In response to growing concern about the harmful consequences that computerized data systems could have on the privacy of personal information, the Secretary of Health, Education, and Welfare commissioned an advisory committee in 1972 to examine to what extent limitations should be placed on the application of computer technology to record keeping about people. The committee’s final report proposed a set of principles for protecting the privacy and security of personal information, known as the Fair Information Practices. These practices were intended to address what the committee termed a poor level of protection afforded to privacy under existing law, and they underlie the major provisions of the Privacy Act, which was enacted the following year. A revised version of the Fair Information Practices, developed by the Organization for Economic Cooperation and Development (OECD) in 1980, has been widely adopted. This version of the principles was reaffirmed by OECD ministers in a 1998 declaration and further endorsed in a 2006 OECD report. The OECD version of the principles is shown table 1. The Fair Information Practices are, with some variation, the basis of privacy laws and related policies in many countries, including the United States, Germany, Sweden, Australia, and New Zealand, as well as the European Union. They are also reflected in a variety of federal agency policy statements, beginning with an endorsement of the OECD principles by the Department of Commerce in 1981, and including policy statements from DHS, DOJ, and the Department of Housing and Urban Development. In 2004, the Chief Information Officers Council issued a coordinating draft of its Security and Privacy Profile for the Federal Enterprise Architecture that links privacy protection with a set of acceptable privacy principles corresponding to the OECD’s version of the Fair Information Practices. In addition, in a 2007 report on “Engaging Privacy and Information Technology in a Digital Age,” the National Research Council found that the principles of fair information practice for the protection of personal information are as relevant today as they were in 1973. Accordingly, the committee recommended that the fair information practices should be extended as far as reasonably feasible to apply to private-sector organizations that collect and use personal information. The Fair Information Practices are not precise legal requirements. Rather, they provide a framework of principles for balancing the need for privacy with other public policy interests, such as national security, law enforcement, and administrative efficiency. Striking that balance varies among countries and among types of information (e.g., medical, employment information). There is no single federal law that governs all use or disclosure of personal information. Instead, U.S. law includes a number of separate statutes that provide privacy protections for information used for specific purposes or maintained by specific entities. The major requirements for the protection of personal privacy by federal agencies come from two laws, the Privacy Act of 1974 and the privacy provisions of the E-Government Act of 2002. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. It also defines “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public through a system-of-records notice in the Federal Register that identifies, among other things, the categories of data collected, the categories of individuals about whom information is collected, the intended “routine” uses of data, and procedures that individuals can use to review and correct personally identifiable information. The act’s requirements also apply to government contractors when agencies contract for the operation of a system of records to accomplish an agency function. According to OMB guidance, in these situations the contractual instrument between the agency and the contractor must specify that such records are to be maintained in accordance with the act. As explained by OMB, this requirement was not intended to cover private- sector record-keeping systems, but only those systems actually taking the place of a federal system that, but for the contract, would have been performed by an agency and covered by the Privacy Act. Several provisions of the act require agencies to define and limit collection and use to predefined purposes. For example, the act requires that to the greatest extent practicable, personal information should be collected directly from the subject individual when it may affect an individual’s rights or benefits under a federal program. The act also requires that an agency inform individuals whom it asks to supply information of (1) the authority for soliciting the information and whether disclosure of such information is mandatory or voluntary; (2) the principal purposes for which the information is intended to be used; (3) the routine uses that may be made of the information; and (4) the effects on the individual, if any, of not providing the information. According to OMB, this requirement is based on the assumption that individuals should be provided with sufficient information about the request to make a decision about whether to respond. In handling collected information, agencies are generally required by the Privacy Act to, among other things, allow individuals to (1) review their records (meaning any information pertaining to them that is contained in the system of records), (2) request a copy of their record or information from the system of records, and (3) request corrections to their information. Agencies are allowed to claim exemptions from some of the provisions of the Privacy Act if the records are used for certain purposes. For example, records compiled by criminal law enforcement agencies for criminal law enforcement purposes can be exempt from a number of provisions, including (1) the requirement to notify individuals of the purposes and uses of the information at the time of collection and (2) the requirement to ensure the accuracy, relevance, timeliness, and completeness of records. A broader category of investigative records compiled for criminal or civil law enforcement purposes can also be exempted from a somewhat smaller number of Privacy Act provisions, including the requirement to provide individuals with access to their records and to inform the public of the categories of sources of records. In general, the exemptions for law enforcement purposes are intended to prevent the disclosure of information collected as part of an ongoing investigation that could impair the investigation or allow those under investigation to change their behavior or take other actions to escape prosecution. Statutory exemptions under the Privacy Act are summarized in appendix III. In 1988, Congress passed the Computer Matching and Privacy Protection Act as an amendment to the Privacy Act, to establish procedural safeguards that affect agencies’ use of Privacy Act records from benefit programs in performing certain types of computerized matching programs. For example, the 1988 act requires agencies to create written agreements specifying the terms under which matches are to be done. …information is handled: (i) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (ii) to determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (iii) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. Agencies must conduct PIAs (1) before developing or procuring information technology that collects, maintains, or disseminates information that is in identifiable form or (2) before initiating any new data collections of information in an identifiable form that will be collected, maintained, or disseminated using information technology if the same questions are asked of 10 or more people. OMB guidance also requires agencies to conduct PIAs when a system change creates new privacy risks, for example, changing the way in which personal information is being used. According to OMB, no assessment is required when the information relates to internal government operations, the information has been previously assessed under an evaluation similar to a PIA, or when privacy issues are unchanged. The PRA applies to federal information collections and was designed to help ensure that when the government asks the public for information, the burden of providing this information is as small as possible and the information itself is used effectively. Such collections may have a range of purposes, which may or may not involve the collection of personal information, including applications for government benefits, program evaluation, general purpose statistics, research and regulation or compliance; all of these information collections may occur in a variety of forms, including questionnaires and telephone surveys. To achieve the goal of minimizing paperwork burden while maximizing the public benefit and utility of the information collected, the act includes provisions that establish standards and procedures for effective implementation and oversight of information collections. Among these provisions is the requirement that agencies not establish information collections without having them approved by OMB, and that before submitting them for approval, agencies’ chief information officers certify that the collections meet 10 specified standards, including that the collection is necessary for the proper performance of agency functions and avoids unnecessary duplication. The law also requires agencies both to publish notices in the Federal Register and to otherwise consult with the public about their planned collections. Privacy is also addressed in the legal framework for the emerging information sharing environment. As directed by the Intelligence Reform and Terrorism Prevention Act of 2004, the administration has taken steps, beginning in 2005, to establish an information sharing environment to facilitate the sharing of terrorism-related information with protections for privacy and civil liberties. The move was driven by the recognition that before the attacks of September 11, 2001, federal agencies had been unable to effectively share information about suspected terrorists and their activities. In addressing this problem, the National Commission on Terrorist Attacks Upon the United States (9/11 Commission) recommended that the sharing and uses of information be guided by a set of practical policy guidelines that would simultaneously empower and constrain officials, closely circumscribing what types of information they would be permitted to share as well as the types of information they would need to protect. Exchanging terrorism-related information continues to be a significant challenge for federal, state, and local governments—one that we recognize is not easily addressed. Accordingly, since January 2005, we have designated information sharing for homeland security a high-risk area. The Privacy Act gives OMB responsibility for developing guidelines and providing “continuing assistance to and oversight of” agencies’ implementation of the Privacy Act. The E-Government Act of 2002 also assigns OMB responsibility for developing PIA guidance and ensuring agency implementation of the privacy impact assessment requirement. In July 1975, OMB published guidance for implementing the provisions of the Privacy Act. Since then, OMB has periodically issued additional guidance. For example, in 1991, OMB provided guidance to assist agencies in complying with the Computer Matching and Privacy Protection Act. In September 2003, consistent with its responsibility under section 208 of the E-Government Act, OMB issued guidance to agencies on conducting privacy impact assessments. Enacted in 1980, the PRA made virtually all federal agency information collection activities subject to OMB review and established broad objectives for OMB oversight of the management of federal information resources. The act established the Office of Information and Regulatory Affairs within OMB and gave this office a variety of oversight responsibilities over federal information functions, including general information policy, reduction of paperwork burden, and information privacy. To assist agencies in fulfilling their responsibilities under the act, OMB took various steps. It issued a regulation and provided agencies with instructions on filling out a standard form for submissions and providing supporting statements. OMB has also periodically issued guidance on other privacy-related issues, including federal agency Web site privacy policies; interagency sharing of personal information; designation of senior staff responsible for privacy; and data breach notification. A list of privacy guidance from OMB can be found in appendix IV. Concerns about the Privacy Act have arisen periodically since its passage. The Privacy Act established a temporary national study commission to conduct a comprehensive assessment of privacy policy and to make recommendations for better protecting the privacy of individuals. This commission, called the Privacy Protection Study Commission (PPSC), was to study privacy issues and recommend future legislation. In its final report, the PPSC concluded that, as transactions involving personal information have proliferated, there has been no compensating tendency to give the individual the kind of control over the collection, use, and disclosure of personal information that natural, or face-to-face, encounters normally entail. The PPSC found that if informational privacy is to be protected, public policy must focus on certain systemic features such as the proliferating use of information for a different purpose than for what it was originally collected, and the greater use of third-party reporting. The commission concluded that it would be beneficial to create a federal body to oversee, regulate, and enforce compliance with the commission’s recommendations. The PPSC formally recommended that the President and Congress create an independent entity to participate in any federal proceeding that would affect personal privacy, including the issuance of rules that must be followed by federal agencies in interpreting the Privacy Act. As another example, in a 1983 report summarizing 9 years (1975 to1983) of congressional oversight of the Privacy Act, the House Committee on Government Operations concluded that OMB had not pursued its responsibility to revise and update its original guidance from 1975 and had not actively monitored agency compliance with its guidance. It stated “Interest in the Privacy Act at has diminished steadily since 1975. Each successive Administration has shown less concern about Privacy Act oversight.” More recently, in 2002, the Information Security and Privacy Advisory Board (ISPAB), a federal advisory committee originally established by the Computer Security Act of 1987, issued a report on government privacy policy setting and management. In its report, the ISPAB raised a number of concerns about advances in technology and its impact on privacy. Specifically, ISPAB observed that “with the migration toward e- government services, greater demands will be placed on the government’s privacy policies and systems.” ISPAB further observed that the public’s willingness to use such services will depend “in large measure on their confidence that the information that they disclose will be safeguarded.” The ISPAB report further stated that, “changes in technology, the privacy management challenges stemming from expanded e-government services, the accelerated interaction of networked information systems within and across critical infrastructure boundaries, and the extended, routine exchange of data among Federal and non-Federal government and non- government systems - all mandate immediate and serious attention to Federal government’s data privacy policies and operational controls.” Among the issues identified was a need for a review of the sufficiency and relevance of the Privacy Act to determine whether modifications were required, given the numerous changes affecting privacy that had occurred since the act was passed. Following up on its 2002 report, in 2005 ISPAB issued a “Privacy Act White Paper” raising the question of whether the existing legal and policy framework governing the information practices of federal agencies was sufficient to protect the privacy of individuals about whom the federal government maintained or used personal information. The paper postulated that “laws and policies have not kept pace with changes in technology and information and handling processes and suggests the need for an open dialogue on what changes in law and policy are needed and how to best make those changes.” Accordingly, in 2006 ISPAB initiated a partnership with the DHS Data Privacy and Integrity Advisory Committee to develop recommendations on a 21st century framework for revisions to the Privacy Act and other federal privacy statutes. Work on this initiative was ongoing at the time of our review. In 2007, the National Research Council issued a report entitled Engaging Privacy and Information Technology in a Digital Age. The report identified a number of issues related to the implications of advances in technology on privacy. With regard to government use of personal information, the committee found that the government has important roles to play in protecting the privacy of individuals and groups and in ensuring that decisions concerning privacy are made in an informed fashion. However, the report characterized the U.S. legal and regulatory framework as “a patchwork that lacks consistent principles or unifying themes.” The committee concluded that a less decentralized and more integrated approach to privacy policy in the United States could bring a greater degree of coherence to the subject of privacy. The committee recommended that the U.S. government undertake a broad systematic review of national privacy laws and regulations. Further, with regard specifically to government use of personal information, the committee found that “because the benefits of privacy often are less tangible and immediate than the perceived benefits of other interests, such as public security and economic efficiency, privacy is at an inherent disadvantage when decision makers weigh privacy against these other interests.” The committee concluded that, to reduce this inherent disadvantage, governments at federal, state, and local levels should establish mechanisms for the institutional advocacy of privacy within government. Much as the PPSC had recommended in 1977, the NRC recommended that a national privacy commissioner or standing privacy commission be established to provide ongoing and periodic assessments of privacy developments. We have previously reported on a number of agency-specific and governmentwide privacy-related issues at federal agencies. For example, in 2003, we reported that agencies generally did well with certain aspects of the Privacy Act’s requirements—such as issuing systems-of-records notices when required—but did less well at other requirements, such as ensuring that information is complete, accurate, relevant, and timely before it is disclosed to a nonfederal organization. In discussing this uneven compliance agency officials reported the need for additional OMB leadership and guidance to assist in difficult implementation issues in a rapidly changing environment. For example, officials had questions about the act’s applicability to electronic records. We have also reported on key privacy challenges facing federal agencies, federal Web site privacy, notification of individuals in the event of a data breach, and government data-mining initiatives. A list of our privacy-related products can be found in appendix V. Other federal laws address privacy protection for personal information with respect to information security requirements as well as for certain types of information, such as when taxpayer, statistical, or health information is involved. The Federal Information Security Management Act (FISMA) addresses the protection of personal information by defining federal requirements for securing information and information systems that support federal agency operations and assets; it requires agencies to develop agencywide information security programs that extend to contractors and other providers of federal data and systems. Under FISMA, information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction, including controls necessary to preserve authorized restrictions on access and disclosure to protect personal privacy, among other things. Other laws address protection of personal information by federal agencies in specific circumstances and are described in table 2. The Privacy Act’s controls on the collection, use, and disclosure of personally identifiable information do not consistently protect such information in all circumstances of its collection and use throughout the federal government. Issues have largely centered on the Privacy Act’s definition of a “system of records” (any grouping of records containing personal information retrieved by individual identifier), which triggers the act’s protections. Personal information is not always obtained and processed by federal agencies in ways that conform to the definition of a system of records, and in cases where such information falls outside this definition, it may not receive the full privacy protections established by the act. In contrast, the E-Government Act of 2002 sets broader terms for its requirement to conduct PIAs—namely, (1) before an agency develops or procures information technology that collects, maintains, or disseminates information that is in identifiable form, or (2) before an agency collects information in identifiable form using information technology. Although the E-Government Act’s broader definition is more inclusive than the system-of-records concept, its requirements are more limited because it imposes no restrictions on agency collection and use of personally identifiable information. Alternatives for addressing these issues could include revising the system-of-records definition to cover all personally identifiable information collected, used, and maintained systematically by the federal government, and revising the E-Government Act’s scope to cover federal rulemaking. The Privacy Act’s controls on the collection, use, and disclosure of personally identifiable information only apply when such information is covered by the act’s key terms, especially the “system-of-records” construct. There are several different ways in which federal collection and use of personally identifiable information could be outside of such a construct and thus not receive the Privacy Act’s protections: Personally identifiable information held by the government is not always retrieved by identifier. The Privacy Act defines a system of records as “a group of records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.” If personally identifiable information (records) is not retrieved by identifier but instead accessed through some other method or criteria— for example, by searching for all individuals who have a certain medical condition or who applied for benefits on a certain date—the system would not meet the Privacy Act’s system-of-records definition and therefore would not be governed by the act’s protections. OMB’s 1975 Privacy Act implementation guidance reflects an acknowledgement that agencies could potentially evade the act’s requirements by organizing personal information in ways that may not be considered to be retrieved by identifier. This scope of the system-of-records definition has been an issue since the Privacy Act became law in 1974. In its 1977 report, the PPSC pointed out that retrieval by name or identifier reflected a manual rather than a computer-based model of information processing and did not take into account emerging computing technology. As the study explained, while manual record-keeping systems are likely to store and retrieve information by reference to a unique identifier, this is unnecessary in computer-based systems that permit attribute searches. The PPSC noted that retrieval of individually identifiable information by scanning (or searching) large volumes of computer records was not only possible but an ever-increasing agency practice. Our 2003 report concerning compliance with the Privacy Act found that the PPSC’s observations had been borne out across federal agencies. A key characteristic of agencies’ systems of records at the time was that a large proportion of them were electronic, reflecting the government’s significant use of computers and the Internet to collect and share personal information. Based on survey responses from 25 agencies in 2002, we estimated that 70 percent of the agencies’ systems of records contained electronic records and that 11 percent of information systems in use at those agencies contained personal information that was outside a Privacy Act system of records. We also reported that among the agencies we surveyed, the most frequently cited reason for systems not being considered Privacy Act systems of records was that the agency did not use a personal identifier to retrieve the personal information. Recent OMB guidance reflects an acknowledgement that, although personally identifiable information does not always reside in Privacy Act systems of records, it should nevertheless be protected. Following a number of highly publicized data breaches at government agencies, OMB issued guidance instructing agencies to take action to safeguard “personally identifiable information.” Beginning in May 2006, OMB required senior agency privacy officials to “conduct a review of policies and processes and take corrective action as appropriate to ensure adequate safeguards to prevent the intentional or negligent misuse of, or unauthorized access to personally identifiable information.” Most recently, in May 2007, OMB required agencies to review and reduce “all current holding of personally identifiable information.” This guidance is not limited to information that is “retrieved by identifier” or contained within systems of records. The Privacy Act’s protections may not apply to contemporary data processing technologies and applications. In today’s highly interconnected environment, information can be gathered from many different sources, analyzed, and redistributed in very dynamic, unstructured ways that may have little to do with the file-oriented concept of a Privacy Act system of records. For example, data mining, a prevalent technique used by federal agencies for extracting useful information from large volumes of data, may escape the purview of the Privacy Act’s protections. Specifically, a data-mining system that performs analysis by looking for patterns in personal information located in other systems of records or that performs subject-based queries across multiple data sources may not constitute a system of records under the act. In recent years, reports required by law on data mining have described activities that had not been identified as systems of records covered by the Privacy Act. In one example, DHS reported that all the data sources for the planned Analysis Dissemination Visualization Insight and Semantic Enhancement (ADVISE) data mining program were covered by existing system-of-records notices; however, the system itself was not covered, and no system of records notice was created specifically to document protections under the Privacy Act governing the specific activities of the system. ADVISE was a data-mining tool intended to allow an analyst to search for patterns in data—such as relationships among people, organizations, and events—and to produce visual representations of those patterns. This was also the case with other data mining programs reported by DHS and DOJ. For example, DHS reported on a data mining system known as Intelligence and Information Fusion—which provides intelligence analysts with an ability to view, query, and analyze multiple data sources from within the government—that is not considered a Privacy Act system of records. While DHS reported that the system was “covered” by the system- of-records notice for the Homeland Security Operations Center Database, that notice does not specifically describe the uses of the Intelligence and Information Fusion system. Thus, while the underlying data sources are subject to the protections of the act, the uses of the Intelligence and Information Fusion system have not been specifically addressed. Likewise, DOJ reported that its Foreign Terrorist Tracking Task Force was developing a data mining system, known as the System to Assess Risk, to assist analysts in prioritizing persons of possible investigative interest in support of a specified terrorist threat. DOJ reported that the system’s data sources were covered by the system-of-records notice for the Federal Bureau of Investigation’s (FBI) Central Records System. However, the Central Records System notice does not specifically describe the uses of the System to Assess Risk and thus provides no evidence that the Privacy Act’s protections are being applied to the system. The fact that these notices do not specifically describe data-mining systems that they are said to include reflects the limitations of the system-of-records construct as a way to identify, assess, and report on the protections being applied to these types of analytical uses. As a result, personally identifiable information collected and processed by such systems may be less well protected than if it were more specifically addressed by the Privacy Act. Use of personal information from third party sources is not consistently covered by the Privacy Act. The Privacy Act requires agencies to collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual’s rights, benefits, and privileges under federal programs. Yet agencies have increasingly turned to other sources to collect personal information, particularly third-party sources such as information resellers—companies that amass and sell personal information from many sources. Concerns were raised in our expert forum that government agencies may be using such third-party sources as a way to avoid the constraints of the Privacy Act. In our 2006 report on federal agency use of personal information from information resellers, we noted that agency officials said they generally did not prepare system-of-records notices for the use of information resellers because they were not required to do so by the Privacy Act. The Privacy Act makes its provisions applicable to third-party systems when “an agency provides by a contract for the operation by or on behalf of the agency a system of records to accomplish an agency function.” According to agency officials, information reseller databases were not considered systems of records operated “by or on behalf of a government agency” because resellers develop their databases for multiple customers, not the federal government exclusively. Further, agency officials stated that merely querying information reseller databases did not amount to maintaining the information that was obtained, and thus the provisions of the Privacy Act did not apply. In many cases, agency officials considered their use of reseller data to be of this type—essentially “ad hoc” querying or “pinging” of databases for personal information about specific individuals, which they were not doing in connection with a designated system of records. Thus, these sources, which agencies use for many purposes, have not been considered subject to the provisions of the Privacy Act. As a result, individuals may be limited in their ability to learn that information is being collected about them, because the information is being obtained from other sources and the activity is not publicly described in a system-of-records notice. Further, the Privacy Act’s constraints on collection, use, and disclosure would not apply. In our 2006 report, we made recommendations to OMB to revise its guidance to clarify the applicability of requirements for public notices and privacy impact assessments with respect to agency use of personal information from resellers. We also recommended that OMB direct agencies to review their uses of such information to ensure it is explicitly referenced in privacy notices and assessments. However, OMB has not addressed our recommendations. OMB stated that following the completion of work on the protection of personal information through the Identity Theft Task Force, it would consider issuing appropriate guidance concerning reseller data. OMB issued guidance based on the work of the Identity Theft Task Force in May 2007; however, it did not include clarifying guidance concerning reseller data. Without clarifying guidance, agencies may continue to consider use of reseller data as not covered by the Privacy Act and thus may not apply the Privacy Act’s protections to this use. The E-Government Act’s requirements for the conduct of PIAs apply to a broader range of government activities than are currently covered by the Privacy Act’s definition of a system of records. Specifically, the E- Government Act requires agencies to conduct PIAs before (1) developing or procuring information technology that collects, maintains, or disseminates information that is in individually identifiable form or (2) initiating data collections involving personal information that will be collected, maintained or disseminated using information technology if the same questions are asked of 10 or more people. The PIA requirement has provided a mechanism for agencies to consider privacy protections during the earliest stages of development of their systems, when it may be relatively easy to make critical adjustments. Senior agency privacy officials at several agencies reported that their PIA processes are incorporated into key stages in systems development. For example, senior agency privacy officials at the IRS reported that PIAs are required at every stage of the systems development life cycle for new systems or systems undergoing major modifications. In addition, five of the six agencies we interviewed reported that they use a privacy threshold analysis, a brief assessment that requires system owners to answer basic questions on the nature of their systems and whether the systems contain personally identifiable information, to identify systems that require a PIA; this approach enables agencies to ensure that systems undergo the PIA process at the earliest stages of development. Privacy experts and senior agency privacy officials we interviewed also noted that the E-Government Act provides a mechanism to address certain uses of personal information that might not have been covered by the Privacy Act. According to OMB guidance, PIAs are required to be performed and updated whenever a system change creates new privacy risks. Among the types of changes identified in OMB guidance that might require conducting a PIA are when converting from paper to electronic records, when applying new technologies that significantly change how information in identifiable form is managed in the system, and when merging databases to create one central source of information. Typically, under the Privacy Act changes of this nature could result in limited modifications to a system-of-records notice to reflect additional categories of records and/or routine uses. It would not result in a reassessment of privacy risks, as is required for a PIA. Because the E-Government Act’s PIA requirement applies more broadly than the Privacy Act, it may help in part to address concerns about the narrow definition of terms in the Privacy Act. Specifically, a well-written PIA can inform the public about such things as what information is being collected, why it is being collected, and how it is to be used. However, the E-Government Act does not include the specific constraints on how information is to be collected, maintained, and shared that are included in the Privacy Act—such as restrictions on disclosure of personal information and requirements to allow for access to and correction of records by individuals, among other things. Further, the E-Government Act only applies to information technology systems and therefore does not address personal information contained in paper records. In addition, the E-Government Act may not be broad enough to cover all cases in which the federal government makes determinations about what personal information is to be collected and how it is to be protected. A major function that is not covered is rulemaking that involves the collection of personally identifiable information. Rulemaking is the process by which federal agencies establish regulations that can govern individual behavior as well as commercial and other activities. For example, DHS is required by the Homeland Security Act to conduct PIAs for all of its proposed rules, and, as a result, PIAs have been conducted for major initiatives, including the REAL ID Act, which required DHS to establish minimum standards for state-issued drivers’ licenses and identification cards that federal agencies would accept for official purposes, and the Western Hemisphere Travel Initiative, aimed at strengthening border security and facilitating entry into the United States for U.S. citizens and certain foreign visitors through a standardized identification card. These PIAs have provided for the evaluation of privacy considerations before final decisions are made concerning specific technologies to be used in drivers’ licenses and border-crossing identification cards issued by state governments. However, DHS, DOT, Treasury, and a number of smaller agencies are currently the only agencies required to conduct PIAs on proposed rules. Other agencies may be issuing rules that have privacy implications without conducting privacy assessments of them. A number of alternatives exist to address the issues associated with the coverage of existing privacy laws governing federal use of personal information. These alternatives involve revisions to the Privacy Act and E- Government Act, as follows: Revise the system of records definition to cover all personally identifiable information collected, used, and maintained by the federal government. Like the Privacy Protection Study Commission, which believed in 1977 that the act’s definition of a system of records should be revised, experts at our forum were in agreement that the system-of- records definition is outdated and flawed. The experts agreed that the act’s protections should be applied whenever agencies obtain, process, store, or share personally identifiable information—not just when records are retrieved by personal identifier. Such an approach could address concerns that certain activities, such as data mining or retrieving information from commercial information resellers could avoid the protections of the act. As shown in table 3, several recent OMB memoranda providing direction to federal agencies on privacy protection reflects this approach. The Privacy Act’s narrowly scoped system-of-records definition does not match OMB’s broadened approach to protecting personally identifiable information. Changing the system-of-records definition is an option that could help ensure that the act’s protections are consistently applied to all personally identifiable information. Revise the E-Government Act’s scope to cover federal rulemaking. The E- Government Act’s privacy provisions could be broadened to apply to all federal rulemaking involving the collection of personally identifiable information, as the Homeland Security Act currently requires of DHS and the Transportation, Treasury, Independent Agencies and General Government Appropriations Act of 2005 requires of Transportation, Treasury, and certain other agencies. This change would ensure that privacy concerns are addressed as the federal government proposes and adopts rules that affect how other entities, including state and local government agencies, collect and use personally identifying information. Current laws and guidance impose only modest requirements for describing the purposes for collecting and using personal information and limiting how that information is collected and used. For example, agencies are not required to be specific in formulating purpose descriptions in their public notices. Laws and guidance also may not effectively limit the collection of personal information. For example, the Privacy Act’s requirement that information be “relevant and necessary” gives broad latitude to agencies in determining the amount of information to collect. In addition, mechanisms to limit use to a specified purpose may be weak. For example, the Privacy Act does not limit agency internal use of information, as long as it is needed for an official purpose or include provisions addressing external sharing with other entities to ensure that the information’s new custodians preserve the act’s protections. Examples of alternatives for addressing these issues include setting specific limits on routine uses and use of information within agencies to include more specific limits, requiring agencies to justify how collection has been limited in privacy notices, and requiring agencies to establish formal agreements with external governmental entities before sharing personally identifiable information with them. A key area of concern about personal information maintained by government agencies is to ensure that limits are placed on what the government acquires and how it uses the information—thus giving individuals a measure of control over their own personal information. Two of the fair information practices relate specifically to limiting the way the government collects and uses personal information: collection limitation and use limitation. A third principle—purpose specification—is critical to ensuring that the other two are applied effectively. The purpose specification principle states that the purpose for the collection of personal information should be disclosed before the collection is made and upon any change to that purpose, and its use should be limited to that purpose and compatible purposes. Clearly specifying the purpose of a given activity establishes the measure for determining whether the collection of information has been sufficiently limited to what is relevant for the purpose and whether the ways in which the information is used have also been limited to what is appropriate for the same purpose. The collection limitation principle states that the collection of personal information should be limited, should be obtained by lawful and fair means, and, where appropriate, with the knowledge or consent of the individual. When the collection limitation principle is applied, individuals can gain assurance that the information about them that is being collected is only what is needed to perform a specific, predisclosed function. In the government arena, this mitigates the risk that an over-collection of personal information could facilitate the improper use of that information to make adverse determinations. For example, the Transportation Security Administration (TSA) received criticism about its now-cancelled Computer-Assisted Passenger Pre-screening System II because it proposed to collect information from third-party sources in addition to airline passengers themselves. Concerns were raised that individuals could be delayed or denied boarding their airline flights based on third-party information that was potentially inaccurate. In developing a successor project, called Secure Flight, TSA responded to privacy concerns by planning to collect far less information and to focus on information collected directly from individuals. A closely related principle—the use limitation principle—provides that personal information, once collected, should not be disclosed or used for other than a specified purpose without consent of the individual or legal authority. The use limitation principle is arguably of heightened importance in the government arena because the government has many functions that affect numerous aspects of an individual’s well-being. Hence, it is important to ensure that information the government collects for one function is not used indiscriminately for other unrelated functions. By requiring the government to define a specific purpose for the collection of personal information and limit its use to that specified purpose, individuals gain assurance that their privacy will be protected and their information will not be used in ways that could jeopardize their rights or otherwise unfairly affect them. The Privacy Act includes requirements that agencies (1) inform individuals from whom information is being collected of the principal purpose or purposes for which the information is intended to be used and (2) publish a system-of-records notice in the Federal Register of the existence and character of the system of records, including planned routine uses of the records and the purpose of each of these routine uses. Concerns have been raised that the act’s requirements do not go far enough in ensuring that the government’s planned purposes are sufficiently specified: Statements of overall purpose are not always required. The Privacy Act requires agencies to inform individuals on forms used to collect information from them of the principal purpose or purposes for which the information is intended to be used. This is an important provision that protects individuals when the government is collecting information directly from them. However, in many cases, agencies obtain information about individuals from other sources, such as commercial entities (including information resellers) and other governmental entities. In those cases, no overall declaration of purpose is required in the system-of- records notice. For each of the stated routine uses a description is required of the potential purposes for which the records may be used; however, there is no requirement for a declaration of the purpose or purposes for the system of records as a whole. Given that individuals may be especially concerned about how their information is collected from different government and commercial entities, not having an overall purpose associated with this information raises concerns. Purpose descriptions in public notices are not required to be specific. As mentioned above, while there is no requirement for an overall statement of purpose, Privacy Act notices may contain multiple descriptions of purposes associated with routine uses, and agencies are not required to be specific in formulating these purposes. OMB guidance on the act gives agencies discretion to determine how to define the range of appropriate uses and associated purposes that it intends for a given system of records. For example, purpose statements for certain law enforcement and anti- terrorism systems might need to be phrased broadly enough so as not to reveal investigative techniques or the details of ongoing cases. However, overly broadly-defined purposes could allow for unnecessarily broad collections of information and ranges of subsequent uses, thus calling into question whether meaningful limitations had been imposed. For example, in previous work on international passenger prescreening by DHS’s Customs and Border Protection (CBP), we reported that CBP’s public notices and reports regarding its international prescreening process did not fully or accurately describe CBP’s use of personal data throughout the passenger prescreening process. In that case, CBP relied on a system- of-records notice for the Treasury Enforcement Communications System—one of several data sources used in the prescreening process—to notify the public about the purpose of the international prescreening program. The notice, however, did not mention CBP’s passenger prescreening purpose but simply included a broad statement about its law enforcement purpose, namely that “every possible type of information from a variety of Federal, state and local sources, which contributes to effective law enforcement may be maintained in this system of records.” Use of such a sweeping purpose statement obscured its use in international passenger prescreening and did not establish a basis for limiting use of the information in the system. Its use shows that the act does not require the government to clearly state its purposes for collecting and using personal information. Another example can be found in the system-of-records notice for the FBI’s Central Records System. The FBI relies on this notice to inform the public about a broad range of files it maintains and uses for a variety of different purposes. According to the notice, the Central Records System contains investigative, personnel, applicant, administrative, and “general” files. In addition to information within 281 different categories of legal violations over which the FBI has investigative jurisdiction, the files also include information pertaining to personnel, applicant, and administrative matters. As a result, it is unclear from the notice how any given record in this system is to be used. While law enforcement agencies are often concerned about revealing their methods to criminals, descriptions of the specific purposes of FBI systems could be crafted to avoid revealing what information had been collected about any specific individual or how it was being used by the agency. DOJ officials acknowledged that there has been frequent criticism of the broad scope of the Central Records System notice but said the notice had been structured that way because all the records covered by the notice are organized according to that same indexing hierarchy. More significantly, the Privacy Act does not require that systems of records be defined and described more specifically. Like the CBP notice, the FBI notice demonstrates that the act does not require the government to clearly state its purposes for collecting and using personal information. Regarding collection limitation, the Privacy Act states that each agency should maintain only such information about individuals in its systems of records that is “relevant and necessary” to accomplish a purpose the agency is required to accomplish by statute or executive order of the President. The act further states that agencies generally cannot disclose records about an individual without his or her consent, except under a number of specific conditions. Collection limitation may also be addressed indirectly as part of agency procedures under the E-Government Act for conducting PIAs. Based on OMB guidance, PIAs are required to include explanations regarding what information is being collected, why it is being collected, and what the intended uses are. According to agency privacy officials, they often question agency program officials about whether planned collections are really necessary or could be reduced during the process of reviewing draft PIAs. The Paperwork Reduction Act also addresses collection limitation when information is to be collected individually from 10 or more people. It requires agency chief information officers to determine whether the information has practical utility and is necessary for the proper performance of agency functions. Once a chief information officer has certified that a planned information collection meets 10 standards set forth in the act, the collection is submitted to OMB for review. The agency may not collect the information without OMB’s approval. Finally, OMB also has issued guidance instructing agencies to limit the collection of personally identifiable information. In early 2007, OMB issued Memorandum M-07-16, which required agencies to review and reduce the volume of their holdings of personally identifiable information to the minimum necessary for the proper performance of documented agency functions. The memorandum noted that “by collecting only the information necessary and managing it properly, agencies can often reduce the volume of information they possess, the risk to the information, and the burden of safeguarding it.” The memorandum also required agencies to develop a plan to reduce their use of Social Security numbers and to make public a schedule by which they would periodically update the review of their overall holdings of personally identifiable information. Nothwithstanding these various provisions in law and guidance, the government’s collection of personal information may not be effectively limited: The Privacy Act’s “relevant and necessary” provision gives broad latitude to agencies in determining the amount of information to collect. The Privacy Act states that each agency shall “maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by Executive order of the President.” Under these criteria, agency officials do not have specific requirements for justifying how much information to collect; instead, it is a matter of judgment whether any specific piece of information is relevant and necessary. OMB’s implementation guidance advises agencies to identify the specific provisions in law that authorize a collection before it is implemented and provides questions that agencies should consider in determining what information to collect but concludes that a final decision on what is relevant and necessary is a matter of judgment. For certain functions, such as homeland security, new and varied collections of personal information may be relevant and necessary. However, several experts at our forum expressed concern about what they view as an increasing trend in the post-9/11 era for federal agencies to collect as much information as possible in the event that such information might be needed at a future date. Without establishing more specific requirements for justifying information collections, it may be difficult to ensure that agencies collect only relevant and necessary personal information. The Paperwork Reduction Act information collection review process has not always been effective at limiting collection. In addition to provisions in the Privacy Act, the PRA has the potential to serve as a useful control for ensuring that agencies make reasoned judgments about what personal information to collect. However, it has not always achieved this objective. As we reported in 2005, the PRA’s constraints on information collection are not always completely followed. For our previous report, we examined a sample of 12 approved information collections to assess the effectiveness of the PRA review process. We found that while chief information officers reviewed information collections regularly, support for a particular collection was often partial. For example, of the 12 approved data collections we reviewed, 6 provided only partial support for determining whether the collection was necessary for the proper performance of agency functions and 8 had only partial support for determining whether a collection provided the information it was intended to provide. Despite these shortcomings, all 12 data collections were certified by agency chief information officers, and all 12 were also approved by OMB. The fact that agencies are able to have information collections approved despite incomplete justification contributes to concern that the PRA information collection review process may not be effective at limiting collection of personally identifiable information by the government. We recommended that OMB take steps to improve the review process, and OMB responded that it was considering changing its instructions to align them more closely with 10 standards specified in the act. However, OMB has not yet addressed our recommendation. OMB guidance does not provide specific measures for limiting information collections. Although agency privacy officials believe the PIA process gives them the opportunity to address collection limitation, the requirements of the E-Government Act do not specifically address collection limitation, and OMB PIA guidance accordingly does not include requirements for limiting information collection, and the process does not include criteria for making determinations as to whether specific planned data elements are necessary. The lack of specific control mechanisms contributes to concerns by privacy experts that collection of personally identifiable information is not being effectively limited. Similarly, OMB’s recent guidance to limit collection of personally identifiable information did not include plans to monitor agency actions or take other proactive steps to ensure that agencies are effectively limiting their collections of personally identifiable information. OMB has not reported publicly on agencies’ progress in responding to its guidance, and thus it remains unclear what steps agencies have taken. Finally, like previous guidance, M- 07-16 did not provide any criteria for making determinations about whether specific data elements are needed. Without a legal requirement to limit collection of personally identifiable information, it is unclear the extent to which agencies will follow OMB’s guidance. The Privacy Act generally prevents agencies from sharing personal information in systems of records, except pursuant to a written request by, or with prior written consent of, the affected individual. There are, however, a number of specific conditions defined by the Privacy Act under which federal agencies may share information from systems of records with other government agencies without the affected individuals’ consent. For example, agencies may share information with another agency for civil or criminal law enforcement activity. Sharing is also allowed if it is for a purpose that is “compatible” with the purpose for which the information was collected, referred to as a “routine use.” Agencies are required to enumerate these routine uses in their system-of-records notices and publish the notice in the Federal Register for public comment. According to OMB’s 1975 implementation guidance, the routine use provisions were intended to “serve as a caution to agencies to think out in advance what uses it will make of information” and was intended “to discourage the unnecessary exchange of information to other persons or to agencies who may not be as sensitive to the collecting agency’s reasons for using and interpreting the material.” Section 208 of the E-Government Act of 2002 and related OMB guidance also have provisions that implement the use limitation principle, chiefly by requiring that PIAs include the intended uses of the information and with whom the information will be shared. Although the Privacy Act and E-Government Act have provisions for limiting the use of personally identifiable information to a specified purpose, these mechanisms may not always be effective for the following reasons: Unconstrained application of pre-defined “routine” uses may weaken use limitations. A number of concerns have been raised about the impact on privacy of potentially unnecessary routine uses for agency systems of records, particularly through the application of “standard” routine uses that are developed for general use on multiple systems of records. This practice is not prohibited by the Privacy Act. All six agencies we reviewed had lists of standard routine uses for application to their systems of records. However, the language of these standard routine uses varies from agency to agency. For example, as shown in table 4, several agencies have a routine use allowing them to share information about individuals with other governmental entities for purposes of decision-making about hiring or retention of an individual, issuance of a security clearance, license, contract, grant, or other benefit. As shown in the table, one agency (HHS) includes a provision that sharing of this information will occur only after the requesting agency has submitted a request supported by written consent of the affected individual. In contrast, similar routine uses at other agencies (DHS, DOJ, IRS, and DOT) have no requirement for the written consent of the individual. Still another agency (SSA) has no comparable standard routine use at all. Experts expressed concern that “standard” routine uses such as these vary so much from agency to agency, with no specific legal requirement that they be formulated consistently. Further, agencies do not apply these uses consistently. DHS, for example, has a “library” of routine uses that are applied selectively to systems of records on a case-by-case basis. In contrast, DOT applies its list of general routine uses to all of its systems of records, unless explicitly disavowed in the system’s public notice. Similarly, the FBI applies its “blanket” routine uses to “every existing FBI Privacy Act system of records and to all FBI systems of records created or modified in the future.” As a result, use may not always be limited as the Privacy Act intended. The Privacy Act sets only modest limits on the use of personal information for multiple purposes within an agency. Recognizing the need for agency personnel to access records to carry out their duties, the Privacy Act permits disclosures from agency systems of records “to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties.” However, without additional limits, internal uses could go beyond uses that are related to the purpose of the original collection. In our interviews with senior agency privacy officials, we asked what, if any, limits were placed on internal agency uses of information. Several agencies responded that, consistent with the Privacy Act and OMB guidance, internal agency usage of personal information was limited to those personnel with a “need to know.” Because the Privacy Act and related guidance do not require it, none of these agencies took steps to determine whether internal uses were consistent with the purposes originally stated for the collection of information. Reliance on the “need to know” criteria for sharing information does not require a determination regarding compatibility with the original collection. The potential that personal information could be used for multiple, unspecified purposes is especially heightened in large agencies with multiple components that may collect personal information in many different ways for disparate purposes. For example, the establishment of DHS in March 2003 brought 22 agencies with varied missions and 180,000 employees into a single agency. These agencies collect personal information for a range of purposes, including administering citizenship, enforcing immigration laws, protecting land and sea ports of entry, and protecting against threats to aviation security. The Privacy Act does not constrain DHS or other agencies from using information obtained for one of these specific missions for another agency mission. As a result, individuals do not have assurance that their information will be used only for the purpose for which it was collected. The Privacy Act’s provisions may not apply when data are shared for use by another agency. In addition to concerns about limiting use to a specified purpose within an agency, more extensive issues have been raised when data are shared outside an agency, even when such sharing is pursuant to a predefined “routine” use. Although the Privacy Act provides assurance that the information in systems of records cannot be disclosed unless it is pursuant to either a routine use or another statutorily allowed condition, the act does not attach its protections to data after they have been disclosed. Despite the lack of requirements, agencies we reviewed reported taking measures to ensure the data are used appropriately by recipients. For example, agencies reported using mechanisms such as computer matching agreements under the matching provisions of the Privacy Act or other types of data-sharing agreements to impose privacy protections on recipients of shared data. However, absent these measures taken by agencies, data shared outside federal agencies would not always have sufficient protections. Data sharing among agencies is central to the emerging information sharing environment intended to facilitate the sharing of terrorism information. If the information sharing environment is to be effective, it will require policies, procedures, and technologies that link people, systems, and information among all appropriate federal, state, local, and tribal entities and the private sector. In the recent development of guidelines for the information-sharing environment, there has been general agreement that privacy considerations must also be addressed alongside measures for enhancing the exchange of information among agencies. The Intelligence Reform and Terrorism Prevention Act of 2004 called for the issuance of guidelines to protect privacy and civil liberties in the development of the information sharing environment, and the President reiterated that requirement in an October 2005 directive to federal departments and agencies. Based on the President’s directive, a committee within the Office of the Director of National Intelligence was established to develop such guidelines, and they were approved by the President in November 2006. However, as we previously testified, the guidelines as issued provide only a high-level framework for addressing privacy protection and do not include all of the Fair Information Practices. More recently, in September 2007, the Program Manager for the Information Sharing Environment released a Privacy and Civil Liberties Implementation Guide for the Information Sharing Environment. The guide describes the processes for information-sharing environment participants to follow when integrating privacy and civil liberties safeguards into their information sharing efforts, including an assessment of whether current activities comply with the privacy guidelines. However, as noted by our expert panel, these guidelines do not address the application of protections to Privacy Act data as they are shared within the information sharing environment, mentioning the act only in passing. In the absence of the adoption of more specific implementation guidelines or more explicit protections in the Privacy Act for data that are disclosed, agency information-sharing activities may not ensure that the use of personal information is sufficiently limited. Require agencies to state the principal purpose for each system of records. Having a specific stated purpose for each system of records would make it easier to determine whether planned uses were consistent with that purpose. Require agencies to limit collection of personally identifiable information and to explain how such collection has been limited in system-of-records notices. This requirement would more directly require agencies to limit their collection of personally identifiable information than the current requirement, which is simply to maintain only such information as is relevant and necessary to accomplish a purpose of the agency. Revise the Paperwork Reduction Act to include specific requirements for limiting the collection of personally identifiable information. The Paperwork Reduction Act currently does not specifically address limiting the collection of personally identifiable information but could serve as an established mechanism for incorporating such limits. Require agencies to justify the use of key elements of personally identifiable information. Agencies could be required to state their reasons for collecting specific personally identifiable information, such as Social Security numbers and dates of birth. The Secure Flight program within DHS, for example, recently went through a process of analyzing specific data elements to be collected from airline passengers for pre- screening purposes and was able as a result to limit its requirements to only a few key elements for most passengers. Given concerns about data collection, it is likely that other government data collections could also be reduced based on such an analysis. Set specific limits on routine uses and internal uses of information within agencies. Sharing of information within an agency could be limited to purposes clearly compatible with the original purpose of a system of records. Agencies could also be required to be specific in describing purposes associated with routine uses. Require agencies to establish formal agreements with external governmental entities before sharing personally identifiable information with them, as is already done at certain agencies. These formal agreements would be a means to carry forward to external entities the privacy controls that applied to the information when it was in an agency system of records. These requirements could be set explicitly in law or a legal requirement could be set for another agency, such as OMB, to develop specific implementation guidelines for agencies. Setting such requirements could help ensure that a proper balance exists in allowing government agencies to collect and use personally identifiable information while also limiting that collection and use to what is necessary and relevant. Transparency about government programs and systems that collect and use personal information is a key element in maintaining public trust and support for programs that use such information. A primary method for providing transparency is through public written notices. A clear and effective notice can provide individuals with critical information about what personal data are to be collected, how they are to be used, and the circumstances under which they may be shared. An effective notice can also provide individuals with information they need to determine whether to provide their personal information (if voluntary), or who to contact to correct any errors that could result in an adverse determination about them. In formal terms, the openness principle states that the public should be informed about privacy policies and practices and that individuals should have a ready means of learning about the use of personal information. The openness principle underlies the public notice provisions of the Privacy Act. Specifically, the Privacy Act requires agencies to publish in the Federal Register, “upon establishment or revision, a notice of the existence and character of a system of records.” This notice is to include, among other things, the categories of records in the system as well as the categories of sources of records. The notice is also required to explain agency procedures whereby an individual can gain access to any record pertaining to him or her contained in the system of records and contest its content. Agencies are further required to publish notice of any new use or intended use of the information in the system and provide an opportunity for interested persons to submit written data, views, or arguments to the agency. In addition, when collection of personal information is received directly from the affected individual, agencies are required to notify the individual of the primary purposes for the collection and the planned routine uses of the information. The act encourages agencies, to the extent practicable, to collect information directly from the subject individual when the information may result in adverse determinations about the individual’s rights, benefits, and privileges under federal programs. It is critical that Privacy Act notices effectively communicate to the public the nature of agency collection and use of personal information because such notices are the fundamental mechanisms by which agencies are held accountable for specifying purpose, limiting collection and use, and providing a means to access and correct records. These notices can be seen as agreements between agencies and the public to provide protections for the data in the custody of the government. System-of-records notices are especially important in cases where information is not obtained directly from individuals because there is no opportunity for them to be informed directly. As experts noted, collection from individuals may be less prevalent in an environment where agencies are encouraged to participate in cross agency e-government initiatives that promote a “collect once, use many” approach. Experts also noted that since the terrorist attacks on 9/11, agencies are charged with sharing information more readily, one of the major goals of the information sharing environment. In situations such as these, the system-of-records notice may be one of the only ways for individuals to learn about the collection of their personal information. However, experts at our forum as well as agency privacy officials questioned the value of system-of-records notices as vehicles for providing information to the general public. Specifically, concerns were raised that the content of these notices and their publication in the Federal Register may not fully inform the public about planned government uses of personal information, for the following reasons: System of record notices may be difficult to understand. As with other legally-required privacy notices, such as the annual privacy notices provided to consumers by banks and other financial institutions, system- of-records notices have been criticized as hard to read and understand. For example, lay readers may have difficulty understanding the extent to which lists of “routine” uses actually explain how the government intends to collect and use personal information. Likewise, for an uninformed reader, a list of exemptions claimed for the system—cited only by the corresponding paragraph number in the Privacy Act—could raise more questions than it answers. Agency senior privacy officials we interviewed frequently cited legal compliance as the primary function of a system-of- records notice, thus leading to legalistic descriptions of the controls on collection and use of personal information. These officials acknowledged that these descriptions of privacy protections may not be very useful to the general public. Privacy experts at our forum likewise viewed system-of- records notices as having limited value as a vehicle for public notification. System-of-records notices do not always contain complete and useful information about privacy protections. As discussed earlier in this report, system-of-records notices can be written to describe purposes and uses of information in such broad terms that it becomes questionable whether those purposes and uses have been significantly limited. Likewise, broad purpose statements contained in system-of-records notices may not contain enough information to usefully inform the public of the government’s intended purposes, and the citation of multiple routine uses does little to aid individuals in learning about how the government is using their personal information. The Privacy Act does not require agencies to be specific in describing the purposes associated with routine uses. Further, individuals are limited in their ability to know how extensively their information may be used within an agency, since there are no requirements to publish all expected internal agency uses of personal information. Several agency privacy officials as well as experts at our forum noted that privacy impact assessments, when properly prepared, can lead to more meaningful discussions about privacy protections and may serve as a better vehicle to convey purposes and uses of information to the public. OMB guidance requires agency PIAs to identify what choices were made regarding an IT system or information collection as a result of performing a PIA, while a system-of-records notice contains no comparable requirement. As a result, a well-crafted PIA may provide more meaningful notice to the public not only about the planned purposes and uses of personal information, but also about how an agency’s assessment was used to drive decisions about the system. Publication in the Federal Register May Reach Only a Limited Audience. Agency privacy officials questioned whether the required publication of system-of-records notices in the Federal Register would be useful to a broader audience than federal agency officials and public interest groups, such as privacy advocacy groups. Notices published in the Federal Register may not be very accessible and readable. The Federal Register Web site does not provide a ready means of determining what system-of- records notices are current, when they were last updated, or which ones apply to any specific governmental function. Officials agreed that it can be difficult to locate a system-of-records notice on the Federal Register Web site, even when the name of the relevant system of records is known in advance. Privacy experts at our forum likewise agreed that the Federal Register is probably not effective with the general public and that a more effective technique for reaching a wide audience in today’s environment is via consolidated publication on a governmentwide Web site devoted to privacy. Both agency officials and privacy experts also agreed, however, that the Federal Register serves a separate but important role as the official public record of federal agencies, and thus it would not be advisable to cease publishing system-of-records notices in the Federal Register. Notice in the Federal Register also serves an important role as the official basis for soliciting comments from the public on proposed systems of records. Based on discussions with privacy experts, agency officials, and analysis of laws and related guidance, a number of options exist for addressing the issues associated with improving public notice regarding federal collection and use of personal information. As with the alternatives previously discussed, these could be addressed explicitly in law or a legal requirement could be set for another agency, such as OMB, to develop specific implementation guidelines for agencies. These alternatives are as follows: Require layered public notices in conjunction with system-of-records notices. Given the difficulty that a lay audience may face in trying to understand the content of notices, experts at our forum agreed that a new approach ought to be taken to designing notices for the public about use of personal information. Specifically, the use of layered notices, an approach that is actively being pursued in the private sector for consumer privacy notices, could also be effective for Privacy Act notices. Layering involves providing only the most important summary facts up front—often in a graphically oriented format—followed by one or more lengthier, more narrative versions. By offering both types of notices, the benefits of each can be realized: long notices have the advantage of being complete, but may not be as easy to understand, while brief notices may be easier to understand but may not capture all the detail that needs to be conveyed. A recent interagency research project on the design of easy-to-understand consumer financial privacy notices found, among other things, that providing context to the notice (explaining to consumers why they are receiving the notice and what to do with it) was key to comprehension, and that comprehension was aided by incorporating key visual design elements, such as use of a tabular format, large and legible fonts, and appropriate use of white space and simple headings. The multilayered approach discussed and lessons learned could be applied to government privacy notices. For example, a multilayered government privacy notice could provide a brief description of the information required, the primary purpose for the collection, and associated uses and sharing of such data at one layer. The notice could also provide additional details about the system or program’s uses and the circumstances under which data could be shared at a second layer. This would accomplish the purpose of communicating the key details in a brief format, while still providing complete information to those who require it. Aiming to improve comprehension of notices by citizens through clearer descriptions could better achieve the Privacy Act’s objective of publishing a public notice of the “existence and character” of systems of records. Set requirements to ensure that purpose, collection limitations, and use limitations are better addressed in the content of privacy notices. Additional requirements could be established for the content and preparation of system-of-records notices, to include a specific description of the planned purpose of a system as well as what data needs to be collected to serve that purpose and how its use will be limited to that purpose, including descriptions of primary and secondary uses of information. Agencies may be able to use material developed for PIAs to help meet these requirements. Setting these requirements could spur agencies to prepare notices that include more meaningful descriptions of the intents and purposes of their systems of records. Make all notices available on a governmentwide privacy Web site. Experts at our forum and agency officials also agreed that the most effective and practical method for sharing information with the public is through the Web. Relevant privacy notices could be published at a central governmentwide location, such as www.privacy.gov, and at corresponding standard locations on agency Web sites, such as www.agency.gov/privacy. Given that adequate attention is paid to making the information searchable as well as easy to locate and peruse, such a Web site has the potential to reach a far broader spectrum of users than the Federal Register. Current laws and guidance governing the federal government’s collection, use, and disclosure of personal information have gaps and other potential shortcomings in three broad categories: (1) the Privacy Act and E-Government Act do not always provide protections for federal uses of personal information, (2) laws and guidance may not effectively limit agency collection and use of personal information to specific purposes, and (3) the Privacy Act may not include effective mechanisms for informing the public. These issues merit congressional attention as well as continued public debate. Some of these issues—particularly those dealing with limitations on collection and use as well as mechanisms for informing the public— could be addressed by OMB through revisions or supplements to guidance. However, unilateral actions by OMB would not have the benefit of public deliberations regarding how best to achieve an appropriate balance between the government’s need to collect, process, and share personally identifiable information and the rights of individuals to know about such collections and be assured that they are only for limited purposes and uses. Striking such a balance is properly the responsibility of Congress. In assessing the appropriate balance between the needs of the federal government to collect personally identifiable information for programmatic purposes and the assurances that individuals should have that their information is being sufficiently protected and properly used, Congress should consider amending applicable laws, such as the Privacy Act and the E-Government Act, according to the alternatives outlined in this report, including: revising the scope of the laws to cover all personally identifiable information collected, used, and maintained by the federal government; setting requirements to ensure that the collection and use of personally identifiable information is limited to a stated purpose; and establishing additional mechanisms for informing the public about privacy protections by revising requirements for the structure and publication of public notices. We received written comments on a draft of this report from the Deputy Administrator of the Office of E-Government and Information Technology and the Deputy Administrator of the Office of Information and Regulatory Affairs of OMB. The letter is reprinted in appendix V. In their comments, the officials noted that they shared our concerns about privacy and listed guidance the agency has issued in the areas of privacy and information security. The officials stated they believe it would be important for Congress to consider potential amendments to the Privacy Act and the E-Government Act in the broader context of the several privacy statutes that Congress has enacted. Though we did not make specific recommendations to OMB, the agency provided comments on the alternatives identified in conjunction with our matter for congressional consideration. Regarding alternatives for revising the scope of laws to cover all personally identifiable information collected, used, and maintained by the federal government, OMB stated that it would be important for Congress to evaluate fully the potential implications of revisions such as amending the Privacy Act’s system-of-records definition. We believe that, given the Privacy Act’s controls on the collection, use, and disclosure of personally identifiable information do not consistently protect such information in all circumstances of its collection and use throughout the federal government, amending the act’s definition of a system of records is an important alternative for Congress to consider. However, we agree with OMB that such consideration should be thorough and include further public debate on all relevant issues. Regarding alternatives for setting requirements to ensure that the collection and use of personally identifiable information is limited to a stated purpose, OMB stated that agencies are working to implement a requirement in a recent OMB memorandum to review and reduce the volume of personally identifiable information they handle “to the minimum necessary.” The draft report notes that this requirement is in place; however, because significant concerns were raised about this issue by our previous work and by experts at our forum, we believe Congress should consider additional alternatives for ensuring that the collection and use of personally identifiable information is limited to a stated purpose. Finally, regarding effective mechanisms for informing the public, OMB stated that it supports ensuring that the public is appropriately informed of how agencies are using their information. OMB stated that they will review agency practices in informing the public and review the alternatives outlined in our report. OMB provided additional technical comments, which are addressed in appendix V. We also received technical comments from DHS, DOJ, DOT, and IRS. We have addressed these comments in the final report as appropriate. Unless you publicly announce the content of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Attorney General, the Secretaries of Homeland Security, Health and Human Services, and Transportation; the Commissioners of the Internal Revenue Service and the Social Security Administration; the Director, Office of Management and Budget; and other interested congressional committees. Copies will be made available at no charge on our Web site, www.gao.gov. If you have any questions concerning this report, please call me at (202) 512-6240 or send e-mail to koontzl@gao.gov. Contact points for our office of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix VI. Our objective was to identify major issues regarding whether the Privacy Act of 1974, the E-Government Act of 2002, and related guidance consistently cover the federal government’s collection and use of personal information and incorporate key privacy principles, and in doing so, to identify options for addressing these issues. Our objective was not focused on evaluating compliance with these laws; rather, it was to identify major issues concerning their sufficiency in light of current uses of personal information by the federal government. To address our objective, we reviewed and analyzed the Privacy Act, section 208 of the E-Government Act, and related Office of Management and Budget (OMB) guidance to determine the types of activities and information they apply to and to identify federal agency privacy responsibilities. We compared privacy protection requirements of these laws and related OMB guidance with the Fair Information Practices to identify any issues or gaps in privacy protections for personal information controlled by the federal government. In this regard, we also assessed the role of the Paperwork Reduction Act in protecting privacy by limiting collection of information. We also drew upon our prior work to identify examples of potential gaps in addressing the Fair Information Practices. A list of related GAO products can be found at the end of this report. We also obtained an operational perspective on these issues by analyzing agency privacy-related polices and procedures and through discussion sessions on the sufficiency of these laws with senior agency privacy officials at six federal agencies. These agencies were the Departments of Health and Human Services, Homeland Security, Justice, and Transportation; the Internal Revenue Service; and the Social Security Administration. We selected these agencies because they have large inventories of information collections, prominent privacy issues, and varied missions. Additionally, our colleagues at the National Academy of Sciences (NAS) agreed that this selection was appropriate for obtaining an operational perspective on these issues. The perspective obtained from the six agencies is not representative governmentwide. However, because we selected these agencies based on a rigorous set of selection criteria, the information we gathered during this discussion session provided us with an overview and operational perspective of key privacy-related policies and procedures. The design of our discussion session was informed by a small group meeting held with several agency privacy officials in June 2007. To obtain a citizen-centered perspective on the impact of gaps in privacy laws and guidance, we contracted with NAS to convene an expert panel. The panel, which was held in October 2007, consisted of 12 privacy experts, who were selected by NAS and were from varying backgrounds, such as academic, commercial, advocacy, and other private-sector communities. A list of the individuals participating in the expert forum can be found in appendix II. We developed an agenda and facilitated a detailed discussion concerning major issues with the existing framework of privacy laws. In addition, we met separately with Franklin Reeder, an expert involved in development of the Privacy Act and OMB guidance on the act, who was unable to participate in the expert forum. To identify options for addressing major issues identified, we drew from our own analysis, our interviews with senior agency privacy officials, as well as feedback and suggestions brought forth during the expert forum. We conducted this performance audit from March 2007 to May 2008, in Washington, D.C., in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We contracted with NAS to convene a panel of privacy experts outside government to obtain a citizen-centered perspective on the impact of gaps in privacy laws and guidance. Below is a listing of panel participants and their current affiliations: Jennifer Barrett, Privacy Leader, Acxiom Corporation Fred Cate, Distinguished Professor, Indiana University School of Law- Bloomington Daniel Chenok, Senior Vice President, Pragmatics Robert Gellman, Privacy and Information Policy Consultant Jim Harper, Director, Cato Institute, Information Policy Studies Nuala O’Connor Kelly, Chief Privacy Leader, General Electric Company Priscilla M. Regan, Professor of Government and Politics, George Mason University, Department of Public and International Affairs Leslie Ann Reis, Director & Adjunct Professor of Law, The John Marshall Law School Center for Information Technology and Privacy Law David Sobel, Senior Counsel, Electronic Frontier Foundation John T. Sabo, Director, Global Government Relations, Computer Associates, Inc. Barry Steinhardt, American Civil Liberties Union, Technology and Liberty Program Peter Swire, C. William O’Neill Professor of Law, Ohio State University, Moritz College of Law NAS staff assisting in coordinating the selection of experts and organizing the forum included, Joan Winston, Program Officer; Kristen Batch, Associate Program Officer; and Margaret Huynh, Senior Program Assistant. Agencies are allowed to claim exemptions from some of the provisions of the Privacy Act if the records are used for certain purposes such as law enforcement. The Privacy Act also provides that agencies not disclose information from a system of records without prior written consent of the individual to whom the record pertains, unless the disclosure falls under 1 of 12 exceptions defined by the act. Subsections (j) and (k) of the Privacy Act prescribe the circumstances under which exemptions can be claimed and identify the provisions of the act from which agencies can claim exemptions. When an agency uses the authority in the act to exempt a system of records from certain provisions, it is to issue a rule explaining the reasons for the exemption. Subsection (k) of the Privacy Act permits agencies to claim specific exemptions from seven provisions of the act that relate to notice to an individual concerning the use of personal information, requirements that agencies maintain only relevant and necessary information, and procedures for permitting access to and correction of an individual’s records, when the records are 1. subject to the exemption for classified information in b(1) of the Freedom of Information Act; 2. certain investigatory material compiled for law enforcement purposes other than material within the scope of a broader category of investigative records compiled for civil or criminal law enforcement purposes addressed in subsection (j); 3. maintained in connection with providing protective services to the President of the United States; 4. required by statute to be maintained and used solely as statistical 5. certain investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for federal civilian employment, military service, federal contracts, or access to classified information; 6. certain testing or examination material used solely to determine individual qualifications for appointment or promotion in the federal service; and 7. certain evaluation material used to determine potential promotion in Under these circumstances, agencies may claim exemptions from the provisions of the act, described in table 5. Subsection (j) provides a broader set of general exemptions, which permits records maintained by the Central Intelligence Agency or certain records maintained by an agency which has enforcement of criminal laws as its principal function to be exempted from any provision of the act, except those described in table 6. In general, the exemptions for law enforcement purposes are intended to prevent the disclosure of information collected as part of an ongoing investigation that could impair the investigation or allow those under investigation to change their behavior or take other actions to escape prosecution. Subsection (b) of the Privacy Act provides that “No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be 1. to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties; 2. required under the Freedom of Information Act; 3. for a routine use as defined in the act; 4. to the Bureau of the Census for planning or carrying out a census or survey or related activity; 5. for statistical research, provided the information is not individually 6. to the National Archives and Records Administration for historical 7. to any government agency (e.g., federal, state, or local) for a civil or criminal law enforcement activity if the head of the agency has made a written request specifying the information desired and the law enforcement activity for which the record is sought; 8. to a person upon showing compelling circumstances affecting the health or safety of an individual if notice is transmitted to the last known address of such individual; 9. to either House of Congress or any committee or subcommittee with 10. to the Government Accountability Office; 11. pursuant to a court order; or 12. to a consumer reporting agency for the purpose of collecting a claim of the government.” Since its 1975 Privacy Act Implementation Guidelines, OMB has periodically issued guidance related to privacy addressing specific issues as they have arisen. Nearly all of this guidance can be found on the OMB Web site, www.whitehouse.gov/omb, by searching in the “Agency Information” and “Information and Regulatory Affairs” sections of the Web site. Memorandum M-08-09 — New FISMA Privacy Reporting Requirements for FY 2008. January 18, 2008. Top Ten Risks Impeding the Adequate Protection of Government Information. July 2007. Memorandum M-07-19 — FY 2007 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management. July 25, 2007. Guidance on Protecting Federal Employee Social Security Numbers and Combating Identity Theft. June 18, 2007. OMB Implementation Guidance for Title V of the E-Government Act of 2002. June 15, 2007. Memorandum M-07-16 — Safeguarding Against and Responding to the Breach of Personally Identifiable Information. May 22, 2007. Use of Commercial Credit Monitoring Services Blanket Purchase Agreements (BPA). December 22, 2006. Recommendations for Identity Theft Related Data Breach Notification. September 20, 2006. Memorandum M-06-20 — FY 2006 Reporting Instructions for FISMA. July 17, 2006. Memorandum M-06-19 — Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments. July 12, 2006. Memorandum M-06-16 — Protection of Sensitive Agency Information. June 23, 2006. Memorandum M-06-15 — Safeguarding Personally Identifiable Information. May 22, 2006. Memorandum M-06-06 — Sample Privacy Documents for Agency Implementation of HSPD-12 Common Identification Standard. February 17, 2006. Memorandum M-05-15 — FY 2005 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management. June 13, 2005. Memorandum M-05-08 — Designation of Senior Agency Officials for Privacy. February 11, 2005. Memorandum M-03-22 — Guidance for Implementing the Privacy Provisions of the E-Government Act. September 26, 2003. Memorandum M-03-18 — Implementation Guidance for the E- Government Act of 2002. August 1, 2003. Guidance on Inter-Agency Sharing of Personal Data—Protection Personal Privacy. December 20, 2000. Baker/Spotila Letters and Memorandum M-00-13 – Privacy Policies and Date Collection on Federal Websites. June 22, July 28, and September 5, 2000. Status of Biennial Reporting Requirements Under the Privacy Act and the Computer Matching and Privacy Protection Act. June 21, 2000. Memorandum M-99-18 — Privacy Policies on Federal Web Sites. June 2, 1999. Memorandum M-99-05 — Instructions on Complying with “Privacy and Personal Information in Federal Records.” January 7, 1999. Biennial Privacy Act and Computer Matching Reports. June 1998. Privacy in Personal Information in Federal Records. May 4, 1998. Privacy Act Responsibilities for Implementing the Personal Responsibility and Work Opportunity Reconciliation Act (PRWORA) of 1996. November 3, 1997. Office of Management and Budget Order Providing for the Confidentiality of Statistical Information and Extending the Coverage of Energy Statistical Programs Under the Federal Statistical Confidentiality Order. June 27, 1997. Report of the Privacy Working Group: Principles for Providing and Using Personal Information. June 1995. OMB Guidance on Computer Matching and Privacy Protection Amendments of 1990 and Privacy Act of 1974. April 23, 1991. Office of Management and Budget Final Guidance Interpreting the Provisions of the Computer Matching and Privacy Protection Act of 1988. June 19, 1989. OMB Guidance on the Privacy Act Implications of “Call Detail” Programs. April 20, 1987. OMB Circular A-130, Management of Federal Information Resources, including Federal Agency Responsibilities for Maintaining Records About Individuals, and Implementation of the Paperwork Elimination Act. November 28, 2000. Updates to Original OMB Privacy Act Guidance. May 24, 1985. Revised Supplemental Guidance on Implementation of the Privacy Act of 1974. March 29, 1984. Guidelines on the Relationship of the Debt Collection Act of 1982 to the Privacy Act of 1974. April 11, 1983. OMB Supplemental Guidance for Conducting Matching Programs. May 14, 1982. Supplementary Guidance for Implementation of the Privacy Act of 1974. November 21, 1975. Congressional Inquiries Which Entail Access to Personal Information Subject to the Privacy Act. October 3, 1975. Privacy Act Implementation Guidelines and Responsibilities. July 9, 1975. The following is GAO’s response to OMB’s additional comments. 1. Statements in the 2005 report regarding the draft OMB Paperwork Reduction Act guidance were accurate for that review and supported by the evidence gathered. For that report, among other things, we selected detailed case reviews of 12 OMB-approved collections and compared the agencies’ processes and practices in these case studies with the (1) act’s requirements, (2) OMB’s regulation and draft guidance to agencies, and (3) agencies’ written directives and orders. Nevertheless, in its written response to the 2005 report, OMB officials stated that OMB's draft PRA guidance to agencies had become outmoded. Further, in its response, OMB stated that the report had convinced them that its draft PRA guidance did not serve its intended purpose and that it would explore alternative approaches to advising agencies on their PRA responsibilities. Accordingly, because the draft guidance has not been in effect since the 2005 report was issued, we have removed statements from our current draft regarding this guidance. 2. As we stated in our response to OMB’s comments on our 2003 report, we consider this report to be a comprehensive and accurate source of information on agencies’ implementation of the Privacy Act. Our conclusions were based on the results of a comprehensive analysis of agency compliance with a broad range of requirements. 3. We agree that the responsibility for limiting the collection of personally identifiable information to what is authorized and necessary will require ongoing attention by agencies and oversight by OMB. We also believe that Congress should consider alternatives, as identified in our report, to improve controls on the collection and use of personally identifiable information. In addition to the contact person named above, John de Ferrari (Assistant Director), Shaun Byrnes, Susan Czachor, Barbara Collier, Tim Eagle, Matt Grote, Rebecca LaPaze, David Plocher, Jamie Pressman, and Andrew Stavisky made key contributions to this report. Aviation Security: Efforts to Strengthen International Passenger Prescreening Are Under Way, but Planning and Implementation Issues Remain. GAO-07-346. Washington, D.C.: May 16, 2007. DHS Privacy Office: Progress Made but Challenges Remain in Notifying and Reporting to the Public. GAO-07-522, Washington, D.C.: April 27, 2007. Homeland Security: Continuing Attention to Privacy Concerns Is Needed as Programs Are Developed. GAO-07-630T. Washington, D.C: March 21, 2007. Data Mining: Early Attention to Privacy in Developing a Key DHS Program Could Reduce Risks. GAO-07-293. Washington, D.C.: February 28, 2007. Border Security: US-VISIT Program Faces Strategic, Operational, and Technological Challenges at Land Ports of Entry. GAO-07-248. Washington, D.C.: December 6, 2006. Personal Information: Key Federal Privacy Laws Do Not Require Information Resellers to Safeguard All Sensitive Data. GAO-06-674. Washington, D.C.: June 26, 2006. Veterans Affairs: Leadership Needed to Address Information Security Weaknesses and Privacy Issues. GAO-06-866T. Washington, D.C.: June 14, 2006. Privacy: Preventing and Responding to Improper Disclosures of Personal Information. GAO-06-833T. Washington, D.C.: June 8, 2006. Privacy: Key Challenges Facing Federal Agencies. GAO-06-777T. Washington, D.C.: May 17, 2006. Personal Information: Agencies and Resellers Vary in Providing Privacy Protections. GAO-06-609T. Washington, D.C.: April 4, 2006. Personal Information: Agency and Reseller Adherence to Key Privacy Principles. GAO-06-421. Washington, D.C.: April 4, 2006. Information Sharing: The Federal Government Needs to Establish Policies and Processes for Sharing Terrorism-Related and Sensitive but Unclassified Information. GAO-06-385. Washington, D.C.: March 17, 2006. Paperwork Reduction Act: New Approaches Can Strengthen Information Collection and Reduce Burden. GAO-06-477T. Washington, D.C.: March 8, 2006. Data Mining: Agencies Have Taken Key Steps to Protect Privacy in Selected Efforts, but Significant Compliance Issues Remain. GAO-05-866. Washington, D.C.: August 15, 2005. Aviation Security: Transportation Security Administration Did Not Fully Disclose Uses of Personal Information during Secure Flight Program Testing in Initial Privacy Notices, but Has Recently Taken Steps to More Fully Inform the Public. GAO-05-864R. Washington, D.C.: July 22, 2005. Identity Theft: Some Outreach Efforts to Promote Awareness of New Consumer Rights Are Under Way. GAO-05-710. Washington, D.C.: June 30, 2005. Information Security: Radio Frequency Identification Technology in the Federal Government. GAO-05-551. Washington, D.C.: May 27, 2005. Aviation Security: Secure Flight Development and Testing Under Way, but Risks Should Be Managed as System Is Further Developed. GAO-05- 356. Washington, D.C.: March 28, 2005. Social Security Numbers: Governments Could Do More to Reduce Display in Public Records and on Identity Cards. GAO-05-59. Washington, D.C.: November 9, 2004. Data Mining: Federal Efforts Cover a Wide Range of Uses. GAO-04-548. Washington, D.C.: May 4, 2004. Aviation Security: Computer-Assisted Passenger Prescreening System Faces Significant Implementation Challenges. GAO-04-385. Washington, D.C.: February 12, 2004. Privacy Act: OMB Leadership Needed to Improve Agency Compliance. GAO-03-304. Washington, D.C.: June 30, 2003. Data Mining: Results and Challenges for Government Programs, Audits, and Investigations. GAO-03-591T. Washington, D.C.: March 25, 2003. Technology Assessment: Using Biometrics for Border Security. GAO-03- 174. Washington, D.C.: November 15, 2002. Information Management: Selected Agencies’ Handling of Personal Information. GAO-02-1058. Washington, D.C.: September 30, 2002. Identity Theft: Greater Awareness and Use of Existing Data Are Needed. GAO-02-766. Washington, D.C.: June 28, 2002. Social Security Numbers: Government Benefits from SSN Use but Could Provide Better Safeguards. GAO-02-352. Washington, D.C.: May 31, 2002.

Summary: The centerpiece of the federal government's legal framework for privacy protection, the Privacy Act of 1974, provides safeguards for information maintained by federal agencies. In addition, the E-Government Act of 2002 requires federal agencies to conduct privacy impact assessments for systems or collections containing personal information. GAO was asked to determine whether laws and guidance consistently cover the federal government's collection and use of personal information and incorporate key privacy principles. GAO was also asked, in doing so, to identify options for addressing these issues. To achieve these objectives, GAO analyzed the laws and related guidance, obtained an operational perspective from federal agencies, and consulted an expert panel convened by the National Academy of Sciences. Increasingly sophisticated ways of obtaining and using personally identifiable information have raised concerns about the adequacy of the legal framework for privacy protection. Although the Privacy Act, the E-Government Act, and related guidance from the Office of Management and Budget set minimum privacy requirements for agencies, they may not consistently protect personally identifiable information in all circumstances of its collection and use throughout the federal government and may not fully adhere to key privacy principles. Based on discussions with privacy experts, agency officials, and analysis of laws and related guidance, GAO identified issues in three major areas: Applying privacy protections consistently to all federal collection and use of personal information. The Privacy Act's definition of a "system of records" (any grouping of records containing personal information retrieved by individual identifier), which sets the scope of the act's protections, does not always apply whenever personal information is obtained and processed by federal agencies. One alternative to address this concern would be revising the system-of-records definition to cover all personally identifiable information collected, used, and maintained systematically by the federal government. Ensuring that collection and use of personally identifiable information is limited to a stated purpose. According to generally accepted privacy principles of purpose specification, collection limitation, and use limitation, the collection of personal information should be limited, and its use should be limited to a specified purpose. Yet, current laws and guidance impose only the modest requirements in these areas. While, in the post-9/11 environment, the federal government needs better analysis and sharing of certain personal information, there is general agreement that this need must be balanced with individual privacy rights. Alternatives to address this area of concern include requiring agencies to justify the collection and use of key elements of personally identifiable information and to establish agreements before sharing such information with other agencies. Establishing effective mechanisms for informing the public about privacy protections. Another key privacy principle, the principle of openness, suggests that the public should be informed about privacy policies and practices. Yet, Privacy Act notices may not effectively inform the public about government uses of personal information. For example, system-of-records notices published in the Federal Register (the government's official vehicle for issuing public notices) may be difficult for the general public to fully understand. Layered notices, which provide only the most important summary facts up front, have been used as a solution in the private sector. In addition, publishing such notices at a central location on the Web would help make them more accessible.