These investigations are the responsibility of OPM’s  FIS division. Federal Investigative Services Conducts Background Investigations for the Federal Government

FIS conducts approximately 90 percent of all personnel background  investigations for the federal government. In fiscal year 2009, FIS conducted over 2 million  investigations of varying types. To supplement guidance provided by the OPM Privacy Office, FIS also has  developed a Policy on the Protection of Personally Identifiable  Information (PII) to provide employees, including contractors, with a  description of their responsibilities in protecting PII and reporting PII  breaches. OPM’s Background Investigation Process Involves Extensive Collection and Use of PII

FIS conducts background investigations using extensive amounts of PII  collected from a variety of sources. These  steps can be categorized into four distinct phases: (1) Questionnaire  Submission, (2) Scheduling and Initiation, (3) Investigation, and (4)  Review. In addition, subjects are  asked to provide personal information on family members, friends, and  other contacts. For example, if the investigator did not  corroborate the subject’s education, the investigator may need to  interview educational sources. However, it has not  assessed the risks associated with the use of PII, an important element of  conducting a privacy impact assessment. In addition, while FIS policies  and practices for conducting investigations generally align with the Fair  Information Practices, the agency has exercised only limited oversight of  the use of PII by its field investigators and customer agencies. As described earlier, a  PIA is an analysis of how personal information is collected, stored, shared,  and managed in a federal system. FIS Oversight of the Implementation of Privacy Protections is Limited

Although FIS has established a number of privacy protection measures for  its investigations program that reflect the Fair Information Practices, it has  taken limited steps to oversee its field investigators and customer agencies  to ensure they are implementing the measures appropriately. Without  such oversight, it is unclear whether the agency’s protection measures are  being properly implemented. Without an oversight  mechanism to ensure investigators’ adherence to PII protection policies  during investigations—such as through periodic, structured evaluations by  supervisors—the agency lacks assurance that sensitive information is  being handled appropriately during this critical phase of the background  investigation process. FIS relies on memoranda of understanding (MOU) with its customer  agencies to establish procedures and policies for protecting PII related to  background investigation case files, and these agreements specifically  designate OPM as being responsible for ensuring that customer agencies  comply with the requirements of the Privacy Act when handling PII  received from OPM. Specifically, it does not monitor customer agencies’ adherence to the  requirements agreed upon through the MOUs. Until the guidance requires privacy  risk analyses with PIAs and existing PIAs are revised to include privacy  risk analyses, OPM will continue to have limited assurance that PII  contained in its systems is being properly protected. Recommendations for Executive Action

To ensure that appropriate privacy protections are in place during all  stages of a background investigation, we recommend that the Director of  the OPM take the following four actions:    develop guidance for privacy impact assessments that directs agency  officials to perform an analysis of privacy risks and identify mitigating  techniques for all FIS systems that access, use, or maintain PII;    ensure that all existing PIAs are revised to adhere to this guidance;    perform periodic, structured evaluations to ensure that field investigators  handle and protect PII according to agency policies and procedures while  conducting their investigations; and    develop and implement procedures for monitoring customer agencies’  adherence to the privacy provisions agreed to within memoranda of  understanding. Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine:    how the Office of Personnel Management (OPM) uses personally  identifiable information (PII) in conducting background investigations,  and  the extent to which OPM’s privacy policies and procedures for protecting  PII related to investigations meet statutory requirements and align with  widely accepted privacy practices. To address our second objective, we reviewed OPM and FIS privacy  policies and procedures and analyzed agency actions to (1) comply with  the Privacy Act of 1974 and the E-Government Act of 2002 and (2) align  with the Fair Information Practices, a set of widely accepted privacy  principles.
Why GAO Did This Study

Approximately 90 percent of all federal background investigations are provided by the Office of Personnel Management's (OPM) Federal Investigative Services (FIS) division. In fiscal year 2009, FIS conducted over 2 million investigations of varying types, making the organization a major steward of personal information on U.S. citizens. GAO was asked to (1) describe how OPM uses personally identifiable information (PII) in conducting background investigations and (2) assess the extent to which OPM's privacy policies and procedures for protecting PII related to investigations meet statutory requirements and align with widely accepted privacy practices. To address these objectives, GAO compared OPM and FIS policies and procedures with key privacy laws and widely accepted practices.

What GAO Found

FIS, a component of OPM, conducts background investigations using extensive amounts of PII. Specifically, FIS collects PII from the individual being investigated, government agencies holding relevant data on the subject, and contacts familiar with the subject of the investigation. It uses this information during the four phases of the investigation process: (1) Questionnaire Submission, when requesting agencies submit a questionnaire completed by the individual who will be investigated; (2) Scheduling and Initiation, during which goals and milestones are set, automated information requests occur, and an investigator is assigned; (3) Investigation, during which an investigator gathers information from the automated requests and from interviews and prepares a report; and (4) Review, during which a reviewer determines if a report is complete before allowing it to be sent to the requesting agency. FIS has taken steps to incorporate key privacy laws and widely accepted privacy practices into policies and procedures for conducting background investigations. For example, field investigators are directed to limit collection of PII to only information relevant to an investigation, and several procedures are in place to ensure that such information is recorded as accurately as possible in OPM's systems. However, the agency has conducted limited oversight of FIS's development of privacy impact assessments (PIA), investigators' implementation of privacy protection guidance, and customer agencies' adherence to privacy agreements. A PIA is an analysis of how personal information is collected, stored, shared, and managed in a federal system. It is required by the E-Government Act of 2002. Related Office of Management and Budget guidance emphasizes the need to identify and assess privacy risks in concert with developing a PIA. However, OPM's guidance for PIAs does not require that privacy risks be analyzed or mitigation strategies be identified for those risks. Consequently, OPM cannot be sure that potential risks associated with the use of PII in its information systems have been adequately assessed and mitigated. Additionally, widely accepted privacy practices call for accountability to ensure privacy-protection policies are implemented to safeguard personal information from potential risks. Such accountability includes monitoring to ensure proper implementation of privacy protection measures. However, although FIS tracks PII that is provided to and received from field investigators, it had not monitored investigators' adherence to its policies and procedures for protecting PII while investigations are underway. Further, while FIS has developed agreements with customer agencies related to the protection of PII contained in investigation case files, it does not monitor customer agencies' implementation of these policies, even though its agreements state it is responsible for doing so. Without oversight processes for monitoring investigators' and customer agencies' adherence to its PII protection policies, OPM lacks assurance that its privacy protection measures are being properly implemented.

What GAO Recommends

GAO is recommending that the Director of OPM (1) develop guidance for analyzing and mitigating privacy risks in privacy impact assessments, and (2) develop and implement oversight mechanisms for ensuring that investigators properly protect PII and that customer agencies adhere to agreed-upon privacy protection measures. OPM agreed with our recommendations.