Further, FSA works with  various entities, such as loan servicers, guaranty agencies, private  collection agencies, and lenders, to carry out loan servicing and collection  activities. Under this program, the Department of Education  entered into agreements with guaranty agencies to insure the private  lenders against losses due to a borrower’s default. In accordance with FISMA, OMB is responsible for the oversight of  agencies’ information security policies and practices. FSA  shares a variety of PII with the non-school partners to assist them in  carrying out their functions. FSA’s Non-School Partners Perform Key Roles Related to Loan Servicing, Repayment, and Collection

Non-school partners are involved primarily in the loan servicing,  repayment, and collection phases of the federal student aid process. As part  of the program, students and parents obtained federal loans through  non-federal lenders, such as the borrower’s school, a bank, credit  union, or other lending institution. Loan servicers are responsible for  collecting payments on a loan, advising borrowers on resources and  benefits to better manage their federal student loan obligations,  responding to customer service inquiries, and performing other  administrative tasks associated with maintaining a loan on behalf of  the Department of Education. FSA Shares Extensive Amounts of Personally Identifiable Information about Borrowers with Non- School Partners

In administering the federal student aid program, FSA shares a large  amount of PII that it collects from students and parents with its non-school  partners. Parent demographics (if applicable): Name, Social Security  number, email address, and marital status. This guidance  identifies key practices for overseeing the protection of data by such  entities. FSA Established Security Requirements for Loan Servicers and Private Collection Agencies

FSA established policies and procedures for overseeing Title IV loan  servicers and private collection agencies that generally address the key  selected practices for overseeing the protection of data. FSA Established Security Requirements for Guaranty Agencies, but Lacks a Process for Ongoing Monitoring of Controls

FSA policies and procedures requires guaranty agencies to implement  security and privacy controls to protect student aid data, and the agency  has recently enhanced its processes to include independent, on-site  assessments of those controls and the development of corrective actions  for identified weaknesses. However, FSA does not have a process for ensuring that lenders are  complying with these, or other, requirements related to the protection of  student aid data. Consequently, FSA lacks assurance that risk-based  safeguards commensurate with the sensitivity of these data are being  effectively implemented, tested, and monitored. In its  comments (reprinted in appendix II), FSA concurred with three of our  recommendations, partially concurred with two recommendations, and did  not concur with one. However, FSA did not describe actions to address the first part of our  recommendation. FSA noted that the lenders are already subject to  security and privacy controls that are monitored and enforced through  other legal authorities that are not administered by the Department of  Education or FSA. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) describe the roles of the Office of  Federal Student Aid’s (FSA) non-school partners in the federal student  financial aid program, including the types of personally identifiable  information (PII) shared with them; and (2) assess the extent to which  FSA’s policies and procedures for overseeing non-school partners’  protection of federal student aid data align with federal requirements,  federal guidance, and best practices. To address the second objective, we reviewed and analyzed the policies,  procedures, and processes FSA has in place for overseeing non-school  partners’ protection of student aid data and compared them to federal  requirements and guidance for ensuring the protection of PII. We then compared  the processes to the four key practices we identified.
Why GAO Did This Study

FSA administers billions of dollars in student financial aid, including loans and grants, to eligible college students. The processing of student aid is complex, and FSA relies on non-school partners to carry out various activities supporting the student aid process, such as loan repayment and collection.
GAO was asked to review how FSA ensures the protection of PII by its non-school partners. The objectives of this review were to (1) describe the roles of non-school partners and the types of PII shared with them and (2) assess the extent to which FSA policies and procedures for overseeing the non-school partners' protection of student aid data adhere to federal requirements, guidance, and best practices.
To address these objectives, GAO collected and reviewed FSA documentation, reports, policies, and procedures and compared FSA policies and procedures to four key practices included in federal guidance for overseeing the protection of PII by non-federal entities. GAO also interviewed FSA officials with responsibility for the oversight of non-school partners.

What GAO Found

The Department of Education's Office of Federal Student Aid (FSA) partners with various entities (“non-school partners”) that are involved primarily in supporting the repayment and collection of student loans.
Federal loan servicers are responsible for collecting payments on loans and providing customer service to borrowers on behalf of the Department of Education through its Direct Loan program.
Private collection agencies collect on loans that are in default and work with borrowers to help them get out of default.
Guaranty agencies insure lenders against loss due to borrower default and carry out a variety of loan administration activities.
Federal Family Education Loan lenders are non-federal lenders, such as banks, credit unions, or other lending institutions, that made loans to students in the past and continue to service these loans.
FSA shares a variety of personally identifiable information (PII) on borrowers with its non-school partners. This includes names, addresses, phone numbers, email addresses, Social Security numbers, and financial information.
Key practices for overseeing the protection of PII shared with non-federal entities include requiring (1) risk-based security and privacy controls, (2) independent assessments to ensure controls are effectively implemented, (3) corrective actions to address identified weaknesses in controls, and (4) ongoing monitoring of control status. FSA established oversight policies and procedures for loan servicers and private collection agencies that generally address these key practices. However, FSA exercises minimal oversight of lenders' protection of student data (see table).
FSA officials maintain that the lenders are subject to other legal and regulatory requirements for protecting customer data. However, FSA does not have a process for ensuring lenders are complying with these requirements, and thus lacks assurance that appropriate risk-based safeguards are being effectively implemented, tested, and monitored.

What GAO Recommends

GAO is making six recommendations to FSA to ensure that its oversight of non-school partners addresses the four key practices for ensuring the protection of PII. FSA concurred with three of the recommendations, partially concurred with two, and did not concur with one. It also described actions planned or under way to implement four of the recommendations. GAO maintains that all of its recommendations are warranted.