Skip to main content

DHS Privacy Office: Progress Made but Challenges Remain in Notifying and Reporting to the Public

GAO-07-522 Published: Apr 27, 2007. Publicly Released: May 29, 2007.
Jump To:
Skip to Highlights

Highlights

The Department of Homeland Security (DHS) Privacy Office was established with the appointment of the first Chief Privacy Officer in April 2003, as required by the Homeland Security Act of 2002. The Privacy Office's major responsibilities include: (1) reviewing and approving privacy impact assessments (PIA)--analyses of how personal information is managed in a federal system, (2) integrating privacy considerations into DHS decision making, (3) ensuring compliance with the Privacy Act of 1974, and (4) preparing and issuing annual reports and reports on key privacy concerns. GAO's objective was to examine progress made by the Privacy Office in carrying out its statutory responsibilities. GAO did this by comparing statutory requirements with Privacy Office processes, documents, and activities.

Recommendations

Recommendations for Executive Action

Agency Affected Recommendation Status
Department of Homeland Security The Secretary of Homeland Security should designate full-time privacy officers at key DHS components, such as Customs and Border Protection, the U.S. Coast Guard, Immigration and Customs Enforcement, and the Federal Emergency Management Agency.
Closed – Implemented
The following components have designated full-time privacy officers: Customs and Borders Protection (CBP), Federal Emergency Management Agency (FEMA), Intelligence and Analysis (I&A), Immigrations and Customs Enforcement (ICE), National Protection and Programs Directorate (NPPD),Science and Technology Directorate (S&T), Transportation Security Administration (TSA), US Coast Guard (USCG), US Citizenship and Immigration Services (USCIS), US Secret Service (USSS), and US Visitor and Immigrant Status Indicator Technology (US-VISIT). This satisfies the recommendation
Department of Homeland Security The Secretary of Homeland Security should implement a department-wide process for the biennial review of system-of-records notices, as required by the Office of Management and Budget.
Closed – Implemented
GAO verified as of September 2010 that, in response to GAO's recommendation, DHS has implemented a department-wide process for the biennial review of system of records notices (SORN). According to DHS's June 2010 response, DHS has reissued majority of its SORNs as part of its biennial review process; which includes a checklist for component privacy officers to identify specific issues which may trigger the need to update program SORNs. Further, DHS officials stated that the Privacy Office's compliance tracking system is used in addition to the biennial review process to track SORNs that are due for the review process.
Department of Homeland Security The Secretary of Homeland Security should establish a schedule for the timely issuance of Privacy Office reports (including annual reports), which appropriately consider all aspects of report development, including departmental clearance.
Closed – Implemented
GAO has verified as of September 2010 that, in response to GAO's recommendation, DHS has continuously published privacy reports on an annual schedule to Congress from 2007 through 2010. By consistently issuing annual reports on a regular schedule, DHS's privacy office has improved it process for issuing its public reports on a timely basis as required by law.
Department of Homeland Security The Secretary of Homeland Security should ensure that the Privacy Office's annual reports to Congress contain a specific discussion of complaints of privacy violations, as required by law.
Closed – Implemented
In April 2007, we reported on the progress of the DHS Privacy Office in carrying out its statutory responsibilities under the Homeland Security Act and its related role in ensuring E-Gov Act compliance. We noted that while they made significant progress, more work remains to be done. More specifically, we recommended that the Secretary of DHS ensure that the Privacy Office's annual reports to Congress contain a specific discussion of complaints of privacy violations. In response to our recommendation, DHS has included a discussion of privacy complaints in its 2006-2007 annual report. Furthermore, according to a DHS official, all future annual reports will include a similar section. The addition of the privacy complaints section will ensure that the DHS Privacy Office is fully meeting legal requirements, and will also increase office transparency to the public and special interest groups as it relates to privacy complaint handling and response.

Full Report

Office of Public Affairs

Topics

Data integrityFederal regulationsHomeland securityInformation disclosureInformation technologyPolicy evaluationPrivacy lawRecordsReporting requirementsRight of privacyAgency missionsInformation management