Privacy is also addressed in the legal framework for the emerging  information sharing environment. Issues have largely centered on the Privacy Act’s  definition of a “system of records” (any grouping of records containing  personal information retrieved by individual identifier), which triggers the  act’s protections. In  addition, mechanisms to limit use to a specified purpose may be weak. Use Limitation

Require agencies to justify the use of key elements of personally  identifiable information. Specifically, concerns were raised that  the content of these notices and their publication in the Federal Register  may not fully inform the public about planned government uses of  personal information, for the following reasons:    System of record notices may be difficult to understand. Alternatives for Improving Notice to the Public

Based on discussions with privacy experts, agency officials, and analysis  of laws and related guidance, a number of options exist for addressing the  issues associated with improving public notice regarding federal collection  and use of personal information. Layering  involves providing only the most important summary facts up front—often  in a graphically oriented format—followed by one or more lengthier, more  narrative versions. Conclusions

Current laws and guidance governing the federal government’s collection,  use, and disclosure of personal information have gaps and other potential  shortcomings in three broad categories: (1) the Privacy Act and   E-Government Act do not always provide protections for federal uses of  personal information, (2) laws and guidance may not effectively limit  agency collection and use of personal information to specific purposes,  and (3) the Privacy Act may not include effective mechanisms for  informing the public. Matter for Congressional Consideration

In assessing the appropriate balance between the needs of the federal  government to collect personally identifiable information for  programmatic purposes and the assurances that individuals should have  that their information is being sufficiently protected and properly used,  Congress should consider amending applicable laws, such as the Privacy  Act and the E-Government Act, according to the alternatives outlined in  this report, including:  revising the scope of the laws to cover all personally identifiable  information collected, used, and maintained by the federal government;    setting requirements to ensure that the collection and use of personally  identifiable information is limited to a stated purpose; and   establishing additional mechanisms for informing the public about privacy  protections by revising requirements for the structure and publication of  public notices. We believe that, given the Privacy Act’s controls on the collection, use, and  disclosure of personally identifiable information do not consistently  protect such information in all circumstances of its collection and use  throughout the federal government, amending the act’s definition of a  system of records is an important alternative for Congress to consider. Appendix I: Objective, Scope, and Methodology

Our objective was to identify major issues regarding whether the Privacy  Act of 1974, the E-Government Act of 2002, and related guidance  consistently cover the federal government’s collection and use of personal  information and incorporate key privacy principles, and in doing so, to  identify options for addressing these issues. Additionally, our colleagues at the National Academy of  Sciences (NAS) agreed that this selection was appropriate for obtaining an  operational perspective on these issues. Privacy: Key Challenges Facing Federal Agencies. Personal Information: Agency and Reseller Adherence to Key Privacy  Principles.
Why GAO Did This Study

The centerpiece of the federal government's legal framework for privacy protection, the Privacy Act of 1974, provides safeguards for information maintained by federal agencies. In addition, the E-Government Act of 2002 requires federal agencies to conduct privacy impact assessments for systems or collections containing personal information. GAO was asked to determine whether laws and guidance consistently cover the federal government's collection and use of personal information and incorporate key privacy principles. GAO was also asked, in doing so, to identify options for addressing these issues. To achieve these objectives, GAO analyzed the laws and related guidance, obtained an operational perspective from federal agencies, and consulted an expert panel convened by the National Academy of Sciences.

What GAO Found

Increasingly sophisticated ways of obtaining and using personally identifiable information have raised concerns about the adequacy of the legal framework for privacy protection. Although the Privacy Act, the E-Government Act, and related guidance from the Office of Management and Budget set minimum privacy requirements for agencies, they may not consistently protect personally identifiable information in all circumstances of its collection and use throughout the federal government and may not fully adhere to key privacy principles. Based on discussions with privacy experts, agency officials, and analysis of laws and related guidance, GAO identified issues in three major areas: Applying privacy protections consistently to all federal collection and use of personal information. The Privacy Act's definition of a "system of records" (any grouping of records containing personal information retrieved by individual identifier), which sets the scope of the act's protections, does not always apply whenever personal information is obtained and processed by federal agencies. One alternative to address this concern would be revising the system-of-records definition to cover all personally identifiable information collected, used, and maintained systematically by the federal government. Ensuring that collection and use of personally identifiable information is limited to a stated purpose. According to generally accepted privacy principles of purpose specification, collection limitation, and use limitation, the collection of personal information should be limited, and its use should be limited to a specified purpose. Yet, current laws and guidance impose only the modest requirements in these areas. While, in the post-9/11 environment, the federal government needs better analysis and sharing of certain personal information, there is general agreement that this need must be balanced with individual privacy rights. Alternatives to address this area of concern include requiring agencies to justify the collection and use of key elements of personally identifiable information and to establish agreements before sharing such information with other agencies. Establishing effective mechanisms for informing the public about privacy protections. Another key privacy principle, the principle of openness, suggests that the public should be informed about privacy policies and practices. Yet, Privacy Act notices may not effectively inform the public about government uses of personal information. For example, system-of-records notices published in the Federal Register (the government's official vehicle for issuing public notices) may be difficult for the general public to fully understand. Layered notices, which provide only the most important summary facts up front, have been used as a solution in the private sector. In addition, publishing such notices at a central location on the Web would help make them more accessible.