Federal agency collection or use of personal information is governed primarily by two laws: the Privacy Act of 1974 and the privacy provisions of the E-Government Act of 2002. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a record as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. The act defines a “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public through a system-of- records notice in the Federal Register that identifies, among other things, the categories of data collected, the categories of individuals about whom information is collected, the intended “routine” uses of data, and procedures that individuals can use to review and correct personally identifiable information. Several provisions of the act require agencies to define and limit collection and use of personal information to predefined purposes. For example, it requires that, to the greatest extent practicable, personal information should be collected directly from the individual when it may affect that person’s rights or benefits under a federal program. It also requires agencies to indicate whether the individual’s disclosure of the information is mandatory or voluntary; the principal purposes for which the information is intended to be used; the routine uses that may be made of the information; and the effects on the individual, if any, of not providing the information. Further, in handling information they have collected, agencies are generally required to allow individuals to review their records, request a copy of their record, and request corrections to their information, among other things. The E-Government Act of 2002 was passed, among other reasons, to enhance the protection for personal information in government information systems or information collections by requiring that agencies conduct privacy impact assessments (PIA). PIAs are analyses of how personal information is collected, stored, shared, and managed in a federal system. Title III of the E-Government Act, known as the Federal Information Security Management Act of 2002 (FISMA), established a framework designed to ensure the effectiveness of security controls over information resources that support federal operations and assets. According to FISMA, each agency is responsible for, among other things, providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency and information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency. These protections are to provide federal information and systems with integrity—preventing improper modification or destruction of information, confidentiality—preserving authorized restrictions on access and disclosure, and availability— ensuring timely and reliable access to and use of information. The privacy protections incorporated in the Privacy Act are based primarily on the Fair Information Practices—a set of widely recognized principles for protecting the privacy of personal information first developed by an advisory committee convened by the Secretary of Health, Education and Welfare in 1972 and revised by the Organization for Economic Cooperation and Development (OECD) in 1980. These practices underlie the major provisions of the Privacy Act and privacy laws and related policies in many countries, including Germany, Sweden, Australia, and New Zealand, as well as the European Union. They are also reflected in a variety of federal agency policy statements, beginning with an endorsement of the OECD principles by the Department of Commerce in 1981. The OECD version of the principles is shown in table 1. The Privacy Act gives the Office of Management and Budget (OMB) responsibility for developing guidelines and providing assistance to and oversight of agencies’ implementation of the act. OMB also has responsibility under the E-Government Act for developing PIA guidance and ensuring agency implementation of the PIA requirement. In July 1975, OMB issued guidance for implementing the provisions of the Privacy Act and has periodically issued additional guidance since then. OMB has also issued guidance on other data security and privacy-related issues including federal agency website privacy policies, interagency sharing of personal information, designation of senior staff responsible for privacy, data breach notification, and safeguarding personally identifiable information. Technological developments since the Privacy Act became law in 1974 have radically changed the way information is organized and shared among organizations and individuals. Such advances have rendered some of the provisions of the Privacy Act and the E-Government Act of 2002 inadequate to fully protect all personally identifiable information collected, used, and maintained by the federal government. For example, we reported in 2010 on privacy challenges associated with agencies using Web 2.0 technologies, such as web logs (“blogs”), social networking websites, video- and multimedia-sharing sites, and “wikis.” While the Privacy Act clearly applies to personal information maintained in systems owned and operated by the federal government, agencies often take advantage of commercial Web 2.0 offerings, in which case they have less control over the systems that maintain and exchange information, raising questions about whether personal information contained in those systems is protected under the act. While OMB subsequently issued guidance to federal agencies for protecting privacy when using web-based technologies, we reported in June 2011 that agencies had made mixed progress in updating privacy policies and assessing privacy risks associated with their use of social media services, as required by OMB’s guidance. A number of agencies had not updated their privacy policies or conducted PIAs relative to their Accordingly, use of third-party services such as Facebook and Twitter.we recommended that 8 agencies update their privacy policies and that 10 agencies conduct required PIAs. Most of the agencies agreed with our recommendations; however, 5 have not yet provided evidence that they have updated their privacy policies and 4 have not yet provided documentation that they have conducted PIAs. Another technology that has been increasingly used is data mining, which is used to discover information in massive databases, uncover hidden patterns, find subtle relationships in existing data, and predict future results. Data mining involves locating and retrieving information, including personally identifiable information, in complex ways. In September 2011, we reported that the Department of Homeland Security (DHS) needed to improve executive oversight of systems supporting counterterrorism. We noted that DHS and three of its component agencies—U.S. Customs and Border Protection, U.S. Immigration and Customs Enforcement, and U.S. Citizenship and Immigration Services—had established policies that largely addressed the key elements and attributes needed to ensure that their data mining systems were effective and provided necessary privacy protections. However, we also noted, among other things, that DHS faced challenges in ensuring that all of its privacy-sensitive systems had timely and up-to- date PIAs. We recommended that that DHS develop requirements for providing additional scrutiny of privacy protections for sensitive information systems that are not transparent to the public through PIAs and investigate whether the information-sharing component of a certain data-mining system, the U.S. Immigration and Customs Enforcement Pattern Analysis and Information Collection program, should be deactivated until a PIA is approved that includes the component. DHS has taken action to address both of these recommendations. Given the challenges in applying privacy laws and overseeing systems that contain personally identifiable information, the role of executives in federal departments and agencies charged with oversight of privacy issues is of critical importance. In 2008 we reported on agencies’ designation of senior officials as focal points with overall responsibility for privacy.organizational structures used by agencies to address privacy requirements and assess whether senior officials had oversight over key functions. Although federal laws and OMB guidance require agencies to designate a senior official for privacy with privacy oversight responsibilities, we found that the 12 agencies we reviewed had varying organizational structures to address privacy responsibilities and that Among other things, we were asked to describe the designated senior privacy officials did not always have oversight of all key privacy functions. Without such oversight, these officials may be unable to effectively serve as agency central focal points for information privacy. We recommended that six agencies take steps to ensure that their senior agency officials for privacy have oversight of all key privacy functions. Of the six agencies to which recommendations were made, four have provided evidence that they have fully addressed our recommendations. In 2008, we issued a report on the sufficiency of privacy protections afforded by existing laws and guidance, in particular the Privacy Act, the E-Government Act, and related OMB guidance.that while these laws and guidance set minimum requirements for agencies, they may not consistently protect personally identifiable information in all circumstances of its collection and use throughout the federal government and may not fully adhere to key privacy principles. We identified issues in three major areas: Applying privacy protections consistently to all federal collection and use of personal information. The Privacy Act’s definition of a system of records, which sets the scope of the act’s protections, does not always apply whenever personal information is obtained and processed by federal agencies. For example, if agencies do not retrieve personal information by identifier, as may occur in data-mining systems, the act’s protections do not apply. We previously reported that among the 25 agencies surveyed, the most frequently cited reason for collections of records not being considered Privacy Act systems of records was that the agency did not use a personal identifier to retrieve the information. Factors such as these have led experts to agree that the Privacy Act’s system-of-records construct is too narrowly defined. An alternative for addressing these issues could include revising the system-of-records definition to cover all personally identifiable information collected, used, and maintained systematically by the federal government. GAO, Privacy Act: OMB Leadership Needed to Improve Agency Compliance, GAO-03- 304 (Washington, D.C.: June 30, 2003). specified purpose. Yet current laws and guidance impose only modest requirements for describing the purposes for personal information and limiting how it is used. For example, agencies are not required to be specific in formulating purpose descriptions in their public notices.