The recent theft of personally identifiable information on millions of veterans is only the latest of a series of such data breaches involving the loss or theft of information on magnetic tapes, computer hard drives, and other devices, as well as incidents in which individuals gained unauthorized access to large commercial databases of such information. Concerns about possible identity theft resulting from such breaches are widespread. The Federal Trade Commission (FTC) reported in 2005 that identity theft represented about 40 percent of all the consumer fraud complaints it received during each of the last 3 calendar years. Identity theft generally involves the fraudulent use of another person’s identifying information—such as name, address, Social Security number, date of birth, or mother’s maiden name—to establish credit, run up debt, or take over existing financial accounts. According to identity theft experts, individuals whose identities have been stolen can spend months or years and thousands of dollars clearing their names. Some individuals have lost job opportunities, been refused loans, or even been arrested for crimes they did not commit as a result of identity theft. Federal agencies are subject to security and privacy laws aimed in part at preventing security breaches, including breaches that could enable identity theft. The major requirements for the protection of personal privacy by federal agencies come from two laws, the Privacy Act of 1974 and the E-Government Act of 2002. FISMA also addresses the protection of personal information in the context of securing federal agency information and information systems. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. It also defines “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public by a “system-of-records notice”: that is, a notice in the Federal Register identifying, among other things, the type of data collected, the types of individuals about whom information is collected, the intended “routine” uses of data, and procedures that individuals can use to review and correct personal information. Among other provisions, the act also requires agencies to define and limit themselves to specific predefined purposes. The Office of Management and Budget (OMB), which is responsible for providing guidance to agencies on how to implement the provisions of the Privacy Act and other federal privacy and security laws, recently issued a memorandum reminding agencies of their responsibilities under the Privacy Act, other laws, and policy to appropriately safeguard sensitive personally identifiable information and train employees on their responsibilities in this area. The memo called on agency senior privacy officials to conduct a review of policies and processes to make sure adequate safeguards are in place to prevent the intentional or negligent misuse of, or unauthorized access to, personally identifiable information. The provisions of the Privacy Act are largely based on a set of principles for protecting the privacy and security of personal information, known as the Fair Information Practices, which were first proposed in 1973 by a U.S. government advisory committee; these principles were intended to address what the committee termed a poor level of protection afforded to privacy under contemporary law. Since that time, the Fair Information Practices have been widely adopted as a standard benchmark for evaluating the adequacy of privacy protections. Attachment 2 contains a summary of the widely used version of the Fair Information Practices adopted by the Organization for Economic Cooperation and Development in 1980. The E-Government Act of 2002 strives to enhance protection for personal information in government information systems by requiring that agencies conduct privacy impact assessments (PIA). A PIA is an analysis of how personal information is collected, stored, shared, and managed in a federal system. More specifically, according to OMB guidance, a PIA is to (1) ensure that handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (2) determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (3) examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. To the extent that PIAs are made publicly available, they provide explanations to the public about such things as the information that will be collected, why it is being collected, how it is to be used, and how the system and data will be maintained and protected. FISMA also addresses the protection of personal information. FISMA defines federal requirements for securing information and information systems that support federal agency operations and assets; it requires agencies to develop agencywide information security programs that extend to contractors and other providers of federal data and systems. Under FISMA, information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction, including controls necessary to preserve authorized restrictions on access and disclosure to protect personal privacy, among other things. Your committee has issued annual report cards on federal government information security based on reports submitted by agencies as required by FISMA. Federal laws to date have not required agencies to report security breaches to the public, although breach notification has played an important role in the context of security breaches in the private sector. For example, California state law requires businesses to notify consumers about security breaches that could directly affect them. Legal requirements, such as the California law, led ChoicePoint, a large information reseller, to notify its customers in mid-February 2005 of a security breach in which unauthorized persons gained access to personal information from its databases. Since the ChoicePoint notification, bills were introduced in at least 44 states and enacted in at least 29 that require some form of notification upon a security breach. A number of congressional hearings were held and bills introduced in 2005 in the wake of the ChoicePoint security breach as well as incidents at other firms. In March 2005, the House Subcommittee on Commerce, Trade, and Consumer Protection of the House Energy and Commerce Committee held a hearing entitled “Protecting Consumers’ Data: Policy Issues Raised by ChoicePoint,” which focused on potential remedies for security and privacy concerns regarding information resellers. Similar hearings were held by the House Energy and Commerce Committee and by the U.S. Senate Committee on Commerce, Science, and Transportation in spring 2005. Several bills introduced at the time of these hearings, such as the Data Accountability and Trust Act, would establish a national requirement for companies that maintain personal information to notify the public of security breaches. While many of these proposals were focused on private sector companies rather than the federal government, they could be applied to any organizations that collect and maintain significant amounts of personally identifiable information. The Notification of Risk to Personal Data Act would explicitly include federal agencies, requiring them as well as any “persons engaged in interstate commerce” to disclose security breaches involving unauthorized acquisition of personal data. A number of actions can be taken to help guard against the possibility that personal information maintained by agencies is inadvertently compromised. I will focus my remarks today on key strategic approaches for safeguarding personal information as well as a few practical measures that could be critical in preventing data breaches. I will not discuss at length the broader topic of information security in the federal government, which both the committee and GAO have addressed extensively in the past. Key strategic approaches include the following: Conduct privacy impact assessments (PIAs). It is important that agencies identify the specific instances in which they collect and maintain personal information and proactively assess the means they intend to use to protect this information. This can be done most effectively through the development of PIAs, which, as I previously mentioned, are required by the E-Government Act of 2002 when using information technology to process personal information. PIAs are important because they serve as a tool for agencies to fully consider privacy implications of planned systems and data collections before those systems and collections have been fully implemented, when it may be relatively easy to make critical adjustments. In prior work we have found that agencies do not always prepare PIAs as they are required. For example, our review of selected data mining efforts at federal agencies determined that PIAs were not always being done in full compliance with OMB guidance. Similarly, as identified in our work on federal agency use of information resellers, few PIAs were being developed for systems or programs that made use of information reseller data because officials did not believe they were required. Complete assessments are an important tool for agencies to identify areas of noncompliance with federal privacy laws, evaluate risks arising from electronic collection and maintenance of information about individuals, and evaluate protections or alternative processes needed to mitigate the risks identified. Agencies that do not take all the steps required to protect the privacy of personal information risk the improper exposure or alteration of such information. We recommended that the agencies responsible for the data mining efforts we reviewed complete or revise PIAs as needed and make them available to the public. We also recommended that OMB revise its guidance to clarify the applicability of the E-Gov Act’s PIA requirement to the use of personal information from resellers. OMB stated that it would discuss its guidance with agency senior officials for privacy to determine whether additional guidance concerning reseller data was needed. Ensure that a robust security program is in place. FISMA requires each agency to develop, document, and implement an agencywide information security program to provide security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.