Before advanced computerized techniques, obtaining people’s personal information usually required visiting courthouses or other government facilities to inspect paper-based public records, and information contained in product registrations and other business records was not generally available at all. Automation of the collection and aggregation of multiple-source data, combined with the ease and speed of its retrieval, have dramatically reduced the time and effort needed to obtain such information. Information resellers provide services based on these technological advances. We use the term “information resellers” to refer to businesses that vary in many ways but have in common collecting and aggregating personal information from multiple sources and making it available to their customers. These businesses do not all focus exclusively on aggregating and reselling personal information. For example, Dun & Bradstreet primarily provides information on commercial enterprises for the purpose of contributing to decision making regarding those enterprises. In doing so, it may supply personal information about individuals associated with those commercial enterprises. To a certain extent, the activities of information resellers may also overlap with the functions of consumer reporting agencies, also known as credit bureaus—entities that collect and sell information about individuals’ creditworthiness, among other things. To the extent that information resellers perform the functions of consumer reporting agencies, they are subject to legislation specifically addressing that industry, particularly the Fair Credit Reporting Act. Information resellers have now amassed extensive amounts of personal information about large numbers of Americans. They supply it to customers in both government and the private sector, typically via a centralized online resource. Generally, three types of information are collected: ● Public records such as birth and death records, property records, motor vehicle and voter registrations, criminal records, and civil case files. ● Publicly available information not found in public records but nevertheless publicly available through other sources, such as telephone directories, business directories, classified ads or magazines, Internet sites, and other sources accessible by the general public. ● Nonpublic information derived from proprietary or nonpublic sources, such as credit header data, product warranty registrations, and other application information provided to private businesses directly by consumers. Figure 1 illustrates how these types of information are collected and aggregated into reports that are ultimately accessed by customers, including government agencies. No single federal law governs all use or disclosure of personal information. The major requirements for the protection of personal privacy by federal agencies come from the Privacy Act of 1974 and the privacy provisions of the E-Government Act of 2002. Federal use of personal information is governed primarily by the Privacy Act of 1974, which places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. It also defines “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public by placing a notice in the Federal Register identifying, among other things, the type of data collected, the types of individuals about whom the information is collected, the routine uses of the data, and procedures that individuals can use to review and correct their personal information. Additional provisions of the Privacy Act are discussed in the 2006 report. The E-Government Act of 2002 requires that agencies conduct PIAs. A PIA is an analysis of how personal information is collected, stored, shared, and managed in a federal system. Under the E- Government Act and related OMB guidance, agencies must conduct PIAs (1) before developing or procuring information technology that collects, maintains, or disseminates information that is in a personally identifiable form; (2) before initiating any new data collections involving personal information that will be collected, maintained, or disseminated using information technology if the same questions are asked of 10 or more people; or (3) when a system change creates new privacy risks, for example, by changing the way in which personal information is being used. OMB is tasked with providing guidance to agencies on how to implement the provisions of the Privacy Act and the E-Government Act and has done so, beginning with guidance on the Privacy Act, issued in 1975. OMB’s guidance on implementing the privacy provisions of the E-Government Act of 2002 identifies circumstances under which agencies must conduct PIAs and explains how to conduct them. The PIA mandate in the E-Government Act of 2002 provided a mechanism by which agencies can consider privacy in the earliest stages of system development. PIAs can be an important tool to help agencies to address openness and purpose specification principles early in the process of developing new information systems. To the extent that PIAs are made publicly available, they provide explanations to the public about such things as the information that will be collected, why it is being collected, how it is to be used, and how the system and data will be maintained and protected. The Privacy Act of 1974 is largely based on a set of internationally recognized principles for protecting the privacy and security of personal information known as the Fair Information Practices. A U.S. government advisory committee first proposed the practices in 1973 to address what it termed a poor level of protection afforded to privacy under contemporary law. The Organization for Economic Cooperation and Development (OECD) developed a revised version of the Fair Information Practices in 1980. This version of the principles was reaffirmed by OECD ministers in a 1998 declaration and further endorsed in a 2006 OECD report. The Fair Information Practices, have, with some variation, formed the basis of privacy laws and related policies in many countries, including the United States, Germany, Sweden, Australia, and New Zealand, as well as the European Union. In addition, in its 2007 report, Engaging Privacy and Information Technology in a Digital Age, the National Research Council found that the principles of fair information practice for the protection of personal information are as relevant today as they were in 1973. Accordingly, the committee recommended that the Fair Information Practices should be extended as far as reasonably feasible to apply to private sector organizations that collect and use personal information. The eight principles of the OECD Fair Information Practices are shown in table 1. The Fair Information Practices are not precise legal requirements. Rather, they provide a framework of principles for balancing the need for privacy with other public policy interests, such as national security, law enforcement, and administrative efficiency. Ways to strike that balance vary among countries and according to the type of information under consideration. DOJ, DHS, State, and SSA reported approximately $30 million through contracts with information resellers in fiscal year 2005. The agencies reported using personal information obtained from resellers for a variety of purposes including law enforcement, counterterrorism, fraud detection/prevention, and debt collection. In all, approximately 91 percent of agency uses of reseller data were in the categories of law enforcement (69 percent) or counterterrorism (22 percent). Figure 2 details contract values categorized by their reported use. DOJ, which accounted for about 63 percent of the funding, mostly used the data for law enforcement and counterterrorism. DHS also used reseller information primarily for law enforcement and counterterrorism. State and SSA reported acquiring personal information from information resellers for fraud prevention and detection, identity verification, and benefits eligibility determination. In fiscal year 2005, DOJ and its components reported approximately $19 million through contracts with a wide variety of information resellers, primarily for purposes related to law enforcement (75 percent) and counterterrorism (18 percent). The Federal Bureau of Investigation (FBI), which is DOJ’s largest user of information resellers, used reseller information to, among other things, analyze intelligence and detect terrorist activities in support of ongoing investigations by law enforcement agencies and the intelligence community. In this capacity, resellers provided the FBI’s Foreign Terrorist Tracking Task Force with names, addresses, telephone numbers, and other biographical and demographical information as well as legal briefs, vehicle and boat registrations, and business ownership records. The Drug Enforcement Administration (DEA), the second largest DOJ user of information resellers in fiscal year 2005, obtained reseller data primarily to detect fraud in prescription drug transactions. Agents used reseller data to detect irregular prescription patterns for specific drugs and trace this information to the pharmacy and prescribing doctor. DHS and its components reported that they used information reseller data in fiscal year 2005 primarily for law enforcement purposes, such as developing leads on subjects in criminal investigations and detecting fraud in immigration benefit applications (part of enforcing immigration laws). DHS’s largest investigative component, the U.S. Immigration and Customs Enforcement, is also its largest user of personal information from resellers. It collected data such as address and vehicle information for criminal investigations and background security checks. Another DHS component, U.S. Customs and Border Protection, conducts queries on people, businesses, property. The Federal Emergency Management Agency, an additional component, used an information reseller to detect fraud in disaster assistance applications. DHS also reported using information resellers in its counterterrorism efforts. For example, the Transportation Security Administration (TSA), a DHS component, used data obtained from information resellers as part of a test associated with the development of its domestic passenger prescreening program, called Secure Flight. TSA planned for Secure Flight to compare domestic flight reservation information submitted to TSA by aircraft operators with federal watch lists of individuals known or suspected of activities related to terrorism. In an effort to ensure the accuracy of Social Security benefit payments, the SSA and its components reported approximately $1.3 million in contracts with information resellers in fiscal year 2005 for purposes relating to fraud prevention (such as skiptracing), confirming suspected fraud related to workers’ compensation payments, obtaining information on criminal suspects for follow-up investigations, and collecting debts.