OPM is the central human resources agency for the federal government, tasked with ensuring the government has an effective civilian workforce. To carry out this mission, OPM delivers human resources products and services, including personnel background investigations, to agencies on a reimbursable basis. These investigations are the responsibility of OPM’s FIS division. FIS conducts approximately 90 percent of all personnel background investigations for the federal government. FIS provides the results of the investigations to agencies for use in determining individuals’ suitability or fitness for federal civilian, military, or federal contract employment as well as eligibility for access to classified national security information. FIS also has responsibility for developing and implementing uniform policies and procedures to ensure the proper completion of investigations. For example, FIS issued internal agency guidance, called the Investigator’s Handbook, to direct its federal and contract investigators as they conduct investigations. In fiscal year 2009, FIS conducted over 2 million investigations of varying types. In addition to background investigations, FIS conducts other types of investigations and checks, including—among others—credit searches of all three major credit bureaus regarding financial responsibility and periodic reinvestigations (generally for moderate or high-risk positions). Many of these may be limited to contacting other federal agencies or private institutions for information and may not require an investigator to conduct traditional investigation activities such as interviewing individuals familiar with the subject. FIS’s investigations staff consists of approximately 2,300 federal employees and 6,000 contractor staff. To conduct these investigations, FIS officials use information technology systems located at FIS headquarters, known as the Federal Investigations Processing Center (FIPC), to coordinate investigative activities and store all of the information generated by such investigations. At FIPC, officials store and maintain electronic, microfilm, and paper records of OPM- conducted background investigations. Officials at FIPC make security clearance information available to federal personnel offices through a Web portal. FIPC receives requests for investigations from federal agencies, processes the requests through an automated system, and fields questions about its process and ongoing investigations. Security clearances are required for access to national security information, which may be classified at one of three levels: confidential, secret, and top secret. The level of classification denotes the degree of protection required for information and the amount of damage that unauthorized disclosure could reasonably be expected to cause to national security. Unauthorized disclosure could reasonably be expected to cause (1) “damage,” in the case of confidential information; (2) “serious damage,” in the case of secret information; and (3) “exceptionally grave damage,” in the case of top secret information. Background investigations allow federal agencies to make decisions both about suitability for employment, as well as access to national security information. The scope of information gathered in an investigation depends on the purpose of the investigation, such as whether it is being conducted for an employment suitability determination, an initial clearance, or a clearance renewal. For example, investigators collect information from agencies such as the Federal Bureau of Investigation (FBI) for all initial and renewal clearances. However, for initial top secret clearances investigators need, among other things, to also corroborate the subject’s education and interview educational sources, as appropriate. For an investigation for a confidential or secret clearance, investigators gather much of the information electronically. For an investigation for a top secret clearance, investigators gather additional information through more time-consuming efforts such as conducting in-person interviews to corroborate information about a subject’s employment and education. In 2009, OPM estimated that approximately 6-10 labor hours were needed for each investigation for a secret or confidential clearance, and 50-60 labor hours were needed for the investigation for an initial top secret clearance. The primary laws that provide privacy protections for personal information accessed or held by the federal government are the Privacy Act of 1974 and E-Government Act of 2002. These laws describe, among other things, agency responsibilities with regard to protecting PII. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. A system of records is a collection of information about individuals under control of an agency from which information is retrieved by the name of an individual or other identifier. The E-Government Act of 2002 requires agencies to assess the impact of federal information systems on individuals’ privacy. Specifically, the E-Government Act strives to enhance the protection of personal information in government information systems and information collections by requiring agencies to conduct privacy impact assessments (PIA). A PIA is an analysis of how personal information is collected, stored, shared, and managed in a federal system. Specifically, according to Office of Management and Budget (OMB) guidance, the purpose of a PIA is (1) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (2) to determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (3) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. The Privacy Act of 1974 is largely based on a set of internationally recognized principles for protecting the privacy and security of personal information known as the Fair Information Practices. A U.S. government advisory committee first proposed the practices in 1973 to address what it termed a poor level of protection afforded to privacy under contemporary law. The Organization for Economic Cooperation and Development (OECD) developed a revised version of the Fair Information Practices in 1980 that has, with some variation, formed the basis of privacy laws and related policies of many countries—including the United States, Australia, and New Zealand—and the European Union. These practices are now widely accepted as a standard benchmark for evaluating the adequacy of privacy protections. The eight principles of the Fair Information Practices are shown in table 1. The Fair Information Practices are not precise legal requirements. Rather, they provide a framework of principles for balancing the need for privacy with other public policy interests, such as national security, law enforcement, and administrative efficiency. Ways to strike that balance vary among countries and according to the type of information under consideration. The OPM Privacy Office is tasked with ensuring that the agency is in compliance with privacy laws by providing guidance on how to implement privacy provisions needed to protect personal information. To oversee its implementation of privacy protections, OPM has designated its Chief Information Officer (CIO) as its senior agency official for privacy. The CIO, in turn, uses the Privacy Program Manager to assist in providing oversight to ensure the agency is complying with privacy policies and guidance. Among other things, the Privacy Program Manager is responsible for developing policies and procedures for the development of PIAs as well as reviewing and recommending their approval. Within each OPM division, information system owners are responsible for implementing OPM’s privacy policies and guidance. To assist division-level officials in assessing potential privacy risks and protecting personal information, OPM’s Privacy Office established guidance for conducting PIAs. The guidance includes a template consisting of two parts: (1) an initial screening assessment tool to determine whether system owners are required to complete a PIA and (2) the PIA itself, which requires system owners to answer seven basic questions about the nature of their systems in addition to their intended uses and purposes for collecting personal information. Upon completion of the PIA template, system owners are required to submit PIAs to the Privacy Program Manager for evaluation and recommendation for approval to the CIO. According to OPM guidance, the CIO is responsible for reviewing and signing all OPM PIAs, which signify that a PIA is complete and can be posted to OPM’s Web site for public viewing. Additionally, OPM has developed and issued an agency-wide information security and privacy policy for both its federal and contractor employees to follow in protecting information resources from loss, theft, misuse, and unauthorized access. To supplement guidance provided by the OPM Privacy Office, FIS also has developed a Policy on the Protection of Personally Identifiable Information (PII) to provide employees, including contractors, with a description of their responsibilities in protecting PII and reporting PII breaches. FIS also requires its investigators to adhere to its Investigator’s Handbook for procedures and policies related to conducting personnel background investigations for the federal government. These two documents guide federal and contract investigators in the protection of PII during the course of their work. These documents specify procedures that align with the Fair Information Practices. For example, the documents direct investigators to protect PII they possess at their duty stations using a “two-barrier” approach, such as storing it within a locked desk that is located inside of a locked house, which aligns with the security safeguards principle. In addition to its policies and guidance, FIS promotes awareness of privacy protection requirements through PII training and agency newsletters. For example, to support the agency’s initiative to reduce privacy breaches, employees participated in a “no breach” week initiative to help ensure that FIS policies and guidance were being followed. In April 2009, the OPM Office of the Inspector General (OIG) completed an audit of the security of PII within the FIS division and made nine recommendations to improve the protection of these data. The OPM OIG reviewed FIS controls for the storage, security, and transmission of PII. The OIG’s report identified, among other things, that (1) required security awareness and PII training had not been completed by all FIS employees and contractor staff; and (2) FIS did not have adequate controls for ensuring that PII incidents were reported by FIS employees and contractors in a timely manner. In response to the OIG’s recommendations, FIS recently established a security and PII training program and required all employees and contractors to complete PII awareness training.