A core function of privacy officers is to ensure that their agencies are in compliance with federal laws. The major requirements for th protection of personal privacy by federal agencies come from two laws, the Privacy Act of 1974 and the E-Government Act of 2002. The Federal Information Security Management Act of 2002 (FISM A) also addresses the protection of personal information in the context of securing federal agency information and information systems. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in s ystems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by a agency and contains his or her name or another personal identifier. It also defines “system of records” as a group of records under the control of any agency from which information is retrieved by the n name of the individual or by an individual identifier. The Privacy A requires that when agencies establish or make changes to a system of records, they must notify the public by a “system-of-records notice”: that is, a notice in the Federal Register identifying, amo other things, the type of data collected, the types of individuals about whom information is collected, the intended “routine” use data, and procedures that individuals can use to review and correct personal information. Among other provisions, the act also requires agencies to define and limit themselves to specific predefined purposes. For example, the act requires that to the greatest ext ent practicable, personal information should be collected directly from the subject individual when it may affect an individual’s rights or benefits under a federal program. The provisions of the Privacy Act are largely based on a set of principles for protecting the privacy and security of personal information, known as the Fair Information Practices, which w first proposed in 1973 by a U.S. government advisory committee; these principles were intended to address what the committee termed a poor level of protection afforded to privacy under contemporary law. Since that time, the Fair Information Pra ctices have been widely adopted as a standard benchmark for evaluating the adequacy of privacy protections. Attachment 2 contains a summary of the widely used version of the Fair Information Practices adopted by the Organization for Economic Coopera and Development in 1980. The E-Government Act of 2002 strives to enhance protection for personal information in government information systems or information collections by requiring that agencies conduct pr impact assessments (PIA). A PIA is an analysis of how personal information is collected, stored, shared, and managed in a federa l system. More specifically, according to Office of Management and Budget (OMB) guidance, a PIA is an analysis of how information ishandled. Specifically, a PIA is to (1) ensure that handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (2) determine the risks and effects of collecting, maintaining, and disseminating information in identifiable an electronic information system; and (3) examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. Agencies must conduct PIAs (1) before developing or procuring information technology that collects, maintains, or disseminates information that is in a personally identifiable form; or (2) before initiating any new data collections involving personal information that will be collected, maintained, or disseminated using information technology if the same questions are asked of 10 or more people. To the extent that PIAs are made publicly available they provide explanations to the public about such things as the information that will be collected, why it is being collected, how to be used, and how the system and data will be maintained and protected. FISMA also addresses the protection of personal information. FISMA defines federal requirements for securing information a information systems that support federal agency operations and assets; it requires agencies to develop agencywide information security programs that extend to contractors and other provider federal data and systems. Under FISMA, information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification destruction, including controls necessary to preserve authorized , or restrictions on access and disclosure to protect personal privacy, among other things. OMB is tasked with providing guidance to agencies on how to implement the provisions of the Privacy Act and the E-Government Act and has done so, beginning with guidance on the Privacy Act, issued in 1975. The guidance provides explanations for the various provisions of the law as well as detailed instructions for how to comply. OMB’s guidance on implementing the privacy provisions of the E-Government Act of 2002 identifies circumstances under which agencies must conduct PIAs and explains how to conduct them. OMB has also issued guidance on implementing the provisions of FISMA. While many agencies have had officials designated as focal points for privacy-related matters for some time, these positions have recently gained greater prominence at a number of agencies. A long- standing requirement has been in place for agency chief information officers to be responsible for implementing and enforcing privacy policies, procedures, standards, and guidelines, and for compliance with the Privacy Act. In 2004, we reported that of the 27 major agency chief information officers, 17 were responsible for privacy and 10 were not. In those 10 agencies, privacy was most often the responsibility of the Office of General Counsel and/or various offices focusing on compliance with the Freedom of Information Act and the Privacy Act. Steps have been taken recently to highlight the importance of privacy officers in federal agencies. For example, the Transportation, Treasury, Independent Agencies, and General Government Appropriations Act of 2005 required each agency covered by the act to have a chief privacy officer responsible for, among other things, “assuring that the use of technologies sustain, and do not erode, privacy protections relating to the use, collection, and disclosure of information in identifiable form.” Subsequently, in February 2005, OMB issued a memorandum to federal agencies requiring them to designate a senior official with overall agencywide responsibility for information privacy issues. This senior official was to have overall responsibility and accountability for ensuring the agency’s implementation of information privacy protections and play a central policy-making role in the agency’s development and evaluation of policy proposals relating to the agency’s collection, use, sharing, and disclosure of personal information. Prior to the OMB guidance, several agencies had already designated privacy officials at higher levels. The Internal Revenue Service had been one of the first, establishing its privacy advocate in 1993. In 2001, the Postal Service established a Chief Privacy Officer. More recently, as you know, Section 222 of the Homeland Security Act of 2002 had created the first statutorily required senior privacy official at any federal agency. This law mandated the appointment of a senior official at DHS to assume primary responsibility for privacy policy, including, among other things, assuring that the use of technologies sustains, and does not erode, privacy protections relating to the use, collection, and disclosure of personal information. Since being established, the DHS Privacy Office created a Data Privacy and Integrity Advisory Committee, made up of experts from the private and non-profit sectors and the academic community, to advise it on issues within DHS that affect individual privacy, as well as data integrity, interoperability, and other privacy- related issues. Through the Intelligence Reform Act in 2004, Congress expressed more broadly the sense that agencies with law enforcement or anti- terrorism functions should have a privacy and civil liberties officer. In keeping with that, Justice recently announced the appointment of a Chief Privacy and Civil Liberties Officer responsible for reviewing and overseeing the department’s privacy operations and complying with privacy laws. Justice has also announced plans to establish an internal Privacy and Civil Liberties Board made up of senior Justice officials to assist in ensuring that the department’s activities are carried out in a way that fully protects the privacy and civil liberties of Americans. The elevation of privacy officers at federal agencies reflects the growing demands that these individuals face in addressing privacy challenges on a day-to-day basis. Among these challenges, several that are prominent include (1) complying with the Privacy Act and the E-Government Act of 2002, (2) ensuring that data mining efforts do not compromise privacy protections, (3) controlling the collection and use of personal information obtained from commercial sources, and (4) addressing concerns about radio frequency identification technology. Although it has been on the books for more than 30 years, the Privacy Act of 1974 continues to pose challenges for federal agencies. In 2003, we reported that agencies generally did well with certain aspects of the Privacy Act’s requirements—such as issuing system-of-records notices when required—but did less well at other requirements, such as ensuring that information is complete, accurate, relevant, and timely before it is disclosed to a nonfederal organization. In discussing this uneven compliance, agency officials reported the need for additional OMB leadership and guidance to assist in difficult implementation issues in a rapidly changing environment. For example, officials had questions about the act’s applicability to electronic records. Additional issues included the low agency priority given to implementing the act and insufficient employee training on the act. These are all issues that chief privacy officers could be in a position to address. For example, working in concert with officials from OMB and other agencies, they are in a position to identify ambiguities in guidance and provide clarifications about the applicability of the Privacy Act. Further, the establishment of a chief privacy officer position and its relative seniority within an agency’s organizational structure could indicate that an agency places priority on implementing the act. Finally, a chief privacy officer could also serve as a champion for privacy awareness and education across an agency. The E-Government Act’s requirement that agencies conduct PIAs is relatively recent, and we have not yet made a comprehensive assessment of agencies’ implementation of this important provision. However, our previous work has highlighted challenges with respect to conduct of these assessments for certain applications. For example, in our work on federal agency use of information resellers, we found that few agency components reported developing PIAs for their systems or programs that make use of information reseller data.