The Fair Information Practices Are Widely Agreed to Be Key Principles for Privacy Protection

The Privacy Act of 1974 is largely based on a set of internationally  recognized principles for protecting the privacy and security of  personal information known as the Fair Information Practices. Agencies Used Governmentwide Contracts to Obtain Personal Information from Information Resellers for a Variety of Purposes

DOJ, DHS, State, and SSA reported approximately $30 million  through contracts with information resellers in fiscal year 2005. In  all, approximately 91 percent of agency uses of reseller data were in  the categories of law enforcement (69 percent) or counterterrorism  (22 percent). DHS and its components reported that they used information  reseller data in fiscal year 2005 primarily for law enforcement  purposes, such as developing leads on subjects in criminal  investigations and detecting fraud in immigration benefit  applications (part of enforcing immigration laws). Agencies Lacked Policies on Use of Reseller Data, and Practices Do Not Consistently Reflect the Fair Information Practices

Agencies generally lacked policies that specifically addressed their  use of personal information from commercial sources (although  DHS Privacy Office officials reported in 2006 that they were drafting  such a policy), and agency practices for handling personal  information acquired from information resellers did not always fully  reflect the Fair Information Practices. This practice is consistent with the principle  of data quality. Agency policies and practices with regard to the other four  principles were uneven. The inconsistency with which agencies specify resellers as a source  of information in system-of-records notices is due in part to  ambiguity in OMB guidance, which states that “for systems of  records which contain information obtained from sources other  than the individual to whom the records pertain, the notice should  list the types of sources used.” Although the guidance is unclear as  to what would constitute adequate disclosure of “types of sources,”  OMB and DHS Privacy Office officials agreed that to the extent that  reseller data is subject to the Privacy Act, agencies should  specifically identify information resellers as a source and that  merely citing public records information does not sufficiently  describe the source. Current OMB guidance on conducting PIAs is not always clear about  when they should be conducted. This means that agencies should take steps to ensure that they use  personal information from information resellers appropriately. Not All Agencies Have Taken Steps to Address our Recommendations

In our report, we recommended that the agencies develop specific  policies for the collection, maintenance, and use of personal  information obtained from resellers. We also recommended that  OMB revise its privacy guidance to clarify the applicability of  requirements for public notices and privacy impact assessments to  agency use of personal information from resellers and direct  agencies to review their uses of such information to ensure it is  explicitly referenced in privacy notices and assessments. The  agencies generally agreed with our findings and described actions  initiated to address our recommendations. For example, the DHS  Privacy Office incorporated specific questions in its May 2007 PIA  guidance concerning use of commercial data. Further, the guidance for systems  that use or rely on commercial data requires an explanation of how  data accuracy and integrity are preserved and the reliability of the  data assessed with regard to its value to the purpose of the system. Privacy Provisions of the Proposed Federal Agency Data Protection Act are Consistent with Our Recommendations

The Federal Agency Data Protection Act was introduced on  December 18, 2007. We believe these provisions are  consistent with the results and recommendations contained in our  2006 report.
Why GAO Did This Study

Federal agencies collect and use personal information for various purposes from information resellers--companies that amass and sell data from many sources. GAO was asked to testify on its April 2006 report on agency use of reseller data. For that report, GAO was asked to determine how the Departments of Justice, Homeland Security, and State and the Social Security Administration used personal data from resellers and to review the extent to which agencies' policies and practices for handling this information reflected the Fair Information Practices, a set of widely accepted principles for protecting the privacy and security of personal data. GAO was also asked to provide an update on the implementation status of its recommendations and to comment on provisions of the proposed Federal Agency Data Protection Act. In preparing this testimony, GAO relied primarily on its April 2006 report.

What GAO Found

In fiscal year 2005, the Departments of Justice, Homeland Security, and State and the Social Security Administration reported that they used personal information obtained from resellers for a variety of purposes, including performing criminal investigations, locating witnesses and fugitives, researching assets held by individuals of interest, and detecting prescription drug fraud. The agencies planned spending approximately $30 million on contractual arrangements with resellers that enabled the acquisition and use of such information. About 91 percent of the planned fiscal year 2005 spending was for law enforcement (69 percent) or counterterrorism (22 percent). Agency practices for handling personal information acquired from information resellers did not always fully reflect the Fair Information Practices. That is, for some of these principles, agency practices were uneven. For example, although agencies issued public notices when they systematically collected personal information, these notices did not always notify the public that information resellers were among the sources to be used. This practice is not consistent with the principle that individuals should be informed about privacy policies and the collection of information. Contributing to the uneven application of the Fair Information Practices are ambiguities in guidance from the Office of Management and Budget (OMB) regarding the applicability of privacy requirements to federal agency uses of reseller information. In addition, agencies generally lacked policies that specifically address these uses. GAO made recommendations to OMB to revise privacy guidance and to the four agencies to develop specific policies for the use of personal information from resellers. The five agencies generally agreed with the report and described actions initiated to address the recommendations. Since GAO issued its report, agencies have taken steps to address the recommendations. For example, the Department of Homeland Security Privacy Office incorporated specific questions in its May 2007 Privacy Impact Assessment guidance concerning use of commercial data. In addition, the Department of Justice took steps to update its public notices to specify their use of data from information resellers. OMB, however, has not implemented GAO's recommendation to clarify guidance on use of commercial data. The Federal Agency Data Protection Act was introduced on December 18, 2007. The legislation, among other things would require that agencies (1) conduct privacy impact assessments for their uses of commercial data, and (2) promulgate regulations concerning the use of commercial data brokers. GAO considers these requirements to be consistent with the results and the recommendations made to the agencies in its 2006 report