	Background

The DHS Privacy Office was established with the appointment of the first  Chief Privacy Officer in April 2003. Based on  these laws, the Privacy Office’s major responsibilities can be summarized  into four broad categories: (1) reviewing and approving PIAs,   (2) integrating privacy considerations into DHS decision making,   (3) reviewing and approving public notices required by the Privacy Act,  and (4) preparing and issuing reports. Reviewing and approving public notices required by the Privacy Act  The Privacy Office is required by the Homeland Security Act to assure that  personal information contained in Privacy Act systems of records is  handled in full compliance with fair information practices as set out in the  Privacy Act of 1974. DHS Privacy Office Has Made Significant Progress Establishing Processes to Ensure Implementation of Privacy Protections, but More Work Remains

The DHS Privacy Office has made significant progress in addressing its  statutory responsibilities under the Homeland Security Act by developing  processes to ensure implementation of privacy protections in  departmental programs. For example, the Privacy Office has established  processes for ensuring departmental compliance with the PIA requirement  in the E-Gov Act of 2002. Instituting this framework has led to increased  attention to privacy requirements on the part of departmental components,  contributing to an increase in the quality and number of PIAs issued. Further, the Privacy Office has generally not been timely in issuing public  reports, potentially limiting their value and impact. Late issuance of  reports has a number of negative consequences beyond failure to comply  with mandated deadlines, including a potential reduction in the reports’  value and erosion of the office’s credibility. The Privacy Office Has Taken Steps to Integrate Privacy Into DHS Decision Making

The Privacy Office has also taken steps to integrate privacy considerations  in the DHS decision-making process. Privacy Office Has Generally Not Issued Reports in a Timely Fashion

Section 222 of the Homeland Security Act requires that the Privacy Officer  report annually to Congress on “activities of the department that affect  privacy, including complaints of privacy violations, implementation of the  Privacy Act of 1974, internal controls, and other matters.” The act does not  prescribe a deadline for submission of these reports; however, the  requirement to report “on an annual basis” suggests that each report  should cover a 1-year time period and that subsequent annual reports  should be provided to Congress 1 year after the previous report was  submitted. For example, a report on the Multi-state Anti-Terrorism  Information Exchange (MATRIX) program, initiated in response to a  complaint by the American Civil Liberties Union submitted in May 2004,  was not issued until two and a half years later, long after the program had  been terminated. Component-level privacy officers could help  coordinate processing of PIAs. Until DHS reviews and updates its legacy  notices as required by federal guidance, it cannot assure the public that its  notices reflect current uses and protections of personal information. Key contributors to this report are listed in appendix V.

Appendix I: Objective, Scope, and Methodology

Our objective was to assess the progress of the Department of Homeland  Security (DHS) Privacy Office in carrying out its responsibilities under  federal law, including the Homeland Security Act of 2002 and the E- Government Act of 2002.
Why GAO Did This Study

The Department of Homeland Security (DHS) Privacy Office was established with the appointment of the first Chief Privacy Officer in April 2003, as required by the Homeland Security Act of 2002. The Privacy Office's major responsibilities include: (1) reviewing and approving privacy impact assessments (PIA)--analyses of how personal information is managed in a federal system, (2) integrating privacy considerations into DHS decision making, (3) ensuring compliance with the Privacy Act of 1974, and (4) preparing and issuing annual reports and reports on key privacy concerns. GAO's objective was to examine progress made by the Privacy Office in carrying out its statutory responsibilities. GAO did this by comparing statutory requirements with Privacy Office processes, documents, and activities.

What GAO Found

The DHS Privacy Office has made significant progress in carrying out its statutory responsibilities under the Homeland Security Act and its related role in ensuring compliance with the Privacy Act of 1974 and E-Government Act of 2002, but more work remains to be accomplished. Specifically, the Privacy Office has made significant progress by establishing a compliance framework for conducting PIAs, which are required by the E-Gov Act. The framework includes formal written guidance, training sessions, and a process for identifying affected systems. The framework has contributed to an increase in the quality and number of PIAs issued as well as the identification of many more affected systems. The resultant workload is likely to prove difficult to process in a timely manner. Designating privacy officers in certain DHS components could help speed processing of PIAs, but DHS has not yet taken action to make these designations. The Privacy Office has also taken actions to integrate privacy considerations into the DHS decision-making process by establishing an advisory committee, holding public workshops, and participating in policy development. However, limited progress has been made in updating public notices required by the Privacy Act for systems of records that were in existence prior to the creation of DHS. These notices should identify, among other things, the type of data collected, the types of individuals about whom information is collected, and the intended uses of the data. Until the notices are brought up-to-date, the department cannot assure the public that the notices reflect current uses and protections of personal information. Further, the Privacy Office has generally not been timely in issuing public reports. For example, a report on the Multi-state Anti-Terrorism Information Exchange program--a pilot project for law enforcement sharing of public records data--was not issued until long after the program had been terminated. Late issuance of reports has a number of negative consequences, including a potential reduction in the reports' value and erosion of the office's credibility.