Privacy: Government Use of Data from Information Resellers Could Include Better Protections
Published: 2008-03-11T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Federal agencies collect and use personal information for various purposes from information resellers--companies that amass and sell data from many sources. GAO was asked to testify on its April 2006 report on agency use of reseller data. For that report, GAO was asked to determine how the Departments of Justice, Homeland Security, and State and the Social Security Administration used personal data from resellers and to review the extent to which agencies' policies and practices for handling this information reflected the Fair Information Practices, a set of widely accepted principles for protecting the privacy and security of personal data. GAO was also asked to provide an update on the implementation status of its recommendations and to comment on provisions of the proposed Federal Agency Data Protection Act. In preparing this testimony, GAO relied primarily on its April 2006 report.
section_title: What GAO Found
paragraphs: In fiscal year 2005, the Departments of Justice, Homeland Security, and State and the Social Security Administration reported that they used personal information obtained from resellers for a variety of purposes, including performing criminal investigations, locating witnesses and fugitives, researching assets held by individuals of interest, and detecting prescription drug fraud. The agencies planned spending approximately $30 million on contractual arrangements with resellers that enabled the acquisition and use of such information. About 91 percent of the planned fiscal year 2005 spending was for law enforcement (69 percent) or counterterrorism (22 percent). Agency practices for handling personal information acquired from information resellers did not always fully reflect the Fair Information Practices. That is, for some of these principles, agency practices were uneven. For example, although agencies issued public notices when they systematically collected personal information, these notices did not always notify the public that information resellers were among the sources to be used. This practice is not consistent with the principle that individuals should be informed about privacy policies and the collection of information. Contributing to the uneven application of the Fair Information Practices are ambiguities in guidance from the Office of Management and Budget (OMB) regarding the applicability of privacy requirements to federal agency uses of reseller information. In addition, agencies generally lacked policies that specifically address these uses. GAO made recommendations to OMB to revise privacy guidance and to the four agencies to develop specific policies for the use of personal information from resellers. The five agencies generally agreed with the report and described actions initiated to address the recommendations. Since GAO issued its report, agencies have taken steps to address the recommendations. For example, the Department of Homeland Security Privacy Office incorporated specific questions in its May 2007 Privacy Impact Assessment guidance concerning use of commercial data. In addition, the Department of Justice took steps to update its public notices to specify their use of data from information resellers. OMB, however, has not implemented GAO's recommendation to clarify guidance on use of commercial data. The Federal Agency Data Protection Act was introduced on December 18, 2007. The legislation, among other things would require that agencies (1) conduct privacy impact assessments for their uses of commercial data, and (2) promulgate regulations concerning the use of commercial data brokers. GAO considers these requirements to be consistent with the results and the recommendations made to the agencies in its 2006 report

section_title: Letter
paragraphs: This  is  a  work  of  the  U.S.  government  and  is  not  subject  to  copyright  protection  in  the  United  States.  The  published  product  may  be  reproduced  and  distributed  in  its  entirety  without  further  permission  from  GAO.  However,  because  this  work  may  contain  copyrighted  images  or  other  material,  permission  from  the  copyright  holder  may  be  necessary if you wish to reproduce this material separately.
Mr. Chairman and Members of the Subcommittee:  I appreciate the opportunity to discuss critical issues surrounding  the federal government’s purchase of personal information from  businesses known as information resellers. As you are aware, the  ease and speed with which people’s personal information can be  collected by information resellers from a wide variety of sources  and made available to government and other customers has  accelerated with technological advances. In recent years, security  breaches at large information resellers such as ChoicePoint and  LexisNexis have raised questions about how resellers and their  federal customers handle people’s personal information—and  especially whether their practices are fully consistent with widely  accepted practices for protecting the privacy and security of  personal information.
Federal agency use of personal information is governed primarily by  the E-Government Act of 2002 and the Privacy Act of 1974. The E- Government Act of 2002 strives to enhance protection for personal  information in government information systems by requiring that  agencies conduct privacy impact assessments (PIA). A PIA is an  analysis of how personal information is collected, stored, shared,  and managed in a federal system. The Privacy Act of 1974 requires  that the use of personal information be limited to predefined  purposes and involve only information germane to those purposes.  The provisions of the Privacy Act, in turn, are largely based on a set  of principles for protecting the privacy and security of personal  information, known as the Fair Information Practices, which were  first proposed in 1973 by a U.S. government advisory committee.  These principles, now widely accepted, include  7.  individual participation, and  8.  accountability.
These principles, with some variation, are used by organizations to  address privacy considerations in their business practices and are  also the basis of privacy laws and related policies in many countries,  including the United States, Germany, Sweden, Australia, and New  Zealand, as well as the European Union.
As agreed, my testimony today will be based primarily on the agency  information contained in a report we issued in April 2006. For that  report, we analyzed fiscal year 2005 contracts and other vehicles for  the acquisition of personal information from information resellers  by the Departments of Justice (DOJ), Homeland Security (DHS), and  State (State) and the Social Security Administration (SSA). We  compared relevant agency guidelines and management policies and  procedures to the Fair Information Practices. We also updated the  implementation status of recommendations contained in our 2006  report and analyzed provisions of the proposed Federal Agency Data  Protection Act. Our work was performed in accordance with  generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings  and conclusions based on our audit objectives. We believe that the  evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
Today, after a brief summary of the laws that govern agency use of  personal information, I will summarize the information contained in  our 2006 report on how the selected agencies used the personal  information that they purchased from resellers and the extent to  which the agencies had policies and practices that reflected the Fair  Information Practices. I will also provide an update on steps taken  by the agencies to address the recommendations contained in our  2006 report. Finally, I will comment on specific privacy related  provisions of the proposed Federal Agency Data Protection Act.
subsections: section_title: Background
paragraphs: Before advanced computerized techniques, obtaining people’s  personal information usually required visiting courthouses or other  government facilities to inspect paper-based public records, and  information contained in product registrations and other business  records was not generally available at all. Automation of the  collection and aggregation of multiple-source data, combined with  the ease and speed of its retrieval, have dramatically reduced the  time and effort needed to obtain such information. Information  resellers provide services based on these technological advances.
We use the term “information resellers” to refer to businesses that  vary in many ways but have in common collecting and aggregating  personal information from multiple sources and making it available  to their customers. These businesses do not all focus exclusively on  aggregating and reselling personal information. For example, Dun &  Bradstreet primarily provides information on commercial  enterprises for the purpose of contributing to decision making  regarding those enterprises. In doing so, it may supply personal  information about individuals associated with those commercial  enterprises. To a certain extent, the activities of information  resellers may also overlap with the functions of consumer reporting  agencies, also known as credit bureaus—entities that collect and  sell information about individuals’ creditworthiness, among other  things. To the extent that information resellers perform the  functions of consumer reporting agencies, they are subject to  legislation specifically addressing that industry, particularly the Fair  Credit Reporting Act.
Information resellers have now amassed extensive amounts of  personal information about large numbers of Americans. They  supply it to customers in both government and the private sector,  typically via a centralized online resource. Generally, three types of  information are collected:  ●  Public records such as birth and death records, property records,  motor vehicle and voter registrations, criminal records, and civil  case files.  ●  Publicly available information not found in public records but  nevertheless publicly available through other sources, such as  telephone directories, business directories, classified ads or  magazines, Internet sites, and other sources accessible by the  general public.   ●  Nonpublic information derived from proprietary or nonpublic  sources, such as credit header data, product warranty registrations,  and other application information provided to private businesses  directly by consumers.
Figure 1 illustrates how these types of information are collected and  aggregated into reports that are ultimately accessed by customers,  including government agencies.
subsections: section_title: Federal Laws and Guidance Govern Use of Personal Information in Federal Agencies
paragraphs: No single federal law governs all use or disclosure of personal  information. The major requirements for the protection of personal  privacy by federal agencies come from the Privacy Act of 1974 and  the privacy provisions of the E-Government Act of 2002.
Federal use of personal information is governed primarily by the  Privacy Act of 1974, which places limitations on agencies’  collection, disclosure, and use of personal information maintained  in systems of records. The act describes a “record” as any item,  collection, or grouping of information about an individual that is  maintained by an agency and contains his or her name or another  personal identifier. It also defines “system of records” as a group of  records under the control of any agency from which information is  retrieved by the name of the individual or by an individual identifier.  The Privacy Act requires that when agencies establish or make  changes to a system of records, they must notify the public by  placing a notice in the Federal Register identifying, among other  things, the type of data collected, the types of individuals about  whom the information is collected, the routine uses  of the data,  and procedures that individuals can use to review and correct their  personal information. Additional provisions of the Privacy Act are  discussed in the 2006 report.
The E-Government Act of 2002 requires that agencies conduct PIAs.  A PIA is an analysis of how personal information is collected,  stored, shared, and managed in a federal system. Under the E- Government Act and related OMB guidance, agencies must conduct  PIAs (1) before developing or procuring information technology that  collects, maintains, or disseminates information that is in a  personally identifiable form; (2) before initiating any new data  collections involving personal information that will be collected,  maintained, or disseminated using information technology if the  same questions are asked of 10 or more people; or (3) when a  system change creates new privacy risks, for example, by changing  the way in which personal information is being used.
OMB is tasked with providing guidance to agencies on how to  implement the provisions of the Privacy Act and the E-Government  Act and has done so, beginning with guidance on the Privacy Act,  issued in 1975. OMB’s guidance on implementing the privacy  provisions of the E-Government Act of 2002 identifies  circumstances under which agencies must conduct PIAs and  explains how to conduct them.
The PIA mandate in the E-Government Act of 2002 provided a  mechanism by which agencies can consider privacy in the earliest  stages of system development. PIAs can be an important tool to help  agencies to address openness and purpose specification principles  early in the process of developing new information systems. To the  extent that PIAs are made publicly available, they provide  explanations to the public about such things as the information that  will be collected, why it is being collected, how it is to be used, and  how the system and data will be maintained and protected.
section_title: The Fair Information Practices Are Widely Agreed to Be Key Principles for Privacy Protection
paragraphs: The Privacy Act of 1974 is largely based on a set of internationally  recognized principles for protecting the privacy and security of  personal information known as the Fair Information Practices. A  U.S. government advisory committee first proposed the practices in  1973 to address what it termed a poor level of protection afforded to  privacy under contemporary law. The Organization for Economic  Cooperation and Development (OECD) developed a revised  version of the Fair Information Practices in 1980. This version of the  principles was reaffirmed by OECD ministers in a 1998 declaration  and further endorsed in a 2006 OECD report. The Fair Information  Practices, have, with some variation, formed the basis of privacy  laws and related policies in many countries, including the United  States, Germany, Sweden, Australia, and New Zealand, as well as the  European Union.
In addition, in its 2007 report, Engaging Privacy and Information  Technology in a Digital Age, the National Research Council found  that the principles of fair information practice for the protection of  personal information are as relevant today as they were in 1973.  Accordingly, the committee recommended that the Fair Information  Practices should be extended as far as reasonably feasible to apply  to private sector organizations that collect and use personal  information. The eight principles of the OECD Fair Information  Practices are shown in table 1.
The Fair Information Practices are not precise legal requirements.  Rather, they provide a framework of principles for balancing the  need for privacy with other public policy interests, such as national  security, law enforcement, and administrative efficiency. Ways to  strike that balance vary among countries and according to the type  of information under consideration.
section_title: Agencies Used Governmentwide Contracts to Obtain Personal Information from Information Resellers for a Variety of Purposes
paragraphs: DOJ, DHS, State, and SSA reported approximately $30 million  through contracts with information resellers in fiscal year 2005.  The agencies reported using personal information obtained from  resellers for a variety of purposes including law enforcement,  counterterrorism, fraud detection/prevention, and debt collection. In  all, approximately 91 percent of agency uses of reseller data were in  the categories of law enforcement (69 percent) or counterterrorism  (22 percent). Figure 2 details contract values categorized by their  reported use.
DOJ, which accounted for about 63 percent of the funding, mostly  used the data for law enforcement and counterterrorism. DHS also  used reseller information primarily for law enforcement and  counterterrorism. State and SSA reported acquiring personal  information from information resellers for fraud prevention and  detection, identity verification, and benefits eligibility  determination.
subsections: section_title: DOJ and DHS Used Information Resellers Primarily for Law Enforcement and Counterterrorism
paragraphs: In fiscal year 2005, DOJ and its components reported approximately  $19 million through contracts with a wide variety of information  resellers, primarily for purposes related to law enforcement (75  percent) and counterterrorism (18 percent). The Federal Bureau of  Investigation (FBI), which is DOJ’s largest user of information  resellers, used reseller information to, among other things, analyze  intelligence and detect terrorist activities in support of ongoing  investigations by law enforcement agencies and the intelligence  community. In this capacity, resellers provided the FBI’s Foreign  Terrorist Tracking Task Force with names, addresses, telephone  numbers, and other biographical and demographical information as  well as legal briefs, vehicle and boat registrations, and business  ownership records.
The Drug Enforcement Administration (DEA), the second largest  DOJ user of information resellers in fiscal year 2005, obtained  reseller data primarily to detect fraud in prescription drug  transactions. Agents used reseller data to detect irregular  prescription patterns for specific drugs and trace this information to  the pharmacy and prescribing doctor.
DHS and its components reported that they used information  reseller data in fiscal year 2005 primarily for law enforcement  purposes, such as developing leads on subjects in criminal  investigations and detecting fraud in immigration benefit  applications (part of enforcing immigration laws). DHS’s largest  investigative component, the U.S. Immigration and Customs  Enforcement, is also its largest user of personal information from  resellers. It collected data such as address and vehicle information  for criminal investigations and background security checks. Another  DHS component, U.S. Customs and Border Protection, conducts  queries on people, businesses, property. The Federal Emergency  Management Agency, an additional component, used an information  reseller to detect fraud in disaster assistance applications.
DHS also reported using information resellers in its  counterterrorism efforts. For example, the Transportation Security  Administration (TSA), a DHS component, used data obtained from  information resellers as part of a test associated with the  development of its domestic passenger prescreening program,  called Secure Flight. TSA planned for Secure Flight to compare  domestic flight reservation information submitted to TSA by aircraft  operators with federal watch lists of individuals known or suspected  of activities related to terrorism.
section_title: SSA and State Used Information Resellers Primarily for Fraud Prevention and Detection
paragraphs: In an effort to ensure the accuracy of Social Security benefit  payments, the SSA and its components reported approximately $1.3  million in contracts with information resellers in fiscal year 2005 for  purposes relating to fraud prevention (such as skiptracing),  confirming suspected fraud related to workers’ compensation  payments, obtaining information on criminal suspects for follow-up  investigations, and collecting debts. For example, the Office of the  Inspector General (OIG), the largest user of information reseller  data at SSA, used several information resellers to assist investigative  agents in detecting benefits abuse by Social Security claimants and  to assist agents in locating claimants. Regional office agents may  also use reseller data in investigating persons suspected of claiming  disability fraudulently.
State and its components reported approximately $569,000 in  contracts with information resellers for fiscal year 2005, mainly to  support investigations of passport-related activities. For example,  several components accessed personal information to validate  familial relationships, birth and identity data, and other information  submitted on immigrant and nonimmigrant visa petitions. State also  used reseller data to investigate passport and visa fraud cases.
section_title: Agencies Lacked Policies on Use of Reseller Data, and Practices Do Not Consistently Reflect the Fair Information Practices
paragraphs: Agencies generally lacked policies that specifically addressed their  use of personal information from commercial sources (although  DHS Privacy Office officials reported in 2006 that they were drafting  such a policy), and agency practices for handling personal  information acquired from information resellers did not always fully  reflect the Fair Information Practices. Specifically, agency practices  generally reflected four of the eight Fair Information Practices.
As table 2 shows, the collection limitation, data quality, use  limitation, and security safeguards principles were generally  reflected in agency practices. For example, several agency  components (specifically, law enforcement agencies such as the FBI  and the U.S. Secret Service) reported that in practice, they generally  corroborate information obtained from resellers when it is used as  part of an investigation. This practice is consistent with the principle  of data quality.
Agency policies and practices with regard to the other four  principles were uneven. Specifically, agencies did not always have  policies or practices in place to address the purpose specification,  openness, and individual participation principles with respect to  reseller data. The inconsistencies in applying these principles as  well as the lack of specific agency policies can be attributed in part  to ambiguities in OMB guidance regarding the applicability of the  Privacy Act to information obtained from resellers. Further, privacy  impact assessments, a valuable tool that could address important  aspects of the Fair Information Practices, were often not conducted.  Finally, components within each of the four agencies did not  consistently hold staff accountable by monitoring usage of personal  information from information resellers and ensuring that it was  appropriate; thus, their application of the fourth principle,  accountability, was uneven.
Agency procedures generally reflected the collection limitation,  data quality, use limitation, and security safeguards principles.  Regarding collection limitation, for most law-enforcement and  counterterrorism purposes (which accounted for 90 percent of  usage in fiscal year 2005), agencies generally limited their personal  data collection in that they reported obtaining information only on  specific individuals under investigation or associates of those  individuals. Regarding data quality, agencies reported taking steps  to mitigate the risk of inaccurate information reseller data by  corroborating information obtained from resellers. Agency officials  described the practice of corroborating information as a standard  element of conducting investigations. Likewise, for non-law- enforcement use, such as debt collection and fraud detection and  prevention, agency components reported that they mitigated  potential problems with the accuracy of data provided by resellers  by obtaining additional information from other sources when  necessary. As for use limitation, agency officials said their use of  reseller information was limited to distinct purposes that were  generally related to law enforcement or counterterrorism. Finally,  while we did not assess the effectiveness of information security at  any of these agencies, we found that all four had measures in place  intended to safeguard the security of personal information obtained  from resellers.
subsections: section_title: Limitations in the Applicability of the Privacy Act and Ambiguities in OMB Guidance Contributed to an Uneven Adherence to the Purpose Specification, Openness, and Individual Participation Principles
paragraphs: The purpose specification, openness, and individual participation  principles stipulate that individuals should be made aware of the  purpose and intended uses of the personal information being  collected about them, and, if necessary, have the ability to access  and correct their information. These principles are reflected in the  Privacy Act requirement for agencies to publish in the Federal  Register, “upon establishment or revision, a notice of the existence  and character of a system of records.” This notice is to include,  among other things, the categories of records in the system as well  as the categories of sources of records.
In a number of cases, agencies using reseller information did not  adhere to the purpose specification or openness principles in that  they did not notify the public that they were using such information  and did not specify the purpose for their data collections. Agency  officials said that they generally did not prepare system-of-records  notices that would address these principles because they were not  required to do so by the Privacy Act. The act’s vehicle for public  notification—the system-of-records notice—is required of an agency  only when the agency collects, maintains, and retrieves personal  data in the way defined by the act or when a contractor does the  same thing explicitly on behalf of the government. Agencies  generally did not issue system-of-records notices specifically for  their use of information resellers largely because information  reseller databases were not considered “systems of records  operated by or on behalf of a government agency” and thus were not  considered subject to the provisions of the Privacy Act. OMB  guidance on implementing the Privacy Act does not specifically  refer to the use of reseller data or how it should be treated.  According to OMB and other agency officials, information resellers  operate their databases for multiple customers, and federal agency  use of these databases does not amount to the operation of a system  of records on behalf of the government. Further, agency officials  stated that merely querying information reseller databases did not  amount to agency “maintenance” of the personal information being  queried and thus also did not trigger the provisions of the Privacy  Act. In many cases, agency officials considered their use of resellers  to be of this type—essentially “ad hoc” querying or “pinging” of  reseller databases for personal information about specific  individuals, which they believed they were not doing in connection  with a formal system of records.
In other cases, however, agencies maintained information reseller  data in systems for which system-of-records notices had been  previously published. For example, law enforcement agency  officials stated that, to the extent they retain the results of reseller  data queries, this collection and use is covered by the system-of- records notices for their case file systems. However, in preparing  such notices, agencies generally did not specify that they were  obtaining information from resellers. Among system-of-records  notices that were identified by agency officials as applying to the  use of reseller data, only one—TSA’s system-of-records notice for  the test phase of its Secure Flight program—specifically identified  the use of information reseller data.
In several of these cases, agency sources for personal information  were described only in vague terms, such as “private organizations,”  “other public sources,” or “public source material,” when  information was being obtained from information resellers.
The inconsistency with which agencies specify resellers as a source  of information in system-of-records notices is due in part to  ambiguity in OMB guidance, which states that “for systems of  records which contain information obtained from sources other  than the individual to whom the records pertain, the notice should  list the types of sources used.” Although the guidance is unclear as  to what would constitute adequate disclosure of “types of sources,”  OMB and DHS Privacy Office officials agreed that to the extent that  reseller data is subject to the Privacy Act, agencies should  specifically identify information resellers as a source and that  merely citing public records information does not sufficiently  describe the source.
Aside from certain law enforcement exemptions to the Privacy Act,  adherence to the purpose specification and openness principles is  critical to preserving a measure of individual control over the use of  personal information. Without clear guidance from OMB or specific  policies in place, agencies have not consistently reflected these  principles in their collection and use of reseller information. As a  result, without being notified of the existence of an agency’s  information collection activities, individuals have no ability to know  that their personal information could be obtained from commercial  sources and potentially used as a basis, or partial basis, for taking  action that could have consequences for their welfare.
section_title: Privacy Impact Assessments Could Address Openness and Purpose Specification Principles but Often Were Not Conducted
paragraphs: PIAs can be an important tool to help agencies to address openness  and purpose specification principles early in the process of  developing new information systems. To the extent that PIAs are  made publicly available, they provide explanations to the public  about things such as the information that will be collected, why it is  being collected, how it is to be used, and how the system and data  will be maintained and protected.
However, few agency components reported developing PIAs for  their systems or programs that make use of information reseller  data. As with system-of-records notices, agencies often did not  conduct PIAs because officials did not believe they were required.  Current OMB guidance on conducting PIAs is not always clear about  when they should be conducted. According to guidance from OMB,  a PIA is required by the E-Government Act when agencies  “systematically incorporate into existing information systems  databases of information in identifiable form purchased or obtained  from commercial or public sources.” However, the same guidance  also instructs agencies that “merely querying a database on an ad  hoc basis does not trigger the PIA requirement.” Reported uses of  reseller data were generally not described as a “systematic”  incorporation of data into existing information systems; rather, most  involved querying a database and, in some cases, retaining the  results of these queries. OMB officials stated that agencies would  need to make their own judgments on whether retaining the results  of searches of information reseller databases constituted a  “systematic incorporation” of information.
Until PIAs are conducted more thoroughly and consistently, the  public is likely to remain incompletely informed about agency  purposes and uses for obtaining reseller information.
section_title: Agencies Often Did Not Have Practices in Place to Ensure Accountability for Proper Handling of Information Reseller Data
paragraphs: According to the accountability principle, individuals controlling  the collection or use of personal information should be accountable  for ensuring the implementation of the Fair Information Practices.  This means that agencies should take steps to ensure that they use  personal information from information resellers appropriately.
Agencies described using activities to oversee their use of reseller  information that were largely based on trust in the individual user to  use the information appropriately, rather than on management  oversight of usage details. For example, in describing controls  placed on the use of commercial data, officials from component  agencies identified measures such as instructing users that reseller  data are for official use only and requiring users to sign statements  attesting 1) to their need to access information reseller databases  and 2) that their use will be limited to official business. Additionally,  agency officials reported that their users are required to select from  a list of vendor-defined “permissible purposes” (for example, law  enforcement, transactions authorized by the consumer) before  conducting a search on reseller databases.
While these practices appear consistent with the accountability  principle, they are focused on individual user responsibility instead  of monitoring and oversight. Agencies did not have practices in  place to obtain reports from resellers that would allow them to  monitor usage of reseller databases at a detailed level. Although  agencies generally receive usage reports from the information  resellers, these reports are designed primarily for monitoring costs.  Further, these reports generally contained only high-level statistics  on the number of searches and databases accessed, not the contents  of what was actually searched, thus limiting their utility in  monitoring usage.
To the extent that federal agencies do not implement methods such  as user monitoring or auditing of usage records, they provide limited  accountability for their usage of information reseller data and have  limited assurance that the information is being used appropriately.
section_title: Not All Agencies Have Taken Steps to Address our Recommendations
paragraphs: In our report, we recommended that the agencies develop specific  policies for the collection, maintenance, and use of personal  information obtained from resellers. We also recommended that  OMB revise its privacy guidance to clarify the applicability of  requirements for public notices and privacy impact assessments to  agency use of personal information from resellers and direct  agencies to review their uses of such information to ensure it is  explicitly referenced in privacy notices and assessments. The  agencies generally agreed with our findings and described actions  initiated to address our recommendations.
Since the issuance of our 2006 report, two of the four agencies have  taken action to address our recommendation. For example, the DHS  Privacy Office incorporated specific questions in its May 2007 PIA  guidance concerning use of commercial data. The guidance requires  programs that use commercial or publicly available data to explain  why and how such data are used. Further, the guidance for systems  that use or rely on commercial data requires an explanation of how  data accuracy and integrity are preserved and the reliability of the  data assessed with regard to its value to the purpose of the system.  According to DHS Privacy Office officials, after identifying use of  commercial data through the PIA process, the Privacy Office works  with the relevant DHS component to review uses of commercial  data to ensure appropriate controls are in place and that the planned  uses are appropriately disclosed in privacy notices. In addition,  officials at DOJ informed us that the Privacy and Civil Liberties  Office has in place a verbal agreement with agency components that  there are to be no bulk acquisitions of commercial data and that  when the agency takes in data from commercial sources, there  should be a valid system-of-records notice that specifically identifies  commercial data as a source. Further, DOJ has updated several of  its system-of-records notices to reflect their use of data from  information resellers. SSA and State have not yet addressed our  recommendation.
However, OMB has not addressed our recommendations. In an  August 2006 letter to congressional committees in response to the  recommendations contained in our April 2006 report, OMB noted  that work on the protection of personal information through the  Identity Theft Task Force was ongoing and that following the  completion of this work, they would consider issuing appropriate  clarifying guidance concerning reseller data. Since then, OMB’s  efforts on the Identity Theft Task Force have been completed and  on May 22, 2007 OMB issued M-07-16, “Safeguarding Against the  Breach of Personally Identifiable Information.” To date, OMB has  not issued additional clarifying guidance concerning reseller data.
section_title: Privacy Provisions of the Proposed Federal Agency Data Protection Act are Consistent with Our Recommendations
paragraphs: The Federal Agency Data Protection Act was introduced on  December 18, 2007. Among other things, the legislation contains  privacy provisions that would require agencies to conduct PIAs  when “purchasing or subscribing for a fee to information in  identifiable form from a data broker.” We believe that such a  requirement is consistent with the recommendations contained in  our report, particularly given the debate concerning whether or not  agencies “systematically incorporate” information or are “merely  pinging or querying the information.” Our report found that PIAs  could serve to address certain Fair Information Practice principles  such as purpose specification and openness, but often were not  conducted. Such a requirement could more readily ensure agencies  perform these assessments. Further, since OMB has not clarified its  guidance on this issue, a requirement in law could provide needed  direction to agencies.
The proposed Federal Agency Data Protection Act would also  require each agency to prescribe regulations that specify, among  other things, the personnel permitted to access, analyze, or  otherwise use commercial reseller databases. This legislation is  consistent with our recommendation that agencies develop policies  concerning their use of personal information from information  resellers.
In summary, services provided by information resellers are  important to federal agency functions such as law enforcement and  fraud protection and identification. While agencies have taken steps  to adhere to some Fair Information Practices such as the collection  limitation, data quality, use limitation, and security safeguards  principles, they have not taken all the steps they could to reflect  others—or to use the specific processes of the Privacy Act and E- Government Act requirements—in their handling of reseller data.  Because OMB privacy guidance does not clearly address  information reseller data, agencies are left largely on their own to  determine how to satisfy legal requirements and protect privacy  when acquiring and using reseller data. Since we issued our report  in 2006, two of the four agencies have taken steps to address our  recommendations. However, OMB has not modified its guidance.  Without current and specific guidance, the government risks  continued uneven adherence to important, well-established privacy  principles and lacks assurance that the privacy rights of individuals  are being adequately protected. Absent action from OMB to revise  guidance, privacy provisions contained in the proposed Federal  Agency Data Protection Act could clarify the need to conduct  privacy impact assessments wherever reseller data are involved and  promote the development of agency policies and procedures  concerning the use of such data. We believe these provisions are  consistent with the results and recommendations contained in our  2006 report.
Mr. Chairman, this concludes my testimony today. I would be happy  to answer any questions you or other members of the subcommittee  may have.
section_title: Contacts and Acknowledgements
paragraphs: If you have any questions concerning this testimony, please contact  Linda Koontz, Director, Information Management, at (202) 512-6240,  or koontzl@gao.gov. Other individuals who made key contributions  to this testimony were Susan Czachor, John de Ferrari, Nancy  Glover, Rebecca LaPaze, David Plocher, and Jamie Pressman.