The  committee’s final report proposed a set of principles for pro the privacy and security of personal information, known as the Fair  Information Practices. The  major requirements for the protection of personal information by  federal agencies come from two laws: the Privacy Act of 1974 and  the privacy provisions of the E-Government Act of 2002. For example, officials had questions about the act’s  applicability to electronic records. Key Terms in the Privacy Act May Be Defined Too Narrowly

Because the Privacy Act’s controls on the collection, use, and  disclosure of personally identifiable information only apply wh en  such information is covered by the act’s key terms, especially the  “system-of-records” construct, they do not consistently protect suc h  information in all circumstances of its collection and use throughout  the federal government. Changing the system-of-records definition is an  option that could help ensure that the act’s protections are  consistently applied to all personally identifiable information. While purpose statements for certain law  enforcement and anti-terrorism systems might need to be phrased  broadly enough so as not to reveal investigative techniques or the  details of ongoing cases, very broadly defined purposes could allow  for unnecessarily broad ranges of uses, thus calling into question  whether meaningful limitations had been imposed. In addition to concerns about limiting  use to a specified purpose within an agency, more extensive issues  have been raised when data are shared outside an agency. Despite not  being required to do so, agencies we reviewed reported taking  measures to ensure the data are used appropriately by recipients However, in the absence of such measures, data shared outside  federal agencies would not always have sufficient protections.  .
To better confine agencies’ use of personal information to its  specified purposes, laws or guidance could be revised to (1) requ agencies to justify the use of key elements of personal informat (2) set specific limits on routine uses and internal agency uses of  personal information, and (3) require agencies to establish formal  agreements with external entities before sharing personal  information with them. Based on discussions with privacy experts, agency officials, and  analysis of laws and related guidance, a number of options ex improving public notice regarding federal collection and use of  personal information:   Require layered public notices in conjunction with system-of- records notices. Set requirements to ensure that purpose, collection limitations,  and use limitations are better addressed in the content of pr ivacy  notices. Make all notices available on a governmentwide privacy Web site Relevant privacy notices could be published at a central  governmentwide location, with an address such as  www.privacy.gov, and at corresponding standard  agency Web sites with addresses of the form  www.agency.gov/privacy. Amending Privacy Law Privacy Protections

In summary, current laws and guidance governing the federal  government’s collection, use, and disclosure of personal informatio have gaps and other potential shortcomings in three broad  categories: (1) the Privacy Act and E-Government Act do not always  provide protections for federal uses of personal information,  (2) laws and guidance may not effectively limit agency collection  ) the  and use of personal information to specific purposes, and (3 Privacy Act may not include effective mechanisms for informing the  public. In assessing the appropriate balance between the needs of the  federal government to collect personally identifiable information for  programmatic purposes and the assurances that individuals should  have that their information is being sufficiently protected and  properly used, Congress should consider amending applicable laws,  such as the Privacy Act and the E-Government Act, according to the alternatives outlined in our report, including  revising the scope of the laws to cover all personally identifiable  information collected, used, and maintained by the federal  government;  ●  setting requirements to ensure that the collection and use of  personally identifiable information is limited to a stated pur and  ●  establishing additional mechanisms for informing the public a privacy protections by revising requirements for the structure and publication of public notices.
Why GAO Did This Study

Concerns have been raised about the privacy and security of personal information in light of advances in information technology and the increasingly sophisticated ways in which the government obtains and uses information. Federal agencies' use of personal information is governed by the Privacy Act of 1974 and the E-Government Act of 2002, while the Office of Management and Budget (OMB) provides implementation guidance and oversight. These laws and guidance are based on the Fair Information Practices, a set of widely accepted principles for protecting privacy. GAO was asked to testify on its report, being released today, concerning the sufficiency of privacy protections afforded by existing laws and guidance. To do this, GAO analyzed privacy laws and guidance, compared them with the Fair Information Practices, and obtained perspectives from federal agencies as well as an expert forum.

What GAO Found

Although privacy laws and guidance set minimum requirements for agencies, they may not consistently protect personally identifiable information in all circumstances of its collection and use throughout the federal government and may not fully adhere to key privacy principles. Based on discussions with privacy experts and agency officials, as well as analysis of laws and related guidance, GAO identified issues in three major areas: Applying privacy protections consistently to all federal collection and use of personal information. The Privacy Act's definition of a "system of records," which sets the scope of the act's protections, does not always apply whenever personal information is obtained and processed by federal agencies. For example, if agencies do not retrieve personal information by identifier, the act's protections do not apply. This has led experts to agree that the Privacy Act's system-of-records construct is too narrowly defined. An alternative for addressing these issues could include revising the system-of-records definition to cover all personally identifiable information collected, used, and maintained systematically by the federal government. Ensuring that use of personally identifiable information is limited to a stated purpose. According to the Fair Information Practices, the use of personal information should be limited to a specified purpose. Yet current laws and guidance impose only modest requirements for describing the purposes for personal information and limiting how it is used. For example, agencies are not required to be specific in formulating purpose descriptions in their public notices. Overly broad specifications of purpose could allow for unnecessarily broad ranges of uses, thus calling into question whether meaningful limitations had been imposed. Alternatives for addressing these issues include setting specific limits on use of information within agencies and requiring agencies to establish formal agreements with external governmental entities before sharing personally identifiable information with them. Establishing effective mechanisms for informing the public about privacy protections. Public notices are a primary means of establishing accountability for privacy protections and giving individuals a measure of control over the use of their personal information. Although the Federal Register is the government's official vehicle for issuing public notices, critics have questioned whether system-of-records notices published in the Federal Register effectively inform the public about government uses of personal information. Options for addressing concerns about public notices include requiring that purpose, collection limitations, and use limitations are better addressed in the content of privacy notices, and revising the Privacy Act to require that all notices be published on a standard Web site, with an address such as www.privacy.gov .