendors who 

are trying to sell systems, and they want to have people believe it 

is a good answer. And I also think that there is enormous pressure 

to sort of do something, to come up with secure ways to do things. 

And if our current things do not work very well, we want to move 

to the next generation, and biometrics has seemed tempting. 

The fact that fingerprints are easy to fake, the basic way you do 

it and the simplest method is if I have a picture of your finger, I 

just—nowadays, pictures come in my cell phone, for instance. I just 

blow it up, put it on my computer, and photo-shop it a little bit, 

and then I am able to print it out on a laser printer—this is pretty 

standard—and I can then get Gummy Bears or similar gel from the 

CVS and put it over my finger. And that is basically what it takes. 

You could have fancy machines, which is not what we mostly 

have, that could make sure the pulse is pulsing and things like 

that. But the basic idea that I just put your fingerprint on top of 

my finger is very easy to do. 

So that is known, and biometrics researchers, the sort of academic ones who are not trying to sell their products, have long lists 

of articles explaining these vulnerabilities. And that is why I think 

reports from the agencies, maybe including the Privacy Office, to 

really look at these might be one very specific step so that the eagerness to do things can be tempered by making sure we get the 

technical part right. 

Senator COLLINS. Well, it is particularly interesting to hear you 

say that, because several years ago, when I was the Chairman of 

the Permanent Subcommittee on Investigations, we did an invesVerDate Nov 24 2008 09:50 Apr 08, 2010 Jkt 044117 PO 00000 Frm 00026 Fmt 6633 Sfmt 6601 P:\DOCS\44117.TXT SAFFAIRS PsN: PAT
23 

1 Response from Peter Pietra to Senator Collins appears in Mr. Teufel’s response on page 36. 

tigation on how easy it was to counterfeit identification using readily available software on the Internet. And, indeed, my staff counterfeited, I think, a dozen different IDs for me, licenses in five different States, a college ID—probably that one would not have 

been—— 

Mr. SWIRE. You should be careful doing those. There are some 

laws about that. 

Senator COLLINS. Exactly. [Laughter.] 

Well, I can tell you that the law is a lot stronger after we did 

that investigation. But there were real loopholes in the law as far 

as making that illegal if it is done through the Internet. So we are 

constantly trying to catch up with our laws and our policies to the 

technology that is out there. And your comments on biometrics are 

an excellent caution to us because it has been sold as the way to 

have secure IDs. And now I am hearing from you that just as my 

staff was able to easily locate the technology on the Internet to 

counterfeit identifications, now you are telling me that we could do 

that with fingerprints as well. 

So it seems to me there are two issues here. One is: Is this technology really increasing security? The second is: How do we protect 

individual fingerprints from being counterfeited and used by those 

who would do us harm. 

Mr. SWIRE. If we do it badly, our fingerprints will get out there. 

They will be breached, and they will be out there. And we cannot 

get them back, right? So that means for our generation that fingerprint will be an insecure identifier. And that is a reason to be a 

step or two more cautious because if you screw it up, you have 

done it for a generation of people. 

Senator COLLINS. Well, that is why I want to follow up with TSA 

on the Clear system and what the protections are, and I am going 

to turn to Mr. Teufel to see if he knows the answer to that. 

When the fingerprint and other information that is given to airports that are being used, it it encrypted? Is it retained at the airport and, thus, subject to misuse? 

Mr. TEUFEL. Sadly, the BlackBerry is a wonderful thing, but it 

does not always give me an answer as fast as I might need it. 

I do not know the answer, but I can tell you that on our Web 

site, dhs.gov/privacy, we have privacy documentation posted, and I 

believe the answer may be in there. And I will be talking with 

TSA’s Privacy Officer, Peter Pietra, on this when I get back. So I 

am just hesitant to give an answer without being informed. 

Senator COLLINS. If you would get back to us on that issue, that 

would be helpful.1

Just quickly, because my time is expiring, Mr. Teufel, what do 

you think of the idea that Mr. Schwartz and Mr. Swire have raised 

about having a Privacy Officer at OMB designated in law so that 

it does not depend on the interests of a particular Administration 

to help provide government-wide guidance on privacy issues? 

Would that be helpful to you? Or would it be just another layer of 

bureaucracy? 

24 

Mr. TEUFEL. Well, I do not think it would be another layer of bureaucracy, and certainly as a Privacy Officer, I like Privacy Officers. 

Senator COLLINS. Some of your best friends. [Laughter.] 

Mr. TEUFEL. Some of my best friends are Privacy Officers. But 

my one concern would be I am just a Privacy Officer for DHS, and 

I am hesitant to speak beyond my role at DHS. And also I am 

mindful of the head of OMB’s ability to manage his or her office. 

Senator COLLINS. But just your personal opinion—I realize you 

are not speaking for the Department or the Administration. But 

you are on the front lines day in and day out in the Department, 

that, other than the VA and the Department of Health and Human 

Services (HHS), has the most information about Americans, and 

the Internal Revenue Service (IRS), I suppose. 

Mr. TEUFEL. Yes, ma’am. I work very closely with Karen Evans 

at OMB, and I think very highly of her. She co-chairs the Privacy 

Committee within the CIO Council, and she has designated me to 

be the Chair of the Cyber Security Subcommittee of the Privacy 

Committee. I think it is a good approach, and I like working with 

her. I think she has provided some excellent leadership in the role 

as the person I interact with on a regular basis at OMB for privacy 

issues. 

Senator COLLINS. Thank you. 

Chairman LIEBERMAN. Thanks, Senator Collins. I just want to 

point out that Ms. Evans is the E–Government person at OMB. 

Mr. TEUFEL. Yes, sir. 

Chairman LIEBERMAN. So she is not, as you know, a full-time 

government-wide privacy person. 

I just want to make sure I understand what you said, Mr. Swire 

because it is important to the Committee. What you are saying is 

obviously you have to get somebody else’s fingerprint to be able to 

compromise the biometric system. 

Mr. SWIRE. Yes. 

Chairman LIEBERMAN. So your concern is about the security, 

quite consistent with what we are focused on today, of fingerprints 

that the government has in its possession. 

Mr. SWIRE. And, in particular, if there are databases that the 

government holds where they just have lots and lots of fingerprints 

in there, if you have a breach of those databases, then all those 

people’s fingerprints become compromised. 

Chairman LIEBERMAN. Right, with very significant consequences. 

Mr. SWIRE. Even if it is encrypted at Clear or out at the edges, 

if the database is lying around subject to breach, that is a risk. 

Chairman LIEBERMAN. Right. That is a good point. Senator 

Akaka. 

Senator AKAKA. Thank you very much, Mr. Chairman. 

GAO’s report lays out some solid suggestions about ways to 

strengthen our privacy laws. However, one of the major issues not 

discussed in the report is the list of exemptions to the Privacy Act 

for law enforcement and intelligence activities. I believe that this 

issue merits some discussion since the major privacy arguments 

over the past few years have been with the treatment of personal 

information in the national security and homeland security context. 

25 

Can each of you discuss these exemptions and whether you have 

recommendations for changing these sections of the Privacy Act? 

Ms. KOONTZ. I will start us off. The exemptions are definitely an 

issue. They did not come up specifically in the work that we did, 

but we think that, going forward, any reconsideration of the provisions of the Privacy Act will have to include debate about the law 

enforcement exemptions and the general and specific exemptions in 

the Privacy Act. 

Mr. SWIRE. This is related, in my mind, to the information-sharing environment set of issues because that is where it comes up a 

lot of the time. I wrote an article called ‘‘Privacy and Information 

Sharing in the War Against Terrorism.’’ It came out about 2 years 

ago. And it was an attempt to—this was after I had worked on the 

Markle Task Force, which did a lot of information-sharing work. 

I think it is somewhat difficult to address it within the Privacy 

Act itself, but what the article called for was an expanded process, 

a sort of due diligence process or an expanded Privacy Impact Assessment process, at the time that you create new informationsharing programs. I think when you are building each one of those 

programs, an expanded list of questions about how to look at it, 

what should be shared, what should not, how do you minimize, and 

the rest, that might be the best way day in and day out to try to 

address that. 

Mr. SCHWARTZ. I will say, Senator, it is a good question. I am 

hesitant to touch the more general exemptions, especially the law 

enforcement exemption. I think that exemption actually is, compared to other law enforcement exemptions, pretty tailored for the 

Privacy Act and fits into the Privacy Act pretty well. The problem 

that we have had is more of these routine use exemptions where 

we see lists of 30 or 40 exemptions that the agency is just making 

up at that particular time. So if you have a set of 40 exemptions 

for a particular program that, as Ms. Koontz said, does not have 

a main purpose listed in the first place so you cannot compare the 

main purpose to these exemptions and try and figure out how they 

should be used, it is basically giving a complete loophole for sharing of the information for many purposes, and maybe for any purpose, if these exemptions are written widely enough. And I have 

even spoken with agencies, and with the Postal Service, for example, where there was a System of Records Notice that they put out 

a number of years ago, where I questioned the existence of some 

of the routine uses. And they said, ‘‘Well, those are just our blanket 

routine uses; we always put them in there. We agree with you they 

do not make sense for this particular program, but those are the 

ones we always use.’’ 

So then they went back and they changed their blanket exemptions because of our concerns based on that. But most agencies 

have not done that. As I mentioned in my testimony, the Department of Defense has 16 routine uses that they use for every collection of information. Obviously, not every collection is used in exactly the same way 16 times. It makes sense to look at how that 

particular program is being used and say this is how we plan on 

sharing it. If we want to do something different, we have to put out 

another System of Records Notice. We have to make a commitment 

to the American people that we are going to let them know what 

26 

this system does and how we are going to use that; and if we 

change that, we have to let them know how we are changing it. 

Mr. TEUFEL. So what I would reiterate is that we do not at the 

Department of Homeland Security have blanket routine uses. For 

every System of Records Notice, we think about each and every 

routine use individually. Do we need this routine use in this particular System of Records Notice? So we are very thoughtful or we 

seek to be very thoughtful in terms of what we include in a System 

of Records Notice. 

With respect to law enforcement and intelligence exemptions, I 

can think of a number of occasions when I have had a number of 

senior staff in my office, and we have gotten out our Department 

of Justice Privacy Act guide and gone through and looked at the 

case law and discussed what the meaning is of the particular exemptions and how they apply and whether they apply in a given 

System of Records Notice. And so I can tell you with respect to my 

agency—I cannot speak to others—that we seek to be very thoughtful in the use of those exemptions and to make sure that they are 

appropriate for a particular system. 

Senator AKAKA. Thank you. I have been concerned about the impact of data mining on the protection of personal information in the 

Federal Government for a number of years. This includes the use 

of commercial data for data mining. Could each of you discuss how 

the Privacy Act could be amended to cover data mining and the use 

of commercial data? Ms. Koontz. 

Ms. KOONTZ. I think one thing that could be done is to expand 

the protections of the Privacy Act to all personally identifiable information regardless of whether it is retrieved by a personal identifier or maintained in some other kind of way. We actually have 

done a number of studies about data mining and seen how much 

it has increased in recent years, as well as other analytical initiatives. And it is true that the Privacy Act does not currently always 

cover data-mining kinds of initiatives, but this is one way that it 

could. 

As far as information resellers, one of the reasons that it is not 

always covered by the Privacy Act is that the Act says that the government has to maintain the information. So it means if someone 

merely pings a database or looks at a database but does not retrieve the information and maintain it, the protections of the Privacy Act will not apply in that case. 

Some language along the lines of ‘‘systematic use,’’ focusing on 

use rather than maintenance of the information, might be an appropriate way to treat that reseller information. 

Mr. SCHWARTZ. First, I would like to strongly agree with everything that Ms. Koontz just said, and those are two excellent points. 

The first one that she made on the information and identifiability 

of information I think is a key one. The way that the Privacy Act 

was written, the question was whether information is actually 

being retrieved by name, by Social Security number, by a specific 

identifier. In data mining, you are not doing that. You could have 

a database that has 200 times more personal information, than 

what is considered a System of Records today, where you are 

searching on someone’s actual Social Security number, and use this 

new database for data mining where you are searching not on the 

27 

person’s name, not on the person’s Social Security number, but for 

attributes about them. Then that pulls out names and information, 

and that would not be considered a Privacy Act System of Records 

today or covered under the Privacy Act. 

It gets very confusing, but the basic problem is that we set up 

this system, this law, with the idea of what a database in the 

1970s looked like, where you would search for a particular identifier or a particular person’s name. We do not do that today, and 

data mining is one key example where you do not do that at all 

today, and the privacy sensitivity may actually even be greater 

than in the kind of database that the Privacy Act was written for, 

although clearly the goals of the Privacy Act cover this. And I think 

some of the agencies have taken that idea and said, we have to 

write Privacy Impact Assessments for this kind of data; we should 

take a step further and make sure that this is protected. But it is 

not clear that is being done across the government, and we need 

to make sure that is protected. 

Mr. SWIRE. Can I just respond? This is the single place where 

technology has changed the most since the 1970s. I think this is 

echoing what we just heard. In the 1970s, you had things in files 

retrieved by name. Today we have things called ‘‘Search,’’ and we 

can go through huge databases. And so changing that is the core 

of how technology has been changed. There are some ideas in the 

GAO report about ways to possibly do it, but it is worth recognizing 

this is the one place where the technology has really shifted and 

the law has not caught up. 

Senator AKAKA. Mr. Teufel. 

Mr. TEUFEL. A couple of very quick things here. First, I note that 

my office is holding a workshop on data mining. I do not know if 

we have the Federal Register notice out yet, but I think we have 

scheduled it for July 24 and July 25, and we will be looking at coming up with best practices. 

Second, the Homeland Security Act talks about data mining and, 

if I am not mistaken, talks about the Department looking at data 

mining and doing data mining. 

The third thing is what is the definition of ‘‘data mining,’’ and 

my office has issued a series of reports over the years—I think in 

2006, 2007, and 2008—and every year we have a different definition to look at. So without getting into what those definitions are, 

it is important to note that when we talk about it, we need to have 

some common frame of reference. 

And then, finally, with respect to information resellers, our Data 

Privacy and Integrity Advisory Committee has issued some reports 

on that. One of the things that has come out of those reports has 

been that in our PIA guidance, we have made some changes so that 

we ask the question, and then we publish in our Privacy Impact 

Assessments whether information is being used that comes from information resellers. 

Senator AKAKA. Thank you, Mr. Chairman. 

Chairman LIEBERMAN. Thanks, Senator Akaka. We will go now 

to a second round of 6 minutes for Members who have questions. 

One of the Fair Information Practices underlying the Privacy Act 

is so-called ‘‘data integrity,’’ the importance of ensuring that personal information the government collects is accurate. When this is 

28 

not the case, it obviously increases the risk that individuals will be 

subject to unfair treatment, in this case not only based on violation 

of privacy but on the inaccuracy of the personal data. 

I know that people who spend a lot of time in this field have said 

that inaccurate and incomplete information, so-called ‘‘dirty data,’’ 

is a large problem in some government programs. And, Ms. Koontz, 

I wanted to ask you first about that. Is it a large problem? And is 

the government investing in technologies to monitor and improve 

data quality? For instance, one of the places we have heard it is 

on the so-called no-fly list, that there is a lot of names there that 

may not be quite right. 

Ms. KOONTZ. Obviously, data integrity, a big issue across government and in the privacy area. The principle really talks about the 

fact that the data has to be accurate enough for the purpose for 

which it is used. So, again, it has to be tied to that purpose. Accuracy for one purpose may not be enough for another purpose. The 

no-fly list may need a higher level of accuracy than other ones. 

We did not do a compliance audit across government in order to 

determine to what extent agencies were complying with these various principles. I will say that when we did our report on Privacy 

Act compliance a number of years ago at your request, we did point 

out that while there was sort of mixed compliance across the Federal Government, one area was data integrity that needed improvement across 25 agencies that we looked at at that point. 

Chairman LIEBERMAN. Mr. Teufel, what is your experience with 

this in the Department of Homeland Security? Do we have a dirty 

data problem in accurate information being collected? 

Mr. TEUFEL. Well, I think government always can work on improving the accuracy, relevance, timeliness, and completeness of 

data that it has. So I do not think I can answer any way other than 

we can always do a better job, and part of our effort in looking at 

all of these legacy SORNs and revising them is considering this 

very issue. 

I also note that, as we discussed earlier with respect to law enforcement and intelligence exemptions, there is an exemption with 

respect to accuracy, relevance, timeliness, and completeness when 

it comes to law enforcement and intelligence information. And so 

while I am a Privacy Officer and not an intel guy or not a law enforcement guy, I have to at least on behalf of the agency mention 

this, that in those contexts you cannot have necessarily accurate, 

timely, complete information because you have sources and methods, some of whom or which you cannot attest to the veracity of. 

You get information that comes in, and you will have to assess it 

and determine its credibility, but it may not be accurate, timely, or 

complete. 

Chairman LIEBERMAN. OK. Mr. Schwartz, and Mr. Swire, let me 

get you both into this question of so-called dirty data. Is it a significant problem, inaccurate information, personal information being 

held by government agencies? And if it is, are there any mechanisms that we should be putting into place to try to clean up the 

data? 

Mr. SWIRE. Yes, in our ID Divide report, we have about four 

pages on dirty data problems, and the place that really hits home 

is on matching programs. So, for instance, under the Help America 

29 

Vote Act, there is matching where you delete voter rolls if you 

think there is not the right person signed up. Under E–Verify for 

new hires, you can say somebody is not eligible to work. And there 

has been very high levels of error reported and we have detailed 

footnotes because of this dirty data problem. 

What you see is numbers like 3 percent, 5 percent, or 10 percent 

of all records have inaccuracies in them, depending on which thing 

you look at. And if you then say you are not eligible to vote, you 

are not eligible to get a job, you are not eligible to get a driver’s 

license at that 3- or 5-percent level, that is a lot of people’s lives 

that are getting hit. 

And so dirty data directly affects people’s lives if they get turned 

down at the Department of Motor Vehicles (DMV) and have to try 

to figure out how to get a driver’s license. And so that is where you 

really see it, and those are big numbers, millions of people. 

Chairman LIEBERMAN. Those are big numbers. So how do we 

deal with that? I mean, just at the beginning somebody input the 

data inaccurately or did not have accurate information? 

Mr. SWIRE. It is a long list of things that happen. You type it in 

wrong, or somebody read the reader wrong. But also you have nicknames—there are lists of ways. I think that you need to have redress procedures. You need to have second ways for people—— 

Chairman LIEBERMAN. Give me a little more definition of what 

a redress procedure is. 

Mr. SWIRE. OK. Let’s say I go to the DMV and they say you cannot get a driver’s license because your match is not right with Social Security or something. There has to be some way for me as a 

normal person, not having to hire a lawyer, to be able to say, look, 

there is a mistake here, work with me on this. I am an American 

citizen. I am supposed to be able to get a driver’s license. Social Security says I do not have a match. 

And how those day-in, day-out procedures work when you get the 

bureaucratic ‘‘no’’ is something I think we have not spent enough 

time talking about. If we are going to be matching databases and 

we know there are going to be errors, we have to have ordinary 

ways for ordinary people to get it fixed. 

Chairman LIEBERMAN. I agree. Mr. Schwartz. 

Mr. SCHWARTZ. I agree that it is not going to be perfect, and I 

think Mr. Teufel’s points are well taken. However, I do think that 

it is a widely acknowledged problem in the Federal Government. I 

think pretty much any agency you speak to directly, speak to their 

Chief Information Officers, and they will say, yes, that this is a 

problem not just with my agency but with every agency across government. And it is something that we need to address. 

The important piece here is, to get to the point that Professor 

Swire was speaking about, that we do not think of privacy as the 

barrier to getting to better data. There are a lot of times where 

people talk about privacy as a bureaucracy that is in place on top 

of putting these kinds of systems in place. In this case, I think that 

privacy actually is helping greater efficiency by making sure that 

you have the correct data. By including people in the redress process and by coming up with a redress process that works efficiently 

and effectively, that is not adding bureaucracy to the system. That 

is making sure that the information you have is correct and works 

30 

efficiently. So if we can get that kind of process in place where we 

are correcting data, where we involve the data subject, where possible, into that process, I think we are going to end up with more 

efficiency down the road, although it is going to take longer to 

clean up the data in the short term. 

Chairman LIEBERMAN. Mr. Teufel, do you want to add something 

quickly? 

Mr. TEUFEL. Please, if I may. Redress is an important issue, the 

ability to find out what information government has and then correct that information. And I note that at the Department of Homeland Security there is DHS TRIP, Traveler Redress Inquiry Program, which is a one-stop shop for people affected by things that 

happen at DHS to write in and seek redress. And it applies not just 

to U.S. citizens and legal permanent residents, which is one of the 

restrictions of the Privacy Act, but also applies to non-U.S. citizens. 

Chairman LIEBERMAN. This is all done on the Internet? 

Mr. TEUFEL. Yes, it is. 

Chairman LIEBERMAN. And do you have any sense of how it is 

going? 

Mr. TEUFEL. It has been awhile since I have looked at the figures, but from what I recall, it is very good. 

Chairman LIEBERMAN. Good. Thank you. Senator Collins. 

Senator COLLINS. Thank you. 

We have talked a lot this morning about potential changes in the 

Privacy Act, the E–Government Act, and other laws. But the Fair 

Information Practices, the principles in that, which were developed 

in 1972, have proven very resilient because they are not technology 

dependent. They are principles like openness, transparency, and 

accountability. 

I would like to ask all of you whether we should be considering, 

in addition to changes in the Privacy Act, any changes in the Fair 

Information Practices. And I will start with Ms. Koontz. 

Ms. KOONTZ. I think you said it already. The Fair Information 

Practices have stood the test of time. The Privacy Act is based on 

the Fair Information Practices. The laws in many countries are 

based on Fair Information Practices, and over time, we have used 

them frequently in our work as a framework to look through to 

look at privacy protections. So I would not suggest anything specific. 

Senator COLLINS. Mr. Teufel. 

Mr. TEUFEL. As Privacy Officers, we live and die by the Fair Information Practices. So it is not making changes to them. I think 

it is adhering rigorously to them. 

Senator COLLINS. Mr. Schwartz. 

Mr. SCHWARTZ. I agree with that, but I think it is important to 

note that the Fair Information Practices have evolved over time. In 

the 1972 set, we had four listed, and now I think when you talk 

to most people, it is between eight and ten, depending on if you 

merged two together here or there. So they have changed over 

time. Ideas like data minimization, which was not in the original 

set, but is embedded in the Privacy Act, is now a term that we use 

pretty regularly today where you are getting rid of data. You are 

not collecting data you do not need, and you are getting rid of it 

31 

when you do not need it anymore. That is one example where we 

have had a shift over time. 

But I think the basic Fair Information Practices still exist today, 

and they were written into the Privacy Act, and I think that is the 

structure of the Privacy Act that we need to keep and make sure 

that we do not tinker with the Act so much that we lose that structure. 

Senator COLLINS. Professor Swire. 

Mr. SWIRE. I agree with what was said, but there is one of them 

that is under huge pressure—the idea of no secondary use, that 

you just use the data for the reason you started with it, and then 

you do not use it for 100 other purposes. That is where the pressure is. 

So within each agency, including the huge Homeland Security 

Department, it can go around for other purposes, not just the original purpose, and then these routine uses means it can go out of the 

agency to other agencies, and it can sort of be in a free zone. 

And so I think that is the hardest thing, is which uses are OK 

and which ones are not. And it has been hard to figure out how 

to build that into law. 

Senator COLLINS. Thank you. 

Mr. Teufel, Mr. Schwartz noted in his testimony that there are 

times when the Privacy Impact Assessment is actually completed 

after the project has been developed and approved rather than 

being anticipated beforehand. Is this a problem at DHS? 

Mr. TEUFEL. To the extent it is, it is less and less of a problem, 

and the reason for that is because of a couple of things. One is the 

increase in component Privacy Officers. Last year, I made a recommendation to Secretary Chertoff and he agreed that we ought to 

have more component Privacy Officers, and so in some of the operational components and department-level components that did not 

have Privacy Officers, there are now Privacy Officers. Immigration 

and Customs Enforcement (ICE) and Citizenship and Immigration 

Services (CIS) come to mind. TSA had a component Privacy Officer; 

still does. U.S. Visitor and Immigrant Status Indicator Technology 

(US–VISIT) has one as well. 

So having folks on the ground out in the components makes a 

difference because they can work these issues and are much closer 

to the people at the programmatic level who are doing things. 

The other thing is that we have been able to—and I hate to use 

the word—operationalize—just because I am not sure that is a real 

word. But we have operationalized privacy throughout the Department, so we have really infused ourselves into the bureaucratic 

process. And I do not use that in a pejorative way, but government 

is bureaucracy, and if you can get into the bureaucracy, you can 

make it work for you from a privacy perspective. And so we are 

doing better and better. 

Now, there are always programs that pop up, and we hear about 

them. One popped up earlier this week, and I was after hours on 

the phone with senior officials from a component and the General 

Counsel’s Office—Where are we? What is going on? And we will be 

able to get our work done before this program goes live. But sometimes we have to be very quick on our feet that we make sure that 

we do a thorough job but a timely job, even though the component 

32 

or the program folks have not told us early enough on what they 

are up to. 

Senator COLLINS. Thank you. 

Chairman LIEBERMAN. Thanks, Senator Collins. 

Senator Akaka, next. And then we will conclude with Senator 

Carper. 

Senator AKAKA. Thank you very much, Mr. Chairman. 

Mr. Teufel, today GAO is releasing a report I requested that reviews the responsibilities of senior agency Privacy Officers across 

the government. According to the report, some agencies like DHS 

have placed all of the responsibility under one official while others 

have shared responsibility. 

As the DHS Chief Privacy Officer, what do you believe are the 

benefits of having one individual responsible for privacy at an 

agency? 

Mr. TEUFEL. Well, I think the benefits that Mr. Swire mentioned 

earlier, that single point of contact, the person who is responsible 

for privacy so that if there is a question or a problem, the public, 

Congress, and people within the agency know to whom to go for an 

answer, to get the situation resolved, I think it is important, but 

I recognize that every agency is different, and so some agencies 

may have less involvement with personally identifiable information. For others like DHS, a big part of the Department’s success 

is reliant on personally identifiable information. So you have to 

have someone who is senior enough and who has access to the 

right people to go in and say, hey, I think there is an issue here, 

we need to talk about it. 

And as I mentioned earlier in my opening remarks, at a lot of 

agencies it makes sense to have someone who is more of a technician than a policy person because the privacy issues may not be 

that great at other agencies, and DHS is among them. You have 

to have somebody who is involved with policy and somebody who 

can go into the front office and component leadership offices and 

talk about the issues and work out solutions. 

Senator AKAKA. You mentioned having a person at a senior level. 

Where do you think this office should be set? At what level of an 

agency? 

Mr. TEUFEL. I think it could be any number of places, and I 

think, whether it is an SES-level position or an executive schedulelevel position, whether it is a direct report to the Secretary or perhaps somebody senior within the management or the Administration bureau or directorate, as I mentioned before, listening to 

Judge Baker, the important thing is that you have that access and 

that people will listen to you, that they have trust in confidence in 

you and that they will seek out your advice and counsel. 

Having said that, there is value to reporting directly to the Secretary and Deputy Secretary. 

Senator AKAKA. Yes. The reason I asked that is several years 

back, we wanted to bring about changes in accounting in Defense, 

and we set up an office for that. Two years later, the person that 

we were able to put there came to me and said, ‘‘I am resigning.’’ 

And I asked, ‘‘Why?’’ He said, ‘‘Because I cannot make the changes 

that need to be made.’’ He said, ‘‘It should be on a higher level.’’ 

33 

This tells me that a privacy officer needs to be at a higher level 

to make a difference. 

Mr. TEUFEL. I agree with you, Senator, and certainly when I 

have talked to some of my colleagues at other departments, senior 

career employees who are at the GS–15 level, I am not sure that 

at every one of those departments they are able to effectuate the 

policy changes that need to be made at those agencies. 

Senator AKAKA. Thank you. 

Ms. Koontz, I believe that it is extremely important for the public 

to be aware of how the Federal agencies are using their personal 

information. The GAO report suggests a layered notice with a summary of the most important facts up front, followed by a more detailed description. However, Privacy Impact Assessments, if done 

correctly, can provide more meaningful notice. 

Could you elaborate how under your proposal Privacy Act notices 

could be more easily understood by the public and how they would 

interact with PIAs? 

Ms. KOONTZ. Generally speaking, the problem with the public notices right now is that they are difficult to understand, they are 

treated as a legal compliance factor, and it may be hard for the 

public to identify which ones are in force. Publishing them in the 

Federal Register may not be the best way to communicate with the 

public. I mean, it serves a purpose, but I think in addition to publishing in the Federal Register, we think that publishing them on 

the Internet and some kind of centralized Web site, privacy.gov or 

something of the like, would be a good step to help the public be 

able to identify them. And then, second, I think the idea of layered 

notices really lends itself to a Web-type of presentation because you 

can provide an overall statement and then you can provide details 

if people want to go deeper into the statement and understand 

more about how the government is using information. 

I agree that the Privacy Impact Assessments can be a useful way 

of communicating with the public. If the agency has done a good 

job talking about why they are collecting the information and talking about the trade-offs, that can be an additional way of communicating this to the public. My feeling is that privacy is a lot about 

transparency, and having both means of communications would 

still make sense. 

Senator AKAKA. Mr. Chairman, may I ask—— 

Chairman LIEBERMAN. Please, go right ahead. 

Senator AKAKA. Mr. Swire, you mentioned in your testimony a 

report you recently co-authored on identification in America. I believe this report is timely considering the fact that DHS is working 

to implement the REAL ID Act. As you may know, Senator Sununu 

and I introduced S. 717 to repeal provisions of the REAL ID Act 

and replace it with a negotiated rulemaking process that incorporates States’ views and provides privacy safeguards. And you 

also know that some States have rejected the REAL ID Act for 

these same reasons. 

What are your views on S. 717, and the REAL ID Act, in general? 

Mr. SWIRE. Thank you, Senator. I support S. 717. I think it is 

useful, just for a few sentences, to explain why. REAL ID, as a 

process, never was debated in the Senate, never came through the 

34 

Committee process, etc. And I think as a statute, there were things 

that would have been fixed, more stakeholders could have been involved and all the rest, if it had a more thorough process. 

Going to the negotiated rulemaking means that the different expert people, including the States, would be more deeply involved, 

and I think that would create a framework for a better long-term 

outcome. 

Senator AKAKA. Thank you. Mr. Chairman, if I may, a short one. 

Chairman LIEBERMAN. Sure. 

Senator AKAKA. Mr. Schwartz, I understand that you are also a 

member of the Information Security and Privacy Advisory Board, 

which is working with the DHS Data Privacy and Integrity Advisory Committee to develop recommendations for revisions to the 

Privacy Act. And that is what we are trying to get at here. 

Can you tell me the status of this joint effort and whether other 

changes to the Privacy Act are being considered outside of those 

listed in your testimony? 

Mr. SCHWARTZ. Thank you, Senator Akaka. I actually just joined 

the Board at the last meeting, which was the beginning of this 

month, but there was a status update on that, and there was a discussion. It is a joint group that is working with the DHS Advisory 

Committee as well, and my understanding is that it is in its final 

phases now, and they are expecting to publish something sometime 

this year if they can work out some of the details together. 

I think that many of the changes discussed are similar to the 

things in the GAO report from what I was told. I have not seen 

the latest draft, though, so I cannot fully comment on if there is 

anything broader than that. Because I just came to the Board, I am 

not on that Subcommittee at this point. So I will try to get a report 

back to you from the chairman of the committee sometime in the 

next couple of days. 

Senator AKAKA. Thank you very much, Mr. Chairman. 

Chairman LIEBERMAN. Thanks, Senator Akaka. Senator Carper, 

I do want to put you on notice that in introducing Professor Swire 

and mentioning his university affiliation—— 

Senator CARPER. What affiliation is that? [Laughter.] 

Senator COLLINS. You are just proving what the Chairman said 

would happen. [Laughter.] 

Chairman LIEBERMAN. It is all yours. 

Senator CARPER. Ohio State University. 

Chairman LIEBERMAN. That is it. 

OPENING STATEMENT OF SENATOR CARPER 

Senator CARPER. I apologize to our panelists, but I was just over 

on the Senate floor with another graduate of Ohio State, a law 

school graduate, Senator Voinovich. And I shepherded with the 

support of, among others, Senator Lieberman and Senator Collins 

legislation to help reduce the emission of particulates from diesel 

engines. There are about 11 million of them on the roads. Bad 

stuff. They create a lot of bad health for us. And we appreciate the 

support of our colleagues in getting the legislation done, and on to 

the President to sign into law. 

Professor Swire, he told me that you were here, and he said, ‘‘In 

the French Quarter of Columbus, we pronounce his name ‘SwiVerDate Nov 24 2008 09:50 Apr 08, 2010 Jkt 044117 PO 00000 Frm 00038 Fmt 6633 Sfmt 6601 P:\DOCS\44117.TXT SAFFAIRS PsN: PAT
35 

ray.’’’ And so I said, ‘‘Well, you call him what you want. We will 

call him Swire at the hearing.’’ [Laughter.] 

But we are glad that you are here, and thank you all for coming. 

I have a statement I would like to share and then maybe a question or two, if I could. When I come in late at a hearing like this 

and I have missed your testimony, what I am going to ask you to 

do is just share with me and with my colleagues the common 

ground that you see here, sort of the takeaways, evolving from the 

discussion and from the questioning that occurred. So just be 

thinking about that, if you will. 

Mr. Chairman, thanks very much for holding this hearing. And 

I want to say to Senator Akaka, thank you very much for your 

leadership in bringing us here as well. And sometimes it seems 

that almost every week another agency is compromised by suspected hackers or a laptop is lost or stolen by current or former employees. And all too often, these events put at risk millions of 

Americans’ sensitive information, names, birth dates, Social Security numbers, and health information included. 

In fact, my staff tells me that there are criminal elements in this 

world that have massive inventories of bank numbers, Social Security numbers, and other personally identifiable information that 

are sold to the highest bidder. Some of these criminals have been 

caught—not enough—but largely these criminal groups remain immune to our laws here in the United States. And a lot of them operate outside of the United States, as you know. 

That is why agencies need to ensure that sensitive information 

is protected during its collection, during its transmission, and 

throughout its storage. Placed in the wrong hands, this information 

can leave an individual vulnerable to identity theft, which we suffered in our own family, or to worse. 

That is one of the reasons I chaired a hearing of the Subcommittee on Federal Financial Management, Government Information, Federal Services, and International Security on March 12, 

2008. And we looked into the Federal Information Security Management Act. What I found there surprised me. Many times agencies do not even know what information they hold. They do not 

know where the information is stored. They do not know who has 

the access and whether that information has been compromised. 

Our Federal Government stores some of our Nation’s most sensitive economic, corporate, and military secrets. It is imperative 

that agencies find a better way to protect not just an individual’s 

identity but as much of that sensitive information as we possibly 

can. 

However, I feel the American public is slowly but surely losing 

faith in our government’s ability to protect its sensitive information. That is why I have asked my staff to work hard with some 

of our colleagues on this Committee on reforming this critical information security law. And I look forward to working with our Chairman and with my other colleagues on this Committee on this legislation to protect our Nation’s most sensitive information. 

With that having been said, and earlier having telegraphed my 

pitch, we will just ask maybe Professor Swire to lead off. Please 

summarize what you see as common ground and lessons for us to 

take away from this hearing. Thank you. Again, welcome. 

36 

Mr. SWIRE. Oh, thank you very kindly. Go Buckeyes. 

I think in terms of common ground, one thing I heard is that the 

definition of ‘‘Systems of Records,’’ the definition in the Privacy Act 

of what is covered, leaves out a lot of data mining. That is a technological change from the 1970s. And how to create a legal structure around that, I do not think we have any answer to necessarily. 

There is going to be a workshop coming up on that. But the idea 

that we do not retrieve records one at a time now the way we did 

35 years ago and we need to come up with a new set of ways to 

deal with that, I think that is a strong theme I heard today from 

pretty much everyone. 

Senator CARPER. Thank you, sir. Mr. Schwartz. 

Mr. SCHWARTZ. Well, I will pick one item out from, I think, a 

number of things that the four of us probably agreed on. But I 

think that there was a discussion about changes to encourage leadership in privacy across agencies, and there are a number of ways 

to do that, particularly through making sure that we have highlevel appointees within the agencies and probably within OMB as 

well. But I think that certainly there was agreement that it has to 

be a high-level staff on privacy that can take accountability. 

Senator CARPER. Thanks very much. 

Mr. TEUFEL. So my answer to you, sir, would be transparency. 

It is key to the privacy framework in the public sector in the 

United States, and Chairman Lieberman had mentioned the European approach. And there are many things the Europeans do well, 

but transparency is not something, I think, the Europeans do as 

well as we can and often do in the United States. The goal is for 

the public to have trust and confidence in what its government is 

doing. 

The other thing that one gets through transparency is that it allows the public to make informed decisions that they then can let 

you, the elected representatives of the country, know about those 

views. And so I would stop with that. 

Senator Collins, I did want to mention, thanks to the magic of 

the BlackBerry, Peter Pietra, the component Privacy Officer, tells 

me that Clear is one of the many providers under the Registered 

Traveler Program, and there is a PIA out on the Registered Traveler Program, and the data is encrypted. 

Senator COLLINS. Thank you. 

Senator CARPER. We could not have done that 34 years ago, could 

we? [Laughter.] 

Pretty amazing. Thank you. Actually, information like that sort 

of makes my colleagues and I joyful, which rhymes with your name 

‘‘Teuful.’’ [Laughter.] 

Mr. TEUFEL. Thank you, Senator. I have never heard that before. 

Thank you. 

Chairman LIEBERMAN. That was the proper response to a Senator. Very well done. [Laughter.] 

Senator CARPER. Ms. Koontz. 

Ms. KOONTZ. I think we agree that the System of Records concept in the Privacy Act is outmoded. It is not consistent with current uses of information or the technology that we are employing. 

We would like to see the protections of the Privacy Act expanded 

37 

to all personally identifiable information, regardless of how it is 

held. 

I think another point is that we would like to see personally 

identifiable information, its use and collection, limited to a specified purpose. 

And, finally, I agree with the point on transparency. We need to 

promote transparency, and we need to improve the public notices 

in a number of ways that serve as a vehicle for us to inform the 

public about what the Federal Government is doing with personally 

identifiable information. 

Senator CARPER. I thank you all. We thank you for being here. 

We thank you for your testimony. And thank you for allowing me 

to look for some common ground and some takeaways that should 

serve us well in the future. 

Mr. Chairman, much obliged. 

Chairman LIEBERMAN. Thank you very much, Senator Carper. 

Actually, your question was a great one to conclude the hearing on, 

and it illuminates what struck me. Senator Collins and I were talking about it. As I listened to the testimony, you have all been very 

helpful, and what is also true and significant, and not always the 

case when we bring together a group of people from different perspectives on a common issue, is that there is quite a consensus 

among you about what needs to be done. 

So you have helped us enormously this morning, and I think now 

we want to consider what we can do and perhaps in a short time 

frame—which, unfortunately, is the case with this session of Congress—whether there is some common ground proposal that we can 

come forward with that will not stir up the kind of controversy that 

will block it from being passed or whether we want to wait until 

the next session and do something more comprehensive. 

But there is no question, in my mind, anyway, as I listen to the 

testimony or read the GAO reports, that the Privacy Act of 1974 

is just not up to the realities of 2008 in the age of information. 

Senator Collins, did you want to add anything in conclusion? 

Senator COLLINS. Thank you. I just want to thank our witnesses. 

This was an excellent panel, and I very much appreciate your leadership, Mr. Chairman. Thank you. 

Chairman LIEBERMAN. Thanks, Senator Collins. 

We will keep the record of the hearing open for 15 days in case 

any of you want to add to your testimony, any answers you may 

not have received already over your BlackBerrys and shared with 

the Committee, or in case Members of the Committee who have not 

been here, or even those who have, have additional questions for 

you. 

But, with that, I thank you very much. The hearing is adjourned. 

[Whereupon, at 11:57 a.m., the Committee was adjourned.] 

(39) 

A P P E N D I X 


44117.111
40 


44117.112
41 


44117.113
42 


44117.114
43 


44117.115
44 


44117.116
45 


44117.117
46 


44117.118
47 


44117.119
48 


44117.120
49 


44117.121
50 


44117.122
51 


44117.123
52 


44117.124
53 


44117.125
54 


44117.126
55 


44117.127
56 


44117.128
57 


44117.129
58 


44117.130
59 


44117.131
60 


44117.132
61 


44117.133
62 


44117.134
63 


44117.135
64 


44117.077
65 


44117.078
66 


44117.079
67 


44117.080
68 


44117.081
69 


44117.082
70 


44117.083
71 


44117.084
72 


44117.085
73 


44117.086
74 


44117.087
75 


44117.088
76 


44117.089
77 


44117.090
78 


44117.091
79 


44117.092
80 


44117.093
81 


44117.094
82 


44117.095
83 


44117.096
84 


44117.097
85 


44117.098
86 


44117.099
87 


44117.100
88 


44117.101
89 


44117.102
90 


44117.103
91 


44117.104
92 


44117.105
93 


44117.106
94 


44117.107
95 


44117.108
96 


44117.109
97 


44117.110
98 


44117.001
99 


44117.002
100 


44117.003
101 


44117.004
102 


44117.005
103 


44117.006
104 


44117.007
105 


44117.008
106 


44117.009
107 


44117.010
108 


44117.011
109 


44117.012
110 


44117.013
111 


44117.014
112 


44117.015
113 


44117.016
114 


44117.017
115 


44117.018
116 


44117.019
117 


44117.020
118 


44117.021
119 


44117.022
120 


44117.023
121 


44117.024
122 


44117.025
123 


44117.026
124 


44117.027
125 


44117.028
126 


44117.029
127 


44117.030
128 


44117.031
129 


44117.032
130 


44117.033
131 


44117.034
132 


44117.035
133 


44117.036
134 


44117.037
135 


44117.038
136 


44117.039
137 


44117.040
138 


44117.041
139 


44117.042
140 


44117.043
141 


44117.044
142 


44117.045
143 


44117.046
144 


44117.047
145 


44117.048
146 


44117.049
147 


44117.050
148 


44117.051
149 


44117.052
150 


44117.053
151 


44117.054
152 


44117.055
153 


44117.056
154 


44117.057
155 


44117.058
156 


44117.059
157 


44117.060
158 


44117.061
159 


44117.062
160 


44117.063
161 


44117.064
162 


44117.065
163 


44117.066
164 


44117.067
165 


44117.068
166 


44117.069
167 


44117.070
168 


44117.071
169 


44117.072
170 

Æ 


44117.073