A PIA is an analysis of  how personal information is collected, stored, shared, and managed in a  federal system. In recent years, additional laws have been enacted that  also address the roles and responsibilities of senior officials with regard to  privacy. Despite much variation, all of these laws require agencies to  assign overall responsibility for privacy protection and compliance to a  senior agency official. In addition, OMB guidance has directed agencies to  designate senior officials with overall responsibility for privacy. These laws and guidance set specific privacy responsibilities for these  agency officials. These responsibilities can be grouped into six broad  categories: (1) conducting PIAs; (2) Privacy Act compliance; (3) reviewing  and evaluating the privacy implications of agency policies, regulations, and  initiatives; (4) producing reports on the status of privacy protections; (5)  ensuring that redress procedures are in place; and (6) ensuring that  employees and contractors receive appropriate training. The laws and  guidance vary in how they frame requirements in these categories and  which agencies must adhere to them. Agencies Have Varying Privacy Management Structures, and Senior Agency Officials for Privacy Do Not Consistently Have Oversight of All Key Functions

Agencies have varying organizational structures to address privacy  responsibilities. For example, of the 12 agencies we reviewed, 2 had  statutorily designated CPOs who also served as SAOPs, 5 designated their  agency CIOs as their senior officials, and the others designated a variety of  other officials, such as the general counsel or assistant secretary for  management. Further, not all of the agencies we reviewed had given their  designated senior officials full oversight over all privacy-related functions. While 6 agencies had these officials overseeing all key privacy functions, 6  others relied on other organizational units not overseen by the designated  senior official to perform certain key privacy functions. However, without oversight and involvement in all key privacy functions,  SAOPs may be unable to effectively serve as agency central focal points  for privacy. Evolving Requirements in Laws and Related Guidance Have Led to Fragmented Assignment of Privacy Functions

The fragmented way in which privacy functions have been assigned to  organizational units in several agencies is at least partly the result of  evolving requirements in law and guidance. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) describe laws and guidance that set  requirements for senior privacy officials within federal agencies, and (2)  describe the organizational structures used by agencies to address privacy  requirements and assess whether senior officials have oversight over key  functions. Intelligence Reform and Terrorism Prevention Act of 2004

Section 1011 of this act required the Director of National Intelligence to  appoint a Civil Liberties Protection Officer and gave this officer the  following functions:  ensuring that the protection of civil liberties and privacy is appropriately  incorporated into the policies and procedures of the Office of the Director  of National Intelligence and the elements of the intelligence community  within the National Intelligence Program;    overseeing compliance by the Office of the Director of National  Intelligence with all laws, regulations, and guidelines relating to civil  liberties and privacy; reviewing complaints about abuses of civil liberties and privacy in Office  of the Director of National Intelligence programs and operations;   ensuring that technologies sustain, and do not erode, privacy protections;    ensuring that personal information contained in a system of records  subject to the Privacy Act is handled in full compliance with fair  information practices as set out in that act;   conducting privacy impact assessments when appropriate or as required    performing such other duties as may be prescribed by the Director of  National Intelligence or specified by law.
Why GAO Did This Study

Government agencies have a long-standing obligation under the Privacy Act of 1974 to protect the privacy of individuals about whom they collect personal information. A number of additional laws have been enacted in recent years directing agency heads to designate senior officials as focal points with overall responsibility for privacy. GAO was asked to (1) describe laws and guidance that set requirements for senior privacy officials within federal agencies, and (2) describe the organizational structures used by agencies to address privacy requirements and assess whether senior officials have oversight over key functions. To achieve these objectives, GAO analyzed the laws and related guidance and analyzed policies and procedures relating to key privacy functions at 12 agencies.

What GAO Found

Federal laws set varying roles and responsibilities for senior agency privacy officials. Despite much variation, all of these laws require covered agencies to assign overall responsibility for privacy protection and compliance to a senior agency official. In addition, Office of Management and Budget guidance directs agencies to designate a senior agency official for privacy with specific responsibilities. The specific privacy responsibilities defined in these laws and guidance can be grouped into six broad categories: (1) conducting privacy impact assessments (which are intended to ensure that privacy requirements are addressed when personal information is collected, stored, shared, and managed in a federal system), (2) complying with the Privacy Act, (3) reviewing and evaluating the privacy implications of agency policies, (4) producing reports on the status of privacy protections, (5) ensuring that redress procedures to handle privacy inquiries and complaints are in place, and (6) ensuring that employees and contractors receive appropriate training. The laws and guidance vary in how they frame requirements in these categories and which agencies must adhere to them. Agencies also have varying organizational structures to address privacy responsibilities. For example, of the 12 agencies we reviewed, 2 had statutorily designated chief privacy officers who also served as senior agency officials for privacy, 5 designated their agency chief information officers as their senior privacy officials, and the others designated a variety of other officials, such as the general counsel or assistant secretary for management. Further, not all of the agencies we reviewed had given their designated senior officials full oversight over all privacy-related functions. While 6 agencies had these officials overseeing all key privacy functions, 6 others relied on other organizational units not overseen by the designated senior official to perform certain key privacy functions. The fragmented way in which privacy functions were assigned to organizational units in these agencies is at least partly the result of evolving requirements in law and guidance. However, without oversight of all key privacy functions, designated senior officials may be unable to effectively serve as agency central focal points for information privacy.