Privacy: Congress Should Consider Alternatives for Strengthening Protection of Personally Identifiable Information
Released: 2008-06-18T00:00:00

Letter

Background

In response to growing concern about the harmful consequences that computerized data systems could have on the privacy of personal information, in 1972 the Secretary of Health, Educati on, and Welfare commissioned an advisory committee to examine to what extent limitations should be placed on the application of computer technology to record keeping about people. The committee’s final report proposed a set of principles for pro the privacy and security of personal information, known as the Fair Information Practices. These practices were intended to address what the committee termed a poor level of protection afforded to privacy under then-existing law, and they underlie the major provisions of the Privacy Act, which was enacted the followin g year. A revised version of the Fair Information Practices was developed in 1980 by the Organization for Economic Cooperation and Development (OECD) and has been widely adopted. This version of tecting the principles was reaffirmed by OECD ministers in a 1998 declaration and further endorsed in a 2006 OECD report. The OECD version of the principles is shown in table 1.

The Fair Information Practices are, with some variation, the basis of privacy laws and related policies in many countries, including the United States, Germany, Sweden, Australia, and New Zealand, as well as the European Union. They are also reflected in a variety of federal agency policy statements, beginning with an endorsement of the OECD principles by the Department of Commerce in 1981.

The Fair Information Practices are not legal requirements but provide a framework of principles for balancing the need for privacy with other public policy interests, such as national security, law enforcement, and administrative efficiency. Striking that balance varies among countries and among types of information.

Federal Laws and Guidance Govern Use of Personal Information in Federal Agencies

There is no single federal law that governs all use or disclosure of personal information. Instead, U.S. law includes a number of separate statutes that provide privacy protections for information used for specific purposes or maintained by specific entities. The major requirements for the protection of personal information by federal agencies come from two laws: the Privacy Act of 1974 and the privacy provisions of the E-Government Act of 2002.

The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. It also defines a “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public through a system-of-records notice in the Federal Register that identifies, among other things, the categories of data collected, the categories of individuals about whom information is collected, the intended “routine” uses of data, and procedures that individuals can use to review and correct personally identifiable information.

Several provisions of the act require agencies to define and limit collection and use to predefined purposes. For example, the act requires that, to the greatest extent practicable, personal information should be collected directly from the subject individual when it may affect that individual’s rights or benefits under a federal program. The act also requires that an agency inform individuals whom it asks to supply information of (1) the authority for soliciting the information and whether disclosure of such information is mandatory or voluntary; (2) the principal purposes for which the information is intended to be used; (3) the routine uses that may be made of the information; and (4) the effects on the individual, if any, of not providing the information. According to OMB, this requirement is based on the assumption that individuals should be provided with sufficient information about the request to make a decision about whether to respond.

In handling collected information, agencies are generally required by the Privacy Act to, among other things, allow individuals to (1) review their records (meaning any information pertaining to them that is contained in the system of records), (2) request a copy of their record or information from the system of records, and (3) request corrections to their information.

Agencies are allowed to claim exemptions from some of the provisions of the Privacy Act if the records are used for certain purposes. For example, records compiled by law enforcement agencies for criminal law enforcement purposes can be exempt from a number of provisions, including (1) the requirement to notify individuals of the purposes and uses of the information at the time of collection and (2) the requirement to ensure the accuracy, relevance, timeliness, and completeness of records. A broader category of investigative records compiled for criminal or civil law enforcement purposes can also be exempted from a somewhat smaller number of Privacy Act provisions, including the requirement to provide individuals with access to their records and to inform the public of the categories of sources of records. In general, the exemptions for law enforcement purposes are intended to prevent the disclosure of information collected as part of an ongoing investigation that could impair the investigation or allow those under investigation to change their behavior or take other actions to escape prosecution.

In 2002, Congress enacted the E-Government Act to, among other things, enhance protection for personal information in government information systems or information collections by requiring that agencies conduct privacy impact assessments, which are analyses of how personal information is collected, stored, shared, and managed in a federal system.

In addition, the Paperwork Reduction Act applies to federal information collections and was designed to help ensure that when the government asks the public for information, the burden of providing this information is as small as possible and the information itself is used effectively. Among the act’s provisions is the requirement that agencies not establish information collections without having them approved by OMB, and that before submitting them for approval, agencies’ chief information officers certify that the collections meet 10 specified standards. The law also requires agencies both to publish notices in the Federal Register and to otherwise consult with the public about their planned collections.

Privacy is also addressed in the legal framework for the emerging information sharing environment. As directed by the Intelligence Reform and Terrorism Prevention Act of 2004, the administration has taken steps, beginning in 2005, to establish an information sharing environment to facilitate the sharing of terrorism-related information. The move was driven by the recognition that before the attacks of September 11, 2001, federal agencies had been unable to effectively share information about suspected terrorists and their activities. In addressing this problem, the National Commission on Terrorist Attacks Upon the United States (9/11 Commission) recommended that the sharing and uses of information be guided by a set of practical policy guidelines that would simultaneously empower and constrain officials, closely circumscribing what types of information they would be permitted to share as well as the types of information they would need to protect. Exchanging terrorism- related information continues to be a significant challenge for federal, state, and local governments—one that we recognize is not easily addressed. Accordingly, since January 2005, we have designated information sharing for homeland security a high-risk area.

Other federal laws address privacy protection for personal information with respect to information security requirements, as well as for certain types of information, such as when taxpayer, statistical, or health information is involved. This includes the Federal Information Security Management Act (FISMA), which addresses the protection of personal information by defining federal requirements for securing information and information systems that support federal agency operations and assets; the Health Insurance Portability and Accountability Act of 1996, which addresses the use and disclosure of individual health information; the Confidential Information Protection and Statistical Efficiency Act, which limits the use of information gathered for statistical purposes; and laws governing the disclosure of taxpayer data collected by the Internal Revenue Service.

OMB Has Primary Responsibility for Oversight of the Privacy, E-Government, and Paperwork Reduction Acts

The Privacy Act gives OMB responsibility for developing guidelines and providing “continuing assistance to and oversight of” agencies’ implementation of the Privacy Act. The E-Government Act of 2002 also assigns OMB responsibility for developing privacy impact assessment guidance and ensuring agency implementation of the privacy impact assessment requirement. In July 1975, OMB published guidance for implementing the provisions of the Privacy Act. Since then, OMB has periodically issued additional guidance, including guidance to assist agencies in complying with the Computer Matching and Privacy Protection Act and guidance to agencies on conducting privacy impact assessments.

In 1980, the enactment of the Paperwork Reduction Act made virtually all federal agency information collection activities subject to OMB review and established broad objectives for OMB oversight of the management of federal information resources. The act established the Office of Information and Regulatory Affairs within OMB and gave this office a variety of oversight responsibilities over federal information functions, including general information policy, reduction of paperwork burden, and information privacy. To assist agencies in fulfilling their responsibilities under the act, OMB took various steps. It issued a regulation and provided agencies with instructions on filling out a standard form for submissions and providing supporting statements.

OMB has also periodically issued guidance on other privacy-related issues, including ● federal agency Web site privacy policies; interagency sharing of personal information; ● designation of senior staff responsible for privacy; and ● data breach notification.

Prior GAO Reports Have Id

We have previously reported on a number of agency-specific and governmentwide privacy-related issues at federal agencies. For example, in 2003, we reported that agencies generally did well with certain aspects of the Privacy Act’s requirements—such as issuing systems-of-records notices when required—but did less well at other requirements, such as ensuring that information is complete, accurate, relevant, and timely before it is disclosed to a nonfederal organization. In discussing this uneven compliance, agency official reported the need for additional OMB leadership and guidance to assist in difficult implementation issues in a rapidly changing environment. For example, officials had questions about the act’s applicability to electronic records. We have also reported on key privacy challenges facing federal agencies, federal Web site privac notification of individuals in the event of a data breach, and government data-mining initiatives.

Key Terms in the Privacy Act May Be Defined Too Narrowly

Because the Privacy Act’s controls on the collection, use, and disclosure of personally identifiable information only apply wh en such information is covered by the act’s key terms, especially the “system-of-records” construct, they do not consistently protect suc h information in all circumstances of its collection and use throughout the federal government. There are several different ways in which federal collection and use of personally identifiable information could be outside of such a construct and thus not receive the Privacy Act’s protections, as shown by the following examples: Personally identifiable information held by the government is not always retrieved by identifier. The Privacy Act defines a system of records as “a group of records” that is “under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.” If personally identifiable information (records) is not retrieved by identifier but instead accessed through some other method or criteria—for example, by searching for all individuals who have a certain medical condition or who applied for benefits on a certain date—the system would not meet the Privacy Act’s system-of-records definition and therefore would not be governed by the act’s protections. OMB’s 1975 Privacy Act implementation guidance reflects an acknowledgement that agencies could potentially evade the act’s requirements by organizing personal information in ways that may not be considered to be retrieved by identifier.

In our 2003 report concerning compliance with the Privacy Act, we found that the increasing use of electronic records by federal agencies resulted in personal information falling outside the scope of Privacy Act protections. A key characteristic of agencies’ systems of records at the time was that a large proportion of them were electronic, reflecting the government’s significant use of computers and the Internet to collect and share personal information. Based on survey responses from 25 agencies in 2002, we estimated that 70 percent of the agencies’ systems of records contained electronic records and that 11 percent of information systems in use at those agencies contained personal information that was outside a Privacy Act system of records. We also reported that among the agencies we surveyed, the most frequently cited reason for systems not being considered Privacy Act systems of records was that the agency did not use a personal identifier to retrieve the personal information.● The Privacy Act’s protections may not apply to contemporary data processing technologies and applications. In today’s highly interconnected environment, information can be gathered from many different sources, analyzed, and redistributed in very dy unstructured ways that may have little to do with the file-oriente concept of a Privacy Act system of records. For example, data mining, a prevalent technique used by federal agencies for extracting useful information from large volumes of data, may escape the purview of the Privacy Act’s protections. Speci data-mining system that performs analysis by looking for patter personal information located in other systems of records or that performs subject-based queries across multiple data sources may not constitute a system of records under the act.

In recent years, reports required by law on data mining have described activities that had not been identified as systems of records covered by the Privacy Act. In one example, DHS rep that all the data sources for the planned Analysis Dissemination Visualization Insight and Semantic Enhancement (ADVISE) data mining program were covered by existing system-of-records noti however, the system itself was not covered, and no system of records notice was created specifically to document protections under the Privacy Act governing the specific activities of the system. ADVISE was a data-mining tool intended to allow an analyst to search for patterns in data—such as relationships a people, organizations, and events—and to produce visual representations of those patterns.

As a result, personally identifiable processed by such systems may be less well protected than if it were more specifically addressed by the Privacy Act.

The issues associated with the coverage of the Privacy protections could be addressed by revising the system-of-records definition to cover all personally identifiable information collected, Act’s used, and maintained by the federal government. Experts at o forum were in agreement that the system-of-records definition is outdated and flawed and that the act’s protections should be applied whenever agencies obtain, process, store, or share personally identifiable information—not just when records are retrieved by personal identifier. Changing the system-of-records definition is an option that could help ensure that the act’s protections are consistently applied to all personally identifiable information.

The Privacy Act Does N Information Is Limited to Clearly Stated Purposes

The fair information practices’ purpose specification p states that the purpose for the collection o should be disclosed before the collection is made and upon any change to that purpose, while the use limitation principle provi that personal information, once collected, should not be disclosed or used for other than its specified purpose without consent of th individual or legal authority. When the government is required to define a specific purpose for the collection of personal information and limit its use to that purpose, individuals gain assurance that their privacy will be protected and their information will not be us in ways that could jeopardize their rights or otherwise unfairly affect them.

The Privacy Act requires agencies to (1) inform individuals fromation is being collected of the principal purpose or whom inform purposes for which the information is intended to be used and (2) publish a system-of-records notice in the Federal Register of t existence and character of the system of records, including plann routine uses of the records and the purpose of each of these rou uses. Concerns have been raised, however, that these requirements do not go far enough in ensuring that the government’s planned purposes are sufficiently specified and that the use of information is limited to these purposes: Purpose descriptions in public notices are not required to be specific. While there is no r equirement for an overall statement of purpose, Privacy Act notices may contain multiple descriptions of purposes associated with routine uses, and agencies are not required to be specific in formulating these purposes. OMB guidancon the act gives agencies discretion to determine how to define the range of appropriate uses and associated purposes that it inte a given system of records. While purpose statements for certain law enforcement and anti-terrorism systems might need to be phrased broadly enough so as not to reveal investigative techniques or the details of ongoing cases, very broadly defined purposes could allow for unnecessarily broad ranges of uses, thus calling into question whether meaningful limitations had been imposed.

Unconstrained application of predefined “routine” uses may weaken use limitations. A number of concerns have been raised about the impact on privacy of potentially unnecess for agency systems of records, particularly through the applicat of “standard” routine uses that are developed for general use on multiple systems of records. This practice is not prohibited by the Privacy Act. All six agencies we reviewed had lists of standard routine uses for application to their systems of records. However , the language of these standard routine uses varies from agency to agency. For example, several agencies have a routine use allow them to share information about individuals with other governmental entities for purposes of decision-making about hiring or retention of an individual, issuance of a security clearance, license, contract, grant, or other benefit. Experts expres that “standard” routine uses such as these vary to such a great extent from agency to agency, with no specific legal requireme that they be formulated consistently.

The Privacy Act sets only modest limits on the use of personal information for multiple purposes within an agency. The Privac Act permits disclosures from agency s ystems of records “to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties.” However, without additional limits, internal uses could go beyond uses related to the purpose of the original collection. In our interviews with senior agency privacy officials, we asked what, if any, limits were placed on internal agency uses of information. Several agencies responded that, consistent with the Privacy and OMB guidance, internal agency usage of personal information was limited to those personnel with a “need to know.” However, because the Privacy Act and related guidance do not require it, no ne of these agencies took steps to determine whether internal uses were consistent with the purposes originally stated for the collection of information. The potential that personal information could be used for multiple, unspecified purposes is especially heightened in large agencies with multiple components that may collect personal information in many different ways for disparate purposes.

The Privacy Act’s provisions may not apply when data are shar for use by another agency. In addition to concerns about limiting use to a specified purpose within an agency, more extensive issues have been raised when data are shared outside an agency. Although the Privacy Act provides assurance that the information in systems of records cannot be disclosed unless it is pursuant to either a routine use or another statutorily allowed condition, the act does not attach its protections to data after they have been disclosed. As data sharing among agencies becomes central to the sharing of terrorism-related information, measures to ensure that data are being used appropriately will become more important. Despite not being required to do so, agencies we reviewed reported taking measures to ensure the data are used appropriately by recipients However, in the absence of such measures, data shared outside federal agencies would not always have sufficient protections. .

To better confine agencies’ use of personal information to its specified purposes, laws or guidance could be revised to (1) requ agencies to justify the use of key elements of personal informat (2) set specific limits on routine uses and internal agency uses of personal information, and (3) require agencies to establish formal agreements with external entities before sharing personal information with them.

The Privacy Act May Not Include Effective Mechanisms for Informing the Public

A primary method for providing transparency about gov programs and systems that collect and use personal information is through public written notices. A clear and effective notice can provide individuals with critical information about what personal data are to be collected, how they are to be used, and the circumstances under which they may be shared. An effective not ice can also provide individuals with information they need to determine whether to provide their personal information (if voluntary), or who to contact to correct any errors that could result in an adverse determination about them.

In formal terms, the openness principle states that the public should be informed about privacy policies and pr individuals should have a ready means of learning about the use of personal information. The openness principle underlies the public notice provisions of the Privacy Act. Specifically, the Priva requires agencies to publish in the Federal Register, “upon establishment or revision, a notice of the existence and character o , a system of records.” This notice is to include, among other things the categories of records in the system as well as the catego ries of sources of records. The notice is also required to explain agency procedures whereby an individual can gain access to any record pertaining to him or her contained in the system of records and contest its content. Agencies are further required to publish notic of any new use or intended use of the information in the system a provide an opportunity for interested persons to submit written data, views, or arguments to the agency.

However, experts at our forum as well as agency privacy officials notices as vehicles for questioned the value of system-of-records providing information to the general public for several reasons: System-of-records notices may be difficult to understand. As wit other legally required privacy notices, system-of-records notices have been criticized as hard to read and understand. To the lay reader, the meaning of “routine” uses may be unclear, or a list of exemptions could raise more questions than it answers. Agency privacy officials and privacy experts at our forum both agreed th system-of-records notices have limited value as vehicles for publi notification.

System-of-records notices do not always contain complete and useful information about privacy protections. They often describe purposes and use in such broad terms that it becomes questionable whether those purposes and uses have been significantly limited. Likewise, broad purpose statements may not usefully inform the public of the government’s intended purposes, and the citation of multiple routine uses does little to aid individuals’ understanding of how the government is using their personal information. The Privacy Act does not require agencies to be specific in describing the purposes associated with routine uses of personal informationor to publish all expected internal agency uses of that information.

Publication in the Federal Register may reach only a limited audience. Agency privacy officials questioned whether the required publication of system-of-records notices in the Federal Register would be useful to a broader audience than federal agency officials and public interest groups, such as privacy advocacy groups. Notices published in the Federal Register may not be very accessible and readable. The Federal Register Web site does not provide a ready means of determining what system-of-records notices are current, when they were last updated, or which ones apply to any specific governmental function. Officials agreed that it can be difficult to locate a system-of-records notice on the Federal Register Web site, even when the name of the relevant system of records is known in advance. Privacy experts at our forum likewise agreed that the Federal Register is probably not effective with the general public and that a more effective technique for reaching a wide audience in today’s environment is via consolidated publication on a governmentwide Web site devoted to privacy. Both agency officials and privacy experts also agreed, however, that the Federal Register serves a separate but important role as the official public record of federal agencies and as the official basis for soliciting comments from the public on proposed systems of records.

Based on discussions with privacy experts, agency officials, and analysis of laws and related guidance, a number of options ex improving public notice regarding federal collection and use of personal information: Require layered public notices in conjunction with system-of- records notices. Layering involves providing only the most important summary facts up front—often in a graphically orient format—followed by on e or more lengthier, more narrative versions.

By offering both types of notices, the benefits of each can be realized: long notices offer completeness, while brief notice ease of understanding.

Set requirements to ensure that purpose, collection limitations, and use limitations are better addressed in the content of pr ivacy notices. These could include requirements for a specific descriptionof the planned purpose of a system, what data needs to be collected to serve that purpose, and how its use will be limited to that purpose, including descriptions of primary and secondary uses of information. Setting these requirements could spur agencies to prepare notices that include more meaningful descriptions of the intents and purposes of their systems of records.

Make all notices available on a governmentwide privacy Web site Relevant privacy notices could be published at a central governmentwide location, with an address such as www.privacy.gov, and at corresponding standard agency Web sites with addresses of the form www.agency.gov/privacy. These sites have the potential t ster. far broader spectrum of users than the Federal Regi .

Amending Privacy Law Privacy Protections

In summary, current laws and guidance governing the federal government’s collection, use, and disclosure of personal informatio have gaps and other potential shortcomings in three broad categories: (1) the Privacy Act and E-Government Act do not always provide protections for federal uses of personal information, (2) laws and guidance may not effectively limit agency collection ) the and use of personal information to specific purposes, and (3 Privacy Act may not include effective mechanisms for informing the public.

In assessing the appropriate balance between the needs of the federal government to collect personally identifiable information for programmatic purposes and the assurances that individuals should have that their information is being sufficiently protected and properly used, Congress should consider amending applicable laws, such as the Privacy Act and the E-Government Act, according to the alternatives outlined in our report, including revising the scope of the laws to cover all personally identifiable information collected, used, and maintained by the federal government; ● setting requirements to ensure that the collection and use of personally identifiable information is limited to a stated pur and ● establishing additional mechanisms for informing the public a privacy protections by revising requirements for the structure and publication of public notices.

In commenting on a draft of our report, OMB officials noted that they shared our concerns about privacy and stated they believe it would be important for Congress to consider potential amendments to the Privacy Act and the E-Government Act in the broader context of all existing privacy and related laws that Congress has enacted.

Though we did not make specific recommendations to OMB, the agency provided comments on the alternatives identified in conjunction with our matter for Congressional consideration. Regarding alternatives for revising the scope of laws to cover all personally identifiable information collected, used, and main by the federal government, OMB stated that it would be import for Congress to evaluate fully the potential implications of revisio ns such as amending the Privacy Act’s system-of-records definition. Webelieve that, given that the Privacy Act’s controls on the collection, use, and disclosure of personally identifiable information do not consistently protect such information in all circumstances of its collection and use throughout the federal government, amending theact’s definition of a system of records is an important alternative for Congress to consider.

We agree with OMB, however, that any consideration of amendments to the Privacy Act and E-Government Act should be considered thoroughly and within the context of all existing laws. Further, the challenge of how best to balance the federal ’ government’s need to collect and use information with individuals privacy rights in the current technological and political environmen t merits a national public debate on all relevant issues, inclu alternatives I have highlighted today.

Mr. Chairman, this concludes my testimony today. I would be happy to answer any questions you or other members of the committee may have.

Contacts and Acknowledgements

If you have any questions concerning this testimony, please contact Linda D. Koontz, Director, Information Management, at (202) 512-6240, or KoontzL@gao.gov. Other individuals who made key contributions include John de Ferrari (Assistant Director), Susan Czachor, Nancy Glover, Lee McCracken, David Plocher, and Jamie Pressman.