More specifically, according to Office of Management and  Budget (OMB) guidance, a PIA is an analysis of how information ishandled. For example, the  Transportation, Treasury, Independent Agencies, and General  Government Appropriations Act of 2005 required each agency  covered by the act to have a chief privacy officer responsible for,  among other things, “assuring that the use of technologies sustain,  and do not erode, privacy protections relating to the use, collection,  and disclosure of information in identifiable form.” Subsequently, in  February 2005, OMB issued a memorandum to federal agencies  requiring them to designate a senior official with overall agencywide  responsibility for information privacy issues. Agency Privacy Officers Face a Number of Challenges

The elevation of privacy officers at federal agencies reflects the  growing demands that these individuals face in addressing privacy  challenges on a day-to-day basis. Among these challenges, several  that are prominent include (1) complying with the Privacy Act and  the E-Government Act of 2002, (2) ensuring that data mining efforts  do not compromise privacy protections, (3) controlling the  collection and use of personal information obtained from  commercial sources, and (4) addressing concerns about radio  frequency identification technology. In 2003, we reported that agencies generally did well with  certain aspects of the Privacy Act’s requirements—such as issuing  system-of-records notices when required—but did less well at other  requirements, such as ensuring that information is complete,  accurate, relevant, and timely before it is disclosed to a nonfederal  organization. For example, working in concert with officials from  OMB and other agencies, they are in a position to identify  ambiguities in guidance and provide clarifications about the  applicability of the Privacy Act. Finally, a chief privacy officer  could also serve as a champion for privacy awareness and education  across an agency. These agencies often did not conduct PIAs  because officials did not believe they were required. In the government, data mining was initially used to detect financial  fraud and abuse. In August 2005, we reported on five different data mining efforts at  selected federal agencies, noting that although the agencies  responsible for these data mining efforts took many of the steps  needed to protect the privacy and security of personal information  used in the efforts, none followed all key procedures. Agency privacy offices can provide a degree  of internal oversight to help ensure that privacy is fully addressed in  agency data mining activities. For example,  although agencies issued public notices on information collections,  these did not always notify the public that information resellers  were among the sources to be used, a practice inconsistent with the  principle that individuals should be informed about privacy policies  and the collection of information. In our report on information resellers, we recommended that the  Director, OMB, revise privacy guidance to clarify the applicability of  requirements for public notices and privacy impact assessments to  agency use of personal information from resellers and direct  agencies to review their uses of such information to ensure it is  explicitly referenced in privacy notices and assessments. Until privacy requirements  are better defined and broadly understood, agency privacy officers  are likely to continue to face challenges in helping ensure that their  agencies are providing appropriate privacy protections. RFID is  an automated data-capture technology that can be used to  electronically identify, track, and store information contained on a  tag. The tag can be attached to or embedded in the object to be  identified, such as a product, case, or pallet. RFID technology  provides identification and tracking capabilities by using wireless  communication to transmit data. In May 2005, we reported that  major initiatives at federal agencies that use or propose to use the  technology included physical access controls and tracking assets,  documents, or materials. The  Department of Defense was also using it to track shipments. However, the use of RFIDs  by the federal government to track the movement of individuals  traveling within the United States could generate concern by the  affected parties.
Why GAO Did This Study

Advances in information technology make it easier than ever for the federal government to obtain and process personal information about citizens and residents in many ways and for many purposes. To ensure that the privacy rights of individuals are respected, this information must be properly protected in accordance with current law, particularly the Privacy Act and the E-Government Act of 2002. These laws prescribe specific activities that agencies must perform to protect privacy, and the Office of Management and Budget (OMB) has developed guidance on how and in what circumstances agencies are to carry out these activities. Many agencies designate officials as focal points for privacy-related matters, and increasingly, many have created senior positions, such as chief privacy officer, to assume primary responsibility for privacy policy, as well as dedicated privacy offices. GAO was asked to testify on key challenges facing agency privacy officers. To address this issue, GAO identified and summarized issues raised in its previous reports on privacy.

What GAO Found

Agencies and their privacy officers face growing demands in addressing privacy challenges. For example, as GAO reported in 2003, agency compliance with Privacy Act requirements was uneven, owing to ambiguities in guidance, lack of awareness, and lack of priority. While agencies generally did well with certain aspects of the Privacy Act's requirements--such as issuing notices concerning certain systems containing collections of personal information--they did less well at others, such as ensuring that information is complete, accurate, relevant, and timely before it is disclosed to a nonfederal organization. In addition, the E-Gov Act requires that agencies perform privacy impact assessments (PIA) on such information collections. Such assessments are important to ensure, among other things, that information is handled in a way that conforms to privacy requirements. However, in work on commercial data resellers, GAO determined in 2006 that many agencies did not perform PIAs on systems that used reseller information, believing that these were not required. In addition, in public notices on these systems, agencies did not always reveal that information resellers were among the sources to be used. To address such challenges, chief privacy officers can work with officials from OMB and other agencies to identify ambiguities and provide clarifications about the applicability of privacy provisions, such as in situations involving the use of reseller information. In addition, as senior officials, they can increase agency awareness and raise the priority of privacy issues. Agencies and privacy officers will also face the challenge of ensuring that privacy protections are not compromised by advances in technology. For example, federal agency use of data mining--the analysis of large amounts of data to uncover hidden patterns and relationships--was initially aimed at detecting financial fraud and abuse. Increasingly, however, the use of this tool has expanded to include purposes such as detecting terrorist threats. GAO found in 2005 that agencies employing data mining took many steps needed to protect privacy (such as issuing public notices), but none followed all key procedures (such as including in these notices the intended uses of personal information). Another new technology development presenting privacy challenges is radio frequency identification (RFID), which uses wireless communication to transmit data and thus electronically identify, track, and store information on tags attached to or embedded in objects. GAO reported in 2005 that federal agencies use or propose to use the technology for physical access controls and tracking assets, documents, or materials. For example, the Department of Defense was using RFID to track shipments. Although such applications are not likely to generate privacy concerns, others could, such as the use of RFIDs by the federal government to track the movement of individuals traveling within the United States. Agency privacy offices can serve as a key mechanism for ensuring that privacy is fully addressed in agency approaches to new technologies such as data mining and RFID.