The Privacy Act of 1974 is the primary act that regulates the federal government’s use of personal information. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information in systems of records. A system of records is a collection of information about individuals under the control of an agency from which information is actually retrieved by the name of the individual or by some identifying number, symbol, or other particular assigned to the individual. The act does not apply when there is merely a capability or potential for retrieval by identifier, which is often the case with electronic records. Among the major provisions of the Privacy Act are the following: Collecting only necessary information. Agencies are to maintain personal information about an individual only when it is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or executive order of the President. According to OMB guidance, the goal of this provision is to reduce the amount of personal information that agencies collect in order to reduce the risk of agencies’ improperly using personal information. Providing public notice. Agencies are to publish a notice in the Federal Register when establishing or revising a system of records. The notice is to contain the name and location of the system, the categories of individuals on whom records are maintained in the system, and each “routine use” of the records contained in the system. Providing for informed consent. Agencies are to inform individuals whom it asks to supply information of (1) the authority for soliciting the information and whether disclosure of such information is mandatory or voluntary, (2) the principal purposes for which the information is intended to be used, (3) the routine uses that may be made of the information, and (4) the effects on the individual, if any, of not providing the information. Protecting against adverse determinations through maintaining accuracy of personal information. Agencies are to maintain all records used in making any determination about individuals with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to ensure fairness to the individual. Safeguarding information. Agencies are to establish appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records and to protect against anticipated threats or hazards to their security or integrity that could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained. Accounting for disclosures of records. Agencies are to keep an accounting of the date, nature, and purpose of each disclosure of a record, and the name and address of the person or agency to whom the disclosure is made (except for disclosures within the agency for official purposes or for disclosures required under the Freedom of Information Act). Training employees. Agencies are to instruct persons on the requirements of the act if they are involved in the design, development, operation, or maintenance of any system of records or in maintaining any record. Providing notice of exemptions of systems of records. When an agency uses the authority in the act to exempt a system of records from certain provisions, the agency is to issue a rule explaining the reasons for the exemption. Providing for civil remedies and criminal penalties for violating the rights granted by the Privacy Act. The act grants individuals the right of access to agency records pertaining to themselves; the right to amend such a record if it is inaccurate, irrelevant, untimely, or incomplete; and the right to sue the government for violations of the act. There are civil remedies and criminal penalties for agencies not affording individuals these rights. In 1988, Congress amended the Privacy Act through passage of the Computer Matching and Privacy Protection Act, which established safeguards regarding an agency’s use of Privacy Act records in performing certain computerized matching programs. Under the act, a written computer matching agreement is required for any computerized comparison of two or more automated systems of records for the purposes of determining the eligibility of applicants for assistance under federal benefits programs or of recouping payments or delinquent debts under federal benefits programs. Agreements are also required for any computerized comparison of federal personnel or payroll systems. Computer matching agreements must specify the purpose and legal authority for conducting the match and how these matches will be performed. Agency Data Integrity Boards are to approve matching agreements and assess the costs and benefits of the match. (There are some exceptions, such as not assessing costs and benefits where the match is required by statute.) Under the Privacy Act, OMB is responsible for developing guidelines and regulations and providing “continuing assistance to and oversight of” agencies’ implementation of the act. In 1975, OMB issued its initial Privacy Act implementing guidance entitled Privacy Act Implementation: Guidelines and Responsibilities. In addition, OMB Circular A-130 (Management of Federal Information Resources) sets forth a number of general policies concerning the protection of personal privacy by the federal government: The individual’s right of privacy must be protected in federal government information activities involving personal information. Agencies shall consider the effects of their actions on the privacy rights of individuals and ensure that appropriate legal and technical safeguards are implemented. Agencies shall limit the collection of information that identifies individuals to that which is legally authorized and necessary for the proper performance of agency functions. Agency heads shall periodically review (1) a random sample of agency contracts for maintaining systems of records to ensure that contractors are bound by the Privacy Act; (2) routine use disclosures associated with each system of records to ensure that they are compatible with their original purpose for collection; and (3) training practices to ensure that employees are familiar with the Privacy Act and the agency’s implementing regulation. As of April 2003, OMB’s Web site, www.whitehouse.gov/omb, also provides links to documents characterized as “Privacy Guidance” and “Privacy Reference Materials” (http://www.whitehouse.gov/omb/inforeg/infopoltech.html). Those documents include the initial Privacy Act guidance, memoranda about privacy policies on federal Web sites, interagency sharing of personal data, letters on agency use of Web “cookies.” (See app. III.) OMB officials stated that one OMB staff person is dedicated to Privacy Act issues full time. In addition, according to that one staff person, several other OMB staff also devote part of their time to this effort. The Privacy Act staff position is located in the Information Policy and Technology Branch within the Office of Information and Regulatory Affairs. According to OMB, the duties associated with this position include reviewing agencies’ draft Federal Register notices and systems reports for new and altered systems of records and computer matches; answering agencies’ questions about how to implement the act, and responding to questions from federal employees and the public about the scope and application of the act; monitoring court rulings involving the Privacy Act; developing written guidance to agencies on Privacy Act implementation issues and federal Internet privacy policy; leading interagency work groups on Privacy Act issues; providing input to OMB’s positions on legislation, rules, regulations, and testimony that have privacy policy implications; and participating in interagency discussions and activities concerning other privacy policy issues (consumer fraud/identity theft, do-not-call lists, medical privacy, financial privacy, etc.). One body tasked with addressing federal governmentwide issues such as privacy and security is the Chief Information Officers (CIO) Council, chaired by the Deputy Director for Management in OMB. Initially established in 1996 by Executive Order 13011, the CIO Council was enacted into law by the E-Government Act of 2002. The council serves as the principal interagency forum for improving practices in the management of federal information resources. Among its functions are responsibilities to develop policy recommendations for OMB, help coordinate multiagency projects and other innovative initiatives, assist in standards development, and work with the Office of Personnel Management (OPM) to address hiring and training needs. Concerns about implementation of the Privacy Act have arisen periodically since its passage. In 1983, for example, in a report summarizing 9 years (1975–1983) of congressional oversight of the act, the House Committee on Government Reform (formerly called the Committee on Government Operations) concluded that OMB had not pursued its responsibility to revise and update its original guidance from 1975 and had not actively monitored agency compliance with its guidance. It stated “Interest in the Privacy Act at has diminished steadily since 1975. Each successive Administration has shown less concern about Privacy Act oversight.” A subsequent administration initiative addressed the difficulty of assuring privacy in an increasingly electronic environment. In May 1998, a presidential memorandum was issued stating that increases in agencies’ use of electronic records permit “this information to be used and analyzed in ways that could diminish individual privacy in the absence of additional safeguards.” Consequently, the heads of executive departments and agencies were directed to review their Privacy Act systems of records within 1 year, and OMB was directed, among other things, to issue instructions to agencies on conducting and reporting these reviews. In its January 1999 instructions, OMB also asked agencies to identify areas where they believe further OMB guidance was needed. The resulting responses from 72 agencies highlighted a range of issues. For example, in assessing their own compliance with the Privacy Act, agencies (1) added 131 systems of records that previously had not been properly identified, (2) revised 457 systems of records that were not up to date, and (3) deleted 288 systems of records that were no longer necessary. In addition, agencies requested centralized, updated guidance, particularly with regard to new technologies such as E-mail, Web sites, and electronic records. Further, agencies suggested, for example, that OMB establish an interagency taskforce on privacy. In addition, over the past 3 years, we have issued reports that raised concerns with the adequacy of selected OMB guidance. In September 2000, we reported that OMB’s guidance to agencies on Web site privacy policies was unclear in several respects and contained undefined language. We recommended that OMB clarify its guidance on privacy policies for agencies’ Web sites.