The  Privacy Act requires that when agencies establish or make changes to a  system of records, they must notify the public through a system-of- records notice in the Federal Register that identifies, among other things,  the categories of data collected, the categories of individuals about whom  information is collected, the intended “routine” uses of data, and  procedures that individuals can use to review and correct personally  identifiable information. Technological Changes Have Made Key Elements of Privacy Laws Outdated

Technological developments since the Privacy Act became law in 1974  have radically changed the way information is organized and shared  among organizations and individuals. Such advances have rendered  some of the provisions of the Privacy Act and the E-Government Act of  2002 inadequate to fully protect all personally identifiable information  collected, used, and maintained by the federal government. DHS  has taken action to address both of these recommendations. Privacy Laws May Not Consistently Protect Personally Identifiable Information

In 2008, we issued a report on the sufficiency of privacy protections  afforded by existing laws and guidance, in particular the Privacy Act, the  E-Government Act, and related OMB guidance.that while these laws and guidance set minimum requirements for  agencies, they may not consistently protect personally identifiable  information in all circumstances of its collection and use throughout the  federal government and may not fully adhere to key privacy principles. We identified issues in three major areas:  Applying privacy protections consistently to all federal collection  and use of personal information. For example, if agencies do not retrieve personal  information by identifier, as may occur in data-mining systems, the act’s  protections do not apply. Yet current laws and guidance impose only modest  requirements for describing the purposes for personal information and  limiting how it is used. Establishing effective mechanisms for informing the public about  privacy protections. Yet concerns have  been raised that Privacy Act notices may not serve this function well. An effective notice can  also provide individuals with information they need to determine whether  to provide their personal information (if voluntary), or who to contact to  correct any errors that could result in an adverse determination about  them. Accordingly, we suggested that Congress consider amending applicable  laws, such as the Privacy Act and E-Government Act, according to the  alternatives we outlined, including  revising the scope of the laws to cover all personally identifiable  information collected, used, and maintained by the federal  government;  setting requirements to ensure that the collection and use of  personally identifiable information is limited to a stated purpose; and establishing additional mechanisms for informing the public about  privacy protections by revising requirements for the structure and  publication of public notices. In 2006, in the wake of a security  breach at the Department of Veterans Affairs resulting in the compromise  of personal data on millions of U.S. veterans, we testified on preventing  and responding to improper disclosures of personal information in the  federal government. In particular, we noted two key  steps agencies should take:
Develop PIAs whenever information technology is used to process  personal information. These assessments are a tool for agencies to  fully consider the privacy implications of planned systems and data  collections before implementation, when it may be easier to make  critical adjustments. Ensure the implementation of a robust information security program  as required by FISMA. Such a program includes periodic risk  assessments; security awareness training; security policies,  procedures, and practices, as well as tests of their effectiveness; and  procedures for addressing deficiencies and for detecting, reporting,  and responding to security incidents. Data Breaches Continue to Proliferate in the Public and Private Sectors

Over the last several years, we have continued to report that federal  agency systems are vulnerable to cyber attacks and the potential  compromise of sensitive information, including personally identifiable   For fiscal year 2011, agency inspector general and GAO  information.assessments of information security controls revealed that most major  federal agencies had weaknesses in most of five major categories of  information system controls. 1.) Of the  incidents occurring in 2011, 15,560 involved unauthorized disclosure of  personally identifiable information, a 19 percent increase over the 13,017  personally identifiable information incidents that occurred in 2010. Information Management: Challenges in Federal Agencies’ Use of Web  2.0 Technologies. Information Security: Federal Agency Efforts to Encrypt Sensitive  Information Are Under Way, but Work Remains.
Why GAO Did This Study

The federal government collects and uses personal information on individuals in increasingly sophisticated ways, and its reliance on information technology (IT) to collect, store, and transmit this information has also grown. While this enables federal agencies to carry out many of the governments critical functions, concerns have been raised that the existing laws for protecting individuals personal information may no longer be sufficient given current practices. Moreover, vulnerabilities arising from agencies increased dependence on IT can result in the compromise of sensitive personal information, such as inappropriate use, modification, or disclosure.
GAO was asked to provide a statement describing (1) the impact of recent technology developments on existing laws for privacy protection in the federal government and (2) actions agencies can take to protect against and respond to breaches involving personal information. In preparing this statement, GAO relied on previous work in these areas as well as a review of more recent reports on security vulnerabilities.

What GAO Found

Technological developments since the Privacy Act became law in 1974 have changed the way information is organized and shared among organizations and individuals. Such advances have rendered some of the provisions of the Privacy Act and the E-Government Act of 2002 inadequate to fully protect all personally identifiable information collected, used, and maintained by the federal government. For example, GAO has reported on challenges in protecting the privacy of personal information relative to agencies use of Web 2.0 and data-mining technologies.
While laws and guidance set minimum requirements for agencies, they may not protect personal information in all circumstances in which it is collected and used throughout the government and may not fully adhere to key privacy principles. GAO has identified issues in three major areas:
Applying privacy protections consistently to all federal collection and use of personal information. The Privacy Acts protections only apply to personal information when it is considered part of a system of records as defined by the act. However, agencies routinely access such information in ways that may not fall under this definition.
Ensuring that use of personally identifiable information is limited to a stated purpose. Current law and guidance impose only modest requirements for describing the purposes for collecting personal information and how it will be used. This could allow for unnecessarily broad ranges of uses of the information.
Establishing effective mechanisms for informing the public about privacy protections. Agencies are required to provide notices in the Federal Register of information collected, categories of individuals about whom information is collected, and the intended use of the information, among other things. However, concerns have been raised whether this is an effective mechanism for informing the public.
The potential for data breaches at federal agencies also pose a serious risk to the privacy of individuals personal information. OMB has specified actions agencies should take to prevent and respond to such breaches. In addition, GAO has previously reported that agencies can take steps that include
assessing the privacy implications of a planned information system or data collection prior to implementation;
ensuring the implementation of a robust information security program; and
limiting the collection of personal information, the time it is retained, and who has access to it, as well as implementing encryption.
However, GAO and inspectors general have continued to report on vulnerabilities in security controls over agency systems and weaknesses in their information security programs, potentially resulting in the compromise of personal information. These risks are illustrated by recent security incidents involving individuals personal information. Federal agencies reported 13,017 such incidents in 2010 and 15,560 in 2011, an increase of 19 percent.

What GAO Recommends

GAO previously suggested that Congress consider amending applicable privacy laws to address identified issues. GAO has also made numerous recommendations to agencies over the last several years to address weaknesses in policies and procedures related to privacy and to strengthen their information security programs.