U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

46–195 PDF 2009

PRIVACY: THE USE OF COMMERCIAL

INFORMATION RESELLERS BY FEDERAL AGENCIES

HEARING

BEFORE THE

SUBCOMMITTEE ON INFORMATION POLICY,

CENSUS, AND NATIONAL ARCHIVES

OF THE

COMMITTEE ON OVERSIGHT

AND GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED TENTH CONGRESS

SECOND SESSION

MARCH 11, 2008

Serial No. 110–108

Printed for the use of the Committee on Oversight and Government Reform

(

Available via the World Wide Web: http://www.gpoaccess.gov/congress/index.html

http://www.oversight.house.gov

(II)

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM

HENRY A. WAXMAN, California, Chairman

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

CAROLYN B. MALONEY, New York

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

DANNY K. DAVIS, Illinois

JOHN F. TIERNEY, Massachusetts

WM. LACY CLAY, Missouri

DIANE E. WATSON, California

STEPHEN F. LYNCH, Massachusetts

BRIAN HIGGINS, New York

JOHN A. YARMUTH, Kentucky

BRUCE L. BRALEY, Iowa

ELEANOR HOLMES NORTON, District of

Columbia

BETTY MCCOLLUM, Minnesota

JIM COOPER, Tennessee

CHRIS VAN HOLLEN, Maryland

PAUL W. HODES, New Hampshire

CHRISTOPHER S. MURPHY, Connecticut

JOHN P. SARBANES, Maryland

PETER WELCH, Vermont

——— ———

TOM DAVIS, Virginia

DAN BURTON, Indiana

CHRISTOPHER SHAYS, Connecticut

JOHN M. MCHUGH, New York

JOHN L. MICA, Florida

MARK E. SOUDER, Indiana

TODD RUSSELL PLATTS, Pennsylvania

CHRIS CANNON, Utah

JOHN J. DUNCAN, JR., Tennessee

MICHAEL R. TURNER, Ohio

DARRELL E. ISSA, California

KENNY MARCHANT, Texas

LYNN A. WESTMORELAND, Georgia

PATRICK T. MCHENRY, North Carolina

VIRGINIA FOXX, North Carolina

BRIAN P. BILBRAY, California

BILL SALI, Idaho

JIM JORDAN, Ohio

PHIL SCHILIRO, Chief of Staff

PHIL BARNETT, Staff Director

EARLEY GREEN, Chief Clerk

LAWRENCE HALLORAN, Minority Staff Director

SUBCOMMITTEE ON INFORMATION POLICY, CENSUS, AND NATIONAL ARCHIVES

WM. LACY CLAY, Missouri, Chairman

PAUL E. KANJORSKI, Pennsylvania

CAROLYN B. MALONEY, New York

JOHN A. YARMUTH, Kentucky

PAUL W. HODES, New Hampshire

MICHAEL R. TURNER, Ohio

CHRIS CANNON, Utah

BILL SALI, Idaho

TONY HAYWOOD, Staff Director

(III)

C O N T E N T S

Page

Hearing held on March 11, 2008 ............................................................................ 1

Statement of:

Evans, Karen S., Administrator, Office of E-Government and Information

Technology, OMB; Linda D. Koontz, Director, Information Management

Issues, GAO; and Hugo Teufel III, Chief Privacy Officer, Department

of Homeland Security ................................................................................... 6

Evans, Karen S. ......................................................................................... 6

Koontz, Linda D. ....................................................................................... 12

Teufel, Hugo, III ........................................................................................ 43

Schwartz, Ari, deputy director, Center for Democracy and Technology;

Stuart Pratt, president, Consumer Data Industry Association; and

Paula J. Bruening, deputy director, Center for Information Policy Leadership ............................................................................................................. 66

Bruening, Paula J. .................................................................................... 93

Pratt, Stuart .............................................................................................. 79

Schwartz, Ari ............................................................................................. 66

Letters, statements, etc., submitted for the record by:

Bruening, Paula J., deputy director, Center for Information Policy Leadership, prepared statement of ...................................................................... 95

Clay, Hon. Wm. Lacy, a Representative in Congress from the State of

Missouri, prepared statement of .................................................................. 3

Evans, Karen S., Administrator, Office of E-Government and Information

Technology, OMB, prepared statement of ................................................... 8

Koontz, Linda D., Director, Information Management Issues, GAO, prepared statement of ........................................................................................ 14

Pratt, Stuart, president, Consumer Data Industry Association, prepared

statement of ................................................................................................... 81

Schwartz, Ari, deputy director, Center for Democracy and Technology,

prepared statement of ................................................................................... 68

Teufel, Hugo, III, Chief Privacy Officer, Department of Homeland Security:

Prepared statement of ............................................................................... 45

Various e-mails .......................................................................................... 58

(1)

PRIVACY: THE USE OF COMMERCIAL INFORMATION RESELLERS BY FEDERAL AGENCIES

TUESDAY, MARCH 11, 2008

HOUSE OF REPRESENTATIVES,

SUBCOMMITTEE ON INFORMATION POLICY, CENSUS, AND

NATIONAL ARCHIVES,

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM,

Washington, DC.

The subcommittee met, pursuant to notice, at 2:12 p.m., in room

2203, Rayburn House Office Building, Hon. Wm. Lacy Clay (chairman of the subcommittee) presiding.

Present: Representatives Clay and Turner.

Staff present: Darryl Piggee, staff director/counsel; Jean Gosa,

clerk; Adam Bordes, professional staff member; Michelle Mitchell,

legislative assistant, Office of Wm. Lacy Clay; Leneal Scott, information systems manager; and Charles Phillips, minority counsel.

Mr. CLAY. The Information Policy, Census, and National Archives Subcommittee of the Oversight and Government Reform

Committee will now come to order. Today’s hearing will examine

the role of the agencies using commercial information resellers to

obtain personal information about individuals and whether there

are adequate privacy safeguards in place for such transaction. We

will hear from both government and private sector witnesses about

the adequacy of current privacy safeguards and solicit their recommendations for improving the protections afforded to personal

information that is obtained and used by our agencies. And we will

also examine whether our current privacy laws and regulations require additional privacy safeguards, such as those offered in my bill

H.R. 4791, the Federal Agency Data Protection Act.

Without objection, the Chair and ranking minority member will

have 5 minutes to make opening statements, followed by opening

statements not to exceed 3 minutes by any other Member who

seeks recognition. Without objection, Members and witnesses may

have 5 legislative days to submit a written statement or extraneous

materials for the record.

Since the enactment of our Nation’s first comprehensive privacy

laws over three decades ago, advances in computing and data mining have enabled agencies and the information service industry to

aggregate and combine different sources of personal information in

ways that no one could anticipate.

From a privacy perspective, however, such activities have increased the risk of personal information being misused by agency

2

personnel or inadequately protected by data bases that are used for

multiple purposes. This problem has been further magnified by the

agency community’s use of commercial data. Brokers obtain specific

and detailed information on individuals without ensuring that adequate privacy measures are in place. In fact, a recent GAO report

confirms that both agencies and commercial data brokers are uneven in their application of those information safeguards required

under the Privacy Act and that agencies continue to lack effective

privacy practices in the handling of such information from commercial sources.

While I realize that obtaining such information from private

sources is vital to the work of our agencies, it is critical that such

information be afforded the same privacy protections as data maintained on agency systems.

I welcome all of our witnesses today and look forward to their

testimony and I now yield to the distinguished ranking minority

member, Mr. Turner of Ohio.

[The prepared statement of Hon. Wm. Lacy Clay follows:]

3

4

5

Mr. TURNER. Thank you, Mr. Chairman.

Mr. Chairman, I greatly appreciate your holding this hearing.

This issue involves the careful balancing of individuals’ right to privacy and the Federal Government’s need to obtain information to

protect national security in the war on terror and to provide other

vital services. The role of commercial information resellers in supplying data about individuals to Federal agencies is certainly a new

dimension both for opportunity and the need for concern. The government act requires that agencies conduct private investment assessments [PIAs], analysis of how personal information is collected,

stored, shared and managed in a Federal system.

Under the E-Government Act and related Office of Management

and Budget’s guidance, agencies must conduct PIAs before developing or procuring information technology that collects, maintains or

disseminates information that is in a personally identifiable form.

Some are concerned that OMB has not provided sufficient guidance

on PIAs and that some agencies have not always notified the public

that commercial information resellers were among the sources

used.

The importance of this hearing, obviously, is for us to be able to

provide a balance. I understand that there will be a significant

amount of concern of the impact of our looking at this issue on the

commercial sector, and we also have concerns as to protecting individual privacy. This will be helpful because as we get more information, we can ensure that we do the right thing in proceeding.

We certainly want to make certain that on all these issues that

we have a balance. We’re going to hear from all sides and perspectives that we can work together to improve the situation, address

valid concerns while avoiding overreaching legislation that could

negatively impact agency missions. As we look to the successes that

have occurred in the commercial sector, we certainly don’t want to

overly restrict the ability of the Federal Government to overlook

these resources, but we must look to affording protections.

Mr. Chairman, I look forward to all the witnesses’ testimony and

yield back the balance of my time.

Mr. CLAY. If there are no additional opening statements, the subcommittee will now receive testimony from witnesses before us

today. I want to start by introducing our first panel. Ms. Karen

Evans is the Adiminstrator for the office of E-Government and Information Technology at the Office of Management and Budget.

She is an experienced IT professional and leads the administration’s program in information security. And welcome today.

Ms. EVANS. Thank you.

Mr. CLAY. We also have Ms. Linda Koontz who is the Director

of Information Management issues at the U.S. Government Accountability Office. She is responsible for issues concerning the collection, use and dissemination of government information in an era

of rapidly changing technology. Welcome, Ms. Koontz. Welcome

back.

We also have Mr. Hugo Teufel as the Chief Privacy Officer at the

Department of Homeland Security. His office is responsible for all

privacy policies throughout DHS, including agency compliance with

the Privacy Act of 1974, the conducting of Privacy Impact Assessments and oversight of all agency activities relating to the use, colVerDate 11-MAY-2000 14:37 Jan 30, 2009 Jkt 000000 PO 00000 Frm 00009 Fmt 6633 Sfmt 6633 C:\DOCS\46195.TXT KATIE PsN: KATIE
6

lection and disclosure of personal information. Thank you too, Mr.

Teufel, for being here today.

It is the policy of the committee to swear in all witnesses before

they testify. I’d like to ask you to please stand and raise your right

hand.

[Witnesses sworn.]

Mr. CLAY. Let the record reflect that the witnesses answered in

the affirmative. I ask that each of the witnesses now give a brief

summary of their testimony and to keep the summary under 5

minutes in duration. Your complete written statement will be included in the hearing record. Ms. Evans, let’s begin with you.

STATEMENTS OF KAREN S. EVANS, ADMINISTRATOR, OFFICE

OF E-GOVERNMENT AND INFORMATION TECHNOLOGY, OMB;

LINDA D. KOONTZ, DIRECTOR, INFORMATION MANAGEMENT

ISSUES, GAO; AND HUGO TEUFEL III, CHIEF PRIVACY OFFICER, DEPARTMENT OF HOMELAND SECURITY

STATEMENT OF KAREN S. EVANS

Ms. EVANS. Good afternoon, Mr. Chairman and members of the

subcommittee. Thank you for inviting me to speak about the use

of commercial information resellers by Federal agencies and privacy safeguards on such information.

Safeguarding the privacy of individuals and ensuring transparent agency use of personally identifiable information has been

an administration priority. The administration has demonstrated

progress through implementing the recommendations of the President’s Identity Theft Task Force OMB guidance, diligent execution,

and statutory requirements for the System of Record Notice

[SORN], and Privacy Impact Assessments [PIAs], in increasing

agency reporting.

Building on the work of the President’s task force, OMB issued

memorandum 0716 in May 2007 to enhance agency PII protections.

The guidance required agencies to establish breach notification

policies and provided a framework for reducing the risk of PII

breaches. M–07–16 required agencies to review their use of Social

Security numbers and to identify incidences in which the collection

or the use of Social Security numbers was unnecessary. Within 120

days, agencies were required to establish a plan to eliminate the

unnecessary collection and use of Social Security numbers.

In response to one of the task force recommendations, OMB and

DHS also issued a list of 10 common risks impeding adequate protection of government information and best practices for avoiding

and mitigating those risks. The risk covers a range of areas, such

as security and privacy training, contracts and data sharing agreements, and physical security. All the best practices and important

resources are interrelated and complementary and can be broadly

applied when administering agency information security and privacy programs.

Federal agencies have pursued diligent execution of the statutory

requirements for SORN in the Privacy Act and PIAs in the E-Gov

Act to ensure transparent agency use and handling of individuals’

information. OMB released the Fiscal Year 2007 Report on the Implementation of the Federal Information Security Management Act

7

of 2002 on March 1st, which reports on key measures of agencies’

security and privacy programs, including SORNs and PIAs.

For example, the goal of the Federal Government is for 90 percent of the applicable systems to have publicly posted PIAs. In

2007 we reached 84 percent. While this percent remains the same

as it was in 2006, a substantial increase in the number of systems

identified requiring PIAs from 2006 to 2007 is indicative of the

agency progress.

In next year’s FISMA report, we are requiring new key privacy

measures as outlined in memorandum 08–09 issued in January

2008. The increased reporting will enhance public confidence in the

Federal agency privacy programs and further drive agency

progress.

Privacy warrants the administration’s close attention. We need to

ensure Federal agencies are adhering to the enduring principles of

the Privacy Act and the E-Gov Act in the face of advancing technology that allows for greater collection, analysis and storage of information by the government and industry. In the course of pursuing their missions, agencies may determine if it’s necessary to obtain these products for a variety of reasons, such as verifying beneficiary addresses or for law enforcement efforts.

H.R. 4791 contains two provisions amending the E-Gov Act of

2002 intended to strengthen privacy practices specifically related to

agency use of commercial information resellers. In testimony provided to the subcommittee on February 14th, I shared concerns

covering the entire bill. Today I focus my written statement on concerns related to sections 8 and 9, the data broker provisions.

Although we strongly support enhancing privacy protections for

information obtained by Federal agencies, we share several concerns expressed across the Federal agencies about the effect of this

legislation. We are concerned these provisions would have a negative unintended consequence without the resulting enhancements

and privacy protections. Information Federal agencies receive from

commercial resellers must receive the same Privacy Act and E-Gov

Act protections provided to other information obtained by agencies.

We look forward to working with you to ensure agency privacy

policies effectively provide those protections for reseller information

while enabling each agency to maintain privacy policies that align

with their diverse missions.

I’d be happy to take questions at the appropriate time.

Mr. CLAY. Thank you so much, Ms. Evans.

[The prepared statement of Ms. Evans follows:]

8

9

10

11

12

Mr. CLAY. Ms. Koontz, you may proceed.

STATEMENT OF LINDA D. KOONTZ

Ms. KOONTZ. Mr. Chairman and members of the subcommittee,

I appreciate the opportunity to be here today to discuss issues surrounding the Federal Government’s purchase of personal information from businesses known as information resellers.

I’d like to briefly summarize the results of our work on this topic.

Information is an extremely valuable resource and the services provided by information resellers are important to a variety of Federal

agency functions. Our work has shown that agencies make significant use of information obtained from information resellers. Specifically for fiscal year 2005, four agencies we reviewed—Justice,

Homeland Security, State, and Social Security reported a combined

total of approximately $30 million to purchase personal information

from resellers. The vast majority of the spending, just over 90 percent, was for law enforcement or counterterrorism.

For example, the Department of Justice, the largest user among

the four, used the information for criminal investigations, locating

witnesses and fugitives, researching assets held by individuals of

interest and detecting fraud in prescription drug transactions. Reseller information was also used to detect and investigate fraud,

verify identities and determine benefit eligibility.

While agencies took steps to address privacy and security of the

information acquired from resellers, they did not do all that they

could to protect individuals’ privacy rights. Specifically, although

agencies issued public notices on information they were collecting

about individuals, these did not always specifically state that information resellers were among the sources used. In several of these

cases, agency sources for personal information were described only

in vague terms such as private organization, other public resources,

or public source material.

We also found that few agencies were conducting Privacy Impact

Assessments which can be important tools for helping agencies

identify privacy implications because they did not think they were

required. Contributing to this rather uneven application of privacy

principles were ambiguities in OMB guidance regarding the applicability of privacy requirements for Federal agency uses of reseller

information.

As a result we made recommendations to OMB to clarify its guidance and direct agencies to review their uses of information obtained from resellers. We’ve also recommended that the agencies

we reviewed develop specific policies for the use of commercial

data. OMB and the four agencies generally agreed with our report.

Since then, agencies have taken action to address our recommendations.

For example, DHS incorporated direction on the use of commercial data into its May 2007 Guidance on Privacy Impact Assessments. However, OMB has not taken the actions we’ve recommended.

We would also like to comment on the proposed Federal Agency

Data Protection Act which would require that agencies conduct Privacy Impact Assessments for their uses of commercial data and develop regulations governing the use of such data. These provisions

13

are very consistent with our previous recommendations and should

help ensure that Federal agencies appropriately tend to privacy

concerns when using commercial data.

In conclusion, privacy is ultimately about striking a balance between competing interests. In this case, it is about balancing the

value that reseller information adds to important government functions against the privacy rights of individuals. I look forward to

participating in the discussion on how to strike that balance.

That concludes my statement. Thank you.

Mr. CLAY. Thank you so much, Ms. Koontz.

[The prepared statement of Ms. Koontz follows:]

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

Mr. CLAY. Mr. Teufel.

STATEMENT OF HUGO TEUFEL III

Mr. TEUFEL. Good afternoon, Mr. Chairman and Ranking Member Turner and members of the committee. It’s an honor to be here

today to talk to you about commercial information and privacy.

And it’s also a pleasure to be here today with my colleagues who

I hold in very high regard: Ms. Evans from OMB and Ms. Koontz

from GAO, and we work together often. I gather I’m here to give

an agency perspective and I will endeavor to do my best in giving

that perspective.

In my oral statement, which will be brief, I want to touch on a

few highlights beyond what’s in my written statement. And I note

that the privacy implications of the use of commercial information

are not new to my office, and so I want to go through a little

timeline here for you.

In September 2005 the Privacy Office held a workshop on commercial information.

September 28, 2005, our Data Privacy and Integrity Advisory

Committee issued the first of two reports on this information.

And on April 4, 2006, Acting Chief Privacy Officer Maureen

Cooney testified, I think before this committee, on the subject.

Following that, on December 6, 2006, our Data Privacy and Integrity Advisory Committee issued its second report on commercial

information.

As Ms. Koontz noted, our PIA guidance has been updated to take

into account the use of commercial information, and section 2 of the

Privacy Impact Assessment Guidance talks about the sorts of

things that operational components, Department-Level components,

programs at the Department thinking about using personally identifiable information, should consider when using commercial information.

So we’ve got our PIA guidance that addresses this type of information, and our PIA guidance. And our authority to conduct Privacy Impact Assessments comes not just from section 208 of the EGovernment Act, which is one of the three pillars of Federal privacy law, but also comes from section 222, subsection 4, which allows us to conduct Privacy Impact Assessments on proposed rules,

and the subsection 1 of the old section 222, which relates to the

uses of technology at the Department to make sure that they sustain privacy and do not erode privacy.

So the next thing I want to talk about is training. We provide

privacy impact assessment training throughout the government.

We are looking at doing another workshop for Federal agency privacy officers in probably May or June this year. We recently have

begun doing smaller training for 20 or fewer within the Department of Homeland Security on Privacy Impact Assessments. And

we find that when we give PIA training, other agencies follow the

lead that we have—the trail that we have blazed.

System of Records Notices, which as you will recall were required

under the privacy impact of 1974, and GAO and Ms. Koontz recently issued a report—actually I guess it was not so recent, it was

maybe 9 months ago—on my office. And one of the things that Ms.

Koontz mentioned was that we had a number of legacy agency SysVerDate 11-MAY-2000 14:37 Jan 30, 2009 Jkt 000000 PO 00000 Frm 00047 Fmt 6633 Sfmt 6633 C:\DOCS\46195.TXT KATIE PsN: KATIE
44

tem of Records Notices that we have to update. About 208 to be

exact, give or take a couple. We have made substantial progress in

revising our legacy agency System of Records Notices. We’ve just

sent over 28 to Coast Guard for them to consider. And we anticipate that there will be a substantial number more that will be updated in the coming months. And of course we take into account

the types of information that go into Systems of Records, as required under the Privacy Act of 1974.

Then the last highlight I wanted to mention to you is component

privacy officers. One of my recommendations that existed prior to

Ms. Koontz’s report but was highlighted or mentioned independently in her report was for an increase in component privacy officers at the Department. At the time of the report there were two

component privacy officers at the Transportation Security Administration and at US-VISIT. In November, the Secretary—of last

year—the Secretary agreed with me that there should be additional

component privacy officers, and four operational components and

two Department-level components. And we and the components are

moving forward on the hiring or the selection of those component

privacy officers.

So the last thing that I wanted to mention to you is something

that you won’t see on paper, and that’s what happens day in and

day out in my Office. And that is when operational components and

program personnel come to my folks who work in the Compliance

Section of the Office to talk about new systems. And one of the

things that is discussed is whether commercial information is being

used and if so, how it’s being used. And using the Fair Information

Practice Principles, which are set forth in my written testimony, we

work through with the components and program personnel to make

sure that commercial information is used appropriately.

That’s all I have to say. Thank you very much.

Mr. CLAY. Thank you so much, Mr. Teufel.

[The prepared statement of Mr. Teufel follows:]

45

46

47

48

49

50

51

52

53

Mr. CLAY. I will recognize Ranking Member Turner for 5 minutes.

Mr. TURNER. Thank you, Mr. Chairman. I want to thank each of

you because you have outlined very clearly some of the dangers

and problems that—is my mic on?

Mr. CLAY. Yes.

Mr. TURNER. Can you guys hear me? OK. Good. Because it

doesn’t sound like it’s on.

You’ve outlined the dangers and concerns that individuals have

about the privacy aspect of their personal information. But I’m

going to ask you a question that really goes to the broader umbrella of how we have to be concerned, why we protect personal information that we don’t commercially restrict, some important information gathering for our economy.

I want to tell you a story. I just recently took some people from

my community on a tour of the Supreme Court building. And I had

not been to the floor that had the library. And we walked into the

library of the Supreme Court and here was this beautifully ornate

room with all of these books and absolutely gorgeous and reverent

to the point of the information that it contained—absolutely empty.

Now, I’m a member of the Supreme Court Bar but I’ve never

been to the library and I’d not researched in the library. So I asked

the librarian, has this always been empty? And they were telling

us, no; but in fact, by the advent of technology, a library that used

to be packed now has information that is readily accessible to others. And certainly in the area of law.

I know that we have had increased efficiency but also higher

quality and that the level—the playing field has been leveled more

among individuals seeking attorneys, that those attorneys might

have access to information that could be vital to their case, as opposed to just hiring those that have the best research skills. We

have people who are now more able to bring to bear in their case

in their defense, or they are advocating information that’s available

to them.

I noted, Ms. Koontz, that in your GAO report—and it seems like

I’m always referring to footnotes—but you have a footnote.

Ms. KOONTZ. That’s where we put our best stuff.

Mr. TURNER. In footnote 7, when you cite that there’s $30 million

that is planned to be spent to purchase personal information, your

footnote No. 7 says, this figure may include information that—uses

that do not involve or include personal information. And you go

down to cite LexisNexis and West, and LexisNexis is in my district.

And of course being a lawyer, I’ve used both.

I would like each of you to speak for a moment on the issue of

although we want to protect privacy, some of the things that we

are actually seeking in a commercial marketplace where someone

has taken the data information and reconfigured it for our use so

that we can all do a better job of whatever we are doing; that our

things that are just available in the library, how do we—how do

we balance privacy and personal information without restricting

things that we’ve seen in the law practice that actually makes the

system work better?

Ms. KOONTZ. And I do think that this issue is all about balance.

It’s clear from our work that the information obtained from inforVerDate 11-MAY-2000 14:37 Jan 30, 2009 Jkt 000000 PO 00000 Frm 00057 Fmt 6633 Sfmt 6633 C:\DOCS\46195.TXT KATIE PsN: KATIE
54

mation resellers is valuable to a number of agency functions, it’s

very important. But the balance then is that we have to do this

within the context of personal privacy and with the laws and the

guidance that we have now.

I just want to speak for a minute to that footnote. The footnote,

we love to be very exacting. And in all cases we knew that information from—you know, services from LexisNexis, for example, are

procured sort of in bulk. And so it wasn’t—we weren’t able—we

were mostly able to sever the legal services sorts of things from the

purchase of personal information. But there were a few places

where we thought, well, there might be a small amount of that still

in there. But I mean, generally speaking, I think we were able to

put things in separate buckets. But we wanted to make the reader

aware it’s not down to the dollar, probably. So I think that this is

general—you know, generally a good number.

But, again, that’s what this is about, it is about balance. And I

think that the PIA requirement, you know, is a very valuable way

for agencies to think through how they’re going to use information

before they collect it, before they invest in information technology,

and to look at the reason for collecting this information, any privacy risks that might present themselves and then come up with

specific mitigation strategies. And this is a way of ensuring that

we’ve done the right things in terms of privacy.

Mr. TURNER. Would you like to comment?

Ms. EVANS. Well, following off of your example, so looking at our

guidance, we feel that the example that you gave, like LexisNexis,

or looking at data for one-time use and querying into a system, is

already covered. And so, you know, that would not necessarily require us to do or require, like LexisNexis, to do a privacy impact

assessment. I believe the distinction that we are making, which

GAO may agree or may not agree upon, is when we bring that data

into a Federal system and we then start merging it in with other

things that we are doing. That is where our guidance says where

you’re using it on a recurring basis, where it’s more than just a

one-time inquiry, like going into a library and looking at something, then you have to do the full privacy impact assessment. And

that’s where we are drawing the line with the commercial resellers,

because you are bringing that information in, you’re using it and

you need to let the public know how you are using the information

and where the source is coming from.

So in your example, we think our guidance allows for you to still

go to the library. It’s when you start taking the information from

the library and bringing it back into your agency and using it on

a recurring basis that you need to disclose to the public how you’re

doing that.

Mr. TURNER. I appreciate that, because that really is the other

distinction, I’m looking to your No. 1 footnote. When you described

what it is that we are talking about here for this type of information, you include things such as an individual’s name, their date,

place of birth, mother’s maiden name, biometric records. You go on

to talk about employment. And some of those things—excluding biometric information, obviously—are things that are available in the

daily newspaper that may have been reported.

Ms. EVANS. Right.

55

Mr. TURNER. And we don’t want our use, even commercial use

of what would be in fact the evolution of our library, to also then

be the same as data collection on the Federal Government.

Ms. EVANS. Right.

Mr. TURNER. And how do we do one without inhibiting what has

become—what we have all become now used to as our sense of

what a library is. Mr. Teufel.

Mr. TEUFEL. Sure. I’m a nonpracticing lawyer as well, and it’s a

wonderful thing. You know, no billable hours for one thing.

So what caught my eye as I went—as I was reading the legislation was—were the definitions. And I’m not sure that—the definition seemed to be broad and would include the uses of Lexis and

Westlaw or Nexis. I think maybe there’s a provision in the definitions that talks about news, news clippings services, or news reporting services. But when I think about Lexis and Nexis and

Westlaw, I’m not necessarily thinking about the data bases of driver’s license records, marriages and divorces. I’m thinking about—

I need to look up a GSBCA ruling or a Federal circuit ruling or a

10th Circuit ruling, or other things that are more of the types of

things that lawyers tend to look at, than my concern was this definition within the legislation so broad as to encompass those lawyertypes of uses. So that was a concern that came to my eye as I read

the legislation.

Mr. TURNER. Thank you. Mr. Chairman.

Mr. CLAY. Thank you, Mr. Turner.

Ms. Evans, the April 2006 GAO report contained recommendations to OMB to clarify its guidance on the use of commercial data,

yet nearly 2 years have passed and OMB has not taken steps to

address its recommendations. Why hasn’t OMB acted on this issue?

And can we expect to see new guidance? And if so, when?

Ms. EVANS. Well, actually, we feel that we’ve taken the steps

based on the actions that were identified by the President’s Identity Theft Task Force, so we have issued additional guidance. We’ve

also taken additional steps and asked the inspector generals to review the quality associated with Privacy Impact Assessments because we feel that’s a very holistic approach in how the agencies

look at it. We didn’t issue guidance specifically for data commercial

resellers because we were really looking at the program holistically.

But every year as we send the guidance out—the draft guidance

which will come out again this spring, and we are adding new requirements in for privacy—we also solicit GAO’s comments before

it becomes final. So if they feel that the actions that we’ve taken

to date since the time that they’ve issued that report, how we’ve

improved, I believe, the quality and have the measures and have

the IG looking at the privacy aspects of the programs, we can work

with GAO to issue any further guidance if necessary at this point.

Mr. CLAY. Ms. Koontz, any response?

Ms. KOONTZ. I think what we’ve found in our work, that OMB’s

guidance says that agencies are to do a PIA if they systematically

incorporate commercial data into existing data bases. The same

guidance says if you merely query the data base, the reseller’s data

base, then that does not trigger the PIA requirement. And I think

that our feeling was that there was a lot of room between systemVerDate 11-MAY-2000 14:37 Jan 30, 2009 Jkt 000000 PO 00000 Frm 00059 Fmt 6633 Sfmt 6633 C:\DOCS\46195.TXT KATIE PsN: KATIE
56

atic incorporation and merely querying a data base and that OMB’s

guidance can’t go further to say, well, what does systematic incorporation mean? And when we went to agencies, they said, well,

most of what we do is of the querying nature but sometimes we

keep the queries, sometimes we keep the information. And that’s

somewhere in between, and we wanted more clarity around when—

when agencies should do PIAs. And I think we were particularly

concerned about the instance where the information was safe in

that agency.

Mr. CLAY. Yes, sir.

Mr. TEUFEL. Well, I would refer the committee to our PIA guidance. And we asked the questions, how are you using the information? Are you keeping it or not? And when we have our conversations with programmatic personnel, we talk about these sorts of

things. And so we—I mean, the big issue is the ad hoc or one-time

querying use versus the systematic use and that necessarily entails

judgment. We think we do a very good job in exercising judgment

and discretion, and certainly with our authorities to conduct Privacy Impact Assessments, some may feel that sometimes we do

more PIAs than are necessary. But we think that’s an important

thing because PIAs are part of the transparency process, letting the

public know what it is that the Department’s doing. So in an ideal

world, there is trust and confidence in what the Department is

doing, but also so that the public is informed, can make informed

decisions and advise its elected representatives of where it wants

government to go.

Mr. CLAY. Thank you.

Ms. Evans, OMB’s PIA guidance from 2003 requires a PIA to be

performed when an agency systematically incorporate information

into their system; but then merely pinging or querying a data base

does not require a PIA. Given the systematic use of this information by the Federal Government, why is this distinction necessary?

Isn’t the government using this information to inform decisionmaking?

Ms. EVANS. Well, and I think—well, the short answer is yes, you

are using the information to inform decisions. But the example—

I mean one example that I would give is, I also go out and do

Google, and I Google information, and it comes up about a whole

bunch of different things. But I don’t incorporate the results of the

Google search into a Federal information system.

We are making a distinction between the systems that the Federal Government manages, the information we manage, versus just

a general type of query. The point, though, that GAO has made—

and we could go back and look at this—and that my colleague

Hugo has also made, is that it may not necessarily be a change to

the guidance or the policy because the framework exists to allow

flexibility for each agency head and how they use the information.

But it might be more of a sharing of best practices.

Now, we do have a committee that we formalized off of the CIO

Council that specifically deals with privacy practices. So some of

the activities that DHS does and some of the other activities that

the agencies do could help level the playing field across the board

and share these best practices so that agencies then incorporate

them into their existing ways that they then do their PIAs.

57

Mr. CLAY. Thank you.

Ms. Koontz, in its 2006 report, GAO identified instances in which

the use of reseller information was either not identified in Federal

Register notices or was identified only in vague terms.

In your opinion, why haven’t agencies been identifying commercial resellers as a source of personal information?

Ms. KOONTZ. We thought that both the OMB guidance and the

agency guidance were not clear on this particular point. And it may

be simply that the guidance predates—substantial use of personal

information obtained from resellers. And it’s a case of perhaps the

guidance needs to catch up with what the current practice is.

Mr. CLAY. OK. And Mr. Teufel, the information contained in the

2006 GAO report on this subject is based on fiscal year 2005 contracts with information sellers. Can you tell us what the value of

DHS’s contracts with the information resellers was for years—fiscal

years 2006 and 2007?

Mr. TEUFEL. I’m sorry, sir. I don’t have that information available but I would be happy to get back to the committee with that

information.

Mr. CLAY. OK. And you’ll provide the committee with that?

Mr. TEUFEL. I’ll do my best, sir.

[The information referred to follows:]

58

59

60

61

62

Mr. CLAY. OK. Is it fair to say that the 2006 GAO report still

accurately characterizes DHS’s use of information reseller data?

Have there been significant privacy improvements made that we

should know about?

Mr. TEUFEL. Well, sir, I think other than the numbers being different, I think the report probably does a pretty good job of describing things at the Department. That commercial information is used

by—I’m guessing all, I’m trying to recall now—almost all, if not all,

of the seven operational components and some of the DepartmentLevel components.

We’ve been doing a pretty good job of privacy. And since that report came out, we’ve made some improvements in how we do privacy. We are updating the legacy agency system of records notices.

We’ve added to our Privacy Impact Assessment Guidance on how

the Department handles commercial information. So so we’ve made

improvements. We were doing a good job before. We are doing a

better job today.

Mr. CLAY. Mr. Turner, you are recognized.

Mr. TURNER. Another issue that I’d like you to address that we

should be concerned about is there are things that we do want our

government to know. Whenever anything of significance happens,

one of the first questions that you always hear from any reporter

is, why didn’t the government know? The government is expected

to have knowledge of basic current events that we are all aware of,

and then some information that might lead to issues of threat.

Certainly issues that are publicly available that might pose—information from which decisionmaking should occur. How do we balance making certain that we don’t inhibit or discourage the data

brokers or resellers from doing business or providing information

to the Federal Government?

Ms. KOONTZ. I think if we talk about the kinds of recommendations that we made in our report, which were for Federal agencies

to be very specific and forthright in notifying the public about their

use of commercial data and also our suggestion that OMB clarify

the guidance so we know when PIAs are required; admittedly, I

think we have a sense that we would like to see PIAs done more

frequently and for agencies to think through the use of this information before before they acquire it from virtually any source.

But—and I think that none of these sorts of things that are intended for privacy would inhibit resellers from doing business with

the government or providing the information that they provide

now.

Even the bill that we are looking at today doesn’t place any new

obligations on resellers. It says it’s—instead it asks—asks the Federal Government, as it is obligated to, to think through very carefully how they’re going to use this information, and how they’re

going to protect it also. So I don’t see it as an inhibiting factor.

Mr. TURNER. Any other thoughts?

Ms. EVANS. First and foremost, I’d like to clarify one thing. I

think just because we haven’t issued an updated policy doesn’t

mean that we are focusing on the use of the information and how

the agencies do Privacy Impact Assessments. I would say that the

administration has really stepped up its efforts in this area as we

continue with the implementation of the E-Gov Act and as we’ve

63

built out on the foundation of what a Privacy Impact Assessment

is supposed to be.

So we have issued subsequent guidance to the agencies dealing

with privacy information, how they collect information, what their

systems are doing and for them to go back and look at it. We followup on this on a quarterly basis through the President’s management agenda. So we track what the agencies are doing, what they

said they’re doing, how they’re using the information. And we track

the number of Privacy Impact Assessments, Systems of Records of

Notice, what they say they’re going to do, how you match that

against everything that they’re doing.

So we have issued guidance in the bigger, broader aspect of information protection, information security and privacy. Not to this

specific issue of commercial resellers, because we think that they

need to look at this in a holistic way of how they’re doing everything, not just necessarily narrowly focused on the use of commercial resellers.

I don’t think that what we are doing when you bring the information into the Federal Government would prohibit data brokers

from working with the Federal Government. But I do agree with

GAO that the agencies need to be very transparent about how we

are using information to make sure that the public has the ability

to comment on that.

Mr. TEUFEL. Rigorous application of the fair information practice

principles.

Mr. TURNER. One question that personally triggered me, you

were talking about Google. And there’s been some discussion on

systematic use versus pinging. I have a question for you; this is for

my own personal information. How do those distinctions fall within—I understand one computer doing 100 searches on the same

thing. But what if 100 computers are doing the searches on the

same thing? How does that get balanced?

Like I’ll give you an example. I won’t use the Mayflower Hotel

as an example. But we have a satellite that is coming into orbit

and we are going to hit it down with an Aegis system. I’m assuming that there are a number of computers, as that current event

was happening, was doing an inquiry similar on public records and

information for that. So you have a number of computers all focused on the same current event that has happened versus one

computer that is trying to determine as much information about a

narrow topic.

How does that affect you? You have a number of agencies perhaps with the same needs for the same information. How does that

affect the analysis? The distinction between systematic and

pinging?

Ms. EVANS. OK. So I’m going to try and not get real technical

here. But let’s focus on the agency and the use of the agency. And

this is one of the reasons why we always talk about trying to keep

things technology-neutral, just based on the example that you gave.

I think the distinction here in GAO, Ms. Koontz has laid this out,

is it’s one thing when 1 agency or 100 agencies go and ask a question. It’s what you do with the results of that question. And if you

store that result back into a Federal information system is when

all of these triggers then happen.

64

If I go out and I look at that satellite, but I don’t do anything

with the information, it’s for informational purposes and I’m looking, it doesn’t matter whether 1 person did it or 100 people did it.

It makes a difference if one person, like, searches on you, and then

I take that information in and now I store it in a Federal system

and I start using it in conjunction with other information I have.

That’s when it’s important for the Federal agency to say how

they’re using the information, what they’re storing and how they’re

retrieving it. That’s the Privacy Act implications of when you do

the Systems of Records Notice, and then that is the PIA piece, Privacy Impact Assessment.

Do you want to add anything?

Ms. KOONTZ. I’ll just add that there is definitely an issue here

about whether we make decisions on the basis of storing information or we make decisions based on how we use information. And

I think that it would be fair to say that the PIA guidance right now

is more based on the storage model; that if we are going to bring

it in and systematically incorporate—although I would say I’m not

sure what systematically incorporate means versus incorporate versus somehow keep the information—but the point is is that even

if I ping a data base and I—I have existing data and I confirm that

an address I have is—I think that’s now the correct address because I have—I have corroborating information now. I am using

that information despite the fact I’m not, quote, bringing it in or

incorporating it into any kind of data base, but I’m using that as

part of my decisionmaking ability. And I think that’s one of the

things that we need to look at going forward, concerning how we

approach the use of reseller information from the Federal Government.

Mr. TEUFEL. Well, when we mentioned satellite, I thought we

were going to be talking about another DHS program. But we are

not. Its use. I mean, it’s all about use. Your example sounded more

like situational awareness with the hundred computers as opposed

to information that was mission-essential for the conduct of the operation of that particular agency’s use.

Mr. TURNER. Your descriptions have been very helpful. Thank

you, Mr. Chairman.

Mr. CLAY. This is a panel-wide question. Should information resellers that are governed under the Fair Credit Reporting Act and

Gramm-Leach-Bliley Act be exempted from requirements in the

proposed Federal Agency Data Protection Act? Why or why not?

We’ll start with Ms. Evans.

Ms. EVANS. Those particular acts are covered by the FTC and

how they use that. I would not feel that it would be appropriate

for me to answer that question right now. What I would rather do

is take it for the record and be able to go back and discuss it more

specifically with the FTC on that.

Mr. CLAY. Yes. That’s right. Thank you, Ms. Evans. Ms. Koontz.

Ms. KOONTZ. We do not think it’s appropriate to exempt any data

source, any specific data source, from the proposed provisions of the

bill if it passes. Our feeling is that what this does is to bring the

treatment of reseller information—the requirements into line with

how we treat other information sources as well.

65

I also would question to some extent what the basis or the rationale would be for exempting—making exemption for Federal

agencies not to do PIAs because resellers are covered by the two

laws that you mentioned. These two laws do place restrictions on

resellers’ use and collection and disclosure of certain kinds of consumer and financial information. But I don’t—you know, despite

these requirements, I wouldn’t think that would mean that we

would be any less interested in having Federal agencies critically

think through their use of commercial data.

Mr. CLAY. Thank you for that response.

Mr. Teufel.

Mr. TEUFEL. I’m with Karen. I’m very hesitant to answer the

question without the benefit of guidance from FTC.

Mr. CLAY. OK. Let me start with you. Shouldn’t we also be looking to add greater privacy safeguards with personal information

that is shared with us by all nongovernmental sources such as employers, contractors, banks, etc.?

Mr. TEUFEL. Well, sir, I think at DHS we do that.

Mr. CLAY. You do it now?

Mr. TEUFEL. Certainly there’s always room for improvement. But

I think at DHS, as I’m thinking through the various programs at

the Department and how we handle that with our PIA process, our

SORN process and other things that we have in place, I think we

do a pretty good job of protecting the privacy of individuals when

we’ve obtained that information from non-Federal sources.

Mr. CLAY. Ms. Koontz, how about adding greater privacy?

Ms. KOONTZ. I think that there’s a recognition that we need to

protect personally identifiable information regardless of source.

There are a number of laws, of course, that seek to do just that,

and we haven’t evaluated the efficacy of all those requirements.

But I do think that it’s important for the Federal Government to

pay particular attention to personal information that’s obtained

from third-party resources—third-party sources, rather than from

the individual themselves.

Mr. CLAY. Thank you. Ms. Evans, any comment?

Ms. EVANS. The President’s Identity Theft Task Force did look at

both the Federal Government as well as private industry. There

were several recommendations that were made by the task force.

My office was responsible for the Federal Government portion of

implementing those recommendations. That group is chaired by the

FTC and the Department of Justice and we are going to be issuing

an update this spring, which I believe is next month, April, to

where exactly we are in the progress that we’ve made on all the

recommendations. So as soon as that report is out, I’d be happy to

share that with the committee so that you can see, because it’s full

encompassing, private sector as well as public sector.

Mr. CLAY. Very good. We are very interested in seeing that. And

let me thank this entire panel for your responses and your expert

testimony. Panel one is dismissed. Thank you.

Mr. TEUFEL. Thank you.

Ms. EVANS. Thank you.

Mr. CLAY. The committee will recess for 15 minutes and we’ll return with panel two when we come back.

[Recess.]

66

Mr. CLAY. We will now have our second panel.

And that panel will include Mr. Ari Schwartz, who is the vice

president and chief operating officer of the Center for Democracy

and Technology. This work focuses on increasing individual control

over personal and public information by promoting privacy protection in the digital age and expanding access to Government information via the Internet.

Welcome, Mr. Schwartz.

We also have on the panel Mr. Stuart Pratt, who is the CEO of

the Consumer Data Industry Association, an international trade

association representing the consumer information industry. Prior

to his current position, Mr. Pratt served as the association’s vice

president of government relations. He is a well-known expert on

the Fair Credit Reporting Act, identity fraud, and the issues of consumer data and public record data issues.

Thank you for being here, Mr. Pratt.

And our third witness, Ms. Paula Bruening, is deputy executive

director of the Center for Information Policy Leadership at Hunton

& Williams. At the center, she focuses on global, cyber privacy

issues, as well as a frequent author and lecturer on information

policy issues throughout the United States and Europe.

And welcome.

And I welcome you all.

It is the policy of the subcommittee to swear in all witnesses before they testify. At this time, I would ask that you all stand and

raise your right hand.

[Witnesses sworn.]

Mr. CLAY. Let the record reflect that all the witnesses answered

in the affirmative.

I would ask that each witness now give an oral summary of his

or her testimony, and to keep this summary under 5 minutes in

duration. Bear in mind your complete written statement will be included in the hearing record.

Mr. Schwartz, we will begin with you.

STATEMENTS OF ARI SCHWARTZ, DEPUTY DIRECTOR, CENTER

FOR DEMOCRACY AND TECHNOLOGY; STUART PRATT,

PRESIDENT, CONSUMER DATA INDUSTRY ASSOCIATION;

AND PAULA J. BRUENING, DEPUTY DIRECTOR, CENTER FOR

INFORMATION POLICY LEADERSHIP

STATEMENT OF ARI SCHWARTZ

Mr. SCHWARTZ. Chairman Clay, thank you for holding a public

hearing on this important privacy issue and for inviting me to participate.

Government’s use of personal information is key to the functioning of many of its most essential programs, from determining eligibility for benefits to supporting law enforcement investigations. As

the information economy grows, more personal information is being

provided from commercial data brokers, who aggregate and categorize this information for a wide range of purposes to the private

and Government sectors alike.

As with any organization, Government agencies must take the

management responsibility to ensure that their partners and emVerDate 11-MAY-2000 14:37 Jan 30, 2009 Jkt 000000 PO 00000 Frm 00070 Fmt 6633 Sfmt 6633 C:\DOCS\46195.TXT KATIE PsN: KATIE
67

ployees are meeting standards of care and use of that information.

In this case, there are many concerns that come from the use of

personal data. Creating guidelines is a sensible and needed approach. Simply put, Congress should ensure that Americans do not

lose privacy, security and quality protections that are already a

part of law and policy only because a Government agency is using

a private-sector data partner rather than to have the agency collect

it themselves.

The chairman’s bill, H.R. 4791, would move the agencies in the

right direction by requiring agencies to make important management considerations, by requiring the vetting of commercial partners through the privacy impact assessment [PIA] process. The PIA

requirement, which passed as part of the E-Government Act, was

designed to provide greater transparency to how the Government

collects and uses personal information. Over the past 6 years, PIAs

have become an essential tool to help protect privacy. Mr. Teufel,

on the previous panel, called one of them the three pillars of the

U.S. Government privacy policy.

However, as evidenced by OMB’s FISMA report to Congress last

month, the Federal Government has unevenly implemented the

PIA process across agencies. The guidance issued pursuant to the

act with respect to PIAs was vague and has simply not provided

the agencies with the tools they need to successfully implement the

PIA process unless they already had privacy experts on staff.

While some agencies, like the Department of Homeland Security,

have set high quality standards for the PIAs and have continued

to improve them over time, the lack of clear guidance has led some

agencies, such as the State Department, to create cursory PIAs or

others, such as the Department of Defense, to have none at all. We,

therefore, urge Congress to also require that OMB create a set of

best practices for PIAs while it is updating the PIA guidance to

cover agency use of any commercial partner.

Even then, the transparency provided by the PIA process must

not be viewed as a full solution for privacy. Congress must begin

to address more fundamental privacy issues within Government

agencies to ensure the trust of the American people. This should

begin with a review of the Privacy Act of 1974.

In 2000, the full committee passed a bill, sponsored by Ranking

Member Davis and Representative Moran, to create a commission

that would study the state of the Privacy Act and recommend updates to the law. The record shows that, even 8 years ago, it was

clear that this important law, the most direct legal protections that

citizens have over the Federal Governments’s regular use of information, was beginning to erode due to unforeseen advances in technology. We hope that the committee will once again take up a review of the Privacy Act to help protect the privacy of Americans

into the future.

We look forward to working with this subcommittee to help address these critical privacy issues in more detail in the near the future, and we thank you for your leadership on this important issue.

I look forward to your questions.

[The prepared statement of Mr. Schwartz follows:]

68

69

70

71

72

73

74

75

76

77

78

79

Mr. CLAY. Thank you so much, Mr. Schwartz.

Mr. Pratt, you are recognized for 5 minutes.

STATEMENT OF STUART PRATT

Mr. PRATT. Thank you, Mr. Chairman, for this opportunity to appear before you today.

Government’s use of CDIA member products brings value to citizens individually and to Government, which works on their behalf.

This is an important context, I think, for the committee as it considers H.R. 4791. Let me just share a couple of examples of how

products are used and, really, the logic behind these.

Our members provide products which help Government agencies

to enforce child support enforcement orders, to locate missing and

exploited children, to prevent entitlement fraud, to provide background screening for employment and security clearances, to assist

with various natural disasters, and also with witness location and

with various law enforcement investigations.

Equally important, I think, to the context of our discussion today

is the fact that these many products that I’ve just described are

heavily regulated under a range of current Federal laws. And these

laws affect both the public and the private sector. Two laws that

are particularly important, I think, for today are the Fair Credit

Reporting Act and the Gramm-Leach-Bliley Act, which have already been mentioned in the first panel.

H.R. 4791 proposes to improve Government’s effort to protect

personal information and to ensure that citizens are notified when

personal information is lost. Actually, both of these goals make a

lot of sense for us. Our members live under data security requirements today. Our members live under breach notification requirements today. And so, having those apply to the Government in the

same way that they would apply to the private sector makes all the

sense in the world.

Our written comments provide some thoughts on how you might

tailor those provisions just a little bit to make sure that they are

very effective. But, overall, those are good ideas.

The bill also proposes privacy impact assessments and certain

contractual requirements where the Government obtains data from

an entity, termed a ‘‘data broker.’’ And this is really some new territory that is being built within this proposal. And we understand

the importance of this focus on governmental uses to ensure there

is a trust between Government and its citizens. And that really

goes all the way back to the Privacy Act.

In this case, though, is seems to us perhaps the question is

where the data is regulated, or where the data is not regulated—

in other words, where is the trust, and how do consumers feel

about their personal information being used by Government.

In the case of our members’ products, the bridge of trust already

exists through existing laws. And it is for this reason that we urge

the committee to exclude from the definition of ‘‘data broker’’ entities that are subject to the Gramm-Leach-Bliley Act privacy rules,

consumer reporting agencies regulated under the Fair Credit Reporting Act, and publicly available data sources provided by the

private sector.

80

And our reasons for this are several. For example, the contract

requirements in this proposal stipulate that a Government agency

must obtain data from a data broker, and they appear to assume

that data is unregulated. Further, the contract would, for example,

impose an accuracy requirement on a consumer reporting agency

which already has an accuracy requirement under the Fair Credit

Reporting Act.

So, Mr. Chairman, here, perhaps, it’s just an alignment question.

You already have a Federal law. The Government is going to purchase data that’s already under an accuracy standard. And then

the question is, how would the contractual accuracy standard interplay with the standard of law that’s already provided for under the

Fair Credit Reporting Act?

The contractual provisions also would impose, more or less, a

one-size-fits-all approach to the concept of—well, let me just back

up here—would also provide a one-size-fits-all to location tools. And

a location tool is a tool that’s used to try to find a noncustodial parent to enforce a child support enforcement order. That’s not really

an accuracy tool or a tool based on accuracy, but it’s a way to try

to locate that individual and to get them to pay what they owe in

delinquent child support. So, again, here maybe the one-size-fits-all

approach of the accuracy requirement might go a little outside of

the bounds of where you might like it to be at the end of the day.

The concept of a privacy impact assessment is sound, there is no

doubt about it, and it’s appropriate to Government processes. However, we think that requiring a PIA across the board may well have

some adverse effects. For example, will Government continue to

use the private-sector tools for skip tracing where a consumer

hasn’t paid his student loan if the PIA requirements are highly restrictive? Where the Government is a user, defined under the Fair

Credit Reporting Act, and is using a consumer report for background screening, is there a need for a privacy impact assessment,

when the Government is regulated under the FCRA, as is the private sector?

So, Mr. Chairman, in conclusion, there seem to be a lot of good

ideas in this proposal that you have put together. I think there

may be some places where we have other good laws already on the

books. Some of these laws come from other committees on which

you serve, as well. And here today, we’re just offering some

thoughts on how we might be able to more effectively align current

Federal laws with the ideas that you have in this bill.

And, with that, I will look forward to your questions. Thank you.

[The prepared statement of Mr. Pratt follows:]

81

82

83

84

85

86

87

88

89

90

91

92

93

Mr. CLAY. Thank you so much for your testimony.

Ms. Bruening, you are recognized for 5 minutes.

STATEMENT OF PAULA BRUENING

Ms. BRUENING. Thank you, Chairman Clay, for having me here

today. I am honored to testify about Government use of commercial

information and H.R. 4791.

The Center for Information Policy Leadership is a think tank in

policy development organization located in the law firm of Hunton

& Williams. The center and its 41 member companies believe that

difficult information policy issues must be resolved in a responsible

fashion if we’re to fully realize the benefits of an information economy.

While I’ve consulted with center colleagues and members, my

comments today reflect my views and do not necessarily reflect the

views of the center member companies, Hunton & Williams or any

firm clients.

The provisions of H.R. 4791 highlight the growing practice of

Government access and use of information collected and retained

by business and the lack of comprehensive, overarching legal protections for that information when such access is obtained.

Without question, the information collected by companies can

serve as a critical resource for Government in law enforcement,

anti-terrorism efforts, fraud reduction, delivery of services, and administration of programs. With appropriate controls, Government

should continue to be able to access it. Government should not be

precluded from using valuable information for these important purposes, but it should do so under established, rigorous guidance that

ensures its use is both effective and responsible.

Today, the lack of legal protections related to the Government’s

use of data collected in the private sector, due in part to the limitations of the Privacy Act, raises serious risks to U.S. business and

compromises opportunities for growth. Access to information by the

Government without the protection of law places companies of all

kinds in the position of acting as Government data gatherers that

are unable to assure their customers that information they release

to the Government will be used for specified limited purposes, that

it will be handled properly when it is no longer useful, and that

the consumer has redress when data it is mishandled. This failure

of governance erodes consumer confidence in the companies themselves, reduces trust in the information field commerce more generally, and compromises the growth of the digital marketplace.

Moreover, because of the lack of sound guidance and potential for

nearly unfettered access by Government to this information, every

privacy question related to data collection in the private sector is

shattered by the issues of undisciplined Government access and use

of information.

Efforts to resolve issues of consumer protection and privacy in

new services, products, business models and technologies are complicated by this constant concern, making it more difficult to build

consumer confidence that data is being used responsibly.

The lack of oversight further compromises U.S. businesses’ ability to engage with organizations and consumers internationally.

Even as companies become more global in presence and reach, it

94

has become increasingly unattractive to transfer data to U.S. companies because of concerns about U.S. Government access to information about foreign nationals that might occur outside the bounds

of law of their home countries and without any real oversight in

U.S. law. Lack of broad protection and accountability challenges

businesses’ ability to make the case that information from foreign

companies and about foreign nationals will be managed in a trustworthy fashion, limiting opportunities to transfer and exchange

data that can enable innovative business models, research and

services.

It is time to consider the myriad ways in which Government accesses, maintains and uses information collected throughout the

private sector and develop an overarching governing structure for

data use that establishes discipline and accountability in the practice. This inquiry must be forward-thinking and broad in scope, as

the solutions we arrive at must be sufficiently rigorous to promote

trust and sufficiently flexible to adapt to as-yet-unanticipated technological and marketplace developments.

Developing guidance will require a review of new and emerging

technologies for data collection and storage and the trajectory of future technological development. It will be important to consider the

legitimate needs and activities of Government for this data and the

manner in which it is to be used to further legitimate Government

objectives. It must involve development of reliable structures that

establish accountability, oversight and protocols for Government

collection, retention, use and disposal of data. At the same time, it

must assure that access to data is not unduly hindered when it is

legitimately needed.

The goal of this inquiry must be to develop a system of governance that fosters data use that is both effective and responsible.

Government entities must be required to identify clear objectives

for data use and to understand what and how data will be used to

accomplish those objectives. Limits must be set for data use and

procedures established for data management. Citizens must have

redress when data has been misused. Governance must include

oversight, both within agencies and by other branches of Government, to instill confidence that the goals of effectiveness and responsibility are achieved.

Thank you very much, and I look forward to the discussion this

afternoon.

[The prepared statement of Ms. Bruening follows:]

95

96

97

98

99

100

101

Mr. CLAY. Thank you so much for your testimony.

Let’s start with Mr. Schwartz.

This question is similar to the one I asked Ms. Evans from OMB

earlier. OMB’s PIA guidance from 2003 requires a PIA to be performed when agencies systematically incorporate information into

their system, but that merely pinging or querying a data base does

not require a PIA.

Given the systematic use of this information by the Federal Government, why is this distinction necessary? And isn’t the Government using this information to inform decisionmaking?

Mr. SCHWARTZ. It’s an excellent question. I think that it really

gets to the heart of the matter about where we stand with PIAs

today.

I think we agree with Ms. Evans about agency flexibility, and

there would be room for agency flexibility. But I disagree with her

in how she was talking about that flexibility. To me, it doesn’t matter where the information is stored; it is how the information is

used and what it is going to be used for.

And I can illustrate this pretty easily in some of the other issues

by talking about that the PIA is really a management function of

the agency, in terms of information policy management, which is

why this——

Mr. CLAY. Why should it matter, how agencies are accessing the

information?

Mr. SCHWARTZ. Well, I don’t think that’s what the distinction

should be.

Mr. CLAY. OK.

Mr. SCHWARTZ. It should be how they are using information and

what they are using for.

So an example I can give is that we’ve been talking about the

use of the information, which resulted in the question of how do we

stop misuse of information. The information that an agency may be

pinging from a data base may be entirely accurate and may follow

all the rules and laws that it is supposed to follow, but there is still

the question of how that Government employee uses the information.

We’ve had cases where a drug enforcement agent has gone and

looked up their ex-girlfriend’s record using a commercial data base,

looked up the ex-girlfriend’s boyfriend’s records using a commercial

data base. That shouldn’t be allowed today, and it’s not allowed.

The question is, how do you effect those rules? And what the privacy officers tell me today is that the only tool that they have at

their disposal to make sure that’s in place is the privacy impact assessment.

So if we’re not covering this data and not looking at how that

management goes into effect, we’re going to miss those cases where

we could have stopped misuse before it happens.

Mr. CLAY. It is a tool, and a needed tool. Is what you’re telling

me?

Mr. SCHWARTZ. Yes, absolutely.

Mr. CLAY. Thank you for that.

Any comment on that?

Mr. PRATT. If I may, let’s just take a consumer reporting agency

as one example.

102

And I think that Mr. Schwartz gives a great example of browsing. Browsing is always something that you want to control, and

there’s some technological strategy for how you can control browsing. If you’re a using a consumer reporting agency data base, it is

not an unregulated data base. It will register an inquiry showing

that the Government agency accessed the data base. And, in fact,

contracts and Federal law would prohibit the browsing activity.

So I think that if Mr. Schwartz is simply saying that there needs

to be an effective oversight mechanism within the Government

agency to ensure that browsing doesn’t occur or that other data security practices are effective in protecting data, I mean, that makes

sense. I just wanted to make the distinction between that and the

idea that the data is just sitting on a screen and anybody should

be able to walk up or that law doesn’t somehow constrain it.

The same is true, by the way, for the Gramm-Leach-Bliley Act.

If you are using fraud-prevention tool or a locator tool, it is used

for a certain purpose, and there is a certain limited amount of data

that will be made available.

So those are just two examples of where Federal laws today set

up a regime where both the end user, in many cases by contract

and in some cases by Federal law, is restricted in terms of its use

of that information.

Mr. CLAY. You know, Mr. Pratt, in your testimony, you mention

that sections 8 and 9 of H.R. 4791 are unnecessary or inconsistent

with current law. Please define what those provisions are and how

they would unduly burden CDIA’s members.

And if we follow your train of thought, you know, there would

not be many teeth left in the original intent of the bill, and it

would only be a shadow of its original self.

Mr. PRATT. Well, we hope not, meaning I think we share the

same goal, which is to make sure that when Government obtains

information it understands why it is obtaining it, it understands

the uses of that information, it understands what current Federal

law requires or imposes.

And so when we talk about, for example, section 8, that’s the section which defines the data broker, and then in following, section

9 is the section which establishes, not just the PIA review, but it

also talks about the contract.

And so, again, one of our concerns is a Government agency imposing wrongly or imprecisely an accuracy requirement on a data

product which isn’t built to be accurate but to be a law enforcement

research tool, or a skip tracing tool to try to locate, again, somebody who has not paid a student loan.

So there seems to be just a little bit of a one-size-fits-all in the

current structure of the bill that you’ve proposed. And so, we’re not

suggesting there should be no teeth, but I’m suggesting that the

FCRA has a lot of teeth with regard to accuracy and a lot of teeth

with regard to the end user, the Government, and the restrictions

that they must have and the contracts that they must sign off on,

and the private liability and the civil enforcement powers that

apply to the FCRA.

The same is true for contracts under GLB. It’s that there is a

limited set of uses, and they contract for those uses. So those are

103

not data-mining browsing data bases. Those are data bases used

for particular——

Mr. CLAY. OK. I look forward to working with you on those sections.

Mr. PRATT. Thank you, sir. We appreciate that.

Mr. CLAY. Let me also say, to followup, how exactly are PIAs,

which would be the responsibility of an agency to carry out, an

undue burden for your membership? It seems to me that our proposed legislation places nearly all of the burden on the agencies obtaining the information, does it not?

Mr. PRATT. It does. Our concern is that—and I think I heard this

at least implied in some of the previous panel’s discussion—it is a

resource question, first of all. Saying we will require PIAs across

the board almost on a product-specific basis would require individuals with the right core competencies to be able to do that well. So

there is a training issue. And there’s an appropriations resource

question, just how many new FTEs we have to hire on a Government agency basis.

So at the beginning of the dialog was, first, have we staffed properly each governmental agency to have the right core competency

around data management? And then you move to the question of,

well, how then do we use data under the Fair Credit Reporting

Act? That may be a different flow.

But, for now, our concern is that what are going to find is that

some agencies say, ‘‘Well, we just won’t clean up our internal data

base. We just can’t use the private sector anymore. We don’t have

anybody who can do this PIA this year, so we just simply won’t use

private sector. We’ll just be less effective in doing what it is that

we’re required to do by a Federal law.’’

Mr. CLAY. OK, then.

Please explain the information reseller industry’s position regarding the appropriate use of information in public records that

is not specifically restricted by law. Given that resellers aggregate

information from multiple sources, including public record, and

make it more readily available than paper records located in places

such as courthouses, shouldn’t resellers be responsible for protecting the privacy of the individuals involved?

Mr. PRATT. That it is a great question. It’s actually one of the

tough societal questions we’re wrestling with right now.

A couple of things. First of all, and it was mentioned in the first

panel, a Google search. In Maryland today, for example, I can go

to my courthouse and I can go online and actually find my deed.

And on my deed is a certain amount of personal information. I

would say, over the last 10 years, though, the State government

and local government agencies that are storing a great deal of information have been removing sensitive personal information, making those kinds of documents less prone to contributing to the risk

of identity theft, for example.

But the key here is, this is all publicly available. And it’s not actually in paper records, in many cases. Now it’s an online process.

Most of the court systems have online systems available. In fact,

State laws often require online systems to be available to fulfill

their mission.

104

So between Google searches and your ability to go to certain Web

sites where you can just simply pick up the URL and click through

to the public record, that data is out there today and it is publicly

available information. So our view is that a data reseller that has

publicly available information is in no different position than the

courthouse itself with regard to the same information.

Do we want a Social Security number—this is a different question—do we want a Social Security number in a deed for a home?

Our members’ answer is no.

Mr. CLAY. No.

Mr. PRATT. In other words, we are working with State governments right now to try to pull back data where it is not appropriately or necessarily part of a public record.

Mr. CLAY. OK. But now, Mr. Pratt, here is what GAO has told

us, is that information resellers generally allow individuals limited

ability to access and correct their personal information.

Mr. PRATT. That’s a great point.

Mr. CLAY. So how do we square with that?

Mr. PRATT. Well, again, this would be a general data base, not

an FCRA-regulated data base. If it is built for Fair Credit Reporting Act purposes, you have the right to correct the information.

One of the big challenges is, if you don’t correct the information

at the courthouse level, then the same data can be gathered by another company, subsequently, under general public record and

Freedom of Information Act laws today.

So it isn’t so much that we don’t want to correct the record, but

we want to make sure if a record is going to be corrected it is not

just artificially corrected in a single private-sector data base, but

that the consumer goes to the right original source, so that it’s corrected in the courthouse, so every data base that might have that

public record are all going to reflect the correct information.

Mr. CLAY. And the court clerk has a responsibility then to redact

or to block out?

Mr. PRATT. The court should. I mean, candidly, one of the challenges is for courts to make sure that they have a way for consumers to correct their information.

By the way, not every court does today. That’s one of the challenges we have in the public record discussion that we’ve had in

this country for some time. I, as an individual, may not easily get

the attention of a court to correct information, or it may take a

longer period of time than we would like. We think we’re getting

closer to solutions, but that is a problem we’re still facing.

Mr. CLAY. Thank you for your response.

Let me go to Ms. Bruening.

An important thing in the testimony seems to be that information collected by the Government from all sources, not just data

brokers, is inadequately protected or safeguarded. Please explain

the reasons why you believe this is so. For example, is it due to

an outdated Government privacy act or an effect of private-sector

regulations?

Ms. BRUENING. Well, first, Mr. Chairman, I think it is important

to emphasize that data is being collected from all kinds of privatesector sources, not just data resellers. Our ISPs are being asked for

information, retailers are asked for information, our telecommuniVerDate 11-MAY-2000 14:37 Jan 30, 2009 Jkt 000000 PO 00000 Frm 00108 Fmt 6633 Sfmt 6633 C:\DOCS\46195.TXT KATIE PsN: KATIE
105

cation services. So this practice goes on throughout the private sector.

The other point I think that’s important to be made is that the

Federal Privacy Act was passed in 1974 at a time during mainframe computing, and it certainly has not anticipated where we are

today. It probably didn’t even anticipate a couple of different jumps

we’ve made since 1974 in terms of computing.

We’re now in an age of cloud computing. We’re collecting data in

all kinds of different ways, through different kinds of technologies.

In some cases, the Government may access that information and

bring it into its own systems of records. In other cases, it doesn’t.

It merely pings data bases or obtains information from data bases,

never bringing it into Government.

So the definitions in the Privacy Act are challenged by this new

kind of technology and these new kinds of data uses. And so, given

that, we’re left with very little protection for the kinds of information access that the Government is using in the private sector.

Mr. CLAY. You know, you also cite the lack of a cohesive or modernized definition of what is a system of records, in your testimony.

How is current law limited in its definition of what constitutes a

system of record? Do you have recommendations on how to improve

the current definition?

Ms. BRUENING. Well, as I mentioned, the way that information

is maintained and stored today is very different from the traditional ways we’ve thought about that, in terms of data bases, and

therefore the way we access it very different.

In the past, we thought about systems of records as the ability

to search for information on the basis of an identifier or a person’s

name. In many cases, that’s not how Government uses information

anymore. And, you know, data mining is the prime example. There

are other analytics tools that have very creative ways of using information about individuals that would not involve a system of

records as it is defined in the Privacy Act.

I don’t have the recommendation for how to fix it. I think this

is a big question. It’s one that would require a lot of serious thinking on the part of people in a range of areas, whether it’s technology, the law, people who are involved in data management, security people. So I don’t have the answer, but it is a question I

think that requires some very serious attention, because it is raising some significant concerns for the business community, as I’m

sure it is elsewhere.

Mr. CLAY. Please explain for us how ineffective protections for

personal data negatively impact business. Is it because of legal liability or an issue of consumer trustworthiness in modern technology? Do ineffective privacy safeguards have a tangible impact on

electronic commerce or online banking activities?

Ms. BRUENING. Well, I think one of the prime examples in the

area of, sort of, our ability as American business to engage with

companies outside of the United States is an action that was recently taken by the province of British Columbia in Canada, which

limited the ability of Canadian companies in British Columbia to

outsource data for processing in the United States. And that action

was taken on the basis of concerns about the perceived lack of protection for information that is potentially accessed by Government.

106

And what that does is create inefficiencies in business, and it

puts businesses at a competitive disadvantage. I think it also does

impact the relationship of companies with their consumers. I think

that responsible companies put a lot of time and effort into addressing the privacy concerns that are raised by some of their new

businesses models and the new technologies that they deploy.

But what happens is, in attempting to address those questions,

what we’ve come to call the elephant in the room—although, I

guess in a political year that’s not the best term, but we will call

it the rhinoceros in the room—tends to be, no matter what we do

to protect privacy, this data is accessible by Government, and

where does that leave us in our relationship with consumers. And

so, that is of very serious concern on the part of companies.

Mr. CLAY. Thank you for your response.

Let me start—yes, sir, Mr. Schwartz?

Mr. SCHWARTZ. I want to followup on something that Ms.

Bruening said that I agree with, in terms of her comments on a

definition of systems of records. And you heard Ms. Evans on the

last panel talk about, in terms of, in the case of commercial resellers, information being systematically incorporated. And one of

things she said then was, if it is turned into a part of a system of

records. Right?

And so, this shows both the weakness of the Privacy Act in that

there are fewer and fewer data bases that are qualifying as Privacy

Act system of records today because of the decay that Ms. Bruening

talked about in technology, being able to search out information

without necessarily searching on an identifier or a name.

So we have a lot more information that is being brought into the

Government that may not necessarily be in a system of records.

And I think Ms. Koontz was getting at that in the last panel, too.

It is hard to figure out what ‘‘systematically incorporated’’ means

today, with this definition of system of records that we have. And

because OMB has not defined that better, you have a lot of confusion at agencies about that. You have agencies with a lot of different standards.

Mr. CLAY. This is a series of questions for the entire panel. Let’s

start with Mr. Schwartz and move down. This is a yes-or-no question.

Is it considered a best practice today for large organizations to

conduct a privacy impact assessment when purchasing or subscribing to a service that could have a major impact on the privacy of

its customers or citizens?

Mr. SCHWARTZ. Yes.

Mr. CLAY. Mr. Pratt? And you can elaborate, if you’d like.

Mr. PRATT. Is it a yes-or-no?

Mr. CLAY. You can elaborate.

Mr. PRATT. Every private-sector company that’s going to obtain

data is going to do several things. They are going to say, is it sensitive personal information under a State data breach law, so do I

have to protect it in a certain way? Is it regulated under the Fair

Credit Reporting Act? Does the contract, if I’m contracting with an

entity, put certain restraints on what I must do?

So I suppose, in essence, that is a privacy assessment. Am I

going to secure it because it is sensitive personal information? Is

107

it a consumer report, so then do I have additional responsibilities

such as properly disposing of it, limiting access to it and so on?

So, in that sense, yes, I think private-sector laws regulating entities all across this country are, in fact, conducting privacy assessments with regard to sensitive personal information of all types,

many of which are represented by the members of the CDIA.

Mr. CLAY. OK.

Ms. Bruening.

Ms. BRUENING. Yes, privacy impact assessments are a best practice. They serve a very important role.

The concern is, however, that within Government it isn’t enough

to simply conduct a privacy impact assessment; that there needs to

be oversight both within an agency and from other branches of

Government so that you can get the kind of accountability and responsibility in that use that you need.

Mr. CLAY. Mr. Schwartz, should information resellers that are

governed under the Fair Credit Reporting Act or Gramm-Leach-Bliley be exempted from requirements in the proposed Federal Agency

Data Protection Act?

Mr. SCHWARTZ. I think that they should. The question of whether

they take steps toward accuracy—and, again, you also heard Mr.

Pratt speak earlier about different kinds of data bases, so it is not

necessarily—I think that there is some distinction there about

whether the information broker has to follow FCRA for certain

data bases and not for other data bases, and that’s confusing, I

think. And it is the responsibility of the agency to figure out where

the coverage lies, what the protections are, and to do that kind of

review.

PIAs, in particular, are set at different levels. And the OMB

guidance today has said that agencies are supposed to do the PIA

based on what the potential of impact of privacy is. And that’s really what the goal should be here. It is completely incumbent on the

agency to do this review.

As I said earlier, beyond the accuracy issues and beyond figuring

out who the partner is, it is also to figure out what the rules are

internally for the use of that information, and to set that up in a

way that the program officers understand those rules. The PIA is

the only way do that today under U.S. law.

Mr. CLAY. OK, let me go to Ms. Bruening.

What is your feeling?

Ms. BRUENING. Unfortunately, I’m not in a position to speak to

the specifics of the provisions of the bill.

However, I think what your question does highlight is the fact

that we really need to be careful that we don’t approach this question in a piecemeal fashion; that this really is a question about how

Government treats data once it is brought into Government, so

that we can—you know, are we asking the right questions? Are we

setting appropriate objectives? Are we setting the right priorities

about those objectives? Are we looking closely at what data is being

used and how it is being used and whether it is going to get us to

the objectives that we want to reach? And is there accountability

around that? And do we have the right kind of processes and procedures for management of that data once it is brought into Government?

108

Mr. CLAY. Mr. Pratt, go ahead. You may respond.

Mr. PRATT. Thank you, Mr. Chairman.

I see it this way: There already is an assessment any time a Government agency is going to have to purchase a consumer report,

whether they’re going to hire an employee and they need to conduct a background check, whether it’s for a national security investigation. And legal counsel, not just a privacy officer, but legal

counsel are going to have to determine and ensure that the State

or Federal Government agency is going to comply with the Fair

Credit Reporting Act, that there is a certain permissible purpose

for which the data can be obtained.

And, by the way, the permissible purpose—obtaining for a permissible purpose under the 2003 amendments made it very clear

that the user had to obtain and use the data for the permissible

purpose. This is not just a question of what the consumer reporting

agency does to deliver a report for permissible purpose.

So, to me, it is just apples and oranges. A consumer reporting

agency delivering a consumer report to a Government agency

knows that Government agency, by contract and by Federal law, is

going to have to comply with everything that is required of it, including notifying the consumer if the decision based on that data

was adverse to the consumer, the adverse action notice that we’re

familiar with.

Same thing on the Gramm-Leach-Bliley Act side. I am selling

you a look-up service product, you are going to use it for look-up

services. Now, to the extent it should not be used for other purposes, that’s probably part of what a Government agency should do

well. But that’s not really a privacy impact assessment, or maybe

there’s some semantics here in terms of what we mean by the scope

of a privacy impact.

But if you are buying it for a skip tracing purpose, that’s what

it’s going to be used for and that’s what the contract’s going to limit

you to. That’s different than ISP data. That’s different than

telecom data. That’s different than depersonalized credit card

transaction data that the U.S. Secret Service might use, for example, to try to locate a belt skimming operation in Miami.

So there really are, I think, different approaches, and so I don’t

think—you can look at it holistically, but at the granular level you

are going to take different approaches.

Mr. CLAY. Yes, sir, Mr. Schwartz?

Mr. SCHWARTZ. I don’t think it is different at all from the private

impact assessments that we see from the—the ones that receive

good marks from OMB in the FISMA reports. You go back and you

look at their PIAs that they’ve done, they all go through how the

information is used, what was management’s intent for the use of

the data. That’s what they are supposed to do.

So this idea that this is only focused on what FCRA is, I think

is another universe from what’s going on in Government, or what

should be going on in the Government, which is covering how this

information is managed and used.

109

Mr. CLAY. Thank you very much for your responses.

And that will conclude the testimony from the second panel. This

hearing is adjourned. Thank you.

[Whereupon, at 4:05 p.m., the subcommittee was adjourned.]

Æ