In recent years, a number of factors have led to growing concern about the protection of privacy when personally identifiable information is collected and maintained by the federal government. Recent data breaches of personal information at government agencies, such as the data breach at the Department of Veterans Affairs, which exposed the personal information of 26.5 million veterans and active duty members of the military in May 2006, have raised concerns about identity theft. In addition, increasingly sophisticated analytical techniques employed by federal agencies, such as data mining, also raise concerns about how personally identifiable information is used and what controls are placed on its use. Concerns such as these have focused attention on the structures agencies have instituted to ensure privacy protections are in place. The major requirements for privacy protection by federal agencies come from two laws, the Privacy Act of 1974 and the E-Gov Act of 2002. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. It also defines “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires that when agencies maintain a system of records, they must notify the public by a system-of-records notice: that is, a notice in the Federal Register identifying, among other things, the type of data collected, the types of individuals about whom information is collected, the intended “routine” use of the data, and procedures that individuals can use to review and correct personal information. The act also requires agencies to define and limit their use of covered personal information. In addition, the act requires that to the greatest extent practicable, personal information should be collected directly from the subject individual when it may affect an individual’s rights or benefits under a federal program. The E-Gov Act of 2002 also assigns agencies significant responsibilities relating to privacy. The E-Gov Act strives to enhance protection for personal information in government information systems or information collections by requiring that agencies conduct PIAs. A PIA is an analysis of how personal information is collected, stored, shared, and managed in a federal system. Furthermore, according to OMB guidance, a PIA is an analysis of how information is handled. Specifically, a PIA is to (1) ensure that handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (2) determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (3) examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. Agencies must conduct PIAs (1) before developing or procuring information technology that collects, maintains, or disseminates information that is in a personally identifiable form or (2) before initiating any new data collections involving personal information that will be collected, maintained, or disseminated using information technology if the same questions are asked of 10 or more people. To the extent that PIAs are made publicly available, they provide explanations to the public about such things as the information that will be collected, why it is being collected, how it is to be used, and how the system and data will be maintained and protected. OMB is tasked with providing guidance to agencies on how to implement the provisions of these two acts and has done so, beginning with guidance on the Privacy Act, issued in 1975. The guidance provides explanations for the various provisions of the law as well as detailed instructions on how to comply. OMB’s guidance on implementing the privacy provisions of the E- Gov Act of 2002 identifies circumstances under which agencies must conduct PIAs and explains how to conduct them. We have previously reported on the role of senior privacy officials in the federal government. In 2006, we testified that the elevation of privacy officers to senior positions reflected the growing demands that these individuals faced in addressing privacy challenges on a day-to-day basis. The challenges we identified included ensuring compliance with relevant privacy laws, such as the Privacy Act and the E-Gov Act, and controlling the collection and use of personal information obtained from commercial sources. Additionally, in 2007 we reported that the DHS Privacy Office had made significant progress in carrying out its statutory responsibilities under the Homeland Security Act and its related role in ensuring E-Gov Act compliance, but noted that more work remained to be accomplished. We recommended that DHS designate privacy officers at key DHS components, implement a department wide process for reviewing Privacy Act notices, establish a schedule for the timely issuance of privacy reports, and ensure that the Privacy Office’s annual reports to Congress contain a specific discussion of complaints of privacy violations. In response, DHS included a discussion of privacy complaints in its most recent annual report; however, the other recommendations have not yet been implemented. Laws and guidance set a variety of requirements for senior privacy officials at federal agencies. For example, agencies have had a long standing requirement under the Paperwork Reduction Act to assign agency CIOs overall responsibility for privacy policy and compliance with the Privacy Act. In recent years, additional laws have been enacted that also address the roles and responsibilities of senior officials with regard to privacy. Despite much variation, all of these laws require agencies to assign overall responsibility for privacy protection and compliance to a senior agency official. In addition, OMB guidance has directed agencies to designate senior officials with overall responsibility for privacy. These laws and guidance set specific privacy responsibilities for these agency officials. These responsibilities can be grouped into six broad categories: (1) conducting PIAs; (2) Privacy Act compliance; (3) reviewing and evaluating the privacy implications of agency policies, regulations, and initiatives; (4) producing reports on the status of privacy protections; (5) ensuring that redress procedures are in place; and (6) ensuring that employees and contractors receive appropriate training. The laws and guidance vary in how they frame requirements in these categories and which agencies must adhere to them. Numerous laws assign privacy responsibility to senior agency officials. The earliest of these laws is the Paperwork Reduction Act of 1980, which, as amended, directs agency heads to assign a CIO with responsibility for carrying out the agency’s information resources management activities to improve agency productivity, efficiency, and effectiveness. The act directs agency CIOs to undertake responsibility for implementing and enforcing applicable privacy policies, procedures, standards, and guidelines, and to assume responsibility and accountability for compliance with and coordinated management of the Privacy Act of 1974 and related information management laws. As concerns about privacy have increased in recent years, Congress has enacted additional laws that include provisions addressing the roles and responsibilities of senior officials with regard to privacy. Despite variations, a common thread among these laws, as well as relevant OMB guidance, is that they all require agencies to assign overall responsibility for privacy protection and compliance to a senior agency official. Relevant laws include the following: The Homeland Security Act of 2002 directed the secretary of DHS to designate a senior official with primary responsibility for privacy policy. The Intelligence Reform and Terrorism Prevention Act of 2004 required the Director of National Intelligence to appoint a Civil Liberties Protection Officer and assigned this individual specific privacy responsibilities. The Violence Against Women and Department of Justice Reauthorization Act of 2005 instructed the Attorney General to designate a senior official with primary responsibility for privacy policy. The Transportation, Treasury, Independent Agencies and General Government Appropriations Act of 2005 directed each agency whose appropriations were provided by the act, including the Departments of Transportation and Treasury, to designate a CPO with primary responsibility for privacy and data protection policy. The Implementing Recommendations of the 9/11 Commission Act of 2007 instructed the heads of Defense, DHS, Justice, Treasury, Health and Human Services, and State, as well as the Office of the Director of National Intelligence and the Central Intelligence Agency to designate no less than one senior officer to serve as a privacy and civil liberties officer. Specific privacy provisions of these laws are summarized in appendix II. A number of OMB memorandums have also addressed the roles and responsibilities of senior privacy officials. In 1999, OMB required agencies to designate a senior official to assume primary responsibility for privacy policy. OMB later reiterated this requirement in its guidance on compliance with the E-Gov Act, in which it directed agency heads to designate an appropriate senior official with responsibility for the coordination and implementation of OMB Web and privacy policy and to serve as the agency’s principal contact for privacy policies. Most recently, in 2005, OMB directed agencies to designate an SAOP with agency wide responsibility for information privacy issues and with responsibility for specific privacy functions, including ensuring agency compliance with all federal privacy laws, playing a central policy-making role in the development of policy proposals that implicate privacy issues, and ensuring that contractors and employees are provided with adequate privacy training. Beginning in 2005, OMB has also issued guidance significantly enhancing longstanding requirements for agencies to report on their compliance with privacy laws. OMB’s 2005 guidance directed agencies to add a new section addressing privacy to their annual reports under the Federal Information Security Management Act (FISMA). SAOPs were assigned responsibility for completion of this section, in which they were to report on such things as agency policies and procedures for the conduct of PIAs, agency policies for ensuring adequate privacy training, as well as their own involvement in agency regulatory and policy decisions. In 2006, OMB issued further guidance requiring agencies to include as part of their FISMA reports a section addressing measures for protecting personally identifiable information. This guidance also required that agencies provide OMB with quarterly privacy updates and report all incidents relating to the loss of or unauthorized access to personally identifiable information. Most recently, OMB directed agencies in 2007 to include in their FISMA reports additional items, such as their breach notification policies, plans to eliminate unnecessary use of Social Security numbers, and plans for reviewing and reducing their holdings of personally identifiable information.