Before advanced computerized techniques for aggregating, analyzing, and disseminating data came into widespread use, personal information contained in paper-based public records at courthouses or other government offices was relatively difficult to obtain, usually requiring a personal visit to inspect the records. Nonpublic information, such as personal information contained in product registrations, insurance applications, and other business records, was also generally inaccessible. In recent years, however, advances in technology have spawned information reseller businesses that systematically collect extensive amounts of personal information from a wide variety of sources and make it available electronically over the Internet and by other means to customers in both government and the private sector. This automation of the collection and aggregation of multiple-source data, combined with the ease and speed of its retrieval, have dramatically reduced the time and effort needed to obtain information of this type. Among the primary customers of information resellers are financial institutions (including insurance companies), retailers, law offices, telecommunications and technology companies, and marketing firms. We use the term “information resellers” to refer to businesses that vary in many ways but have in common the fact that they collect and aggregate personal information from multiple sources and make it available to their customers. These businesses do not all focus exclusively on aggregating and reselling personal information. For example, Dun & Bradstreet primarily provides information on commercial enterprises for the purpose of contributing to decision making regarding those enterprises. In doing so, it may supply personal information about individuals associated with those commercial enterprises. To a certain extent, the activities of information resellers may also overlap with the functions of consumer reporting agencies, also known as credit bureaus—entities that collect and sell information about individuals’ creditworthiness, among other things. As is discussed further below, to the extent that information resellers perform the functions of consumer reporting agencies, they are subject to legislation specifically addressing that industry, particularly the Fair Credit Reporting Act. Information resellers obtain personal information from many different sources. Generally, three types of information are collected: public records, publicly available information, and nonpublic information. Public records are a primary source of information about consumers, available to anyone, and can be obtained from governmental entities. What constitutes public records is dependent upon state and federal laws, but generally these include birth and death records, property records, tax lien records, motor vehicle registrations, voter registrations, licensing records, and court records (including criminal records, bankruptcy filings, civil case files, and legal judgments). Publicly available information is information not found in public records but nevertheless publicly available through other sources. These sources include telephone directories, business directories, print publications such as classified ads or magazines, Internet sites, and other sources accessible by the general public. Nonpublic information is derived from proprietary or nonpublic sources, such as credit header data, product warranty registrations, and other application information provided to private businesses directly by consumers. Private sector businesses rely on information resellers for information to support a variety of activities, such as conducting pre-employment background checks on prospective verifying individuals’ identities by reviewing records of their personal marketing commercial products to consumers matching specified preventing financial fraud by examining insurance, asset, and other financial record information. Typically, while information resellers may collect and maintain personal information in a variety of databases, they provide their customers with a single, consolidated online source for a broad array of personal information. Figure 1 illustrates how information is collected from multiple sources and ultimately accessed by customers, including government agencies, through contractual agreements. In addition to providing consolidated access to personal information through Internet-based Web sites, information resellers offer a variety of products tailored to the specific needs of various lines of business. For example, an insurance company could obtain different products covering police and accident reports, insurance carrier information, vehicle owner verification or claims history, or online public records. Typically, services offered to law enforcement officers include more information—including sensitive information, such as full Social Security numbers and driver’s license numbers—than is offered to other customers. There is no single federal law that governs all use or disclosure of personal information. Instead, U.S. law includes a number of separate statutes that provide privacy protections for information used for specific purposes or maintained by specific types of entities. The major requirements for the protection of personal privacy by federal agencies come from two laws, the Privacy Act of 1974 and the privacy provisions of the E-Government Act of 2002. The Federal Information Security Management Act of 2002 (FISMA) also addresses the protection of personal information in the context of securing federal agency information and information systems. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. It also defines “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public by a notice in the Federal Register identifying, among other things, the type of data collected, the types of individuals about whom information is collected, the intended “routine” uses of data, and procedures that individuals can use to review and correct personal information. The act’s requirements also apply to government contractors when agencies contract for the development and maintenance of a system of records to accomplish an agency function. The act limits its applicability to cases in which systems of records are maintained specifically on behalf of a government agency. Several provisions of the act require agencies to define and limit themselves to specific predefined purposes. For example, the act requires that to the greatest extent practicable, personal information should be collected directly from the subject individual when it may affect an individual’s rights or benefits under a federal program. The act also requires that an agency inform individuals whom it asks to supply information of (1) the authority for soliciting the information and whether disclosure of such information is mandatory or voluntary; (2) the principal purposes for which the information is intended to be used; (3) the routine uses that may be made of the information; and (4) the effects on the individual, if any, of not providing the information. According to OMB, this requirement is based on the assumption that individuals should be provided with sufficient information about the request to make a decision about whether to respond. In handling collected information, the Privacy Act also requires agencies to, among other things, allow individuals to (1) review their records (meaning any information pertaining to them that is contained in the system of records), (2) request a copy of their record or information from the system of records, and (3) request corrections in their information. Such provisions can provide a strong incentive for agencies to correct any identified errors. Agencies are allowed to claim exemptions from some of the provisions of the Privacy Act if the records are used for certain purposes. For example, records compiled for criminal law enforcement purposes can be exempt from a number of provisions, including (1) the requirement to notify individuals of the purposes and uses of the information at the time of collection and (2) the requirement to ensure the accuracy, relevance, timeliness, and completeness of records. A broader category of investigative records compiled for criminal or civil law enforcement purposes can also be exempted from a somewhat smaller number of Privacy Act provisions, including the requirement to provide individuals with access to their records and to inform the public of the categories of sources of records. In general, the exemptions for law enforcement purposes are intended to prevent the disclosure of information collected as part of an ongoing investigation that could impair the investigation or allow those under investigation to change their behavior or take other actions to escape prosecution. …information is handled: (i) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (ii) to determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (iii) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. Agencies must conduct PIAs (1) before developing or procuring information technology that collects, maintains, or disseminates information that is in a personally identifiable form or (2) before initiating any new data collections involving personal information that will be collected, maintained, or disseminated using information technology if the same questions are asked of 10 or more people. OMB guidance also requires agencies to conduct PIAs when a system change creates new privacy risks, for example, changing the way in which personal information is being used. The requirement does not apply to all systems. For example, no assessment is required when the information collected relates to internal government operations, the information has been previously assessed under an evaluation similar to a PIA, or when privacy issues are unchanged. FISMA also addresses the protection of personal information. FISMA defines federal requirements for securing information and information systems that support federal agency operations and assets; it requires agencies to develop agencywide information security programs that extend to contractors and other providers of federal data and systems. Under FISMA, information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction, including controls necessary to preserve authorized restrictions on access and disclosure to protect personal privacy, among other things. OMB is tasked with providing guidance to agencies on how to implement the provisions of the Privacy Act and the E-Government Act and has done so, beginning with guidance on the Privacy Act, issued in 1975. The guidance provides explanations for the various provisions of the law as well as detailed instructions for how to comply. OMB’s guidance on implementing the privacy provisions of the E-Government Act of 2002 identifies circumstances under which agencies must conduct PIAs and explains how to conduct them. OMB has also issued guidance on implementing the provisions of FISMA. Although federal laws do not specifically regulate the information reseller industry as a whole, they provide safeguards for personal information under certain specific circumstances, such as when financial or health information is involved, or for such activities as pre-employment background checks. Specifically, the Fair Credit Reporting Act, the Gramm- Leach-Bliley Act, the Driver’s Privacy Protection Act, and the Health Insurance Portability and Accountability Act all restrict the ways in which businesses, including information resellers, may use and disclose consumers’ personal information (see app. II for more details about these laws). The Gramm-Leach-Bliley Act, for example, limits financial institutions’ disclosure of nonpublic personal information to nonaffiliated third parties and requires companies to give consumers privacy notices that explain the institutions’ information sharing practices. Consumers then have the right to limit some, but not all, sharing of their nonpublic personal information. As shown in table 1, these laws either restrict the circumstances under which entities such as information resellers are allowed to disclose personal information or restrict the parties with whom they are allowed to share information. Information resellers are also affected by various state laws. For example, California state law requires businesses to notify consumers about security breaches that could directly affect them. Legal requirements, such as the California law, led ChoicePoint, a large information reseller, to notify its customers in mid-February 2005 of a security breach in which unauthorized persons gained access to personal information from its databases. Since the ChoicePoint notification, bills were introduced in at least 35 states and enacted in at least 22 states that require some form of notification upon a security breach. The Fair Information Practices are a set of internationally recognized privacy protection principles. First proposed in 1973 by a U.S. government advisory committee, the Fair Information Practices were intended to address what the committee termed a poor level of protection afforded to privacy under contemporary law. A revised version of the Fair Information Practices, developed by the Organization for Economic Cooperation and Development (OECD) in 1980, has been widely adopted. The OECD principles are shown in table 2. The Fair Information Practices are, with some variation, the basis of privacy laws and related policies in many countries, including the United States, Germany, Sweden, Australia, New Zealand, and the European Union. They are also reflected in a variety of federal agency policy statements, beginning with an endorsement of the OECD principles by the Department of Commerce in 1981, and including policy statements of the DHS, Justice, Housing and Urban Development, and Health and Human Services. In 2004, the Chief Information Officers Council issued a coordinating draft of their Security and Privacy Profile for the Federal Enterprise Architecture that links privacy protection with a set of acceptable privacy principles corresponding to the OECD’s version of the Fair Information Practices. The Fair Information Practices are not precise legal requirements. Rather, they provide a framework of principles for balancing the need for privacy with other public policy interests, such as national security, law enforcement, and administrative efficiency. Striking that balance varies among countries and among types of information (e.g., medication versus employment information). The Fair Information Practices also underlie the provisions of the Privacy Act of 1974. For example, the system of records notice required under the Privacy Act embodies the purpose specification, openness, and individual participation principles in that it provides a public accounting through the Federal Register of the purpose and uses for personal information, and procedures by which individuals may access and correct, if necessary, information about themselves. Further, the E-Government Act’s requirement to conduct PIAs likewise reflects the Fair Information Practices. Under the act, agencies are to make these assessments publicly available, if practicable, through agency Web sites or by publication in the Federal Register, or other means. To the extent that such assessments are made publicly available, they also provide notice to the public about the purpose of planned information collections and the planned uses of the information being collected. A number of congressional hearings were held and bills introduced in 2005 in the wake of widely publicized data security breaches at major information resellers such as ChoicePoint and LexisNexis as well as other firms. In March 2005, the House Subcommittee on Commerce, Trade, and Consumer Protection of the House Energy and Commerce Committee held a hearing entitled “Protecting Consumers’ Data: Policy Issues Raised by ChoicePoint,” which focused on potential remedies for security and privacy concerns regarding information resellers. Similar hearings were held by the House Energy and Commerce Committee and by the U.S. Senate Committee on Commerce, Science, and Transportation in spring 2005. The heightened interest in this subject led a number of Members of Congress to propose a variety of bills aimed at regulating companies that handle personal information, including information resellers. Several of these bills require companies such as information resellers to notify the public of security breaches, while a few also allow consumers to “freeze” their credit (i.e., prevent new credit accounts from being opened without special forms of authentication), or see and correct personal information contained in reseller data collections. Other proposed legislation includes (1) the Data Accountability and Trust Act, requiring security policies and procedures to protect computerized data containing personal information and nationwide notice in the event of a security breach, and (2) the Personal Data Privacy and Security Act of 2005, requiring data brokers to disclose personal electronic records pertaining to an individual and inform individuals on procedures for correcting inaccuracies. Primarily through governmentwide contracts, Justice, DHS, State, and SSA reported using personal information obtained from resellers for a variety of purposes, including law enforcement, counterterrorism, fraud detection/prevention, and debt collection. Most uses by Justice were for law enforcement and counterterrorism, such as investigations of fugitives and obtaining information on witnesses and assets held by individuals of interest. DHS also used reseller information primarily for law enforcement and counterterrorism, such as screening vehicles entering the United States. State and SSA reported acquiring personal information from information resellers for fraud detection and investigation, identity verification, and benefit eligibility determination. The four agencies reported approximately $30 million in contractual arrangements with information resellers in fiscal year 2005. Justice accounted for most of the funding (about 63 percent). Approximately 91 percent of agency uses of reseller data were in the categories of law enforcement (69 percent) or counterterrorism (22 percent). Figure 2 details contract values categorized by their reported use. (Details on uses by each agency are given in the individual agency discussions.) According to Justice contract documentation, access to up-to-date and comprehensive public record information is a critical ongoing mission requirement, and the department relies on a wide variety of information resellers—including ChoicePoint, Dun & Bradstreet, LexisNexis, and West—to meet that need. Departmental use of information resellers was primarily for purposes related to law enforcement (75 percent) and counterterrorism (18 percent), including support for criminal investigations, location of witnesses and fugitives, information on assets held by individuals under investigation, and detection of fraud in prescription drug transactions. In fiscal year 2005, Justice and its components reported approximately $19 million in acquisitions from information resellers involving personal information. The department acquired these services primarily through use of GSA’s Federal SupplySchedule offerings including a blanket purchase agreement with ChoicePoint valued at approximately $15 million. Several component agencies, such as the Federal Bureau of Investigation (FBI), the Drug Enforcement Administration (DEA), and the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) placed orders with information resellers based on the schedules. In addition, for fiscal year 2005, Justice established separate departmentwide contracts with LexisNexis and West valued at $4.5 million and $5.2 million, respectively. Tasked to protect and defend the United States against terrorist and foreign intelligence threats and to enforce criminal laws, the FBI is Justice’s largest user of information resellers, with about $11 million in contracts in fiscal year 2005. The majority of FBI’s use involves two major programs, the Public Source Information Program and the Foreign Terrorist Tracking Task Force (FTTTF). In support of the investigative and intelligence missions of the FBI, the Public Source Information Program provides all offices of the FBI with access via the Internet to public record, legal, and news media information available from various online commercial databases. These databases are used to assist with investigations by identifying the location of individuals and identifying alias names, Social Security numbers, relatives, dates of birth, telephone numbers, vehicles, business affiliations, other associations, and assets. Public Source Information Program officials reported that use of these commercial databases often results in new information regarding the subject of the investigation. Officials noted that commercial databases are used in preliminary investigations, and that subsequently, investigative personnel must verify the results of each search. The FBI’s FTTTF also contracts with several information resellers (1) to assist in fulfilling its mission of assisting federal law enforcement and intelligence agencies in locating foreign terrorists and their supporters who are in or have visited the United States and (2) to provide information to other law enforcement and intelligence community agencies that can lead to their surveillance, prosecution, or removal. As we previously reported, FTTTF makes use of personal information from several commercial sources to analyze intelligence and detect terrorist activities in support of ongoing investigations by law enforcement agencies and the intelligence community. Information resellers provide FTTTF with names, addresses, telephone numbers, and other biographical and demographical information as well as legal briefs, vehicle and boat registrations, and business ownership records. Other Justice components reported using personal information from information resellers to support the conduct of investigations and other law enforcement-related activities. For example, the U.S. Marshals Service uses an information reseller to, among other things, locate fugitives by identifying a fugitive’s relatives and their addresses. Through interviews with relatives, a U.S. Marshal may be able to ascertain the location of a fugitive and subsequently apprehend the individual. DEA, the second largest Justice user of information resellers in fiscal year 2005, obtains reseller data to detect fraud in prescription drug transactions. Through these data, DEA agents can detect irregular prescription patterns for specific drugs and trace this information to the pharmacy and prescribing doctor. DEA also uses an information reseller to locate individuals in asset forfeiture cases. Reseller data allows DEA to identify all possible addresses for an individual in order to meet the agency’s obligation to make a reasonable effort to notify individuals of seized property and inform them of their rights to contest the seizures. Other uses reported by Justice components are not related to law enforcement. For example, uses by the U.S. Trustees, Antitrust, Civil, Tax, and Criminal Divisions include ascertaining the financial status of individuals for debt collection purposes or bankruptcy proceedings or for the location of individuals for court proceedings. The Executive Office for U.S. Attorneys uses information resellers to ascertain the financial status of those indebted to the United States in order to assess the debtor’s ability to repay the debt. According to officials, information reseller databases may reveal assets that a debtor is attempting to conceal. Further, the U.S. Attorneys use information resellers to locate victims of federal crime in order to notify these individuals of relevant court proceedings pursuant to the Justice for All Act. Table 3 details in aggregate the vendors, fiscal year 2005 contract values, and reported uses for contracts with information resellers by major Justice components. In fiscal year 2005, DHS and its components reported that they used information reseller data primarily for law enforcement purposes, such as for developing leads on subjects in criminal investigations and detecting fraud in immigration benefit applications (part of enforcing the immigration laws). Counterterrorism uses involved screening programs at the northern and southern borders as well as at the nation’s airports. DHS reported planning to spend about $9 million acquiring personal information from resellers in fiscal year 2005. DHS acquired these services primarily for law enforcement (63 percent) and counterterrorism (35 percent) purposes through FEDLINK—a governmentwide contract vehicle provided by the Library of Congress—and GSA’s Federal Supply Schedule contracts as well as direct purchases by its components. DHS’s primary vehicle for acquiring data from information resellers was the FEDLINK contract vehicle, which DHS used to acquire reseller services from Choicepoint ($4.1 million), Dun & Bradstreet ($640,000), LexisNexis ($2 million), and West ($1 million). U.S. Immigration and Customs Enforcement (ICE) is DHS’s largest user of personal information from resellers, with acquisitions worth over $4.3 million. The largest investigative component of DHS, ICE has as its mission to prevent acts of terrorism by targeting the people, money, and materials that support terrorist and criminal activities. ICE uses information resellers to collect personal information for criminal investigative purposes and to perform background security checks. Data commonly obtained include address and vehicle information; according to officials, this information is either used to verify data already collected or is itself verified by investigators through other means. For example, ICE’s Federal Protective Service has about 50 users who access an information reseller database to assist in properly identifying and locating potential criminal suspects. Investigators may verify an address obtained from the database by confirming billing information with a utility company or by conducting “drive-by” surveillance. The Federal Protective Service views information obtained from resellers as “raw” or “unverified” data, which may or may not be of use to investigators. Other DHS components likewise reported using personal information from resellers to support investigations and other law enforcement-related activities. For example, U.S. Customs and Border Protection (CBP)— tasked with managing, controlling, and protecting the nation’s borders at and between the official ports of entry—uses information resellers for law enforcement, intelligence gathering, and prosecution support. Using these databases, investigators conduct queries on people, businesses, property, and corresponding links via a secure Internet connection. According to officials, information obtained is corroborated with other previously obtained data, open-source information, and investigative leads. CBP also uses a specially developed information reseller product to assist law enforcement officials in vehicle identification at northern and southern land borders. CBP uses electronic readers to capture license plate data on vehicles entering or exiting U.S. borders, converts the data to an electronic format, and transmits the data to an information reseller, which returns U.S. motor vehicle registration information to CBP. The license plate data, merged with the associated motor vehicle registration data provided by the reseller, are then checked against government databases in order to help assess risk related to vehicles (i.e., a vehicle whose license plate is associated with a law enforcement record might be referred for secondary examination). The Federal Emergency Management Agency (FEMA), charged with building and supporting the nation’s emergency management system, uses an information reseller to detect fraud in disaster assistance applications. FEMA uses this service to verify information that individuals present in their applications for disaster assistance via the Internet. At the time of application, an individual is required to pass an identity check that determines whether the presented identity exists, followed by an identity validation quiz to better ensure that the applicant corresponds to the identity presented. The information reseller is used to verify the applicant’s name, address, and Social Security number. DHS is also using information resellers in its counterterrorism efforts. For example, the Transportation Security Administration (TSA), tasked with protecting the nation’s transportation systems, used data obtained from information resellers as part of a test associated with the development of its domestic passenger prescreening program, called “Secure Flight.” TSA’s plans for Secure Flight involve the submission of passenger information by an aircraft operator to TSA whenever a reservation is made for a flight in which the origin and destination are domestic airports. In the prescreening of airline passengers, this information would be compared with federal watch lists of individuals known or suspected of activities related to terrorism. TSA conducted a test designed to help determine the extent to which information resellers could be used to authenticate passenger identity information provided by air carriers. It plans to use the test results to determine whether commercial data can be used to improve the effectiveness of watch-list matching by identifying passengers who would not have been identified from passenger name records and government data alone. The test results also may be used to identify items of personally identifying information that should be required of passengers to improve aviation security. Table 4 provides detailed information about DHS uses of information resellers in fiscal year 2005, as reported by officials of the department’s components. In an effort to ensure the accuracy of Social Security benefit payments, SSA and its components reported using approximately $1.3 million in contracts in fiscal year 2005 with information resellers for a variety of purposes relating to fraud prevention (66 percent), such as skiptracing, confirming suspected fraud related to workers compensation payments, obtaining information on criminal suspects for follow-up investigations (18 percent), and collecting debts (16 percent). SSA and its components acquired these services through the use of the GSA and FEDLINK governmentwide contracts and their own contracts. In fiscal year 2005, SSA contracted with ChoicePoint, LexisNexis, SourceCorp, and Equifax. The Office of the Inspector General (OIG), the largest user of information reseller data at SSA, supports the agency’s efforts to prevent fraud, waste, and abuse. The OIG uses several information resellers to assist investigative agents in detecting benefit abuse by Social Security claimants and to assist agents in locating claimants. For example, OIG agents access reseller data to verify the identity of subjects undergoing criminal investigations. Regional office agents may also use reseller data in investigating persons suspected of claiming disability fraudulently and draw upon assistance from OIG headquarters staff and state investigators from the state Attorney General’s office in these investigations. For example, the Northeastern Program Service Center, located in the New York branch of SSA, obtains New York State Workers Compensation Board data from SourceCorp, the only company legally permitted to maintain the physical and electronic records for New York State Workers Compensation. Through the use of this information, SSA can identify persons collecting workers compensation benefits but not reporting those benefits, as required, to the SSA. Table 5 details in aggregate the vendors, fiscal year 2005 contract values, and uses of contracts with information resellers reported by major SSA components. The Department of State and its components reported approximately $569,000 in contracts in fiscal year 2005 with information resellers, primarily for assistance in fraud related activities through criminal investigations (51 percent), fraud detection (26 percent), and other uses (23 percent) such as background screening. State acquired information reseller services through the GSA schedule and a Justice blanket-purchase agreement. In fiscal year 2005, the majority of State contracts were with ChoicePoint; the agency also had contracts with LexisNexis, Equifax and Metronet. State’s components reported use of these contracts mainly for passport- related activities. For example, several components of State accessed personal information to validate information submitted on immigrant and nonimmigrant visa petitions, such as marital or familial relationships, birth and identity information, and address validation. A major use of reseller data at State is by investigators acquiring information on suspects in passport and visa fraud cases. According to State, information reseller data are increasingly important to its operations, because the number of passport and visa fraud cases has increased, and successful investigations of passport and visa fraud are critical to combating terrorism. In addition to these uses, State acquires personal information through Equifax to support the financial background screening of its job applicants. Table 6 details the vendors, fiscal year 2005 contract values, and uses of contracts with information resellers reported by major State components. In fiscal year 2005, the four agencies acquired personal information primarily through governmentwide contracts, including GSA’s Federal Supply Schedule (52 percent) contracts and the Library of Congress’s FEDLINK contracts (28 percent). Components within these agencies also initiated separate contracts with resellers as well. The Department of Justice was the largest user, accounting for approximately $19 million of the $30 million total for all four agencies. Figure 3 shows the values of reseller data acquisition by agency for fiscal year 2005. In fiscal year 2005, the most common vehicles used among all four agencies to acquire personal information from information resellers were the governmentwide contracts made available through GSA’s Federal Supply Schedule. The GSA schedule provides agencies with simplified, streamlined contracting vehicles, allowing them to obtain access to information resellers’ services either by issuing task or purchase orders or by establishing blanket purchase agreements based on the schedule contracts. The majority of Justice’s acquisition of information reseller services was obtained through the GSA schedule, including a blanket purchase agreement with ChoicePoint that was also made available to non- Justice agencies (for example, the Departments of State and Health and Human Services). In addition, components of DHS such as the U.S. Secret Service and the SSA’s Office of Inspector General made use of GSA schedule contracts with information resellers. The Federal Supply Schedule allows agencies to take advantage of prenegotiated contracts with a variety of vendors, including information resellers. GSA does not assess fees for the use of these contracts; rather it funds the operation of the schedules in part by obtaining administrative fees from vendors on a quarterly basis. According to GSA officials, use of the schedule contracts allows agencies to obtain the best price and reduce their procurement lead time. Since these contracts have been prenegotiated, agencies do not need to issue their own solicitation. Instead, agencies may simply place a task order directly with the vendor, citing the schedule number. GSA’s role in administering these contracts is primarily to negotiate baseline contract requirements and pricing; it does not monitor which agencies are using its schedule contracts. GSA officials noted that the requirements contained in the schedule contracts are baseline, and agencies may add more stringent requirements to their individual task orders. Another contract vehicle commonly used to obtain personal information from information resellers was the Library of Congress’s FEDLINK service (28 percent). This vehicle was used by both DHS and SSA. FEDLINK, an intragovernmental revolving fund, is a cooperative procurement, accounting, and training program designed to provide access to online databases, periodical subscriptions, books, and other library and information support services from commercial suppliers, including information resellers. At DHS, use of the FEDLINK service was the primary vehicle for contracting with information resellers. DHS also used GSA schedule buys, and some smaller purchases were made directly between DHS components and information resellers. The majority of SSA’s fiscal year 2005 acquisitions from information resellers were through FEDLINK, with some use of the GSA schedule contracts. FEDLINK allows agencies to take advantage of prenegotiated contracts at volume discounts with a variety of vendors, including information resellers. As with the GSA schedule contracts, the requirements of the FEDLINK contracts serve as a baseline, and agencies may add more stringent requirements if they so choose. FEDLINK offers two different options for using its contracts: direct express and transfer pay. The direct express option is similar to the GSA schedule process, in which the agency issues a purchase order directly to the vendor and cites the underlying FEDLINK contract. Under direct express, the ordering agency is responsible for managing the delivery of products and services and paying invoices, and the vendor pays an administrative fee to the Library. Under the transfer pay option, ordering agencies must sign an interagency agreement and pay an administrative fee to the Library. In turn, the ordering agencies receive additional administrative services. DHS used both the direct express and transfer pay options in fiscal year 2005, while SSA used transfer pay exclusively. Although the information resellers that do business with the federal agencies we reviewed have practices in place to protect privacy, these measures were not fully consistent with the Fair Information Practices. Most significantly, the first four principles, relating to collection limitation, data quality, purpose specification, and use limitation, are largely at odds with the nature of the information reseller business. These principles center on limiting the collection and use of personal information and require data accuracy based on that limited purpose and limited use of the information. However, the information reseller industry presupposes that the collection and use of personal information is not limited to specific purposes, but instead that information can be collected and made available to multiple customers for multiple purposes. Resellers make it their business to collect large amounts of personal information and to combine that information in new ways so that it serves purposes other than those for which it was originally collected. Further, they are limited in their ability to ensure the accuracy, currency, or relevance of their holdings, because these qualities may vary based on customers’ varying uses. Information reseller policies and procedures were consistent with aspects of the remaining four Fair Information Practices. Large resellers reported implementing a variety of security safeguards, such as stringent customer credentialing, to improve protection of personal information. Resellers also generally provided public notice of key aspects of their privacy policies and practices, (relevant to the openness principle) and reported taking actions to ensure internal compliance with their own privacy policies (relevant to the accountability principle). However, resellers generally limited the extent to which individuals could gain access to personal information held about themselves, and because they obtain their information from other sources, most resellers also had limited provisions for correcting or deleting inaccurate information contained in their databases (relevant to the individual participation principle). Instead, they directed individuals wishing to make corrections to contact the original sources of the data. Table 7 provides an overview of information resellers’ application of the Fair Information Practices. According to the collection limitation principle of the Fair Information Practices, the collection of personal information should be limited, information should be obtained by lawful and fair means, and, where appropriate, it should be collected with the knowledge and consent of the individual. The collection limitation principle also suggests that organizations could limit collection to the minimum amount of data necessary to process a transaction. In practice, resellers are limited in the personal information that they can obtain by laws that apply to specific kinds of information (for example, the Fair Credit Reporting Act and the Gramm-Leach-Bliley Act, which restrict the collection, use, and disclosure of certain consumer and financial data). One reseller reported that it also restricts collection of Social Security number information from public records, as well as collection of identifying information on children from public sources, such as telephone directories. Beyond specific legal restrictions, information resellers generally attempt to aggregate large amounts of personal information so as to provide useful information to a broad range of customers. For example, resellers collect personal information from a wide variety of sources, including state motor vehicle records; local government records on births, real property, and voter registrations; and various court records. Information resellers may also obtain information from telephone directories, Internet sites, and consumer applications for products or services. The widely varying sources and types of information demonstrate the broad nature of the collection of personal information. The amount and scope of information collected vary from company to company, and resellers use this information to offer a range of products tailored to different markets and uses. Regarding the principle that information should be obtained by lawful and fair means, resellers stated that they take steps to ensure that their collection of information is legal. For example, resellers told us that they obtain assurances from their data suppliers that information is legally collected from reputable sources. Further, they design their products and services to ensure they are in conformance with laws such as the Gramm- Leach-Bliley Act and the Fair Credit Reporting Act. Regarding the principle that, where appropriate, information should be collected with the knowledge and consent of the individual, resellers do not make provisions to notify the individuals involved when they obtain personal data from their many sources, including public records. Concomitantly, individuals are not afforded an opportunity to express or withhold their consent when the information is collected. Resellers said they believe it may not be appropriate or practical for them to provide notice or obtain consent from individuals because they do not collect information directly from them. One reseller noted that in many instances the company does not have a direct relationship with the data subject and is therefore not in a position to interact with the consumer for purposes such as providing notice. Further, this reseller stated its belief that requiring resellers to notify and obtain consent from each individual about whom they obtain information would result in consumers being overwhelmed with notices and negate the value of notice. Under certain conditions, some information resellers offer consumers an “opt-out” option—that is, individuals may request that information about themselves be suppressed from selected databases. However, resellers generally offer this option only with respect to certain types of information and only under limited circumstances. For example, one reseller allows consumers to opt out of its marketing products but not other products, such as background screening and fraud detection products. The privacy policy for another information reseller states that it will allow certain individuals to opt out of its nonpublic information databases containing sensitive information under specific conditions: if the individual is a state, local, or federal law enforcement officer or public official whose position exposes him or her to a threat of imminent harm; if the individual is a victim of identity theft; or if the individual is at risk of physical harm. In order to exercise this option, consumers generally must provide satisfactory documentation to support the basis for their request. In any event, the reseller retains the right to determine (1) whether to grant or deny any request, (2) to which databases the request for removal will apply, and (3) the duration of the removal. Two resellers stated their belief that under certain circumstances it may not be appropriate to provide consumers with opportunities for opting out, such as for information products designed to detect fraud or locate criminals. These resellers stated that if individuals were permitted to opt out of fraud prevention databases, some of those opting out could be criminals, which would undermine the effectiveness and utility of these databases. According to the data quality principle, personal information should be relevant to the purpose for which it is collected, and should be accurate, complete, and current as needed for that purpose. Information resellers reported taking steps to ensure that they generally receive accurate data from their sources and that they do not introduce errors in the process of transcribing and aggregating information; however, they generally provide their customers with exactly the same data they obtain and do not claim or guarantee that the information is accurate for a specific purpose. Some resellers’ privacy policies state that they expect their data to contain some errors. Further, resellers varied in their policies regarding correction of data determined to be inaccurate as obtained by them. One reseller stated that it would delete information in its databases that was found to be inaccurate. Another stated that even if an individual presents persuasive evidence that certain information is in error, the reseller generally does not make changes if the information comes directly from an official public source (unless instructed to do so by that source). Because they are not the original source of the personal information, information resellers generally direct individuals to the original sources to correct any errors. Several resellers stated that they would correct any identified errors introduced through their own processing and aggregation of data. While not providing specific assurance of the accuracy of the data they provide, information resellers reported that they take steps to ensure that their suppliers have data quality controls in place. For example, officials from one information reseller said they use a screening process to help determine whether they should use a particular supplier. As part of this process, the reseller assesses whether the supplier has internal controls in place that are in line with the reseller’s policies. Information resellers also reported that they conduct annual audits of their suppliers aimed at assessing the integrity and quality of the information they receive. If these audits show that a supplier has failed to provide accurate, complete, and timely information, the reseller may discontinue using that supplier. Resellers also noted that data accuracy is contingent upon intended use. That is, data that may be perfectly adequate for one purpose may not be precise enough or appropriate for another purpose. While end users, such as federal agencies, may address data quality for their specific purposes, resellers—who maintain personal information for multiple purposes—are less able to achieve accuracy because they support multiple uses. Thus, resellers generally disclaim data accuracy and leave it to their customers to ensure that the data are accurate for their intended uses. One reseller stated that their customers understand the accuracy limitations of the data they obtain and take the potential for data inaccuracy into account when using the data. According to the purpose specification principle, the purpose for the collection of personal information should be disclosed before collection and upon any change to that purpose, and its use should be limited to that purpose and compatible purposes. While information resellers specify purpose in a general way by describing the types of businesses that use their data, they generally do not designate specific intended uses for each of their data collections. Resellers generally obtain information that has already been collected for a specific purpose and make that information available to their customers, who in turn have a broader variety of purposes for using it. For example, personal information originally submitted by a customer to register a product warranty could be obtained by a reseller and subsequently made available to another business or government agency, which might use it for an unrelated purpose, such as identity verification, background checking, or marketing. In a general sense, information resellers specify their purpose by indicating (on company Web sites, for example) the business categories of the customers for whom they collect information. For example, reseller privacy policies generally state that resellers make personal information available for legitimate uses by business and government organizations. Examples of business categories may be provided, but resellers do not specify which types of information are to be used in which business categories. It is difficult for resellers to provide greater specificity because they make their data available to many customers for a wide range of legitimate purposes. As a result, the public is made aware only of the broad range of potential uses to which their personal information may be applied, rather than a specific use, as envisioned in the Fair Information Practices. Under the use limitation principle, personal information should not be disclosed or used for other than the originally specified purpose without consent of the individual or legal authority. However, because information reseller purposes are specified very broadly, it is difficult for resellers to ensure that use of the information in their databases is limited. As previously discussed, information reseller data may have many different uses, depending on the types of customers involved. Resellers do take steps to ensure that their customers’ use of personal information is limited to legally sanctioned purposes. Information resellers pass this responsibility to their customers through licensing agreements and contract terms and agreements. According to two large information resellers, customers are generally contractually required to use data from resellers appropriately and must agree to comply with applicable laws, such as the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and the Driver’s Privacy Protection Act. For example, one information reseller uses a service agreement that includes provisions governing permissible use of information sought by the customer, the confidentiality of information provided, legal requirements under federal and state laws, and other customer obligations. The reseller reported that the company monitors its customers’ compliance by conducting periodic audits and taking appropriate actions in response to any audit findings. In a standardized agreement form used by another reseller, federal agencies must certify that they will use information obtained from the reseller only as permissible under the Gramm-Leach-Bliley Act and the Driver’s Privacy Protection Act. The service agreement identifies permissible purposes for information whose use is restricted by these laws and requires agencies to agree that they will use the information only in the performance or the furtherance of appropriate government activities. In conformance with the Gramm-Leach-Bliley Act permissible uses, the information reseller requires agencies to certify that they will use personal information “only as requested or authorized by the consumer.” The information resellers used by the federal agencies we reviewed generally also reported taking steps to ensure that access to certain sensitive types of personally identifiable information is limited to certain customers and uses. For example, two resellers reported that they provide full Social Security numbers and driver’s license numbers only to specific types of customers, including law enforcement agencies and insurance companies, and for purposes such as employment or tenant screening. While actions such as these are useful in protecting privacy and are consistent with the use limitation principle in that they narrow the range of potential uses for this type of information, they are not equivalent to limiting use only to a specific predefined purpose. Without limiting use to predefined purposes, resellers cannot provide individuals with assurance that their information will only be accessed and used for the purpose originally specified when the information was collected. According to the security safeguards principle, personal information should be protected with reasonable safeguards against risks such as loss or unauthorized access, destruction, use, modification, or disclosure. While we did not evaluate the effectiveness of resellers’ information security programs, resellers we spoke with said they employ various safeguards to protect consumers’ personal information. They implemented these safeguards in part for business reasons but also because federal laws require such protections. Resellers describe these safeguards in various policy statements, such as online and data privacy policies or privacy statements posted on Internet sites. Resellers also generally had information security plans describing, among other things, access controls for information and systems, document management practices, incident reporting, and premises security. Given recent incidents, large information resellers reported having recently taken steps to improve their safeguards against unauthorized access. In a well-publicized incident, in February 2005, ChoicePoint disclosed that unauthorized individuals had gained access to personal information by posing as a firm of private investigators. In the following month, LexisNexis disclosed that unauthorized individuals had gained access to personal information through the misappropriation of user IDs and passwords from legitimate customers. These disclosures were required by state law, as previously discussed. In January 2006, ChoicePoint reached a settlement with the Federal Trade Commission over charges that the company did not have reasonable procedures to verify the identity of prospective new users. The company agreed to implement new procedures to ensure that it provides consumer reports only to legitimate business for lawful purposes. In the mean time, both information resellers reported that they had taken steps to improve their procedures for authorizing customers to have access to sensitive information, such as Social Security numbers. For example, one reseller established a credentialing task force with the goal of centralizing its customer credentialing process. In order for customers of this reseller to obtain products and services containing sensitive personal information, they must now undergo a credentialing process involving a site visit by the information reseller to verify the accuracy of information reported about the business. Applicants are then scored against a credentialing checklist to determine whether they will be granted access to sensitive information. In addition, both resellers reported efforts to strengthen user ID and password protections and restrict access to sensitive personal information (including full driver’s license numbers and Social Security numbers) to a limited number of customers, such as law enforcement agencies (others would be able to view masked information). Although we did not test the effectiveness of these measures, if implemented correctly, they could help provide assurance that sensitive information is protected appropriately. In addition to enhancing safeguards on customer access authorizations, resellers have instituted a variety of other security controls. For example, three large information resellers have implemented physical safeguards at their data centers, such as continuous monitoring of employees entering and exiting facilities, monitoring of activity on customer accounts, and strong authentication of users entering and exiting secure areas within the data centers. Officials at one reseller told us that security profiles were established for each employee that restrict access to various sections of the center based upon employee job functions. Computer rooms were further protected with a combined system of biometric hand readers and security codes. Security cameras were placed throughout the facility for continuous recording of activity and review by security staff. Information resellers also had contingency plans in place to continue or resume operations in the event of an emergency. Information resellers reported that on an annual basis, or more frequently if needed, they conduct security risk assessments as well as internal and external security audits. These assessments address such topics as vulnerabilities to internal or external security threats, reporting and responding to security incidents, controls for network and physical facilities, and business continuity management. The assessments also addressed strategies for mitigating potential or identified risks. If properly implemented, security measures such as those reported by information resellers could contribute to effective implementation of the security safeguards principle. According to the openness principle, the public should be informed about an organization’s privacy policies and practices, and individuals should have ready means of learning about the organization’s use of personal information. To address openness, information resellers took steps to inform the public about key aspects of their privacy policies. They used means such as company Web sites and brochures to inform the public of specific policies and practices regarding the collection and use of personal information. Reseller Web sites also generally provided information about the types of information products the resellers offered—including product samples—as well as general descriptions about the types of customers served. Several Web sites also provided advice to consumers on protecting personal information and discussed what to do if individuals suspect they are victims of identity theft. Providing public notice of privacy policies informs individuals of what steps an organization takes to protect the privacy of the personal information it collects and helps to ensure the organization’s accountability for its stated policies. According to the individual participation principle, individuals should have the right to know about the collection of personal information, to access that information, to request correction, and to challenge the denial of those rights. Information resellers generally allow individuals access to their personal information. However, this access is limited, as is the opportunity to make corrections. Resellers may provide an individual a report containing certain types of information—such as compilations of public records information—however, the report may not include all information maintained by the resellers about that individual. For example, one information reseller stated that it offers a free report, under certain circumstances, on an individual’s claims history, employment history, or tenant history. Resellers may offer basic reports to individuals at no cost, but they generally charge for reports on additional information. A free consumer report, such as an employment history report, for example, typically excludes information such as driver’s license data, family information, and credit header data that a reseller may possess in other databases. Although individuals can access information about themselves, if they find inaccuracies, they generally cannot have these corrected by the resellers. Information resellers direct individuals to take their cases to the original data sources—such as courthouses or other local government agencies— and attempt to have the inaccuracy corrected there. Several resellers stated that they would correct any identified errors introduced through their own processing and aggregation of data. As discussed above, resellers, as a matter of policy, do not make corrections to data obtained from other sources, even if the consumer provides evidence that the data are wrong. According to resellers, making corrections to their own databases is extremely difficult, for several reasons. First, the services these resellers provide concentrate on providing references to a particular individual from many sources, rather than distilling only the most accurate or current reference. For example, a reseller might have many instances in its databases of a particular individual’s current address. Although most might be the same, there could be errors as well. Resellers generally would report the information as they have it rather than attempting to determine which entry is correct. This information is important to customers such as law enforcement agencies. Further, resellers stated that making corrections to their databases could be ineffective because the data are continually refreshed with updated data from the source, and thus any correction is likely to be changed back to its original state the next time the data are updated. In addition, as discussed in the collection limitation section, resellers stated their belief that it would not be appropriate to allow the public to access and correct information held for certain purposes, such as fraud detection and locating criminals, since providing such rights could undermine the effectiveness of these uses (e.g., by allowing criminals to access and change their information). However, as a result of these practices, individuals cannot know the full extent of personal information maintained by resellers or ensure its accuracy. According to the accountability principle, individuals controlling the collection or use of personal information should be accountable for taking steps to ensure the implementation of the Fair Information Practices. Although information resellers’ overall application of the Fair Information Practices varied, each reseller we spoke with reported actions to ensure compliance with its own privacy policies. For example, resellers reported designating chief privacy officers to monitor compliance with internal privacy policies and applicable laws (e.g., the Gramm-Leach-Bliley Act and the Driver’s Privacy Protection Act). Information resellers reported that these officials had a range of responsibilities aimed at ensuring accountability for privacy policies, such as establishing consumer access and customer credentialing procedures, monitoring compliance with federal and state laws, and evaluating new sources of data (e.g., cell phone records). Auditing of an organization’s practices is one way of ensuring accountability for adhering to privacy policies and procedures. Although there are no industrywide standards requiring resellers to conduct periodic audits of their compliance with privacy policies, one information reseller reported using a third party to conduct privacy audits on an annual basis. Using a third party to audit compliance with privacy policies further helps to ensure that an information reseller is accountable for the implementation of its privacy practices. Establishing accountability is critical to the protection of privacy. Actions taken by data resellers should help ensure that their privacy policies are appropriately implemented. Agency practices for handling personal information acquired from information resellers did not always fully reflect the Fair Information Practices. Further, agencies generally lacked policies that specifically address their use of personal information from commercial sources, although DHS Privacy Office officials reported that they were drafting such a policy. As shown in table 8, four of the Fair Information Practices—the collection limitation, data quality, use limitation, and security safeguards principles—were generally reflected in agency practices. For example, several agency components (specifically, law enforcement agencies such as the FBI and the U.S. Secret Service) reported that in practice, they generally corroborate information obtained from resellers when it is used as part of an investigation. This practice is consistent with the data quality principle that data should be accurate, current, and complete. Agency policies and practices with regard to the other four principles, however, were uneven. Specifically, agencies did not always have policies or practices in place to address the purpose specification, openness, and individual participation principles with respect to reseller data. The inconsistencies in application of these principles as well as the lack of specific agency policies can be attributed in part to ambiguities in OMB guidance regarding the applicability of the Privacy Act to information obtained from resellers. Further, privacy impact assessments, which often are not conducted, are a valuable tool that could address important aspects of the Fair Information Practices. Finally, components within each of the four agencies did not consistently hold staff accountable by monitoring usage of personal information from information resellers and ensuring that it was appropriate; thus, their application of the accountability principle was uneven. The collection limitation principle establishes, among other things, that organizations should obtain only the minimum amount of personal data necessary to process a transaction. This principle also underlies the Privacy Act requirement that agencies maintain in their records “only such information about an individual as is relevant and necessary to accomplish a purpose of the agency.” Regarding most law-enforcement and counterterrorism purposes, which accounted for 90 percent of usage in fiscal year 2005, agencies generally limited their personal data collection in that they reported obtaining information only on specific individuals under investigation or associates of those individuals. Having initiated investigations on specific individuals, however, agencies generally reported that they obtained as much personal information as possible about the individuals being investigated, because law enforcement investigations require pursuing as many investigative leads as possible. The data quality principle states that, among other things, personal information should be relevant to the purpose for which it is collected and be accurate. This principle is mirrored in the Privacy Act’s requirement for agencies to maintain all records used to make determinations about an individual with sufficient accuracy, relevance, timeliness, and completeness as is reasonably necessary to ensure fairness. Agencies reported taking steps to mitigate the risk of inaccurate information reseller data by corroborating information obtained from resellers. Agency officials described the practice of corroborating information as a standard element of conducting investigations. Officials from several law enforcement component agencies, including ATF and DEA, said corroboration was necessary to build legally sound cases from investigations. For example, U.S. Secret Service officials reported that they instruct agents that the information obtained from resellers should be independently corroborated, and that none of it should be used as probable cause for obtaining warrants. Further, FBI officials from FTTTF noted that obtaining data from information resellers helps to improve the overall quality and accuracy of the data in investigative files. Officials stated that the variety of private companies providing personal information enhances the value, quality, and diversity of the information used by the FBI, noting that a decision to put an individual under arrest is based on “probable cause,” which is determined by a preponderance of evidence, rather than any single source of information, such as information in a reseller’s data base. Likewise, for non law-enforcement use, such as debt collection and fraud detection and prevention, agency components reported procedures for mitigating potential problems with the accuracy of data provided by resellers by obtaining additional information from other sources when necessary. For example, the Executive Office for U.S. Attorneys uses information resellers to obtain information on assets possessed by an individual indebted to the United States. According to officials, should information contained in the information reseller databases conflict with informataion provided by an individual, further investigation takes place before any action to collect debts would be taken. Likewise, officials from the U.S. Citizenship and Immigration Services (USCIS) component of DHS and the Office of Consular Affairs within the Department of State reported similar practices. While these practices do not eliminate inaccuracies in data coming into the agency, they help ensure the quality of the information that is the basis for agency actions. The use limitation principle provides that personal information should not be disclosed or used for other than a specified purpose without consent of the individual or legal authority. This principle underlies the Privacy Act requirement that prevents agencies from disclosing records on individuals except with consent of the individual, unless disclosure of the record would be, for example, to another agency for civil or criminal law enforcement activity or for a purpose that is compatible with the purpose for which the information was collected. Although agencies rely on resellers’ multipurpose collection of information as a source, agency officials said their use of reseller information was limited to distinct purposes, which were generally related to law enforcement or counterterrorism. For example, the Department of Justice reported uses specific to the conduct of criminal investigations on individuals, terrorism investigations, and the location of assets and witnesses. Other Justice and DHS components, such as the Federal Protective Service, U.S. Secret Service, FBI, and ATF, also reported that they used information reseller data for investigations. For uses not related to law enforcement, such as those reported by State and SSA, use of reseller information was also described as supporting a specific purpose (e.g., fraud detection or debt collection). The use limitation principle also precludes agencies from sharing personal information they collect for purposes unrelated to the original intended use of the information. Officials of certain law enforcement components of these agencies reported that in certain cases they share information with other law enforcement agencies, a use consistent with the purposes originally specified by the agency. For example, the FBI’s FTTTF supports ongoing investigations in other law enforcement agencies and the intelligence community by sharing information obtained from resellers (among other information) in response to requests about foreign terrorists from FBI agents or officials from partner agencies. The security safeguards principle requires that personal information be reasonably protected against unauthorized access, use, or disclosure. This principle also underlies the Privacy Act requirement that agencies establish appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records on individuals. This principle is further mirrored in the FISMA requirement to protect information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction, including through controls for confidentiality. While we did not assess the effectiveness of information security or the implementation of FISMA at any of these agencies, we found that all four had measures in place intended to safeguard the security of personal information obtained from resellers. For example, all four agencies cited the use of passwords to prevent unauthorized access to information reseller databases. Further, agency components such as ATF, DEA, CBP, and USCIS, reported that they limit access to sensitive personal information (e.g., full Social Security number, driver’s license number) to those with a specific need for this information. Several agency components also reported that resellers were promptly notified to deactivate accounts for employees separated from government service to protect against unauthorized use. As another security measure, several components, including DEA and the FBI, reported that resellers notified them when accounts were accessed from Internet addresses at unexpected locations, such as outside the United States. Another measure to prevent unauthorized disclosure reported by law enforcement agencies, such as the FBI, ICE, and Secret Service, is the use of “cloaked logging,” which prevents vendor personnel from monitoring the queries being made by law enforcement agents. Officials in FBI’s FTTTF reported that, in order to maintain the integrity of investigations, resellers are contractually prohibited from tracking or monitoring the exact persons or other entities being searched by FTTTF personnel. Law enforcement officials stated that the ability to mask searches from vendors is important so that those outside law enforcement have no knowledge of who is being investigated and so that subjects of an investigation are not “tipped off.” Agency adherence to the collection limitation, data quality, use limitation, and security safeguards principles was based on general business procedures—including law-enforcement investigative practices— that reflect security and civil liberties protections, rather than written policies specifically regarding the collection, accuracy, use, and security of personal information obtained from resellers. Implementation of these practices provides individuals with assurances that only a limited amount of their personal information is being collected, that it is used only for specific purposes, and that measures are in place to corroborate the accuracy of the information and safeguard it from improper disclosure. These controls help prevent potential harm to individuals and invasion of their privacy by limiting the exposure of their information and reducing the likelihood of inaccurate data being used to make decisions that could affect their welfare. The purpose specification, openness, and individual participation principles stipulate, among other things, that individuals should be made aware of the purpose and intended uses of the personal information being collected about them and have the ability to access and correct such information, if necessary. The Privacy Act reflects these principles in part by requiring agencies to publish in the Federal Register, “upon establishment or revision, a notice of the existence and character of a system of records.” This notice is to include, among other things, the categories of records in the system as well as the categories of sources of records. In a number of cases, agencies did not adhere to the purpose specification or openness principles in regard to their use of reseller information in that they did not notify the public that they were using such information and did not specify the purpose for their data collections. Agency officials said that they generally did not prepare system-of-records notices that would address these principles because they were not required to do so by the Privacy Act. The act’s vehicle for public notification—the system-of- records notice—becomes binding on an agency only when the agency collects, maintains, and retrieves personal data in the way defined by the act or when a contractor does the same thing explicitly on behalf of the government. Agencies generally did not issue system-of-records notices specifically for their use of information resellers largely because information reseller databases were not considered “systems of records operated by or on behalf of a government agency” and thus were not considered subject to the provisions of the Privacy Act. OMB guidance on implementing the Privacy Act does not specifically refer to the use of reseller data or how it should be treated. According to OMB and other agency officials, information resellers operate their databases for multiple customers, and federal agency use of these databases does not amount to the operation of a system of records on behalf of the government. Further, agency officials stated that merely querying information reseller databases did not amount to agency “maintenance” of the personal information being queried and thus also did not trigger the provisions of the Privacy Act. In many cases, agency officials considered their use of resellers to be of this type—essentially “ad hoc” querying or “pinging” of reseller databases for personal information about specific individuals, which they believed they were not doing in connection with a formal system of records. In other cases, however, agencies maintained information reseller data in systems for which system-of-records notices had been previously published. For example, law enforcement agency officials stated that, to the extent they retain the results of reseller data queries, this collection and use is covered by the system of records notices for their case file systems. However, in preparing such notices, agencies generally did not specify that they were obtaining information from resellers. Among system of records notices that were identified by agency officials as applying to the use of reseller data, only one—TSA’s system of records notice for the test phase of its Secure Flight program—specifically identified the use of information reseller data. Other programs that involve use of information reseller data include the fraud prevention and detection programs reported by SSA and State as well as law enforcement programs within ATF, the U.S. Marshals, and USCIS. For these programs, associated system of records notices identified by officials did not specify the use of information reseller data. In several of these cases, agency sources for personal information were described only in vague terms, such as “private organizations,” “other public sources,” or “public source material,” when information was being obtained from information resellers. In one case, a notice indicated incorrectly that personal information was collected only from the individuals concerned. Specifically, USCIS prepared a system of records notice covering the Computer Linked Application Information Management System, which did not identify information resellers as a source. Instead, the notice stated only that “information contained in the system of records is obtained from individuals covered by the system.” The inconsistency with which agencies specify resellers as a source of information in system-of-records notices is in part due to ambiguity in OMB guidance, which states that “for systems of records which contain information obtained from sources other than the individual to whom the records pertain, the notice should list the types of sources used.” Although the guidance is unclear what would constitute adequate disclosure of “types of sources,” OMB and DHS Privacy Office officials agreed that to the extent that reseller data are subject to the Privacy Act, agencies should specifically identify information resellers as a source and that merely citing public records information does not sufficiently describe the source. The individual participation principle gives individuals the right to access and correct information that is maintained about them. However, under the Privacy Act, agencies can claim exemptions from the requirement to provide individual access and the ability to make corrections if the systems are for law enforcement purposes. In most cases where officials identified system-of-record notices associated with reseller data collection for law enforcement purposes, agencies claimed this exemption. Like the ability to mask database searches from vendors, this provision is important so that the subjects of law enforcement investigations are not tipped off. Aside from the law enforcement exemptions to the Privacy Act, adherence to the purpose specification and openness principles is critical to preserving a measure of individual control over the use of personal information. Without clear guidance from OMB or specific policies in place, agencies have not consistently reflected these principles in their collection and use of reseller information. As a result, without being notified of the existence of an agency’s information collection activities, individuals have no ability to know that their personal information could be obtained from commercial sources and potentially used as a basis, or partial basis, for taking action that could have consequences for their welfare. The PIA is an important tool for agencies to address privacy early in the process of developing new information systems, and to the extent that PIAs are made publicly available, they provide explanations to the public about such things as the information that will be collected, why it is being collected, how it is to be used, and how the system and data will be maintained and protected. In doing so, they serve to address the openness and purpose specification principles. However, only three agency components reported developing PIAs for their systems or programs that make use of information reseller data. As with system-of-records notices, agencies often did not conduct PIAs because officials did not believe they were required. Current OMB guidance on conducting PIAs is not always clear about when they should be conducted. According to guidance from OMB, a PIA is required by the E-Government Act when agencies “systematically incorporate into existing information systems databases of information in identifiable form purchased or obtained from commercial or public sources.” However, the same guidance also instructs agencies that “merely querying a database on an ad-hoc basis does not trigger the PIA requirement.” Reported uses of reseller data were generally not described as a “systematic” incorporation of data into existing information systems; rather, most involved querying a database and in some cases retaining the results of these queries. OMB officials stated that agencies would need to make their own judgments on whether retaining the results of searches of information reseller databases constituted a “systematic incorporation” of information. DHS has recently developed guidance requiring PIAs to be conducted whenever reseller data are involved. The DHS Privacy Office guidance on conducting PIAs points out, for example, that a program decision to obtain information from a reseller would constitute a new source of information, requiring that a PIA be conducted. However, although the DHS guidance clearly states that PIAs are required when personally identifiable information is obtained from a commercial source, it also states that “merely querying such a source on an ad hoc basis using existing technology does not trigger the PIA requirement.” Like OMB’s guidance, the DHS guidance is not clear, because agency personnel are left to make individual determinations as to whether queries are “on an ad hoc basis.” In one case, a DHS component prepared a PIA for a system that collects reseller data but had not identified in the assessment that resellers were being used. DHS’s USCIS uses copies of court records obtained from an information reseller to support evidentiary requirements for official adjudication proceedings concerning fraud. Although this use was reported to be covered by the PIA for the office’s Fraud Tracking System, the PIA identifies only “public records” as the source of its information and does not mention that the public records are obtained from information resellers. In contrast, the draft DHS guidance on PIAs instructs DHS component agencies to “list the individual, entity, or entities providing the specific information identified above. For example, is the information collected directly from the individual as part of an application for a benefit, or is it collected from another source such as a commercial data aggregator.” At the time of our review, this draft guidance had not yet been disseminated to DHS components. Lacking such guidance, DHS components did not have policies in place regarding the conduct of PIAs with respect to reseller data, nor did other agencies we reviewed. Until PIAs are conducted more thoroughly and consistently, the public is likely to remain incompletely informed about agency purposes and uses for obtaining reseller information. According to the accountability principle (individuals controlling the collection or use of personal information should be accountable for taking steps to ensure the implementation of the Fair Information Practices), agencies should take steps to ensure that employee uses of personal information from information resellers are appropriate. While agencies described activities to oversee the use of information resellers, such activities were largely based on trust of the user to use the information appropriately. For example, in describing controls placed on the use of commercial data, officials from component agencies identified measures such as instructing users that reseller data are for official use only and requiring users to sign statements of responsibility attesting to a need to access the information reseller databases and that their use will be limited to official business. Additionally, agency officials reported that in accessing reseller databases, users are required to select from a list of vendor-defined “permissible purposes” (e.g., law enforcement, transactions authorized by the consumer) before conducting a search. While these practices appear consistent with the accountability principle, they are focused on individual user responsibility rather than management oversight. For example, agencies did not have practices in place to obtain reports from resellers that would allow them to monitor usage of reseller databases at a detailed level. Although agencies generally receive usage reports from the information resellers, these reports are designed primarily for monitoring costs. Further, these reports generally contained only high-level statistics on the number of searches and databases accessed, not the contents of what was actually searched, thus limiting their utility in monitoring usage. For example, one information reseller reported that it does not provide reports to agencies on the “permissible purpose” that a user selects before conducting a search. Not all component agencies lacked robust user monitoring. Specifically, according to FBI officials from the FTTTF, their network records and monitors searches conducted by the user account, including who is searched against what public source database. The system also tracks the date and time of the query as well as what the analyst does with the data. FBI officials stated that the vendor reports as well as the network monitoring provide FBI with the ability to detect unusual usage of the public source providers. To the extent that federal agencies do not implement methods such as user monitoring or auditing of usage records, they provide limited accountability for their usage of information reseller data and have limited assurance that the information is being used appropriately. Services provided by information resellers serve as important tools that can enhance federal agency functions, such as law enforcement and fraud protection and identification. Resellers have practices in place to protect privacy, but these practices are not fully consistent with the Fair Information Practices. Among other things, resellers collect large amounts of information about individuals without their knowledge or consent, do not ensure that the data they make available are accurate for a given purpose, and generally do not make corrections to the data when errors are identified by individuals. Information resellers believe that application of the relevant principles of the Fair Information Practices is inappropriate or impractical in these situations. Given that reseller data may be used for a variety of purposes, determining the appropriate degree of control or influence individuals should have over the way in which their personal information is obtained and used—as envisioned in the Fair Information Practices—is critical. To more fully embrace these principles could require resellers to change the way they conduct business, and currently resellers are not legally required to follow them. As Congress weighs various legislative options, adherence to the Fair Information Practices will be an important consideration in determining the appropriate balance between the services provided by information resellers to customers such as government agencies and the public’s right to privacy. Agencies take steps to adhere to Fair Information Practices such as the collection limitation, data quality, use limitation, and security safeguards principles. However, they have not taken all the steps they could to reflect others—or to comply with specific Privacy Act and e- Government Act requirements—in their handling of reseller data. Specifically, agencies did not always have policies or practices in place to address the purpose specification, individual participation, openness, and accountability principles with respect to reseller data. An important factor contributing to this is that OMB privacy guidance does not clearly address information reseller data, which has become such a valuable and useful tool for agencies. As a result, agencies are left largely on their own to determine how to satisfy legal requirements and protect privacy when acquiring and using reseller data. Without current and specific guidance, the government risks continued uneven adherence to important, well- established privacy principles and lacks assurance that the privacy rights of individuals are adequately protected. In considering legislation to address privacy concerns related to the information reseller industry, Congress should consider the extent to which the industry should adhere to the Fair Information Practices. To improve accountability, ensure adequate public notice of agencies’ use of personal information from commercial sources, and allay potential privacy concerns arising from agency use of information from such sources, we are making three recommendations to the Director of OMB and the heads of the four agencies. Specifically, we recommend that: the Director of OMB revise guidance on system of records notices and privacy impact assessments to clarify the applicability of the governing laws (the Privacy Act and the E-Government Act) to the use of personal information from resellers. These clarifications should specify the circumstances under which agencies should make disclosures about their uses of reseller data so that agencies can properly notify the public (for example, what constitutes a “systematic” incorporation of reseller data into a federal system). The guidance should include practical scenarios based on uses agencies are making of personal information from information resellers (for example, visa, criminal, and fraud investigations). the Director of OMB direct agencies to review their uses of personal information from information resellers, as well as any associated system of records notices and privacy impact assessments, to ensure that such notices and assessments explicitly reference agency use of information resellers. the Attorney General, the Secretary of Homeland Security, the Secretary of State, and the Commissioner of SSA develop specific policies for the collection, maintenance, and use of personal information obtained from resellers that reflect the Fair Information Practices, including oversight mechanisms such as the maintenance and review of audit logs detailing queries of information reseller databases—to improve accountability for agency use of such information. We received written comments on a draft of this report from the Justice’s Assistant Attorney General for Administration (reproduced in appendix III), from the Director of the DHS Departmental GAO/OIG Liaison Office (reproduced in appendix IV), from the Commissioner of SSA (reproduced in appendix V), and from State’s Assistant Secretary and Chief Financial Officer (reproduced in appendix VI). We also received comments via E - mail from staff of OMB’s Office of Information and Regulatory Affairs. Justice, DHS, SSA, and OMB all generally agreed with the report and described actions initiated to address our recommendations. Justice and SSA also provided technical comments, which has been incorporated in the final report as appropriate. In its comments, Justice agreed that revised or additional guidance and policy could be created to address unique issues presented by use of personal information obtained from resellers. However, noting that the Privacy Act allows law enforcement agencies to exempt certain records from provisions of the law that reflect aspects of the Fair Information Practices, Justice recommended that prior to issuance of any new or revised policy, careful consideration be given to the balance struck in the Privacy Act on applying the Fair Information Practices to law enforcement data. We recognize that law enforcement purposes are afforded the opportunity for exemptions from some of the provisions of the Privacy Act. The report acknowledges this fact. We also agree and acknowledge in the report that the Fair Information Practices serve as a framework of principles for balancing the need for privacy with other public policy interests, such as national security and law enforcement. DHS also agreed on the importance of guidance to federal agencies on the use of reseller information and stated that it is working diligently on finalizing a DHS policy for such use. The agency commented that its Privacy Office has been reviewing the use and appropriate privacy protections for reseller data, including conducting a 2-day public workshop on the subject in September 2005. DHS also noted that it had just issued departmentwide guidance on the conduct of privacy impact assessments in March 2006, which include directions relevant to the collection and use of commercial data. We have made changes to the final report to reflect the recent issuance of the DHS guidance. SSA noted in its comments that it had established internal controls, including audit trails of systems usage, to ensure that information is not improperly disclosed. SSA also stated that it would amend relevant system- of-record notices to reflect use of information resellers and would explore options for enhancing its policies and internal controls over information obtained from resellers. State interpreted our draft report to “rest on the premise that records from ‘information resellers’ should be accorded special treatment when compared with sensitive information from other sources.” State indicated that it does not distinguish between types of information or sources of information in complying with privacy laws. However, our report does not suggest that data from resellers should receive special treatment. Instead, our report takes the widely accepted Fair Information Practices as a universal benchmark of privacy protections and assesses agency practices in comparison with them. State also interpreted our draft report to state that fraud detection, as a purpose for collecting personal information, is not related to law enforcement. However, the draft does not make such a claim. We have categorized agency uses of personal information based on descriptions provided by agencies and have categorized fraud detection uses separately from law enforcement to provide insight into different types of uses. We do not claim the two uses are unrelated. Finally, the department stated that in its view, it would be bad policy to require specification of sources such as data resellers in agency system of records notices. In contrast, we believe that adding clarity and specificity about sources is in the spirit of the purpose specification practice and note that DHS has recently issued guidance on privacy impact assessments that is consistent with this view. OMB stated that, based on a staff-level meeting of agency privacy experts, it believes agencies recognize that when personal data are brought into their systems, this fact must be reflected in their privacy impact assessments and system-of-record notices. We do not find this observation inconsistent with our findings. We found, however, that inconsistencies occurred in agencies’ determinations of when or whether reseller information was actually brought into their systems, as opposed to being merely “accessed” on an ad-hoc basis. We believe clarification of this issue is important. OMB further stated that agencies have procedures in place to verify commercial data before they are used in decisions involving the granting or recoupment of benefits or entitlements. Again, this is not inconsistent with the results of our review. Finally OMB stated that it would discuss its guidance with agency senior officials for privacy to determine whether additional guidance concerning reseller data is needed. We also obtained comments on excerpts of our draft report from the five information resellers we reviewed. General comments made by resellers and our evaluation are summarized below: Several resellers raised concerns about our reliance on the OECD version of the Fair Information Practices as a framework for assessing their privacy policies and business practices. They suggested that it would be unreasonable to require them to comply with aspects of the Fair Information Practices that they believe were intended for other types of users of personal information, such as organizations that collect information directly from consumers. Further, they commented that our draft summary appeared to treat strict adherence to all of the Fair Information Practices as if it were a legally binding requirement. In several cases, they suggested that it would be more appropriate for us to use the privacy framework developed by the Asia-Pacific Economic Cooperation (APEC) organization in 2004, because the APEC framework is more recent and because it explicitly states that it has limited applicability to publicly available information. As discussed in our report, the OECD version of the Fair Information Practices is widely used and cited within the federal government as well as internationally. In addition, the APEC privacy framework, which was developed as a tool for encouraging the development of privacy protection in the Asia Pacific region, acknowledges that the OECD guidelines are still relevant and “in many ways represent the international consensus on what constitutes honest and trustworthy treatment of personal information.” Further, our use of the OECD guidelines is as an analytical framework for identifying potential privacy issues for further consideration by Congress—not as legalistic compliance criteria. The report states that the Fair Information Practices are not precise legal requirements; rather they provide a framework of principles for balancing the needs for privacy against other public policy interests, such as national security, law enforcement, and administrative efficiency. In conducting our analysis, we noted that the nature of the reseller business is largely at odds with the principles of collection limitation, data quality, purpose specification, and use limitation. We also noted that resellers are not currently required to follow the Fair Information Practices and that for resellers to more fully embrace them could require that they change the way they do business. We recognize that it is important to achieve an appropriate balance between the benefits of resellers’ services and the public’s right to privacy and point out that, as Congress weighs various legislative options, it will be critical to determine an appropriate balance. We have made changes in this report to clarify that we did not attempt to make determinations of whether or how information reseller practices should change and that such determinations are a matter of policy based on balancing the public’s right to privacy with the value of reseller services. Several information resellers stated that the draft did not take into account that public record information is freely available. For example, one reseller stated that public records should be understood by consumers to be open to all for any use not prohibited by state or federal law. Another stated that information resellers merely effectuate the determination made by governmental entities that public records should be open to all. However, the views expressed by the resellers do not take into account several important factors. First, resellers collect information for their products from a variety of sources, including information provided by consumers to businesses. Resellers products are not based exclusively on public records. Thus a consideration of protections for public record information does not take the place of a full assessment of the information reseller business. Second, resellers do not merely pass on public record information as they find it; they aggregate information from many different sources to create new information products, and they make the information much more readily available than it would be if it remained only in paper records on deposit in government facilities. The aggregation and increased accessibility provided by resellers raises privacy concerns that may not apply to the original paper-based public records. Finally, it is not clear that individuals give up all privacy rights to personal information contained in public records. The Supreme Court has expressed the opinion in the past that individuals retain a privacy interest in publicly released personal information. We therefore believe it is important to assess the status of privacy protections for all personal information being offered commercially to the government so that informed policy decisions may be made about the appropriate balance between resellers’ services and the public’s right to privacy. Several resellers also noted that the draft report did not address the complexity of the reseller business—the extent to which resellers’ businesses vary among themselves and overlap with consumer reporting agencies. We have added text addressing this in the final report. The resellers also provided technical comments, which were incorporated in the final report as appropriate. We are sending copies of this report to the Attorney General, the Secretary of Homeland Security, the Secretary of State, the Commissioner of the Social Security Administration, the Director of the Office of Management and Budget, and other interested congressional committees. Copies will be made available to others on request. In addition, this report will be available at no charge on our Web site at www.gao.gov. If you have any questions concerning this report, please call me at (202) 512-6240 or send E-mail to koontzl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are John de Ferrari, Assistant Director; Mathew Bader; Barbara Collier; Pamlutricia Greenleaf; David Plocher; and Jamie Pressman. Our objectives were to determine the following: how the Departments of Justice, Homeland Security, and State and the Social Security Administration are making use of personal information obtained through contracts with information resellers; the extent to which the information resellers providing personal information to these agencies have policies and practices in place that reflect widely accepted principles for protecting the privacy and security of personal information; and the extent to which these agencies have policies and practices in place for handling information reseller data that reflect widely accepted principles for protecting the privacy and security of personal information. To address our objectives, we identified and reviewed applicable laws such as the Privacy Act of 1974 and the E-Government Act, agency policies and practices, and the widely accepted privacy principles embodied in the Organization for Economic Cooperation and Development (OECD) version of the Fair Information Practices. Working with liaisons at the four federal agencies we were requested to review, we identified officials responsible for the acquisition and use of personal information from information resellers. Through these officials, we obtained applicable contractual documentation such as statements of work, task orders, blanket purchase agreements, purchase orders, interagency agreements, and contract terms and conditions. To address our first objective, we obtained and reviewed contract vehicles covering federal agency use of information reseller services for fiscal year 2005. We also reviewed applicable General Services Administration (GSA) schedule and Library of Congress FEDLINK contracts with information resellers that agencies made use of by various means, including through issuance of blanket purchase agreements, task orders, purchase orders, or interagency agreements. We analyzed the contractual documentation provided to determine the nature, scope, and dollar amounts associated with these uses, as well as mechanisms for acquiring personal information. In an effort to identify all relevant instances of agency use of information resellers and related contractual documents, we developed a list of structured questions to address available contract documents, uses of personal information, and applicable agency guidance. We provided these questions to agency officials and held discussions with them to help ensure that they provided all relevant information on uses of personal information from information resellers. To further ensure that relevant contract vehicles were identified, we asked major information resellers about their business with the four agencies. We also interviewed officials from GSA and the Library of Congress to discuss the mechanisms available to federal agencies for acquiring personal information and to identify any additional uses of these mechanisms by the four agencies. To further address our first objective, we categorized agency use of information resellers into five categories: counterterrorism, debt collection, fraud detection/prevention, law enforcement, and other. These categorizations were based on the component and applicable program’s mission, as well as the specific reported use of the contract. In identifying relevant uses of information resellers, we were unable to identify small purchases (e.g., purchases below $2,500), as agencies do not track this information centrally. In addition, to the extent practicable, we excluded uses that generally did not involve the use of personal information. For example, officials from several component agencies reported that their use of the LexisNexis and West services was primarily for legal research rather than for public records information. In other cases, reported amounts may reflect uses that do not involve personal information because agencies were unable to separate such uses from uses involving personal information. To address our second objective, we obtained and reviewed relevant private sector laws and guidance, such as the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and the Fair Information Practices. We also identified major information resellers in agency contractual agreements for personal information and held interviews with officials from these companies, including Acxiom, ChoicePoint, Dun & Bradstreet, LexisNexis, and West, to discuss security, quality controls, and privacy policies. In addition, we conducted site visits at Acxiom, ChoicePoint, and LexisNexis, and obtained written responses to related questions from West. These five resellers accounted for approximately 95 percent of the dollar value of all reported contracts with resellers. To determine the extent that they reflect widely accepted Fair Information Practices, we reviewed and compared information reseller’s privacy policies and procedures with these principles. In conducting our analysis, we identified the extent to which reseller practices were consistent with the key privacy principles of the Fair Information Practices. We also assessed the effect of any inconsistencies; however, we did not attempt to make determinations of whether or how information reseller practices should change. Such determinations are a matter of policy based on balancing the public’s right to privacy with the value of services provided by resellers to customers such as government agencies. To address our third objective, we identified applicable guidelines and management controls regarding the acquisition, maintenance, and use of personal information from information resellers at each of the four agencies. We also interviewed agency officials, including acquisition and program staff, to further identify relevant policies and procedures. Our assessment of overall agency application of the Fair Information Practices was based on the policies and procedures of major components at each of the four agencies. We also conducted interviews at the four agencies with senior agency officials designated for privacy as well as officials of the Office of Management and Budget (OMB) to obtain their views on the applicability of federal privacy laws (including the Privacy Act of 1974 and the E-Government Act of 2002) and related guidance on agency use of information resellers. In addition, we compared relevant policies and management practices with the Fair Information Practices. We assessed the overall application of the principles of the Fair Information Practices by agencies according to the following categories: 1. General. We assessed the application as general if the agency had policies or procedures to address all major aspects of a particular principle. 2. Uneven. We assessed the application as uneven if the agency had policies or procedures that addressed some but not all aspects of a particular principle or if some but not all components and agencies had policies or practices in place addressing the principle. We performed our work at the Departments of Homeland Security, Justice, and State in Washington, D.C.; at the Social Security Administration in Baltimore, Maryland; Acxiom Corporation in Little Rock, Arkansas; ChoicePoint in Alpharetta, Georgia; Dun & Bradstreet in Washington, D.C.; and LexisNexis in Washington, D.C., and Miamisburg, Ohio. Our work was conducted from May 2005 to March 2006 in accordance with generally accepted government auditing standards. Major laws that affect information resellers include the Gramm-Leach- Bliley Act, the Drivers Privacy Protection Act, the Health Insurance Portability and Accountability Act, the Fair Credit Reporting Act, and the Fair and Accurate Credit Transactions Act. Their major privacy related provisions are briefly summarized below. The Gramm-Leach-Bliley Act requires financial institutions (e.g., banks, insurance, and investment companies) to give consumers privacy notices that explain the institutions’ information-sharing practices (P.L. 106-102 (1999), Title V, 15 U.S.C. 6801). In turn, consumers have the right to limit some, but not all, sharing of their nonpublic personal information. Financial institutions are permitted to disclose consumers’ nonpublic personal information without offering them an opt-out right in a number of circumstances including the following: to effect a transaction requested by the consumer in connection with a financial product or service requested by the consumer; maintaining or servicing the consumer’s account with the financial institution or another entity as part of a private label credit card program or other extension of credit; or a securitization, secondary market sale, or similar transaction; with the consent or at the direction of the consumer; to protect the confidentiality or security of the consumer’s records; to prevent fraud; for required institutional risk control or for resolving customer disputes or inquiries; to persons holding a legal or beneficial interest relating to the consumer; or to the consumer’s fiduciary; to provide information to insurance rate advisory organizations, guaranty funds or agencies, rating agencies, industry standards agencies, and the institution’s attorneys, accountants, and auditors; to the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978, to law enforcement agencies, self-regulatory organizations, or for an investigation on a matter related to public safety; to a consumer reporting agency in accordance with the Fair Credit Reporting Act or from a consumer report reported by a consumer reporting agency; in connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business if the disclosure concerns solely consumers of such business; and to comply with federal, state, or local laws; an investigation or subpoena; or to respond to judicial process or government regulatory authorities. The Driver’s Privacy Protection Act generally prohibits the disclosure of personal information by state departments of motor vehicles. (P.L. 103-322 (1994), 18 U.S.C. § 2721-2725). It also specifies a list of exceptions when personal information contained in a state motor vehicle record may be disclosed. These permissible uses include the following: for use by any government agency in carrying out its functions; for use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; motor vehicle market research activities; for use in the normal course of business by a legitimate business, but only to verify the accuracy of personal information submitted by the individual to the business and, if such information is not correct, to obtain the correct information but only for purposes of preventing fraud by pursuing legal remedies against, or recovering on a debt or security interest against, the individual; for use in connection with any civil, criminal, administrative, or arbitral proceeding in any federal, state, or local court or agency; for use in research activities; for use by any insurer or insurance support organization in connection with claims investigation activities; for use in providing notice to the owners of towed or impounded for use by a licensed private investigative agency for any purpose permitted under the act; for use by an employer or its agent or insurer to obtain information relating to the holder of a commercial driver’s license; for use in connection with the operation of private toll transportation for any other use, if the state has obtained the express consent of the person to whom a request for personal information pertains; for bulk distribution of surveys, marketing, or solicitations, if the state has obtained the express consent of the person to whom such personal information pertains; for use by any requester, if the requester demonstrates that it has obtained the written consent of the individual to whom the information pertains; and for any other use specifically authorized under a state law, if such use is related to the operation of a motor vehicle or public safety. The Health Insurance Portability and Accountability Act of 1996 (P.L. 104- 191) made a number of changes to laws relating to health insurance. It also directed the Department of Health and Human Services to issue regulations to protect the privacy and security of personally identifiable health information. The resulting privacy rule (45 C.F.R. Part 164) defines certain rights and obligations for covered entities (e.g., health plans and health care providers) and individuals, including the following: giving individuals the right to be notified of privacy practices and to inspect, copy, request correction, and have an accounting of disclosures of health records, except for specified exceptions; setting limits on the use of health information apart from treatment, payment, and health care operations (e.g., for marketing) without the individual’s authorization; permitting disclosure of health information without the individual’s authorization for purposes of public health protection; health oversight; law enforcement; judicial and administrative proceedings; approved research activities; coroners, medical examiners, and funeral directors; workers’ compensation programs, government abuse, neglect, and domestic violence authorities; organ transplant organizations; government agencies with specified functions, e.g., national security activities; and as required by law; requiring that authorization forms contain specific types of information, such as a description of the health information to be used or disclosed, the purpose of the use or disclosure, and the identity of the recipient of the information; and requiring covered entities to take steps to limit the use or disclosure of health information to the minimum necessary to accomplish the intended purpose, unless authorized or under certain circumstances. The Fair Credit Reporting Act (P.L. 91-508, 1970, 15 U.S.C. § 1681) governs the use of personal information by consumer reporting agencies, which are individuals or entities that regularly assemble or evaluate information about individuals for the purpose of furnishing consumer reports to third parties. The act defines a consumer report as any communication by a consumer reporting agency about an individual’s credit worthiness, character, reputation, characteristics, or mode of living and permits its use only in the following situations: as ordered by a court or federal grand jury subpoena; as instructed by the consumer in writing; for the extension of credit as a result of an application from a consumer or the review or collection of a consumer’s account; for employment purposes, including hiring and promotion decisions, where the consumer has given written permission; for the underwriting of insurance as a result of an application from a when there is a legitimate business need, in connection with a business transaction that is initiated by the consumer; to review a consumer’s account to determine whether the consumer continues to meet the terms of the account; to determine a consumer’s eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant’s financial responsibility or status; for use by a potential investor or servicer or current insurer in a valuation or assessment of the credit or prepayment risks associated with an existing credit obligation; and for use by state and local officials in connection with the determination of child support payments, or modifications of enforcement thereof. The act generally limits the amount of time negative information can be included in a consumer report to no more than 7 years, or 10 years in the case of bankruptcies. Under the act, individuals have a right to access all information in their consumer reports; a right to know who obtained their report during the previous year or two, depending on the circumstances; and a right to dispute the accuracy of any information about them. The Fair and Accurate Credit Transactions Act (P.L. 108-159, 2003) amended the Fair Credit Reporting Act, extending provisions to improve the accuracy of personal information assembled by consumer reporting agencies and better provide for the fair use of and consumer access to personal information. The act’s provisions include the following: consumers may request a free annual credit report from nationwide consumer reporting agencies, to be made available no later than 15 days after the date on which the request is received; persons furnishing information about individuals to consumer reporting agencies, and resellers of consumer reports, must have polices and procedures for investigating and correcting inaccurate information, consumers are given the right to prohibit business affiliates of consumer reporting agencies from using information about them for certain marketing purposes; and consumer reporting agencies cannot include medical information in reports that will be used for employment, credit transactions, or insurance transactions unless the consumer consents to such disclosures.

Summary: Federal agencies collect and use personal information for various purposes, both directly from individuals and from other sources, including information resellers--companies that amass and sell data from many sources. In light of concerns raised by recent security breaches involving resellers, GAO was asked to determine how the Departments of Justice, Homeland Security, and State and the Social Security Administration use personal data from these sources. In addition, GAO reviewed the extent to which information resellers' policies and practices reflect the Fair Information Practices, a set of widely accepted principles for protecting the privacy and security of personal data. GAO also examined agencies' policies and practices for handling personal data from resellers to determine whether these reflect the Fair Information Practices. In fiscal year 2005, the Departments of Justice, Homeland Security, and State and the Social Security Administration reported that they used personal information obtained from resellers for a variety of purposes. Components of the Department of Justice (the largest user of resellers) used such information in performing criminal investigations, locating witnesses and fugitives, researching assets held by individuals of interest, and detecting prescription drug fraud. The Department of Homeland Security used reseller information for immigration fraud detection and border screening programs. Uses by the Social Security Administration and the Department of State were to prevent and detect fraud, verify identity, and determine eligibility for benefits. The agencies spent approximately $30 million on contractual arrangements with resellers that enabled the acquisition and use of such information. About 91 percent of the planned fiscal year 2005 spending was for law enforcement (69 percent) or counterterrorism (22 percent). The major information resellers that do business with the federal agencies we reviewed have practices in place to protect privacy, but these measures are not fully consistent with the Fair Information Practices. For example, the principles that the collection and use of personal information should be limited and its intended use specified are largely at odds with the nature of the information reseller business, which presupposes that personal information can be made available to multiple customers and for multiple purposes. Resellers said they believe it is not appropriate for them to fully adhere to these principles because they do not obtain their information directly from individuals. Nonetheless, in many cases, resellers take steps that address aspects of the Fair Information Practices. For example, resellers reported that they have taken steps recently to improve their security safeguards, and they generally inform the public about key privacy principles and policies. However, resellers generally limit the extent to which individuals can gain access to personal information held about themselves, as well as the extent to which inaccurate information contained in their databases can be corrected or deleted. Agency practices for handling personal information acquired from information resellers did not always fully reflect the Fair Information Practices. That is, some of these principles were mirrored in agency practices, but for others, agency practices were uneven. For example, although agencies issued public notices on information collections, these did not always notify the public that information resellers were among the sources to be used. This practice is not consistent with the principle that individuals should be informed about privacy policies and the collection of information. Contributing to the uneven application of the Fair Information Practices are ambiguities in guidance from the Office of Management and Budget (OMB) regarding the applicability of privacy requirements to federal agency uses of reseller information. In addition, agencies generally lack policies that specifically address these uses.