In recent years, a number of factors have led to growing concern about the protection of privacy when personally identifiable information is collected and maintained by the federal government. Recent data breaches of personal information at government agencies, such as the data breach at the Department of Veterans Affairs, which exposed the personal information of 26.5 million veterans and active duty members of the military in May 2006, have raised concerns about identity theft. In addition, increasingly sophisticated analytical techniques employed by federal agencies, such as data mining, also raise concerns about how personally identifiable information is used and what controls are placed on its use. Concerns such as these have focused attention on the structures agencies have instituted to ensure privacy protections are in place. The major requirements for privacy protection by federal agencies come from two laws, the Privacy Act of 1974 and the E-Gov Act of 2002. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. It also defines “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires that when agencies maintain a system of records, they must notify the public by a system-of-records notice: that is, a notice in the Federal Register identifying, among other things, the type of data collected, the types of individuals about whom information is collected, the intended “routine” use of the data, and procedures that individuals can use to review and correct personal information. The act also requires agencies to define and limit their use of covered personal information. In addition, the act requires that to the greatest extent practicable, personal information should be collected directly from the subject individual when it may affect an individual’s rights or benefits under a federal program. The E-Gov Act of 2002 also assigns agencies significant responsibilities relating to privacy. The E-Gov Act strives to enhance protection for personal information in government information systems or information collections by requiring that agencies conduct PIAs. A PIA is an analysis of how personal information is collected, stored, shared, and managed in a federal system. Furthermore, according to OMB guidance, a PIA is an analysis of how information is handled. Specifically, a PIA is to (1) ensure that handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (2) determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (3) examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. Agencies must conduct PIAs (1) before developing or procuring information technology that collects, maintains, or disseminates information that is in a personally identifiable form or (2) before initiating any new data collections involving personal information that will be collected, maintained, or disseminated using information technology if the same questions are asked of 10 or more people. To the extent that PIAs are made publicly available, they provide explanations to the public about such things as the information that will be collected, why it is being collected, how it is to be used, and how the system and data will be maintained and protected. OMB is tasked with providing guidance to agencies on how to implement the provisions of these two acts and has done so, beginning with guidance on the Privacy Act, issued in 1975. The guidance provides explanations for the various provisions of the law as well as detailed instructions on how to comply. OMB’s guidance on implementing the privacy provisions of the E- Gov Act of 2002 identifies circumstances under which agencies must conduct PIAs and explains how to conduct them. We have previously reported on the role of senior privacy officials in the federal government. In 2006, we testified that the elevation of privacy officers to senior positions reflected the growing demands that these individuals faced in addressing privacy challenges on a day-to-day basis. The challenges we identified included ensuring compliance with relevant privacy laws, such as the Privacy Act and the E-Gov Act, and controlling the collection and use of personal information obtained from commercial sources. Additionally, in 2007 we reported that the DHS Privacy Office had made significant progress in carrying out its statutory responsibilities under the Homeland Security Act and its related role in ensuring E-Gov Act compliance, but noted that more work remained to be accomplished. We recommended that DHS designate privacy officers at key DHS components, implement a department wide process for reviewing Privacy Act notices, establish a schedule for the timely issuance of privacy reports, and ensure that the Privacy Office’s annual reports to Congress contain a specific discussion of complaints of privacy violations. In response, DHS included a discussion of privacy complaints in its most recent annual report; however, the other recommendations have not yet been implemented. Laws and guidance set a variety of requirements for senior privacy officials at federal agencies. For example, agencies have had a long standing requirement under the Paperwork Reduction Act to assign agency CIOs overall responsibility for privacy policy and compliance with the Privacy Act. In recent years, additional laws have been enacted that also address the roles and responsibilities of senior officials with regard to privacy. Despite much variation, all of these laws require agencies to assign overall responsibility for privacy protection and compliance to a senior agency official. In addition, OMB guidance has directed agencies to designate senior officials with overall responsibility for privacy. These laws and guidance set specific privacy responsibilities for these agency officials. These responsibilities can be grouped into six broad categories: (1) conducting PIAs; (2) Privacy Act compliance; (3) reviewing and evaluating the privacy implications of agency policies, regulations, and initiatives; (4) producing reports on the status of privacy protections; (5) ensuring that redress procedures are in place; and (6) ensuring that employees and contractors receive appropriate training. The laws and guidance vary in how they frame requirements in these categories and which agencies must adhere to them. Numerous laws assign privacy responsibility to senior agency officials. The earliest of these laws is the Paperwork Reduction Act of 1980, which, as amended, directs agency heads to assign a CIO with responsibility for carrying out the agency’s information resources management activities to improve agency productivity, efficiency, and effectiveness. The act directs agency CIOs to undertake responsibility for implementing and enforcing applicable privacy policies, procedures, standards, and guidelines, and to assume responsibility and accountability for compliance with and coordinated management of the Privacy Act of 1974 and related information management laws. As concerns about privacy have increased in recent years, Congress has enacted additional laws that include provisions addressing the roles and responsibilities of senior officials with regard to privacy. Despite variations, a common thread among these laws, as well as relevant OMB guidance, is that they all require agencies to assign overall responsibility for privacy protection and compliance to a senior agency official. Relevant laws include the following: The Homeland Security Act of 2002 directed the secretary of DHS to designate a senior official with primary responsibility for privacy policy. The Intelligence Reform and Terrorism Prevention Act of 2004 required the Director of National Intelligence to appoint a Civil Liberties Protection Officer and assigned this individual specific privacy responsibilities. The Violence Against Women and Department of Justice Reauthorization Act of 2005 instructed the Attorney General to designate a senior official with primary responsibility for privacy policy. The Transportation, Treasury, Independent Agencies and General Government Appropriations Act of 2005 directed each agency whose appropriations were provided by the act, including the Departments of Transportation and Treasury, to designate a CPO with primary responsibility for privacy and data protection policy. The Implementing Recommendations of the 9/11 Commission Act of 2007 instructed the heads of Defense, DHS, Justice, Treasury, Health and Human Services, and State, as well as the Office of the Director of National Intelligence and the Central Intelligence Agency to designate no less than one senior officer to serve as a privacy and civil liberties officer. Specific privacy provisions of these laws are summarized in appendix II. A number of OMB memorandums have also addressed the roles and responsibilities of senior privacy officials. In 1999, OMB required agencies to designate a senior official to assume primary responsibility for privacy policy. OMB later reiterated this requirement in its guidance on compliance with the E-Gov Act, in which it directed agency heads to designate an appropriate senior official with responsibility for the coordination and implementation of OMB Web and privacy policy and to serve as the agency’s principal contact for privacy policies. Most recently, in 2005, OMB directed agencies to designate an SAOP with agency wide responsibility for information privacy issues and with responsibility for specific privacy functions, including ensuring agency compliance with all federal privacy laws, playing a central policy-making role in the development of policy proposals that implicate privacy issues, and ensuring that contractors and employees are provided with adequate privacy training. Beginning in 2005, OMB has also issued guidance significantly enhancing longstanding requirements for agencies to report on their compliance with privacy laws. OMB’s 2005 guidance directed agencies to add a new section addressing privacy to their annual reports under the Federal Information Security Management Act (FISMA). SAOPs were assigned responsibility for completion of this section, in which they were to report on such things as agency policies and procedures for the conduct of PIAs, agency policies for ensuring adequate privacy training, as well as their own involvement in agency regulatory and policy decisions. In 2006, OMB issued further guidance requiring agencies to include as part of their FISMA reports a section addressing measures for protecting personally identifiable information. This guidance also required that agencies provide OMB with quarterly privacy updates and report all incidents relating to the loss of or unauthorized access to personally identifiable information. Most recently, OMB directed agencies in 2007 to include in their FISMA reports additional items, such as their breach notification policies, plans to eliminate unnecessary use of Social Security numbers, and plans for reviewing and reducing their holdings of personally identifiable information. These laws and guidance set a variety of requirements for senior officials to carry out specific privacy responsibilities. These responsibilities can be grouped into the following six key functions: Conduct of PIAs: A PIA is an analysis of how personal information is collected, stored, shared, and managed in a federal system, and is required before developing or procuring information technology that collects, maintains, or disseminates information that is in a personally identifiable form. Several laws assign privacy officials at covered agencies responsibilities that are met in part by performing PIAs on systems that collect, process, or store personally identifiable information. This includes the requirements for several agencies to ensure that “technologies sustain and do not erode privacy protections.” Furthermore, OMB guidance requires agency SAOPs to ensure compliance with federal laws, regulations, and policies relating to information privacy, such as the E-Gov Act, which spells out agency PIA requirements. Privacy Act compliance: As previously discussed, the Privacy Act sets a variety of requirements for all federal agencies regarding privacy protection. For example, the act requires that when agencies establish or make changes to a system of records, they must notify the public by a notice in the Federal Register , identifying, among other things, the type of data collected, the types of individuals about whom information is collected, the intended “routine” use of the data, and procedures that individuals can use to review and correct personal information. Several other laws explicitly direct agency privacy officials to ensure that the personal information contained in their Privacy Act systems of records is handled in compliance with fair information practices as set out in the act. Further, OMB guidance assigns agency SAOPs with responsibility for ensuring Privacy Act compliance. Policy consultation: Relevant laws direct senior privacy officials to actively participate in the development and evaluation of privacy-sensitive agency policy decisions. Several specifically task the SAOP with evaluating legislative and regulatory proposals or periodically reviewing agency actions affecting privacy. As agencies develop new policies, senior officials responsible for privacy issues play a key role in identifying and mitigating potential privacy risks prior to finalizing a particular policy decision. Moreover, OMB directed agency SAOPs to undertake a central role in the development of policy proposals that implicate privacy issues. Privacy reporting: Agency senior privacy officials are often required to prepare periodic reports to ensure transparency about their activities and compliance with the law. Many laws reviewed required agencies to produce periodic privacy reports to agency stakeholders and Congress. OMB also requires agency SAOPs to report on their privacy activities as part of their annual FISMA reports, including such measures as their total numbers of systems of records, the number of written privacy complaints they have received, and whether a senior official has responsibility for all privacy-related activities. Redress: With regard to federal agencies, the term “redress” generally refers to an agency’s complaint resolution process, whereby individuals may seek resolution of their concerns about an agency action. Specifically, in the privacy context, redress refers to processes for handling privacy inquiries and complaints as well as for allowing citizens who believe that agencies are storing and using incorrect information about them to gain access to and correct that information. The Privacy Act requires that all agencies, with certain exceptions, allow individuals access to their records and the ability to have inaccurate information corrected. Several recent laws also direct senior privacy officials at specific agencies to provide redress by ensuring that they have adequate procedures for investigating and addressing privacy complaints by individuals. Several laws also provide for attention to privacy in a broader context of civil liberties protection. Privacy training: Privacy training is critical to ensuring that agency employees and contractor personnel follow appropriate procedures and take proper precautions when handling personally identifiable information. For example, The Transportation, Treasury, Independent Agencies and General Appropriations Act of 2005 requires senior privacy officials at covered agencies to ensure that employees have adequate privacy training. OMB also requires agency SAOPs to ensure that employees and contractors receive privacy training. In addition to performing key privacy functions, requirements in laws include responsibilities to ensure adequate security safeguards to protect against unauthorized access, use, disclosure, and destruction of sensitive personal information. Generally, this is provided through agency information security programs established under FISMA, and overseen by agency CIOs and chief information security officers (CISO). Moreover, OMB has issued guidance instructing agency heads to establish appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records. Figure 1 shows the extent to which laws have requirements that specifically address each privacy function and to which agencies these requirements apply. Agencies have varying organizational structures to address privacy responsibilities. For example, of the 12 agencies we reviewed, 2 had statutorily designated CPOs who also served as SAOPs, 5 designated their agency CIOs as their senior officials, and the others designated a variety of other officials, such as the general counsel or assistant secretary for management. Further, not all of the agencies we reviewed had given their designated senior officials full oversight over all privacy-related functions. While 6 agencies had these officials overseeing all key privacy functions, 6 others relied on other organizational units not overseen by the designated senior official to perform certain key privacy functions. The fragmented way in which privacy functions have been assigned to organizational units in these agencies is at least partly the result of evolving requirements in law and guidance. As requirements have evolved, organizational responsibilities have been established incrementally to meet them. However, without oversight and involvement in all key privacy functions, SAOPs may be unable to effectively serve as agency central focal points for privacy. Agencies have taken varied approaches to designating senior agency officials with privacy responsibilities. Two of the 12 agencies we reviewed had separate CPOs that were also designated as the senior officials for privacy. Five agencies assigned their agency CIOs as SAOPs, and 1 agency assigned its CISO. Lastly, 4 agencies assigned another high-level official, such as a general counsel or assistant secretary for management, as the SAOP. In addition to varying in how they designated senior officials for privacy, agencies also varied in the way they assigned privacy responsibilities to organizational units. Four of the 12 agencies we reviewed (Transportation, DHS, State, and U.S. Agency for International Development) had one organization primarily responsible for all of the six key privacy functions outlined in the previous section. The remaining 8 agencies (Social Security Administration, Veterans Affairs, Defense, Commerce, Labor, Justice, Treasury, and Health and Human Services) relied on more than one organizational unit to perform privacy functions. Figure 2 summarizes the organizational structures in place at agencies to address the six key privacy functions, including the specific organizational units responsible for carrying out each of the key privacy functions. Six of the agencies (DHS, State, Social Security Administration, Transportation, U.S. Agency for International Development, and Veterans Affairs) established privacy structures in which the SAOP oversaw all key privacy functions. For example, DHS’s Privacy Office performed these functions under the direction of the CPO, who was also the department’s SAOP. Similarly, U.S. Agency for International Development’s CISO (also the SAOP) oversaw the agency’s privacy office, which was responsible for all key functions. While more than one organizational unit carried out privacy functions in two cases (Veterans Affairs and the Social Security Administration), all such units were overseen by the senior agency official for privacy. However, six other agencies (Commerce, Health and Human Services, Labor, Transportation, Defense, and Treasury) had privacy management structures in which the SAOP did not oversee all key privacy functions. For two agencies—Justice and Treasury—the SAOP had oversight over all key functions except for redress, which was handled by individual component organizations. For the other four agencies, key functions were divided among two or more organizations, and the senior privacy official did not have oversight of all of them. For example, key privacy functions at Labor were being performed not only by the office of the CIO (who is also the SAOP) but also by the Office of the Solicitor, who is independent of the CIO. Likewise, the senior official at Commerce was responsible for overseeing conduct of PIAs, policy consultation, and privacy training, while a separate Privacy Act Officer was responsible for Privacy Act compliance. Without full oversight of key privacy functions, SAOPs may be limited in their ability to ensure that privacy protections are administered consistently across the organization. The fragmented way in which privacy functions have been assigned to organizational units in several agencies is at least partly the result of evolving requirements in law and guidance. As requirements have evolved, organizational responsibilities have been established incrementally to meet them. For example, although the Privacy Act does not specify organizational structures for carrying out its provisions, many agencies established Privacy Act officers to address the requirements of that act and have had such positions in place for many years. In some cases, agencies designated their general counsels to be in charge of ensuring that the Privacy Act’s requirements were met. More recently, the responsibility to conduct PIAs under the E-Gov Act frequently has been given to another office, such as the Office of the CIO, because the E-Gov Act’s requirements apply to information technology, which is generally the purview of the CIO. If an SAOP was designated in such agencies without reassigning these responsibilities, that official may not have oversight and involvement in all key privacy activities. Uneven implementation of the Paperwork Reduction Act also may have contributed to fragmentation of privacy functions. As previously discussed, the Paperwork Reduction Act requires agency CIOs to take responsibility for privacy policy and compliance with the Privacy Act, and thus agencies could ensure they are in compliance with the Paperwork Reduction Act by designating their CIOs as SAOPs. However, 7 out of the 12 agencies we reviewed did not designate their CIOs as SAOPs. Further, if CIOs were designated as agency SAOPs but did not have responsibility for compliance with the Privacy Act—as was the case at Commerce, Labor, and Health and Human Services—the SAOPs would be left without full oversight of key privacy functions. Agencies that have more than one internal organization carrying out privacy functions run the risk that those organizations may not always provide the same protections for personal information if they are not overseen by a central authority. Thus, unless steps are taken to ensure that key privacy functions are under the oversight of the SAOP, agencies may be limited in their ability to ensure that information privacy protections are implemented consistently across their organizations. While agencies have had the responsibility for many years to establish management structures to ensure coordinated implementation of privacy policy and compliance with the Privacy Act, recent laws and guidance have significantly changed requirements for privacy oversight and management. These laws and guidance vary in scope and specificity, but they all require the designation of a senior agency official with overall responsibility for privacy protection and compliance with statutory requirements. In adopting varied assignments for key privacy functions, not all agencies gave their SAOPs responsibility for all key privacy functions. As a result, agencies may not be implementing privacy protections consistently. While the particulars of privacy management may vary according to the size of the agency and the sensitivity of its mission, agencies generally would likely benefit from having SAOPs that serve as central focal points for privacy matters and have oversight of all key functions, as required by law and guidance. Such focal points can help ensure that agency activities provide consistent privacy protections. In order to ensure that their SAOPs function effectively as central focal points for privacy management, we recommend that the Attorney General and the Secretaries of Commerce, Defense, Health and Human Services, Labor, and Treasury take steps to ensure that their SAOPs have oversight over all key privacy functions. We provided a draft of this report to OMB and to the departments and agencies we reviewed: the Departments of Commerce, Defense, Health and Human Services, Homeland Security, Justice, Labor, State, Treasury, Transportation, and Veterans Affairs, as well as the Social Security Administration and the U.S. Agency for International Development, for review and comment. Five agencies provided no comments on this draft. In comments provided via email, the Associate Deputy Assistant Secretary for Privacy and Records Management at Veterans Affairs and the Audit Management Liaison at the Social Security Administration concurred with our assessment and recommendations and provided technical comments, which we incorporated in the final report as appropriate. In oral comments, the Acting Branch Chief of the Information Policy and Technology Branch at OMB also concurred with our assessment and recommendations and provided technical comments, which we incorporated in the final report as appropriate. Commerce and Defense provided written comments that did not state whether they agreed or disagreed with our recommendations; however, both agencies stated that their privacy management structures were adequate. Their comments are reprinted in appendixes II and III respectively. Justice, Labor, and Treasury provided written comments and disagreed with our characterization of their agency SAOPs as not having oversight of all key privacy functions. Their comments are reprinted in appendixes IV, V, and VI respectively. The Chief Information Officer of the Department of Commerce stated that the department agreed with our characterization of the fragmentation that has resulted from recent laws and guidance that have significantly changed requirements for privacy oversight and management. However, she stated that applicable law does not require that the administration of the Privacy Act be consolidated with other privacy functions under the Office of the Chief Information Officer. Law and OMB guidance direct agencies to have a senior agency official, the CIO in the case of the Paperwork Reduction Act, serving as a focal point for privacy and ensuring compliance with the Privacy Act. Clearly establishing a senior official as a focal point for departmental privacy functions aligns with direction provided by law and OMB and would help ensure that the agency provides consistent privacy protections. The Senior Agency Official for Privacy at the Department of Defense stated that, while privacy responsibilities are divided among the Defense Privacy Office, the CIO, and agency components, the current privacy management structure at Defense has proven to be successful over time. We did not assess the effectiveness of the privacy management structures we reviewed. However, establishing an agency official that serves as a central focal point for departmental privacy functions aligns with direction provided by law and OMB and would help ensure that the agency provides consistent privacy protections. The Acting Chief Privacy and Civil Liberties Officer at Justice disagreed with our assessment that the department’s SAOP did not have oversight of redress procedures. He stated that the Chief Privacy and Civil Liberties Officer has statutory authority under the Violence Against Women and Department of Justice Reauthorization Act to assume primary responsibility for privacy policy and to ensure appropriate notifications regarding the department’s privacy policies and privacy-related inquiry and complaint procedures. We agree that the Chief Privacy and Civil Liberties officer has the statutory authority and responsibility for the oversight of privacy functions at Justice, including redress. However, our analysis of agency policies and procedures showed that the Chief Privacy and Civil Liberties Officer did not have an established role in oversight of redress procedures. Clearly defining the role of the Chief Privacy and Civil Liberties Officer in the departmental redress procedures would help ensure that the SAOP has oversight of this key privacy function. In its comments, the department noted that the Office of Privacy and Civil Liberties was undertaking a review of its orders and guidance to clarify and, as appropriate, strengthen existing authorities to ensure that the department implements thoroughly the Chief Privacy and Civil Liberties Officer authorities. The Chief Information Officer at Labor disagreed with our assessment that the SAOP did not have full oversight of all key privacy functions. He stated that Privacy Act compliance, redress, and training were addressed jointly by his office and the Office of the Solicitor. However, our review of Labor’s policies and procedures relating to privacy management showed that a joint oversight management structure had not been established. Rather, we found that while the CIO was responsible for three key privacy functions, the Office of the Solicitor was responsible for the remaining three functions. Clearly defining the role of the SAOP in Privacy Act compliance, redress, and training would help ensure that the SAOP has oversight of all key privacy functions. The Assistant Secretary for Management at Treasury agreed that the SAOP should have overall responsibility for privacy protection and compliance with statutory requirements and that agencies generally would likely benefit from having SAOPs that serve as central focal points for privacy matters and have oversight of all key functions. The Assistant Secretary noted that as of March 2008, the department had implemented a new privacy management structure to emphasize the importance of protecting privacy at its highest levels. However, Treasury disagreed with a statement in our draft report that it had realigned its organization in order to ensure that the SAOP had oversight of privacy functions. We recognize that privacy functions, with the exception of redress, were under the oversight of the SAOP prior to the reorganization and accordingly have deleted this statement from the final report. Treasury also disagreed that its SAOP did not have full oversight of agency redress processes, stating that the department has longstanding regulations that provide departmentwide and bureau-specific policies and procedures relating to redress. While we agree that such redress policies are in place, they do not establish a role for the SAOP. Clearly defining the role of the SAOP in the departmental redress procedures would help ensure that the SAOP has oversight of this key privacy function. Lastly, Treasury stated it submits quarterly reports to Congress on privacy complaint and redress activities. We agree that reporting is an important privacy function; however, it is separate from redress and does not constitute oversight of Treasury redress activities. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Attorney General; the Secretaries of Commerce, Defense, Health and Human Services, Homeland Security, State, Treasury, Labor, Transportation, and Veterans Affairs; the Commissioner of the Social Security Administration; and the Administrator of the U.S. Agency for International Development as well as other interested congressional committees. Copies will be made available at no charge on our Web site, www.gao.gov. If you have any questions concerning this report, please call me at (202) 512-6240 or send e-mail to koontzl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III. Our objectives were to (1) describe laws and guidance that set requirements for senior privacy officials within federal agencies, and (2) describe the organizational structures used by agencies to address privacy requirements and assess whether senior officials have oversight over key functions. We did not evaluate agency compliance with these laws and guidance. To address our first objective, we reviewed and analyzed relevant laws and guidance to determine privacy responsibilities for privacy officials at agencies. We reviewed relevant laws, including the Implementing Recommendations of the 9/11 Commission Act of 2007, the Homeland Security Act of 2002, and others (see app. II for a full listing), which designate senior privacy officials and assign them privacy responsibilities. We also analyzed the Paperwork Reduction Act, which has long-standing privacy requirements assigned to agency chief information officers (CIO), and the Office of Management and Budget (OMB) guidance relating to the designation of senior agency officials with privacy responsibilities, such as Memorandum M-05-08. We also analyzed the specific privacy responsibilities identified in these laws and guidance and categorized the key privacy functions they represented. To address our second objective, we identified 12 agencies (Departments of Commerce, Defense, Health and Human Services, Homeland Security, Justice, Labor, State, Treasury, Transportation, and Veterans Affairs; the Social Security Administration, and the U.S. Agency for International Development) that either have a statutorily designated privacy officer, have a central mission for which privacy protection is a critical component, or have implemented a unique organizational privacy structure. We analyzed policies and procedures at these agencies, and interviewed senior agency privacy officials to identify the privacy management structures used at each of these agencies and the roles and responsibilities of senior privacy officials. We also compared the varying management structures at these agencies to identify the differences and similarities across agencies in their implementation of these structures. Further, we analyzed agency management structures to determine whether senior privacy officials at each of these agencies had full oversight over all key functions. We conducted our work from September 2007 to May 2008, in Washington, D.C., in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The following are recent laws and their major provisions regarding privacy protection responsibilities at federal agencies. Section 222 of the Homeland Security Act of 2002, as amended, instructed the secretary of DHS to appoint a senior official with primary responsibility for privacy policy, including the following: ensuring that technologies sustain, and do not erode, privacy protections; ensuring that personal information contained in Privacy Act systems of records is handled in full compliance with fair information practices as set out in the act; evaluating legislative and regulatory proposals and conducting privacy impact assessments of proposed rules; coordinating functions with the Officer for Civil Rights and Civil Liberties; preparing an annual report to Congress (without prior comment or amendment by agency heads or OMB); and having authority to investigate and having access to privacy-related records, including through subpoena in certain circumstances. Section 1011 of this act required the Director of National Intelligence to appoint a Civil Liberties Protection Officer and gave this officer the following functions: ensuring that the protection of civil liberties and privacy is appropriately incorporated into the policies and procedures of the Office of the Director of National Intelligence and the elements of the intelligence community within the National Intelligence Program; overseeing compliance by the Office of the Director of National Intelligence with all laws, regulations, and guidelines relating to civil liberties and privacy; reviewing complaints about abuses of civil liberties and privacy in Office of the Director of National Intelligence programs and operations; ensuring that technologies sustain, and do not erode, privacy protections; ensuring that personal information contained in a system of records subject to the Privacy Act is handled in full compliance with fair information practices as set out in that act; conducting privacy impact assessments when appropriate or as required performing such other duties as may be prescribed by the Director of National Intelligence or specified by law. Section 1174 of the Violence Against Women and Department of Justice Reauthorization Act of 2005 instructed the Attorney General to designate a senior official to assume primary responsibility for privacy policy, which included responsibility for advising the Attorney General in the following areas: appropriate privacy protections for the department’s existing or proposed information technology and systems; privacy implications of legislative and regulatory proposals; implementation of policies and procedures, including training and auditing, to ensure compliance with privacy-related laws and policies; that adequate resources and staff are devoted to meeting the department’s privacy-related functions and obligations; appropriate notifications regarding privacy policies and inquiry and complaint procedures; and privacy-related reports from the department to Congress and the President, including an annual report to Congress on activities affecting privacy. Section 522 of this act directed each agency with appropriations provided by the act to designate a chief privacy officer with primary responsibility for privacy and data protection policy, including ensuring that technology sustains, and does not erode, privacy and that technology used to collect or process personal information allows for continuous auditing of compliance with stated privacy policies and practices; ensuring that personal information contained in Privacy Act systems of records is handled in full compliance with fair information practices as defined in the Privacy Act; evaluating legislative and regulatory proposals and conducting privacy impact assessments of proposed rules; preparing an annual report to Congress on activities affecting privacy; ensuring the protection of personal information and information systems from unauthorized access, use, disclosure, or destruction, providing employees with privacy training; and ensuring compliance with privacy and data protection policies. This law amended the National Intelligence Reform Act of 2004 to require the heads of covered agencies to designate no less than one senior officer to serve as a privacy and civil liberties officer. This act applies to the Departments of Defense, Homeland Security, Justice, Treasury, Health and Human Services, and State, as well as the Office of the Director of National Intelligence, and the Central Intelligence Agency. The act requires the senior privacy official to perform the following functions: assisting the agency head in considering privacy and civil liberties issues with regard to anti-terrorism efforts; investigating and reviewing agency actions to ensure adequate consideration of privacy and civil liberties; ensuring that the agency has adequate redress procedures, considering privacy and civil liberties when deciding to retain or enhance coordinating activities, when relevant, with the agency Inspector General; preparing periodic reports, not less than quarterly, to the agency head, Congress, and the Privacy and Civil Liberties Oversight Board. Agencies covered under this act are also required to establish a direct reporting relationship between the senior privacy official and the agency head. Major contributors to this report were John de Ferrari, Assistant Director; Idris Adjerid; Shaun Byrnes; Matt Grote; David Plocher; Jamie Pressman; and Amos Tevelow.

Summary: Government agencies have a long-standing obligation under the Privacy Act of 1974 to protect the privacy of individuals about whom they collect personal information. A number of additional laws have been enacted in recent years directing agency heads to designate senior officials as focal points with overall responsibility for privacy. GAO was asked to (1) describe laws and guidance that set requirements for senior privacy officials within federal agencies, and (2) describe the organizational structures used by agencies to address privacy requirements and assess whether senior officials have oversight over key functions. To achieve these objectives, GAO analyzed the laws and related guidance and analyzed policies and procedures relating to key privacy functions at 12 agencies. Federal laws set varying roles and responsibilities for senior agency privacy officials. Despite much variation, all of these laws require covered agencies to assign overall responsibility for privacy protection and compliance to a senior agency official. In addition, Office of Management and Budget guidance directs agencies to designate a senior agency official for privacy with specific responsibilities. The specific privacy responsibilities defined in these laws and guidance can be grouped into six broad categories: (1) conducting privacy impact assessments (which are intended to ensure that privacy requirements are addressed when personal information is collected, stored, shared, and managed in a federal system), (2) complying with the Privacy Act, (3) reviewing and evaluating the privacy implications of agency policies, (4) producing reports on the status of privacy protections, (5) ensuring that redress procedures to handle privacy inquiries and complaints are in place, and (6) ensuring that employees and contractors receive appropriate training. The laws and guidance vary in how they frame requirements in these categories and which agencies must adhere to them. Agencies also have varying organizational structures to address privacy responsibilities. For example, of the 12 agencies we reviewed, 2 had statutorily designated chief privacy officers who also served as senior agency officials for privacy, 5 designated their agency chief information officers as their senior privacy officials, and the others designated a variety of other officials, such as the general counsel or assistant secretary for management. Further, not all of the agencies we reviewed had given their designated senior officials full oversight over all privacy-related functions. While 6 agencies had these officials overseeing all key privacy functions, 6 others relied on other organizational units not overseen by the designated senior official to perform certain key privacy functions. The fragmented way in which privacy functions were assigned to organizational units in these agencies is at least partly the result of evolving requirements in law and guidance. However, without oversight of all key privacy functions, designated senior officials may be unable to effectively serve as agency central focal points for information privacy.