	Background

The DHS Privacy Office was established with the appointment of the first  Chief Privacy Officer in April 2003. Reviewing and approving public notices required by the Privacy Act  The Privacy Office is required by the Homeland Security Act to assure that  personal information contained in Privacy Act systems of records is  handled in full compliance with fair information practices as set out in the  Privacy Act of 1974. This notice must include information such as the type of  information collected, the types of individuals about whom information is  collected, the intended “routine” uses of the information, and procedures  that individuals can use to review and correct their personal information. The Privacy Office Has Made Significant Progress in Reviewing and Approving PIAs, but Faces an Increasing Workload

One of the Privacy Office’s primary responsibilities is to review and  approve PIAs to ensure departmental compliance with the privacy  provisions (section 208) of the E-Gov Act of 2002. Specifically, the office has established a  five-stage review process. The Privacy Office Has Taken Steps to Integrate Privacy Into DHS Decision Making

The Privacy Office has also taken steps to integrate privacy considerations  in the DHS decision-making process. In June 2006, a workshop was held on the policy, legal, and  operational frameworks for PIAs and privacy threshold analyses and  included a tutorial for conducting PIAs. Although Privacy Act Processes Have Been Established, Little Progress Has Been Made in Updating Public Notices for DHS Legacy Systems- of-Records

The DHS Privacy Office is responsible for reviewing and approving DHS  system-of-records notices to ensure that the department complies with the  Privacy Act of 1974. Privacy Office Has Generally Not Issued Reports in a Timely Fashion

Section 222 of the Homeland Security Act requires that the Privacy Officer  report annually to Congress on “activities of the Department that affect  privacy, including complaints of privacy violations, implementation of the  Privacy Act of 1974, internal controls, and other matters.” The act does not  prescribe a deadline for submission of these reports; however, the  requirement to report “on an annual basis” suggests that each report  should cover a 1-year time period and that subsequent annual reports  should be provided to Congress 1 year after the previous report was  submitted. For example, a report on the Multi-state Anti-Terrorism  Information Exchange program, initiated in response to a complaint by the  American Civil Liberties Union submitted in May 2004, was not issued  until two and a half years later, long after the program had been  terminated. Late issuance of reports has a number of negative consequences beyond  noncompliance with mandated deadlines. Until DHS reviews  and updates all of its legacy notices as required by federal guidance, it  cannot assure the public that its notices reflect current uses and  protections of personal information. In summary, the DHS Privacy Office has made significant progress in  implementing its statutory responsibilities under the Homeland Security  Act; however, more work remains to be accomplished.
Why GAO Did This Study

The Department of Homeland Security (DHS) Privacy Office was established with the appointment of the first Chief Privacy Officer in April 2003, as required by the Homeland Security Act of 2002. The Privacy Office's major responsibilities include: (1) reviewing and approving privacy impact assessments (PIA)--analyses of how personal information is managed in a federal system, (2) integrating privacy considerations into DHS decision making and ensuring compliance with the Privacy Act of 1974, and (3) preparing and issuing annual reports and reports on key privacy concerns. GAO was asked to testify on its recent report examining progress made by the DHS Privacy Office in carrying out its statutory responsibilities. GAO compared statutory requirements with Privacy Office processes, documents, and activities.

What GAO Found

The DHS Privacy Office has made significant progress in carrying out its statutory responsibilities under the Homeland Security Act and its related role in ensuring compliance with the Privacy Act of 1974 and E-Government Act of 2002, but more work remains to be accomplished. Specifically, the Privacy Office has established a compliance framework for conducting PIAs, which are required by the E-Gov Act. The framework includes formal written guidance, training sessions, and a process for identifying systems requiring such assessments. The framework has contributed to an increase in the quality and number of PIAs issued as well as the identification of many more affected systems. The resultant workload is likely to prove difficult to process in a timely manner. Designating privacy officers in certain DHS components could help speed processing of PIAs, but DHS has not yet taken action to make these designations. The Privacy Office has also taken actions to integrate privacy considerations into the DHS decision-making process by establishing an advisory committee, holding public workshops, and participating in policy development. However, limited progress has been made in one aspect of ensuring compliance with the Privacy Act--updating public notices for systems of records that were in existence prior to the creation of DHS. These notices should identify, among other things, the type of data collected, the types of individuals about whom information is collected, and the intended uses of the data. Until the notices are brought up-to-date, the department cannot assure the public that the notices reflect current uses and protections of personal information. Further, the Privacy Office has generally not been timely in issuing public reports. For example, a report on the Multi-state Anti-Terrorism Information Exchange program--a pilot project for law enforcement sharing of public records data--was not issued until long after the program had been terminated. Late issuance of reports has a number of negative consequences, including a potential reduction in the reports' value and erosion of the office's credibility.