The E-Government Act of 2002 strives to enhance protection for  personal information in government information systems by  requiring that agencies conduct privacy impact assessments (PIA). A  PIA is an analysis of how personal information is collected, stored,  shared, and managed in a federal system. PIAs  are important because they serve as a tool for agencies to fully  consider privacy implications of planned systems and data  collections before those systems and collections have been fully  implemented, when it may be relatively easy to make critical  adjustments. Key elements of this program include  ●  periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems;  ●  risk-based policies and procedures that cost-effectively reduce risks  to an acceptable level and ensure that security is addressed  throughout the life cycle of each information system;  ●  security awareness training for agency personnel, including  contractors and other users of information systems that support the  operations and assets of the agency;  ●  periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices;  ●  a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies through plans of action  and milestones; and  ●  procedures for detecting, reporting, and responding to security  incidents. As  discussed, this should be minimized. Applicable laws such as the  Privacy Act currently do not require agencies to notify individuals of  security breaches involving their personal information; however,  doing so allows those affected the opportunity to take steps to  protect themselves against the dangers of identity theft. Breach notification is also important in that it can help an  organization address key privacy rights of individuals. Public disclosure of data breaches is a key step in  ensuring that organizations are held accountable for the protection  of personal information. Designing useful, easy-to-understand notices has been cited as a  challenge in other areas where privacy notices are required by law,  such as in the financial industry—where businesses are required by  the Gramm-Leach-Bliley Act to send notices to consumers about  their privacy practices—and in the federal government, which is  required by the Privacy Act to issue public notices in the Federal  Register about its systems of records containing personal  information. Given  that people may be adversely affected by a compromise of their  personal information, it is critical that they fully understand the  nature of the threat and the options they have to address it. In summary, agencies can take a number of actions to help guard  against the possibility that databases of personally identifiable  information are inadvertently compromised, among which  developing PIAs and ensuring that a robust information security  program is in place are key. More specific practical measures aimed  at preventing inadvertent data breaches include limiting the  collection of personal information, limiting data retention, limiting  access to personal information and training personnel accordingly,  and considering using technological controls such as encryption  when data need to be stored on mobile devices. Nevertheless, data  breaches can still occur at any time, and when they do, notification  to the individuals affected and/or the public has clear benefits,  allowing people the opportunity to take steps to protect themselves  against the dangers of identity theft. Care is needed in defining  appropriate criteria if agencies are to be required to report security  breaches to the public. Further, care is also needed to ensure that  notices are useful and easy-to-understand so that they are effective  in alerting individuals to actions they may want to take to minimize  the risk of identity theft.
Why GAO Did This Study

The recent security breach at the Department of Veterans Affairs, in which personal data on millions of veterans were compromised, has highlighted the importance of the federal government's processes for protecting personal information. As the federal government obtains and processes information about individuals in increasingly diverse ways, it remains critically important that it properly protect this information and respect the privacy rights of individuals. GAO was asked to testify on preventing and responding to improper disclosures of personal information in the federal government, including how agencies should notify individuals and the public when breaches occur. In preparing this testimony, GAO drew on its previous reports and testimonies, as well as on expert opinion provided in congressional testimony and other sources.

What GAO Found

Agencies can take a number of actions to help guard against the possibility that databases of personally identifiable information are inadvertently compromised. The first key step is to develop a privacy impact assessment--an analysis of how personal information is collected, stored, shared, and managed--whenever information technology is used to process personal information. These assessments, required by the E-Government Act of 2002, are a tool for agencies to fully consider the privacy implications of planned systems and data collections before implementation, when it may be easier to make critical adjustments. The second key step is to ensure that a robust information security program is in place, as required by the Federal Information Security Management Act of 2002 (FISMA). Such a program includes periodic risk assessments; security awareness training; security policies, procedures, and practices, as well as tests of their effectiveness; and procedures for addressing deficiencies and for detecting, reporting, and responding to security incidents. More specific practical measures aimed at preventing inadvertent data breaches include limiting the collection of personal information, limiting the time that such data are retained, limiting access to personal information and training personnel accordingly, and considering the use of technological controls such as encryption when data need to be stored on mobile devices. When data breaches do occur, notification to the individuals affected and/or the public has clear benefits, allowing people the opportunity to take steps to protect themselves against the dangers of identity theft. Although existing laws do not require agencies to notify the public when data breaches occur, such notification is consistent with agencies' responsibility to inform individuals about how their information is being accessed and used, and it promotes accountability for privacy protection. That said, care is needed in defining appropriate criteria for incidents that merit notification. Notifying individuals of security incidents that do not pose serious risks could be counterproductive and costly, while giving too much discretion to agencies could result in their avoiding the disclosure of potentially harmful breaches. Care is also needed to ensure that notices are useful and easy to understand, so that they are effective in alerting recipients to actions they may want to take to minimize the risk of identity theft. Among other things, it is important to provide context in the notice--explaining to recipients why they are receiving a notice and what to do about it. It is also important the notices be coordinated with law enforcement to avoid impeding ongoing investigations. Given that individuals may be adversely impacted by a compromise of their personal information, it is critical that they fully understand the nature of the threat and the options they have to address it.