The DHS Privacy Office was established with the appointment of the first Chief Privacy Officer in April 2003. The Chief Privacy Officer is appointed by the Secretary and reports directly to him. Under departmental guidance, the Chief Privacy Officer is to work closely with other departmental components, such as the General Counsel’s Office and the Policy Office, to address privacy issues. The Chief Privacy Officer also serves as the designated senior agency official for privacy, as has been required by the Office of Management and Budget (OMB) of all major departments and agencies since 2005. The positioning of the Privacy Office within DHS differs from the approach used for privacy offices in other countries, such as Canada and the European Union, where privacy offices are independent entities with investigatory powers. Canada’s Privacy Commissioner, for example, reports to the Canadian House of Commons and Senate and has the power to summon witnesses and subpoena documents. In contrast, the DHS privacy officer position was established by the Homeland Security Act as an internal component of DHS. As a part of the DHS organizational structure, the Chief Privacy Officer has the ability to serve as a consultant on privacy issues to other departmental entities that may not have adequate expertise on privacy issues. The office is divided into two major functional groups addressing Freedom of Information Act (FOIA) and privacy responsibilities, respectively. Within each functional group, major responsibilities are divided among senior staff assigned to oversee key areas, including international privacy policy, departmental disclosure and FOIA, privacy technology, and privacy compliance operations. There are also component-level and program-level privacy officers at the Transportation Security Administration (TSA), U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) program, and U.S. Citizenship and Immigration Services. Figure 1 details the structure of the DHS Privacy Office. When the Privacy Office was initially established, it had 5 full-time employees, including the Chief Privacy Officer. Since then, the staff has expanded to 16 full-time employees. The Privacy Office has also hired private contractors to assist in meeting its obligations. As of February 2007, the Privacy Office had 9 full-time and 3 half-time contractor staff in addition to its full-time employees. The first Chief Privacy Officer served from April 2003 to September 2005, followed by an Acting Chief Privacy Officer who served through July 2006. In July 2006, the Secretary appointed a second permanent chief privacy officer. In 2004, the Chief Privacy Officer established the DHS Data Privacy and Integrity Advisory Committee, which is to advise the Secretary and the Chief Privacy Officer on “programmatic, policy, operational, administrative, and technological issues within DHS” that affect individual privacy, data integrity, and data interoperability. The Advisory Committee is composed of privacy professionals from the private sector and academia and is organized into three subcommittees; Data Integrity and Information Protection, Privacy Architecture, and Data Acquisition and Use. To date, the Advisory Committee has issued reports on several privacy issues, such as use of commercial data and radio frequency identification (RFID) technology, and has made related policy recommendations to the department. The Advisory Committee’s charter requires that the committee meet at least once a year; however, thus far it has met quarterly. The Advisory Committee meetings, which are open to the public, are used to discuss progress on planned reports, to identify new issues, to receive briefings from DHS officials, and to hold panel discussions on privacy issues. The Privacy Office is responsible for ensuring that DHS is in compliance with federal laws that govern the use of personal information by the federal government. Among these laws are the Homeland Security Act of 2002 (as amended by the Intelligence Reform and Terrorism Prevention Act of 2004), the Privacy Act of 1974, and the E-Gov Act of 2002. Based on these laws, the Privacy Office’s major responsibilities can be summarized into four broad categories: (1) reviewing and approving PIAs, (2) integrating privacy considerations into DHS decision making, (3) reviewing and approving public notices required by the Privacy Act, and (4) preparing and issuing reports. Section 208 of the E-Gov Act is designed to enhance protection of personally identifiable information in government information systems and information collections by requiring that agencies conduct PIAs. According to OMB guidance, a PIA is an analysis of how information is handled: (1) to ensure that handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (2) to determine the risks and effects of collecting, maintaining, and disseminating personally identifiable information in an electronic information system; and (3) to examine and evaluate protections and alternative processes for handling information to mitigate potential risks to privacy. Agencies must conduct PIAs before they (1) develop or procure information technology that collects, maintains, or disseminates personally identifiable information or (2) initiate any new data collections of personal information that will be collected, maintained, or disseminated using information technology—if the same questions are asked of 10 or more people. To the extent that PIAs are made publicly available, they provide explanations to the public about such things as what information will be collected, why it is being collected, how it is to be used, and how the system and data will be maintained and protected. Further, a PIA can serve as a tool to guide system development decisions that have a privacy impact. The Privacy Office is responsible for ensuring departmental compliance with the privacy provisions of the E-Gov Act. Specifically, the chief privacy officer must ensure compliance with the E-Government Act requirement that agencies perform PIAs. In addition, the Homeland Security Act requires the chief privacy officer to conduct a PIA for proposed rules of the department on the privacy of personal information. The Privacy Office’s involvement in the PIA process also serves to address the Homeland Security Act requirement that the chief privacy officer assure that technology sustains and does not erode privacy protections. Integrating privacy considerations into the DHS decision-making process Several of the Privacy Office’s statutory responsibilities involve ensuring that the major decisions and operations of the department do not have an adverse impact on privacy. Specifically, the Homeland Security Act requires that the Privacy Office assure that the use of technologies by the department sustains, and does not erode, privacy protections relating to the use, collection, and disclosure of personal information. The act further requires that the Privacy Office evaluate legislative and regulatory proposals involving the collection, use, and disclosure of personal information by the federal government. It also requires the office to coordinate with the DHS Officer for Civil Rights and Civil Liberties on those issues. Reviewing and approving public notices required by the Privacy Act The Privacy Office is required by the Homeland Security Act to assure that personal information contained in Privacy Act systems of records is handled in full compliance with fair information practices as set out in the Privacy Act of 1974. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personally identifiable information that is maintained in their systems of records. The act defines a record as any item, collection, or grouping of information about an individual that is maintained by an agency and contains that individual’s name or other personal identifier, such as a Social Security number. It defines “system-of- records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires agencies to notify the public, via a notice in the Federal Register, when they create or modify a system-of- records. This notice is known as a system-of-records notice and must include information such as the type of information collected, the types of individuals about whom information is collected, the intended “routine” uses of the information, and procedures that individuals can use to review and correct their personal information. The act also requires agencies to define—and limit themselves to—specific purposes for collecting the information. The Fair Information Practices, which form the basis of the Privacy Act, are a set of principles for protecting the privacy and security of personal information that were first proposed in 1973 by a U.S. government advisory committee. These principles were intended to address what the committee considered the poor level of protection then being afforded to privacy under contemporary law. Since that time, the Fair Information Practices have been widely adopted as a benchmark for evaluating the adequacy of privacy protections. Appendix II contains a summary of the Fair Information Practices. The Homeland Security Act requires the Privacy Office to prepare annual reports to Congress detailing the department’s activities affecting privacy, including complaints of privacy violations and implementation of the Privacy Act of 1974. In addition to the reporting requirements under the Homeland Security Act, Congress has occasionally directed the Privacy Office to report on specific technologies and programs. For example, in the conference report for the DHS appropriations act for fiscal year 2005, Congress directed the Privacy Office to report on DHS’s use of data mining technologies. Congress asked for a follow-up report on data mining in the conference report for the fiscal year 2007 DHS appropriations bill. The Intelligence Reform and Terrorism Prevention Act of 2004 also required the Chief Privacy Officer to submit a report to Congress on the privacy and civil liberties impact of the DHS-maintained Automatic Selectee and No-Fly lists, which contain names of potential airline passengers who are to be selected for secondary screening or not allowed to board aircraft. In addition, the Privacy Office can initiate its own investigations and produce reports under its Homeland Security Act authority to report on complaints of privacy violations and assure technologies sustain and do not erode privacy protections. The DHS Privacy Office has made significant progress in addressing its statutory responsibilities under the Homeland Security Act by developing processes to ensure implementation of privacy protections in departmental programs. For example, the Privacy Office has established processes for ensuring departmental compliance with the PIA requirement in the E-Gov Act of 2002. Instituting this framework has led to increased attention to privacy requirements on the part of departmental components, contributing to an increase in the quality and number of PIAs issued.