The Fair Information Practices Are Widely Agreed to Be Key Principles for Privacy Protection

The Privacy Act of 1974 is largely based on a set of internationally  recognized principles for protecting the privacy and security of  personal information known as the Fair Information Practices. Agencies Use Governmentwide Contracts to Obtain Personal Information from Information Resellers for a Variety of Purposes

The Departments of Justice, Homeland Security, State, and the  Social Security Administration reported approximately $30 million  in contractual arrangements with information resellers in fiscal year  2005. The agencies reported using personal information obtained  from resellers for a variety of purposes including law enforcement,  counterterrorism, fraud detection/prevention, and debt collection. In  all, approximately 91 percent of agency uses of reseller data were in  the categories of law enforcement (69 percent) or counterterrorism  (22 percent). It collects data such as address and vehicle information for  criminal investigations and background security checks. Resellers Take Steps to Protect Privacy, but These Measures Are Not Fully Consistent With the Fair Information Practices

Although the information resellers that do business with the federal  agencies we reviewed have taken steps to protect privacy, these  measures were not fully consistent with the Fair Information  Practices. However,  the information reseller industry presupposes that the collection  and use of personal information is not limited to specific purposes,  but instead can be made available to multiple customers for multiple  purposes. However, while information  resellers generally allow individuals limited access to their personal  information, they generally limit the opportunity to correct or delete  inaccurate information contained in reseller databases (relevant to  the individual participation principle). Resellers do not make  provisions to notify the individuals involved when they obtain  personal data from their many sources, including public records. Resellers said they believe it is not appropriate or practical for them  to provide notice or obtain consent from individuals because they  do not collect information directly from them. Security safeguards. They  used means such as company Web sites and brochures to inform the  public of specific policies and practices regarding the collection and  use of personal information. For example, resellers reported designating chief privacy officers to  monitor compliance with internal privacy policies and applicable  laws. Agencies Lack Policies on Use of Reseller Data, and Practices Do Not Consistently Reflect the Fair Information Practices

Agencies generally lacked policies that specifically address their use  of personal information from commercial sources (although DHS  Privacy Office officials have reported that they are drafting such a  policy), and agency practices for handling personal information  acquired from information resellers did not always fully reflect the  Fair Information Practices. This practice is consistent with the principle  of data quality. Limitations in the Applicability of the Privacy Act and Ambiguities in OMB Guidance Contribute to an Uneven Adherence to the Purpose Specification, Openness, and Individual Participation Principles

The purpose specification, openness, and individual participation  principles stipulate that individuals should be made aware of the  purpose and intended uses of the personal information being  collected about them, and, if necessary, have the ability to access  and correct their information. Agencies Often Did Not Have Practices in Place to Ensure Accountability for Proper Handling of Information Reseller Data

According to the accountability principle, individuals controlling  the collection or use of personal information should be accountable  for ensuring the implementation of the Fair Information Practices.
Why GAO Did This Study

Federal agencies collect and use personal information for various purposes from information resellers--companies that amass and sell data from many sources. GAO was asked to testify on its report being issued today on agency use of reseller data. For that report, GAO was asked to determine how the Departments of Justice, Homeland Security, and State and the Social Security Administration use personal data from resellers and to review the extent to which information resellers' policies and practices reflect the Fair Information Practices, a set of widely accepted principles for protecting the privacy and security of personal data. GAO also examined agencies' policies and practices for handling personal data from resellers to determine whether these reflect the Fair Information Practices.

What GAO Found

In fiscal year 2005, the Departments of Justice, Homeland Security, and State and the Social Security Administration reported that they used personal information obtained from resellers for a variety of purposes, including performing criminal investigations, locating witnesses and fugitives, researching assets held by individuals of interest, and detecting prescription drug fraud. The agencies spent approximately $30 million on contractual arrangements with resellers that enabled the acquisition and use of such information. About 91 percent of the planned fiscal year 2005 spending was for law enforcement (69 percent) or counterterrorism (22 percent). The major information resellers that do business with the federal agencies GAO reviewed have practices in place to protect privacy, but these measures are not fully consistent with the Fair Information Practices. For example, the principles that the collection and use of personal information should be limited and its intended use specified are largely at odds with the nature of the information reseller business, which is based on obtaining personal information from many sources and making it available to multiple customers for multiple purposes. Resellers believe it is not appropriate for them to fully adhere to these principles because they do not obtain their information directly from individuals. Nonetheless, in many cases, resellers take steps that address aspects of the Fair Information Practices. For example, resellers reported that they have taken steps recently to improve their security safeguards, and they generally inform the public about key privacy principles and policies. However, resellers generally limit the extent to which individuals can gain access to personal information held about themselves, as well as the extent to which inaccurate information contained in their databases can be corrected or deleted. Agency practices for handling personal information acquired from information resellers did not always fully reflect the Fair Information Practices. That is, for some of these principles, agency practices were uneven. For example, although agencies issued public notices when they systematically collected personal information, these notices did not always notify the public that information resellers were among the sources to be used. This practice is not consistent with the principle that individuals should be informed about privacy policies and the collection of information. Contributing to the uneven application of the Fair Information Practices are ambiguities in guidance from the Office of Management and Budget regarding the applicability of privacy requirements to federal agency uses of reseller information. In addition, agencies generally lack policies that specifically address these uses.