For the purposes of this report,  we are using the same definition. Following the terrorist attacks of September 11, 2001, data mining has been  used increasingly as a tool to help detect terrorist threats through the  collection and analysis of public and private sector data. While the characteristics of each data mining effort can vary greatly, data  mining generally incorporates three processes: data input, data analysis,  and results output. These systems use information that the agency collects directly, as well as  information provided by other agencies, such as the Social Security  Administration, and private sector sources, such as credit card companies. Agencies Addressed Many Required Privacy Provisions, but None Addressed All Requirements

While the agencies responsible for the five data mining efforts took many of  the key steps needed to protect the privacy and security of personal  information used in the efforts, none followed all the key procedures. However, the notice did not describe how to identify  which contact would be appropriate. The agencies responsible for two of the five efforts we reviewed generally  fulfilled the Privacy Act requirements regarding providing notice at the  time of collection, one partially fulfilled these requirements, and two  agencies claimed exemptions from these requirements. However, none of the  lenders demonstrated that they provided adequate notice to insurance  agents or adjusters, who also provided personal information used by RMA. In the five efforts we reviewed, agency compliance with the security and  data quality requirements was inconsistent. FBI and IRS claimed an allowable exemption because their records  are used for criminal law enforcement. However, the  assessment did not analyze these decisions, as required by OMB’s guidance. Until agencies fully comply with the Privacy Act, they lack assurance that  individual privacy rights are appropriately protected. Specifically, we recommend that the Secretary of  Agriculture direct the Administrator of the Risk Management Agency  (RMA) to  provide the required Privacy Act notices to individuals, including  producers, insurance agents, and adjusters, when personal information  is collected from them;  apply the appropriate information security measures defined in OMB  and NIST guidance to the systems used in the RMA data mining effort,  specifically, the development of a complete system security plan, a  tested contingency plan, and regular testing and evaluation of the  systems used in the effort;  develop and implement procedures that ensure the accuracy, relevance,  timeliness, and completeness of personal information used in the RMA  data mining effort to make determinations about individuals;  revise the privacy impact assessment for the RMA data mining effort to  comply with OMB guidance, including analyses of the intended use of  the information it collects, with whom the information will be shared,  how the information is to be secured, opportunities for impacted  individuals to comment, and the choices made by the agency as a result  of the assessment;   have the completed privacy impact assessment approved by the chief  information officer or equivalent official; and  make the completed privacy impact assessment available to the public,  as appropriate. Data from outside sources, including nonpartner government  agencies and commercial entities, are typically acquired on an as-needed  basis.
Why GAO Did This Study

Data mining--a technique for extracting knowledge from large volumes of data--is being used increasingly by the government and by the private sector. Many federal data mining efforts involve the use of personal information, which can originate from government sources as well as private sector organizations. The federal government's increased use of data mining since the terrorist attacks of September 11, 2001, has raised public and congressional concerns. As a result, GAO was asked to describe the characteristics of five federal data mining efforts and to determine whether agencies are providing adequate privacy and security protection for the information systems used in the efforts and for individuals potentially affected by these data mining efforts.

What GAO Found

The five data mining efforts we reviewed are used by federal agencies to fulfill a variety of purposes and use various information sources, including both information collected on behalf of the agency and information originally collected by other agencies and commercial sources. Although the systems differed, the general process each used was basically the same. Each system incorporates data input, data analysis, and results output. While the agencies responsible for these five efforts took many of the key steps required by federal law and executive branch guidance for the protection of personal information, they did not comply with all related laws and guidance. Specifically, most agencies notified the general public that they were collecting and using personal information and provided opportunities for individuals to review personal information when required by the Privacy Act. However, agencies are also required to provide notice to individual respondents explaining why the information is being collected; two agencies provided this notice, one did not provide it, and two claimed an allowable exemption from this requirement because the systems were used for law enforcement. In addition, agency compliance with key security requirements was inconsistent. Finally, three of the five agencies completed privacy impact assessments--important for analyzing the privacy implications of a system or data collection--but none of the assessments fully complied with Office of Management and Budget guidance. Until agencies fully comply with these requirements, they lack assurance that individual privacy rights are being appropriately protected.