State and SSA reported acquiring personal information from  information resellers for fraud detection and investigation, identity  verification, and benefit eligibility determination. The four agencies  reported approximately $30 million in contractual arrangements with  information resellers in fiscal year 2005. Approximately 91 percent of agency uses of reseller data were in the  categories of law enforcement (69 percent) or counterterrorism (22  percent). For example, the U.S. DEA, the second largest Justice user of information resellers in fiscal year  2005, obtains reseller data to detect fraud in prescription drug  transactions. Resellers Take Steps to Protect Privacy, but These Measures Are Not Fully Consistent with the Fair Information Practices

Although the information resellers that do business with the federal  agencies we reviewed have practices in place to protect privacy, these  measures were not fully consistent with the Fair Information Practices. However, the information reseller industry presupposes that  the collection and use of personal information is not limited to specific  purposes, but instead that information can be collected and made available  to multiple customers for multiple purposes. However, resellers generally limited the  extent to which individuals could gain access to personal information held  about themselves, and because they obtain their information from other  sources, most resellers also had limited provisions for correcting or  deleting inaccurate information contained in their databases (relevant to  the individual participation principle). Regarding the principle that, where appropriate, information should be  collected with the knowledge and consent of the individual, resellers do  not make provisions to notify the individuals involved when they obtain  personal data from their many sources, including public records. Given recent incidents, large information resellers reported having recently  taken steps to improve their safeguards against unauthorized access. Agencies Lack Policies on Use of Reseller Data, and Practices Do Not Consistently Reflect the Fair Information Practices

Agency practices for handling personal information acquired from  information resellers did not always fully reflect the Fair Information  Practices. This practice is consistent with  the data quality principle that data should be accurate, current, and  complete. The inconsistencies in application of these principles as well as the  lack of specific agency policies can be attributed in part to ambiguities in  OMB guidance regarding the applicability of the Privacy Act to information  obtained from resellers. Citizenship and Immigration Services (USCIS) component of DHS  and the Office of Consular Affairs within the Department of State reported  similar practices. They suggested that it  would be unreasonable to require them to comply with aspects of the  Fair Information Practices that they believe were intended for other  types of users of personal information, such as organizations that collect  information directly from consumers. Objectives, Scope, and Methodology

Our objectives were to determine the following:  how the Departments of Justice, Homeland Security, and State and the  Social Security Administration are making use of personal information  obtained through contracts with information resellers;  the extent to which the information resellers providing personal  information to these agencies have policies and practices in place that  reflect widely accepted principles for protecting the privacy and  security of personal information; and  the extent to which these agencies have policies and practices in place  for handling information reseller data that reflect widely accepted  principles for protecting the privacy and security of personal  information. To determine the extent that they reflect  widely accepted Fair Information Practices, we reviewed and compared  information reseller’s privacy policies and procedures with these  principles. General. Uneven. These permissible uses include the following:   for use by any government agency in carrying out its functions;   for use in connection with matters of motor vehicle or driver safety and  theft; motor vehicle emissions; motor vehicle product alterations,  recalls, or advisories; motor vehicle market research activities;   for use in the normal course of business by a legitimate business, but  only to verify the accuracy of personal information submitted by the  individual to the business and, if such information is not correct, to  obtain the correct information but only for purposes of preventing fraud  by pursuing legal remedies against, or recovering on a debt or security  interest against, the individual;   for use in connection with any civil, criminal, administrative, or arbitral  proceeding in any federal, state, or local court or agency;   for use in research activities;   for use by any insurer or insurance support organization in connection  with claims investigation activities;   for use in providing notice to the owners of towed or impounded   for use by a licensed private investigative agency for any purpose  permitted under the act;   for use by an employer or its agent or insurer to obtain information  relating to the holder of a commercial driver’s license;   for use in connection with the operation of private toll transportation   for any other use, if the state has obtained the express consent of the  person to whom a request for personal information pertains;   for bulk distribution of surveys, marketing, or solicitations, if the state  has obtained the express consent of the person to whom such personal  information pertains;   for use by any requester, if the requester demonstrates that it has  obtained the written consent of the individual to whom the information  pertains; and  for any other use specifically authorized under a state law, if such use is  related to the operation of a motor vehicle or public safety. Comments from the Department of Justice

Comments from the Department of Homeland Security

Comments from the Social Security Administration

Appendix VI
Why GAO Did This Study

Federal agencies collect and use personal information for various purposes, both directly from individuals and from other sources, including information resellers--companies that amass and sell data from many sources. In light of concerns raised by recent security breaches involving resellers, GAO was asked to determine how the Departments of Justice, Homeland Security, and State and the Social Security Administration use personal data from these sources. In addition, GAO reviewed the extent to which information resellers' policies and practices reflect the Fair Information Practices, a set of widely accepted principles for protecting the privacy and security of personal data. GAO also examined agencies' policies and practices for handling personal data from resellers to determine whether these reflect the Fair Information Practices.

What GAO Found

In fiscal year 2005, the Departments of Justice, Homeland Security, and State and the Social Security Administration reported that they used personal information obtained from resellers for a variety of purposes. Components of the Department of Justice (the largest user of resellers) used such information in performing criminal investigations, locating witnesses and fugitives, researching assets held by individuals of interest, and detecting prescription drug fraud. The Department of Homeland Security used reseller information for immigration fraud detection and border screening programs. Uses by the Social Security Administration and the Department of State were to prevent and detect fraud, verify identity, and determine eligibility for benefits. The agencies spent approximately $30 million on contractual arrangements with resellers that enabled the acquisition and use of such information. About 91 percent of the planned fiscal year 2005 spending was for law enforcement (69 percent) or counterterrorism (22 percent). The major information resellers that do business with the federal agencies we reviewed have practices in place to protect privacy, but these measures are not fully consistent with the Fair Information Practices. For example, the principles that the collection and use of personal information should be limited and its intended use specified are largely at odds with the nature of the information reseller business, which presupposes that personal information can be made available to multiple customers and for multiple purposes. Resellers said they believe it is not appropriate for them to fully adhere to these principles because they do not obtain their information directly from individuals. Nonetheless, in many cases, resellers take steps that address aspects of the Fair Information Practices. For example, resellers reported that they have taken steps recently to improve their security safeguards, and they generally inform the public about key privacy principles and policies. However, resellers generally limit the extent to which individuals can gain access to personal information held about themselves, as well as the extent to which inaccurate information contained in their databases can be corrected or deleted. Agency practices for handling personal information acquired from information resellers did not always fully reflect the Fair Information Practices. That is, some of these principles were mirrored in agency practices, but for others, agency practices were uneven. For example, although agencies issued public notices on information collections, these did not always notify the public that information resellers were among the sources to be used. This practice is not consistent with the principle that individuals should be informed about privacy policies and the collection of information. Contributing to the uneven application of the Fair Information Practices are ambiguities in guidance from the Office of Management and Budget (OMB) regarding the applicability of privacy requirements to federal agency uses of reseller information. In addition, agencies generally lack policies that specifically address these uses.