Agency Compliance with the Privacy Act and OMB Guidance Is Uneven

While compliance with Privacy Act provisions and related OMB guidance  was generally high in many areas, according to agency reports, it was  uneven across the federal government—ranging from 100 percent for some  requirements to about 70 percent for others. For example, for 100 percent  of agency systems of records, agencies followed the requirement to issue a  rule that explains to the public why a system of records is exempt from one  or more of the act’s privacy protections. Agency privacy officials attending our forum acknowledged this  uneven compliance; they pointed out, however, that implementation of the  Privacy Act in a rapidly changing environment presents a number of  difficult issues. Specifically, these officials identified barriers to improved  compliance that include a need for more OMB leadership and guidance on  the act, low agency priority given to implementing the act, and insufficient  training on the act. In the absence of consistent compliance with the  Privacy Act, the government cannot adequately assure the public that all  legislated individual privacy rights are being protected. Safeguarding personal information. Protecting personal information that is maintained in automated  information systems is of particular importance. According to agency responses to our  surveys, agencies are not generally dissatisfied with OMB’s guidance and  assistance on the Privacy Act: for example, most agencies judged that  OMB’s assistance on the act was at least “moderately effective” overall. Until  these issues are addressed by agencies and OMB and compliance with the  Privacy Act across government is improved, the government cannot  adequately assure the public that all legislated individual privacy rights are  being protected. To address implementation issues related to compliance with the Privacy  Act, we recommend that the Director  assess the need for specific changes to OMB guidance, especially with  regard to electronic records, and update the guidance, as appropriate;  raise the awareness and commitment of senior agency officials to the  importance of the principles that underlie the Privacy Act;  lead a governmentwide effort to (1) determine the level of resources,  including human capital, currently devoted to Privacy Act  implementation by both OMB and the agencies, (2) assess the level of  resources needed to fully implement the act, (3) identify the gap, if any,  between current and needed resources, and (4) develop a plan for  addressing any gap that may exist; and  oversee the development of Privacy Act training that meets the needs of  the wide range of employees who carry out the act and make this  training readily available to agencies. Comments from the Office of Management and Budget

	GAO Comments

1.
Why GAO Did This Study

The Privacy Act regulates how federal agencies may use the personal information that individuals supply when obtaining government services or fulfilling obligations--for example, applying for a small business loan or paying taxes. GAO was asked to review, among other things, agency compliance with the Privacy Act and related guidance from the Office of Management and Budget (OMB).

What GAO Found

Based on responses from 25 selected agencies to GAO surveys, compliance with Privacy Act requirements and OMB guidance is generally high in many areas, but it is uneven across the federal government. For example, GAO used agency responses to estimate 100 percent compliance with the requirement to issue a rule explaining to the public why personal information is exempt from certain provisions of the act. In contrast, GAO estimates 71 percent compliance with the requirement that personal information should be complete, accurate, relevant, and timely before it is disclosed to a nonfederal organization. As a result of this uneven compliance, the government cannot adequately assure the public that all legislated individual privacy rights are being protected. Agency senior privacy officials acknowledge the uneven compliance but report a number of difficult implementation issues in a rapidly changing environment. Of these issues, privacy officials gave most importance to the need for further OMB leadership and guidance. Although agencies are not generally dissatisfied with OMB's guidance on the Privacy Act, they made specific suggestions regarding areas in which additional guidance is needed, such as the act's application to electronic records. Besides these gaps in guidance, additional issues included the low agency priority given to implementing the act and insufficient employee training on the act. If these implementation issues and the overall uneven compliance are not addressed, the government will not be able to provide the public with sufficient assurance that all legislated individual privacy rights are adequately protected.