As a result, the Service has no assurance that the seeding process provided an effective oversight mechanism. Nevertheless, even when these additional audits are taken into consideration, we determined that the Service did not perform all audits required. Even after counting these additional audits reported by the Service, we determined that it did not perform the minimum number of annual audits or on-site audits required during the periods included in our review. Specifically, the Service had not stated in the NCOA Processing Acknowledgment Form that NCOA data are not to be used to create or maintain new-movers lists. The Service disagreed with our recommendation in 1996 and stated that it believed that (1) a restriction on the creation and maintenance of new- movers lists from NCOA-linked data was not required by privacy law, (2) enforcement of such a restriction on customers of licensees would be impracticable, and (3) we had misinterpreted the purpose of the acknowledgment form when we said that it was “to limit the use of NCOA- linked data by the customers of licensees.”
Our recent review showed that the Service has not implemented our recommendation that it amend or revise the acknowledgment form to explicitly convey this restriction to the customers of licensees. Further, we continue to believe that more specific language in the acknowledgment form that licensees’ customers sign could help ensure that use of NCOA-linked data is limited to the purposes for which it was collected. The Service has been partially responsive to our previous recommendations to strengthen oversight of the NCOA program in that it developed and implemented written procedures for (1) seeding NCOA file updates released to licensees and (2) reviewing, responding to, and documenting customers’ NCOA-related inquiries and complaints and licensees’ NCOA-related advertising. In addition, the Service reported that it had performed more licensee on-site audits than were documented in licensee audit files at the NCOA program office. The Postmaster General should also ensure that NCOA program officials and other appropriate Service officials coordinate actions to identify and correct weaknesses in the process of alerting program officials when mail is sent to seed record addresses so that the process works as intended and ensure that licensees that fail successive audits are promptly suspended or terminated, as appropriate, from the program or that the licensing agreement is revised to reflect Service policy regarding when licensees will be suspended or terminated. Comments From the U.S.
Why GAO Did This Study

Pursuant to a congressional request, GAO updated its previous report on the U.S. Postal Service's National Change of Address (NCOA) program, focusing on: (1) the actions the Service has taken in response to GAO's 1996 report; and (2) whether any additional actions are needed to strengthen the Service's oversight of the program.

What GAO Found

GAO noted that: (1) as recommended, the Service has developed and implemented written procedures that addressed its NCOA program oversight and control responsibilities for: (a) using seed records to help detect the unauthorized disclosure of NCOA data by licensees, should it occur; and (b) reviewing, responding to, and documenting NCOA-related complaints and inquiries from postal customers and NCOA-related proposed advertisements by licensees; (2) however, procedures designed by the Service to ensure that it is alerted when mail is sent to seed record addresses were not working as intended; thus, the Service lacked assurance that the seeding process provided an effective program oversight mechanism; (3) further, even though required to do so by the licensing agreement or by prescribed program procedures, during the 1996 through 1998 period GAO examined, the Service did not always: (a) conduct the minimum number of licensee audits, including on-site audits; (b) promptly reaudit licensees that failed initial audits; or (c) promptly or always suspend or terminate licensees that failed successive audits; (4) also, the Service reported that it had performed more licensee audits than were documented in its audit files; however, even when GAO included these additional audits in its data, GAO determined that the Service did not perform all audits required; (5) the Service has taken no action on GAO's recommendations that it explicitly state, in the acknowledgement form signed by customers of licensees, that NCOA program-linked data are not to be used to create or maintain new-movers lists; and (6) GAO continues to believe that more specific language in the acknowledgement form could help ensure that use of NCOA program-linked data is limited to the purposes for which they were collected.