Privacy: Agencies Should Ensure That Designated Senior Officials Have Oversight of Key Functions
Published: 2008-05-30T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Government agencies have a long-standing obligation under the Privacy Act of 1974 to protect the privacy of individuals about whom they collect personal information. A number of additional laws have been enacted in recent years directing agency heads to designate senior officials as focal points with overall responsibility for privacy. GAO was asked to (1) describe laws and guidance that set requirements for senior privacy officials within federal agencies, and (2) describe the organizational structures used by agencies to address privacy requirements and assess whether senior officials have oversight over key functions. To achieve these objectives, GAO analyzed the laws and related guidance and analyzed policies and procedures relating to key privacy functions at 12 agencies.
section_title: What GAO Found
paragraphs: Federal laws set varying roles and responsibilities for senior agency privacy officials. Despite much variation, all of these laws require covered agencies to assign overall responsibility for privacy protection and compliance to a senior agency official. In addition, Office of Management and Budget guidance directs agencies to designate a senior agency official for privacy with specific responsibilities. The specific privacy responsibilities defined in these laws and guidance can be grouped into six broad categories: (1) conducting privacy impact assessments (which are intended to ensure that privacy requirements are addressed when personal information is collected, stored, shared, and managed in a federal system), (2) complying with the Privacy Act, (3) reviewing and evaluating the privacy implications of agency policies, (4) producing reports on the status of privacy protections, (5) ensuring that redress procedures to handle privacy inquiries and complaints are in place, and (6) ensuring that employees and contractors receive appropriate training. The laws and guidance vary in how they frame requirements in these categories and which agencies must adhere to them. Agencies also have varying organizational structures to address privacy responsibilities. For example, of the 12 agencies we reviewed, 2 had statutorily designated chief privacy officers who also served as senior agency officials for privacy, 5 designated their agency chief information officers as their senior privacy officials, and the others designated a variety of other officials, such as the general counsel or assistant secretary for management. Further, not all of the agencies we reviewed had given their designated senior officials full oversight over all privacy-related functions. While 6 agencies had these officials overseeing all key privacy functions, 6 others relied on other organizational units not overseen by the designated senior official to perform certain key privacy functions. The fragmented way in which privacy functions were assigned to organizational units in these agencies is at least partly the result of evolving requirements in law and guidance. However, without oversight of all key privacy functions, designated senior officials may be unable to effectively serve as agency central focal points for information privacy.

section_title: Letter
paragraphs: As you know, government agencies have long-standing obligations to  protect the privacy of individuals about whom they collect personal  information. Based on concerns about privacy, a number of laws have  been enacted in recent years directing agency heads to designate chief  privacy officers (CPO) as focal points with overall responsibility for  privacy. For example, the Homeland Security Act of 2002 created the first  statutorily required senior privacy official at the Department of Homeland  Security (DHS). Several other laws followed with similar direction to other  agencies. Furthermore, the Office of Management and Budget (OMB)  issued guidance in 2005 directing each agency to designate a senior agency  official for privacy (SAOP).
Agency responsibilities for protecting privacy are based primarily on two  laws, the Privacy Act of 1974 and the E-Government Act (E-Gov Act) of  2002. Under the Privacy Act, federal agencies must issue public notices  that identify, among other things, the type of data collected, the types of  individuals about whom information is collected, the intended “routine”  uses of the data, and procedures that individuals can use to review and  correct personal information. The E-Gov Act requires agencies to conduct  privacy impact assessments (PIA) of privacy risks associated with  information technology used to process personal information. In addition,  the Paperwork Reduction Act sets conditions for collecting information  from individuals and designates agency chief information officers (CIO) as  responsible for privacy protection. Recent laws and guidance have also  designated specific agency officials with responsibilities for ensuring  agency compliance with privacy protection requirements.
Our objectives were to (1) describe laws and guidance that set  requirements for senior privacy officials within federal agencies, and (2)  describe the organizational structures used by agencies to address privacy  requirements and assess whether senior officials have oversight over key  functions.
To address our first objective, we reviewed and analyzed laws and OMB  guidance that assign agencywide privacy responsibilities to senior officials  within federal agencies. To address our second objective, we analyzed  policies and procedures at these agencies, and interviewed senior agency  privacy officials to identify the privacy management structures used at  each of these agencies and the roles and responsibilities of senior privacy  officials. The agencies included in this review (Departments of Commerce,  Defense, Health and Human Services, Homeland Security, Justice, Labor,  State, Treasury, Transportation, and Veterans Affairs, as well as the Social  Security Administration and the U.S. Agency for International  Development) are major agencies with statutorily designated privacy  officers, have a central mission for which the collection of personally  identifiable information is a critical component, or have implemented a  unique organizational privacy structure. We examined and compared  agency management structures for fulfilling privacy responsibilities and  assessed the differences in roles and responsibilities of privacy officers  based on the differences in agencies’ organizational structures. We  conducted this performance audit from September 2007 to May 2008 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
paragraphs: In recent years, a number of factors have led to growing concern about the  protection of privacy when personally identifiable information is collected  and maintained by the federal government. Recent data breaches of  personal information at government agencies, such as the data breach at  the Department of Veterans Affairs, which exposed the personal  information of 26.5 million veterans and active duty members of the  military in May 2006, have raised concerns about identity theft. In  addition, increasingly sophisticated analytical techniques employed by  federal agencies, such as data mining, also raise concerns about how  personally identifiable information is used and what controls are placed  on its use. Concerns such as these have focused attention on the  structures agencies have instituted to ensure privacy protections are in  place.
The major requirements for privacy protection by federal agencies come  from two laws, the Privacy Act of 1974 and the E-Gov Act of 2002.
The Privacy Act places limitations on agencies’ collection, disclosure, and  use of personal information maintained in systems of records. The act  describes a “record” as any item, collection, or grouping of information  about an individual that is maintained by an agency and contains his or her  name or another personal identifier. It also defines “system of records” as  a group of records under the control of any agency from which  information is retrieved by the name of the individual or by an individual  identifier. The Privacy Act requires that when agencies maintain a system  of records, they must notify the public by a system-of-records notice: that  is, a notice in the Federal Register identifying, among other things, the  type of data collected, the types of individuals about whom information is  collected, the intended “routine” use of the data, and procedures that  individuals can use to review and correct personal information. The act  also requires agencies to define and limit their use of covered personal  information. In addition, the act requires that to the greatest extent  practicable, personal information should be collected directly from the  subject individual when it may affect an individual’s rights or benefits  under a federal program.
The E-Gov Act of 2002 also assigns agencies significant responsibilities  relating to privacy. The E-Gov Act strives to enhance protection for  personal information in government information systems or information  collections by requiring that agencies conduct PIAs. A PIA is an analysis of  how personal information is collected, stored, shared, and managed in a  federal system. Furthermore, according to OMB guidance, a PIA is an  analysis of how information is handled. Specifically, a PIA is to (1) ensure  that handling conforms to applicable legal, regulatory, and policy  requirements regarding privacy; (2) determine the risks and effects of  collecting, maintaining, and disseminating information in identifiable form  in an electronic information system; and (3) examine and evaluate  protections and alternative processes for handling information to mitigate  potential privacy risks.
Agencies must conduct PIAs (1) before developing or procuring  information technology that collects, maintains, or disseminates  information that is in a personally identifiable form or (2) before initiating  any new data collections involving personal information that will be  collected, maintained, or disseminated using information technology if the  same questions are asked of 10 or more people. To the extent that PIAs are  made publicly available, they provide explanations to the public about  such things as the information that will be collected, why it is being  collected, how it is to be used, and how the system and data will be  maintained and protected.
OMB is tasked with providing guidance to agencies on how to implement  the provisions of these two acts and has done so, beginning with guidance  on the Privacy Act, issued in 1975. The guidance provides explanations for  the various provisions of the law as well as detailed instructions on how to  comply. OMB’s guidance on implementing the privacy provisions of the E- Gov Act of 2002 identifies circumstances under which agencies must  conduct PIAs and explains how to conduct them.
We have previously reported on the role of senior privacy officials in the  federal government. In 2006, we testified that the elevation of privacy  officers to senior positions reflected the growing demands that these  individuals faced in addressing privacy challenges on a day-to-day basis.  The challenges we identified included ensuring compliance with relevant  privacy laws, such as the Privacy Act and the E-Gov Act, and controlling  the collection and use of personal information obtained from commercial  sources. Additionally, in 2007 we reported that the DHS Privacy Office had  made significant progress in carrying out its statutory responsibilities  under the Homeland Security Act and its related role in ensuring E-Gov  Act compliance, but noted that more work remained to be accomplished.  We recommended that DHS designate privacy officers at key DHS  components, implement a department wide process for reviewing Privacy  Act notices, establish a schedule for the timely issuance of privacy reports,  and ensure that the Privacy Office’s annual reports to Congress contain a  specific discussion of complaints of privacy violations. In response, DHS  included a discussion of privacy complaints in its most recent annual  report; however, the other recommendations have not yet been  implemented.
section_title: Laws and Guidance Set Varying Requirements for Senior Privacy Officials
paragraphs: Laws and guidance set a variety of requirements for senior privacy  officials at federal agencies. For example, agencies have had a long  standing requirement under the Paperwork Reduction Act to assign  agency CIOs overall responsibility for privacy policy and compliance with  the Privacy Act. In recent years, additional laws have been enacted that  also address the roles and responsibilities of senior officials with regard to  privacy. Despite much variation, all of these laws require agencies to  assign overall responsibility for privacy protection and compliance to a  senior agency official. In addition, OMB guidance has directed agencies to  designate senior officials with overall responsibility for privacy.
These laws and guidance set specific privacy responsibilities for these  agency officials. These responsibilities can be grouped into six broad  categories: (1) conducting PIAs; (2) Privacy Act compliance; (3) reviewing  and evaluating the privacy implications of agency policies, regulations, and  initiatives; (4) producing reports on the status of privacy protections; (5)  ensuring that redress procedures are in place; and (6) ensuring that  employees and contractors receive appropriate training. The laws and  guidance vary in how they frame requirements in these categories and  which agencies must adhere to them.
subsections: section_title: Laws and Guidance Address the Roles and Responsibilities of Privacy Officials
paragraphs: Numerous laws assign privacy responsibility to senior agency officials.  The earliest of these laws is the Paperwork Reduction Act of 1980, which,  as amended, directs agency heads to assign a CIO with responsibility for  carrying out the agency’s information resources management activities to  improve agency productivity, efficiency, and effectiveness. The act directs  agency CIOs to undertake responsibility for implementing and enforcing  applicable privacy policies, procedures, standards, and guidelines, and to  assume responsibility and accountability for compliance with and  coordinated management of the Privacy Act of 1974 and related  information management laws.
As concerns about privacy have increased in recent years, Congress has  enacted additional laws that include provisions addressing the roles and  responsibilities of senior officials with regard to privacy. Despite  variations, a common thread among these laws, as well as relevant OMB  guidance, is that they all require agencies to assign overall responsibility  for privacy protection and compliance to a senior agency official. Relevant  laws include the following:    The Homeland Security Act of 2002 directed the secretary of DHS to  designate a senior official with primary responsibility for privacy policy.
The Intelligence Reform and Terrorism Prevention Act of 2004 required  the Director of National Intelligence to appoint a Civil Liberties Protection  Officer and assigned this individual specific privacy responsibilities.
The Violence Against Women and Department of Justice Reauthorization  Act of 2005 instructed the Attorney General to designate a senior official  with primary responsibility for privacy policy.
The Transportation, Treasury, Independent Agencies and General  Government Appropriations Act of 2005 directed each agency whose  appropriations were provided by the act, including the Departments of  Transportation and Treasury, to designate a CPO with primary  responsibility for privacy and data protection policy.
The Implementing Recommendations of the 9/11 Commission Act of 2007  instructed the heads of Defense, DHS, Justice, Treasury, Health and  Human Services, and State, as well as the Office of the Director of  National Intelligence and the Central Intelligence Agency to designate no  less than one senior officer to serve as a privacy and civil liberties officer.  Specific privacy provisions of these laws are summarized in appendix II.
A number of OMB memorandums have also addressed the roles and  responsibilities of senior privacy officials. In 1999, OMB required agencies  to designate a senior official to assume primary responsibility for privacy  policy. OMB later reiterated this requirement in its guidance on  compliance with the E-Gov Act, in which it directed agency heads to  designate an appropriate senior official with responsibility for the  coordination and implementation of OMB Web and privacy policy and to  serve as the agency’s principal contact for privacy policies. Most recently,  in 2005, OMB directed agencies to designate an SAOP with agency wide  responsibility for information privacy issues and with responsibility for  specific privacy functions, including ensuring agency compliance with all  federal privacy laws, playing a central policy-making role in the  development of policy proposals that implicate privacy issues, and  ensuring that contractors and employees are provided with adequate  privacy training.
Beginning in 2005, OMB has also issued guidance significantly enhancing  longstanding requirements for agencies to report on their compliance with  privacy laws. OMB’s 2005 guidance directed agencies to add a new  section addressing privacy to their annual reports under the Federal  Information Security Management Act (FISMA). SAOPs were assigned  responsibility for completion of this section, in which they were to report  on such things as agency policies and procedures for the conduct of PIAs,  agency policies for ensuring adequate privacy training, as well as their  own involvement in agency regulatory and policy decisions. In 2006, OMB  issued further guidance requiring agencies to include as part of their  FISMA reports a section addressing measures for protecting personally  identifiable information. This guidance also required that agencies provide  OMB with quarterly privacy updates and report all incidents relating to the  loss of or unauthorized access to personally identifiable information.  Most recently, OMB directed agencies in 2007 to include in their FISMA  reports additional items, such as their breach notification policies, plans to  eliminate unnecessary use of Social Security numbers, and plans for  reviewing and reducing their holdings of personally identifiable  information.
These laws and guidance set a variety of requirements for senior officials  to carry out specific privacy responsibilities. These responsibilities can be  grouped into the following six key functions:    Conduct of PIAs: A PIA is an analysis of how personal information is  collected, stored, shared, and managed in a federal system, and is required  before developing or procuring information technology that collects,  maintains, or disseminates information that is in a personally identifiable  form. Several laws assign privacy officials at covered agencies  responsibilities that are met in part by performing PIAs on systems that  collect, process, or store personally identifiable information. This includes  the requirements for several agencies to ensure that “technologies sustain  and do not erode privacy protections.” Furthermore, OMB guidance  requires agency SAOPs to ensure compliance with federal laws,  regulations, and policies relating to information privacy, such as the E-Gov  Act, which spells out agency PIA requirements.
Privacy Act compliance: As previously discussed, the Privacy Act sets a  variety of requirements for all federal agencies regarding privacy  protection. For example, the act requires that when agencies establish or  make changes to a system of records, they must notify the public by a  notice in the Federal Register , identifying, among other things, the type of  data collected, the types of individuals about whom information is  collected, the intended “routine” use of the data, and procedures that  individuals can use to review and correct personal information. Several  other laws explicitly direct agency privacy officials to ensure that the  personal information contained in their Privacy Act systems of records is  handled in compliance with fair information practices as set out in the act.  Further, OMB guidance assigns agency SAOPs with responsibility for  ensuring Privacy Act compliance.
Policy consultation: Relevant laws direct senior privacy officials to  actively participate in the development and evaluation of privacy-sensitive  agency policy decisions. Several specifically task the SAOP with  evaluating legislative and regulatory proposals or periodically reviewing  agency actions affecting privacy. As agencies develop new policies, senior  officials responsible for privacy issues play a key role in identifying and  mitigating potential privacy risks prior to finalizing a particular policy  decision. Moreover, OMB directed agency SAOPs to undertake a central  role in the development of policy proposals that implicate privacy issues.
Privacy reporting: Agency senior privacy officials are often required to  prepare periodic reports to ensure transparency about their activities and  compliance with the law. Many laws reviewed required agencies to  produce periodic privacy reports to agency stakeholders and Congress.  OMB also requires agency SAOPs to report on their privacy activities as  part of their annual FISMA reports, including such measures as their total  numbers of systems of records, the number of written privacy complaints  they have received, and whether a senior official has responsibility for all  privacy-related activities.
Redress: With regard to federal agencies, the term “redress” generally  refers to an agency’s complaint resolution process, whereby individuals  may seek resolution of their concerns about an agency action. Specifically,  in the privacy context, redress refers to processes for handling privacy  inquiries and complaints as well as for allowing citizens who believe that  agencies are storing and using incorrect information about them to gain  access to and correct that information. The Privacy Act requires that all  agencies, with certain exceptions, allow individuals access to their records  and the ability to have inaccurate information corrected. Several recent  laws also direct senior privacy officials at specific agencies to provide  redress by ensuring that they have adequate procedures for investigating  and addressing privacy complaints by individuals. Several laws also  provide for attention to privacy in a broader context of civil liberties  protection.
Privacy training: Privacy training is critical to ensuring that agency  employees and contractor personnel follow appropriate procedures and  take proper precautions when handling personally identifiable  information. For example, The Transportation, Treasury, Independent  Agencies and General Appropriations Act of 2005 requires senior privacy  officials at covered agencies to ensure that employees have adequate  privacy training. OMB also requires agency SAOPs to ensure that  employees and contractors receive privacy training.
In addition to performing key privacy functions, requirements in laws  include responsibilities to ensure adequate security safeguards to protect  against unauthorized access, use, disclosure, and destruction of sensitive  personal information. Generally, this is provided through agency  information security programs established under FISMA, and overseen by  agency CIOs and chief information security officers (CISO). Moreover,  OMB has issued guidance instructing agency heads to establish  appropriate administrative, technical, and physical safeguards to ensure  the security and confidentiality of records.
Figure 1 shows the extent to which laws have requirements that  specifically address each privacy function and to which agencies these  requirements apply.
section_title: Agencies Have Varying Privacy Management Structures, and Senior Agency Officials for Privacy Do Not Consistently Have Oversight of All Key Functions
paragraphs: Agencies have varying organizational structures to address privacy  responsibilities. For example, of the 12 agencies we reviewed, 2 had  statutorily designated CPOs who also served as SAOPs, 5 designated their  agency CIOs as their senior officials, and the others designated a variety of  other officials, such as the general counsel or assistant secretary for  management. Further, not all of the agencies we reviewed had given their  designated senior officials full oversight over all privacy-related functions.  While 6 agencies had these officials overseeing all key privacy functions, 6  others relied on other organizational units not overseen by the designated  senior official to perform certain key privacy functions. The fragmented  way in which privacy functions have been assigned to organizational units  in these agencies is at least partly the result of evolving requirements in  law and guidance. As requirements have evolved, organizational  responsibilities have been established incrementally to meet them.
However, without oversight and involvement in all key privacy functions,  SAOPs may be unable to effectively serve as agency central focal points  for privacy.
subsections: section_title: Agencies Varied in Their Designation of Senior Privacy Officials and in Their Organizational Placement of Key Privacy Functions
paragraphs: Agencies have taken varied approaches to designating senior agency  officials with privacy responsibilities. Two of the 12 agencies we reviewed  had separate CPOs that were also designated as the senior officials for  privacy. Five agencies assigned their agency CIOs as SAOPs, and 1 agency  assigned its CISO. Lastly, 4 agencies assigned another high-level official,  such as a general counsel or assistant secretary for management, as the  SAOP.
In addition to varying in how they designated senior officials for privacy,  agencies also varied in the way they assigned privacy responsibilities to  organizational units. Four of the 12 agencies we reviewed (Transportation,  DHS, State, and U.S. Agency for International Development) had one  organization primarily responsible for all of the six key privacy functions  outlined in the previous section. The remaining 8 agencies (Social Security  Administration, Veterans Affairs, Defense, Commerce, Labor, Justice,  Treasury, and Health and Human Services) relied on more than one  organizational unit to perform privacy functions. Figure 2 summarizes the  organizational structures in place at agencies to address the six key  privacy functions, including the specific organizational units responsible  for carrying out each of the key privacy functions.
Six of the agencies (DHS, State, Social Security Administration,  Transportation, U.S. Agency for International Development, and Veterans  Affairs) established privacy structures in which the SAOP oversaw all key  privacy functions. For example, DHS’s Privacy Office performed these  functions under the direction of the CPO, who was also the department’s  SAOP. Similarly, U.S. Agency for International Development’s CISO (also  the SAOP) oversaw the agency’s privacy office, which was responsible for  all key functions. While more than one organizational unit carried out  privacy functions in two cases (Veterans Affairs and the Social Security  Administration), all such units were overseen by the senior agency official  for privacy.
However, six other agencies (Commerce, Health and Human Services,  Labor, Transportation, Defense, and Treasury) had privacy management  structures in which the SAOP did not oversee all key privacy functions.  For two agencies—Justice and Treasury—the SAOP had oversight over all  key functions except for redress, which was handled by individual  component organizations. For the other four agencies, key functions were  divided among two or more organizations, and the senior privacy official  did not have oversight of all of them. For example, key privacy functions  at Labor were being performed not only by the office of the CIO (who is  also the SAOP) but also by the Office of the Solicitor, who is independent  of the CIO. Likewise, the senior official at Commerce was responsible for  overseeing conduct of PIAs, policy consultation, and privacy training,  while a separate Privacy Act Officer was responsible for Privacy Act  compliance. Without full oversight of key privacy functions, SAOPs may  be limited in their ability to ensure that privacy protections are  administered consistently across the organization.
section_title: Evolving Requirements in Laws and Related Guidance Have Led to Fragmented Assignment of Privacy Functions
paragraphs: The fragmented way in which privacy functions have been assigned to  organizational units in several agencies is at least partly the result of  evolving requirements in law and guidance. As requirements have evolved,  organizational responsibilities have been established incrementally to  meet them. For example, although the Privacy Act does not specify  organizational structures for carrying out its provisions, many agencies  established Privacy Act officers to address the requirements of that act  and have had such positions in place for many years. In some cases,  agencies designated their general counsels to be in charge of ensuring that  the Privacy Act’s requirements were met. More recently, the responsibility  to conduct PIAs under the E-Gov Act frequently has been given to another  office, such as the Office of the CIO, because the E-Gov Act’s requirements  apply to information technology, which is generally the purview of the  CIO. If an SAOP was designated in such agencies without reassigning  these responsibilities, that official may not have oversight and involvement  in all key privacy activities.
Uneven implementation of the Paperwork Reduction Act also may have  contributed to fragmentation of privacy functions. As previously  discussed, the Paperwork Reduction Act requires agency CIOs to take  responsibility for privacy policy and compliance with the Privacy Act, and  thus agencies could ensure they are in compliance with the Paperwork  Reduction Act by designating their CIOs as SAOPs. However, 7 out of the  12 agencies we reviewed did not designate their CIOs as SAOPs. Further, if  CIOs were designated as agency SAOPs but did not have responsibility for  compliance with the Privacy Act—as was the case at Commerce, Labor,  and Health and Human Services—the SAOPs would be left without full  oversight of key privacy functions.
Agencies that have more than one internal organization carrying out  privacy functions run the risk that those organizations may not always  provide the same protections for personal information if they are not  overseen by a central authority. Thus, unless steps are taken to ensure that  key privacy functions are under the oversight of the SAOP, agencies may  be limited in their ability to ensure that information privacy protections  are implemented consistently across their organizations.
section_title: Conclusions
paragraphs: While agencies have had the responsibility for many years to establish  management structures to ensure coordinated implementation of privacy  policy and compliance with the Privacy Act, recent laws and guidance  have significantly changed requirements for privacy oversight and  management. These laws and guidance vary in scope and specificity, but  they all require the designation of a senior agency official with overall  responsibility for privacy protection and compliance with statutory  requirements.
In adopting varied assignments for key privacy functions, not all agencies  gave their SAOPs responsibility for all key privacy functions. As a result,  agencies may not be implementing privacy protections consistently. While  the particulars of privacy management may vary according to the size of  the agency and the sensitivity of its mission, agencies generally would  likely benefit from having SAOPs that serve as central focal points for  privacy matters and have oversight of all key functions, as required by law  and guidance. Such focal points can help ensure that agency activities  provide consistent privacy protections.
section_title: Recommendation for Executive Action
paragraphs: In order to ensure that their SAOPs function effectively as central focal  points for privacy management, we recommend that the Attorney General  and the Secretaries of Commerce, Defense, Health and Human Services,  Labor, and Treasury take steps to ensure that their SAOPs have oversight  over all key privacy functions.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to OMB and to the departments and  agencies we reviewed: the Departments of Commerce, Defense, Health  and Human Services, Homeland Security, Justice, Labor, State, Treasury,  Transportation, and Veterans Affairs, as well as the Social Security  Administration and the U.S. Agency for International Development, for  review and comment. Five agencies provided no comments on this draft.  In comments provided via email, the Associate Deputy Assistant Secretary  for Privacy and Records Management at Veterans Affairs and the Audit  Management Liaison at the Social Security Administration concurred with  our assessment and recommendations and provided technical comments,  which we incorporated in the final report as appropriate. In oral  comments, the Acting Branch Chief of the Information Policy and  Technology Branch at OMB also concurred with our assessment and  recommendations and provided technical comments, which we  incorporated in the final report as appropriate. Commerce and Defense  provided written comments that did not state whether they agreed or  disagreed with our recommendations; however, both agencies stated that  their privacy management structures were adequate. Their comments are  reprinted in appendixes II and III respectively. Justice, Labor, and  Treasury provided written comments and disagreed with our  characterization of their agency SAOPs as not having oversight of all key  privacy functions. Their comments are reprinted in appendixes IV, V, and  VI respectively.
The Chief Information Officer of the Department of Commerce stated that  the department agreed with our characterization of the fragmentation that  has resulted from recent laws and guidance that have significantly  changed requirements for privacy oversight and management. However,  she stated that applicable law does not require that the administration of  the Privacy Act be consolidated with other privacy functions under the  Office of the Chief Information Officer. Law and OMB guidance direct  agencies to have a senior agency official, the CIO in the case of the  Paperwork Reduction Act, serving as a focal point for privacy and  ensuring compliance with the Privacy Act. Clearly establishing a senior  official as a focal point for departmental privacy functions aligns with  direction provided by law and OMB and would help ensure that the agency  provides consistent privacy protections.
The Senior Agency Official for Privacy at the Department of Defense  stated that, while privacy responsibilities are divided among the Defense  Privacy Office, the CIO, and agency components, the current privacy  management structure at Defense has proven to be successful over time.  We did not assess the effectiveness of the privacy management structures  we reviewed. However, establishing an agency official that serves as a  central focal point for departmental privacy functions aligns with direction  provided by law and OMB and would help ensure that the agency provides  consistent privacy protections.
The Acting Chief Privacy and Civil Liberties Officer at Justice disagreed  with our assessment that the department’s SAOP did not have oversight of  redress procedures. He stated that the Chief Privacy and Civil Liberties  Officer has statutory authority under the Violence Against Women and  Department of Justice Reauthorization Act to assume primary  responsibility for privacy policy and to ensure appropriate notifications  regarding the department’s privacy policies and privacy-related inquiry  and complaint procedures. We agree that the Chief Privacy and Civil  Liberties officer has the statutory authority and responsibility for the  oversight of privacy functions at Justice, including redress. However, our  analysis of agency policies and procedures showed that the Chief Privacy  and Civil Liberties Officer did not have an established role in oversight of  redress procedures. Clearly defining the role of the Chief Privacy and Civil  Liberties Officer in the departmental redress procedures would help  ensure that the SAOP has oversight of this key privacy function. In its  comments, the department noted that the Office of Privacy and Civil  Liberties was undertaking a review of its orders and guidance to clarify  and, as appropriate, strengthen existing authorities to ensure that the  department implements thoroughly the Chief Privacy and Civil Liberties  Officer authorities.
The Chief Information Officer at Labor disagreed with our assessment that  the SAOP did not have full oversight of all key privacy functions. He stated  that Privacy Act compliance, redress, and training were addressed jointly  by his office and the Office of the Solicitor. However, our review of  Labor’s policies and procedures relating to privacy management showed  that a joint oversight management structure had not been established.  Rather, we found that while the CIO was responsible for three key privacy  functions, the Office of the Solicitor was responsible for the remaining  three functions. Clearly defining the role of the SAOP in Privacy Act  compliance, redress, and training would help ensure that the SAOP has  oversight of all key privacy functions.
The Assistant Secretary for Management at Treasury agreed that the SAOP  should have overall responsibility for privacy protection and compliance  with statutory requirements and that agencies generally would likely  benefit from having SAOPs that serve as central focal points for privacy  matters and have oversight of all key functions. The Assistant Secretary  noted that as of March 2008, the department had implemented a new  privacy management structure to emphasize the importance of protecting  privacy at its highest levels. However, Treasury disagreed with a statement  in our draft report that it had realigned its organization in order to ensure  that the SAOP had oversight of privacy functions. We recognize that  privacy functions, with the exception of redress, were under the oversight  of the SAOP prior to the reorganization and accordingly have deleted this  statement from the final report. Treasury also disagreed that its SAOP did  not have full oversight of agency redress processes, stating that the  department has longstanding regulations that provide departmentwide and  bureau-specific policies and procedures relating to redress. While we  agree that such redress policies are in place, they do not establish a role  for the SAOP. Clearly defining the role of the SAOP in the departmental  redress procedures would help ensure that the SAOP has oversight of this  key privacy function. Lastly, Treasury stated it submits quarterly reports to  Congress on privacy complaint and redress activities. We agree that  reporting is an important privacy function; however, it is separate from  redress and does not constitute oversight of Treasury redress activities.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the Attorney  General; the Secretaries of Commerce, Defense, Health and Human  Services, Homeland Security, State, Treasury, Labor, Transportation, and  Veterans Affairs; the Commissioner of the Social Security Administration;  and the Administrator of the U.S. Agency for International Development as  well as other interested congressional committees. Copies will be made  available at no charge on our Web site, www.gao.gov.
If you have any questions concerning this report, please call me at   (202) 512-6240 or send e-mail to koontzl@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this report. Key contributors to this report are listed in  appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to (1) describe laws and guidance that set  requirements for senior privacy officials within federal agencies, and (2)  describe the organizational structures used by agencies to address privacy  requirements and assess whether senior officials have oversight over key  functions. We did not evaluate agency compliance with these laws and  guidance.
To address our first objective, we reviewed and analyzed relevant laws  and guidance to determine privacy responsibilities for privacy officials at  agencies. We reviewed relevant laws, including the Implementing  Recommendations of the 9/11 Commission Act of 2007, the Homeland  Security Act of 2002, and others (see app. II for a full listing), which  designate senior privacy officials and assign them privacy responsibilities.  We also analyzed the Paperwork Reduction Act, which has long-standing  privacy requirements assigned to agency chief information officers (CIO),  and the Office of Management and Budget (OMB) guidance relating to the  designation of senior agency officials with privacy responsibilities, such as  Memorandum M-05-08. We also analyzed the specific privacy  responsibilities identified in these laws and guidance and categorized the  key privacy functions they represented.
To address our second objective, we identified 12 agencies (Departments  of Commerce, Defense, Health and Human Services, Homeland Security,  Justice, Labor, State, Treasury, Transportation, and Veterans Affairs; the  Social Security Administration, and the U.S. Agency for International  Development) that either have a statutorily designated privacy officer,  have a central mission for which privacy protection is a critical  component, or have implemented a unique organizational privacy  structure. We analyzed policies and procedures at these agencies, and  interviewed senior agency privacy officials to identify the privacy  management structures used at each of these agencies and the roles and  responsibilities of senior privacy officials. We also compared the varying  management structures at these agencies to identify the differences and  similarities across agencies in their implementation of these structures.  Further, we analyzed agency management structures to determine  whether senior privacy officials at each of these agencies had full  oversight over all key functions.
We conducted our work from September 2007 to May 2008, in Washington,  D.C., in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Commerce
section_title: Appendix III: Comments From the Department of Defense
section_title: Appendix IV: Comments From the Department of Justice
section_title: Appendix V: Comments from the Department of Labor
section_title: Appendix VI: Comments from the Department of the Treasury
section_title: Appendix VII: Recent Laws Establishing Privacy Protection Responsibilities at Federal Agencies
paragraphs: The following are recent laws and their major provisions regarding privacy  protection responsibilities at federal agencies.
subsections: section_title: Homeland Security Act of 2002
paragraphs: Section 222 of the Homeland Security Act of 2002,  as amended, instructed  the secretary of DHS to appoint a senior official with primary  responsibility for privacy policy, including the following:    ensuring that technologies sustain, and do not erode, privacy protections;    ensuring that personal information contained in Privacy Act systems of  records is handled in full compliance with fair information practices as set  out in the act;   evaluating legislative and regulatory proposals and conducting privacy  impact assessments of proposed rules;   coordinating functions with the Officer for Civil Rights and Civil Liberties;    preparing an annual report to Congress (without prior comment or  amendment by agency heads or OMB); and   having authority to investigate and having access to privacy-related  records, including through subpoena in certain circumstances.
section_title: Intelligence Reform and Terrorism Prevention Act of 2004
paragraphs: Section 1011 of this act required the Director of National Intelligence to  appoint a Civil Liberties Protection Officer and gave this officer the  following functions:  ensuring that the protection of civil liberties and privacy is appropriately  incorporated into the policies and procedures of the Office of the Director  of National Intelligence and the elements of the intelligence community  within the National Intelligence Program;    overseeing compliance by the Office of the Director of National  Intelligence with all laws, regulations, and guidelines relating to civil  liberties and privacy; reviewing complaints about abuses of civil liberties and privacy in Office  of the Director of National Intelligence programs and operations;   ensuring that technologies sustain, and do not erode, privacy protections;    ensuring that personal information contained in a system of records  subject to the Privacy Act is handled in full compliance with fair  information practices as set out in that act;   conducting privacy impact assessments when appropriate or as required    performing such other duties as may be prescribed by the Director of  National Intelligence or specified by law.
section_title: Violence Against Women and Department of Justice Reauthorization Act of 2005
paragraphs: Section 1174 of the Violence Against Women and Department of Justice  Reauthorization Act of 2005 instructed the Attorney General to designate  a senior official to assume primary responsibility for privacy policy, which  included responsibility for advising the Attorney General in the following  areas:    appropriate privacy protections for the department’s existing or proposed  information technology and systems;   privacy implications of legislative and regulatory proposals;  implementation of policies and procedures, including training and  auditing, to ensure compliance with privacy-related laws and policies;  that adequate resources and staff are devoted to meeting the department’s  privacy-related functions and obligations;    appropriate notifications regarding privacy policies and inquiry and  complaint procedures; and    privacy-related reports from the department to Congress and the  President, including an annual report to Congress on activities affecting  privacy.
section_title: Transportation, Treasury, Independent Agencies and General Government Appropriations Act of 2005
paragraphs: Section 522 of this act directed each agency with appropriations provided  by the act to designate a chief privacy officer with primary responsibility  for privacy and data protection policy, including    ensuring that technology sustains, and does not erode, privacy and that  technology used to collect or process personal information allows for  continuous auditing of compliance with stated privacy policies and  practices;   ensuring that personal information contained in Privacy Act systems of  records is handled in full compliance with fair information practices as  defined in the Privacy Act;   evaluating legislative and regulatory proposals and conducting privacy  impact assessments of proposed rules;   preparing an annual report to Congress on activities affecting privacy;    ensuring the protection of personal information and information systems  from unauthorized access, use, disclosure, or destruction,   providing employees with privacy training; and    ensuring compliance with privacy and data protection policies.
section_title: Implementing Recommendations of the 9/11 Commission Act of 2007
paragraphs: This law amended the National Intelligence Reform Act of 2004 to require  the heads of covered agencies to designate no less than one senior officer  to serve as a privacy and civil liberties officer. This act applies to the  Departments of Defense, Homeland Security, Justice, Treasury, Health and  Human Services, and State, as well as the Office of the Director of  National Intelligence, and the Central Intelligence Agency. The act requires  the senior privacy official to perform the following functions:    assisting the agency head in considering privacy and civil liberties issues  with regard to anti-terrorism efforts; investigating and reviewing agency actions to ensure adequate  consideration of privacy and civil liberties;   ensuring that the agency has adequate redress procedures,    considering privacy and civil liberties when deciding to retain or enhance    coordinating activities, when relevant, with the agency Inspector General;    preparing periodic reports, not less than quarterly, to the agency head,  Congress, and the Privacy and Civil Liberties Oversight Board.
Agencies covered under this act are also required to establish a direct  reporting relationship between the senior privacy official and the agency  head.
section_title: Appendix VIII: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: Major contributors to this report were John de Ferrari, Assistant Director;  Idris Adjerid; Shaun Byrnes; Matt Grote; David Plocher; Jamie Pressman;  and Amos Tevelow.