Data Mining: Agencies Have Taken Key Steps to Protect Privacy in Selected Efforts, but Significant Compliance Issues Remain

In August 2005, we reported on the privacy and security protections used in several federal data mining efforts. Specifically, we reported that the Risk Management Agency (RMA) had not provided the required Privacy Act notice to all individuals who supplied personal information. We therefore recommended that RMA provide these required notices to individuals, including producers, insurance agents, and adjusters, when personal information is collected from them. As we recommended, RMA developed a Privacy Act statement to employ each time personally identifiable information is collected by an Approved Insurance Provider from an agent, loss adjuster, and policyholder. Based on our recommendation, in December 2008, RMA also issued a bulletin in which it requires Approved Insurance Providers to incorporate the statement each time they seek to obtain personal information from these individuals. By providing the Privacy Act notice to individuals when personal information is collected from them, RMA can help ensure that individual privacy rights are being appropriately protected.

In August 2005, we reported on the privacy and security protections used in several federal data mining systems. In the case of the Risk Management Agency's (RMA) data mining system, we recommended that the Secretary of Agriculture direct the Administrator of RMA to apply the appropriate security measures defined in OMB and NIST guidance to the systems used in the RMA data mining effort, specifically, the development of a complete system security plan, a tested contingency plan, and regular testing and evaluation of the systems used in the effort. As we recommended, RMA developed a system security plan, developed and tested a contingency plan, and tested and evaluated its data mining system. The performance of system testing and evaluation against NIST guidance helps ensure that this data mining effort includes adequate privacy protections.

In August 2005, we reported on the privacy and security protections used in several federal data mining efforts. In regards to the Risk Management Agency (RMA), we recommended that the Secretary of Agriculture direct the Administrator of RMA to develop and implement procedures that ensure the accuracy, relevance, timeliness, and completeness of personal information used to make determinations about individuals. As we recommended, RMA developed and published these procedures in a June 2008 handbook for its data validation system. This handbook is posted on RMA's website. By developing these procedures, RMA can better ensure the quality of records used to make determinations about individuals.

In August 2005, we reported on the privacy and security protections used in several federal data mining systems. In the case of the system used by the Department of Agriculture's (USDA) Risk Management Agency (RMA), we found that the system's privacy impact assessment did not address all of the information required under Office of Management and Budget (OMB) guidance. We recommended that USDA revise the assessment to address the required elements, including analyses of the intended use of the information it collects, with whom the information will be shared, how the information is to be secured, and opportunities for impacted individuals to comment. In September 2006, USDA completed a revised assessment for the RMA data mining system, which substantially addressed the OMB requirements outlined above. As a result of this more comprehensive assessment, the Department should be better able to balance the operational needs of the program with individuals' rights to privacy.

In August 2005, we reported on the privacy and security protections used in several federal data mining systems. In the case of the system used by the Department of Agriculture's (USDA) Risk Management Agency (RMA), we found that the system's privacy impact assessment was not approved by the Department's Chief Information Officer (CIO), as required by the E-Government Act of 2002. We therefore recommended that the Department have its privacy impact assessment approved by the CIO, or equivalent official. In response, USDA's CIO approved the privacy impact assessment for RMA's data mining system in September 2006. By ensuring a thorough review of the system's privacy impact assessment, USDA will be better able to balance the operational needs of the program with individuals' rights to privacy.

In August 2005, we reported on the privacy and security protections used in several federal data mining systems. For the system used by the Department of Agriculture's (USDA) Risk Management Agency, we found that a privacy impact assessment had not been made available to the public, even though it did not contain any sensitive information that would prevent its public release. We therefore recommended that the department revise the assessment and release it to the public, as appropriate. In September 2006, USDA revised the system's privacy assessment. The assessment was subsequently released to the public on the department's Web site. By providing this information to the public, USDA is better able to balance the operational needs of the program with individuals' rights to privacy.

In August 2005, we reported on the privacy and security protections used in several federal data mining systems. In the case of Internal Revenue Service's (IRS) Reveal system, we recommended that the Secretary of the Treasury direct the Commissioner of the IRS to apply the appropriate information security measures defined in Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) guidance to the systems used in the Reveal data mining effort, specifically, the performance of regular system testing and evaluation against NIST guidance. The Reveal system was migrated to the Criminal Investigation System Domain (CI-1) General Support System (GSS). The Reveal system is therefore addressed in the CI-1 GSS Interim Authority to Operate (IATO) Certification on June 23, 2005, and Accreditation on August 11, 2005. The subsequent Authority to Operate (ATO) Accreditation was issued on March 23, 2006, for the CI-1 GSS. Based on the ATO Accreditation, for the CI-1 GSS, which Reveal was migrated to, the IRS has implemented this recommendation. The performance of regular system testing and evaluation against NIST guidance helps ensure that this data mining effort includes adequate privacy protections.

In August 2005, we reported on the privacy and security protections used in several federal data mining systems. In the case of IRS Reveal, we recommended that the Secretary of the Treasury direct the Commissioner of the Internal Revenue Service to revise the privacy impact assessment for the Reveal system to comply with OMB guidance, including analyses of the information to be collected, the purposes of the collection, the intended use of the information, how the information is to be secured, and opportunities for impacted individuals to comment. Since we reported in August 2005, IRS Reveal has migrated to the Criminal Investigation System Domain (CI-1) General Support System (GSS), and now has a revised PIA. The CI-1 GSS PIA was completed by the IRS Office of Privacy in April 2006 and includes Reveal as a component. This CI-1 GSS PIA was approved by the Director of the Office of Privacy in May 2006. The PIA complies with OMB guidance; specifically, it includes analyses of the information to be collected, the purposes of the collection, the intended use of the information, and how the information is to be secured. The revised PIA should help ensure that this data mining effort includes adequate privacy protections.

In August 2005, we reported on the privacy and security protections used in several federal data-mining systems. In the case of the Department of Justice's Federal Bureau of Investigation's (FBI) Foreign Terrorist Tracking Task Force (FTTTF) data mining effort, we reported that the FBI had not demonstrated that they had tested contingency plans. We therefore recommended that the FBI develop these plans for its FTTTF data mining effort. As we recommended, in December 2008, the FBI developed an FTTTF Information Technology (IT) Contingency Plan and tested the plan in February 2009. By developing a tested contingency plan, the FBI can more effectively respond to and recover from damage following an unexpected interruption.

In October 2005, FBI completed a privacy impact assessment that was consistent with OMB guidance, addressing the information to be collected, why it was collected, the intended use of the information, with whom it will be shared, the opportunities for individuals to review information about themselves, and how the information will be secured. The assessment was approved by the FBI's Senior Privacy Official, in consultation with the agency's Privacy Council. The approval was contingent on FTTTF meeting several conditions which should strengthen the privacy of individuals whose information is used in the FTTTF systems. Consistent with OMB guidance, FBI does not plan to publicly release the assessment because it includes sensitive information.

In October 2005, FBI completed a privacy impact assessment that was consistent with OMB guidance, addressing the information to be collected, why it was collected, the intended use of the information, with whom it will be shared, the opportunities for individuals to review information about themselves, and how the information will be secured. The assessment was approved by the FBI's Senior Privacy Official, in consultation with the agency's Privacy Council. The approval was contingent on FTTTF meeting several conditions which should strengthen the privacy of individuals whose information is used in the FTTTF systems. Consistent with OMB guidance, FBI does not plan to publicly release the assessment because it includes sensitive information.

In October 2005, FBI completed a privacy impact assessment that was consistent with OMB guidance, addressing the information to be collected, why it was collected, the intended use of the information, with whom it will be shared, the opportunities for individuals to review information about themselves, and how the information will be secured. The assessment was approved by the FBI's Senior Privacy Official, in consultation with the agency's Privacy Council. The approval was contingent on FTTTF meeting several conditions which should strengthen the privacy of individuals whose information is used in the FTTTF systems. Consistent with OMB guidance, FBI does not plan to publicly release the assessment because it includes sensitive information.

In response to our recommendation, in February 2006, the Department of State modified its purchase card toolkit template and all other toolkit templates used to collect personal information to include a privacy notice which notifies individuals of the agency's legal authority to collect the requested information, the purpose(s) for collecting the information, and routine use(s) of the information.

In August 2005, we reported on the privacy and security protections used in several federal data-mining systems. In the case of the Small Business Administration?s (SBA) Loan/Lender Monitoring System, we recommended that the Administrator of SBA amend its system of records notice regarding its data mining effort to clearly identify the individual responsible for the effort, the process by which individuals can request notification that the system includes records about them, and the procedures individuals should use to review records pertaining to them. In April 2009, SBA published a revised system of records notice for its Loan/Lender Monitoring System. Consistent with our recommendation, the revised notice identifies the system managers; the process by which individuals can request notification about their records from a systems manager; and the procedure by which individuals can request access to their records. By publishing a revised record of systems notice, individuals whose information is used by the system can better understand how to review that information.

In August 2005, we reported on the privacy and security protections used in several federal data mining systems. In the case of the Small Business Administration?s (SBA) Loan/Lender Monitoring System, we found that the system's privacy impact assessment did not address all of the information required under Office of Management and Budget (OMB) guidance. We therefore recommended that SBA revise the assessment to address the required elements, including analyses of the information to be collected, the purposes of the collection, the intended use of the information, how the information is to be secured, opportunities for impacted individuals to comment, and the choices made by the agency as a result of the assessment. In July 2009, SBA completed a revised assessment for its Loan /Lender Monitoring System. Based on our recommendation, SBA assessed the information that is collected by the system, the purposes of collection of this information, and the intended use of the information. Further, SBA identified how the information is to be secured. As a result of this more comprehensive assessment, SBA should be better able to balance the operational needs of the program with individuals' rights to privacy.

In August 2005, we reported on the privacy and security protections used in several federal data mining systems. In the case of the Small Business Administration?s (SBA) Loan/Lender Monitoring System, we found that the system's privacy impact assessment did not address all of the information required under Office of Management and Budget (OMB) guidance. We therefore recommended that SBA revise the assessment to address the required elements, including analyses of the information to be collected, the purposes of the collection, the intended use of the information, how the information is to be secured, opportunities for impacted individuals to comment, and the choices made by the agency as a result of the assessment. In July 2009, SBA completed a revised assessment for its Loan /Lender Monitoring System and posted the notice on its public web site. Based on our recommendation, SBA assessed the information that is collected by the system, the purposes of collection of this information, and the intended use of the information. Further, SBA identified how the information is to be secured. As a result of this more comprehensive assessment, SBA should be better able to balance the operational needs of the program with individuals' rights to privacy.

In August 2005, we reported on the privacy and security protections used in several federal data-mining systems. In the case of GSA's purchase card program, we recommended that the Administrator of the General Services Administration publish a system of records notice for the purchase card program that specifies the name of the system, the categories of individuals and records in the system, the categories of information sources used by the system, the routine uses of the system, how the agency stores and maintains the system, the individual responsible for the effort, the process by which individuals can request notification that the system includes records about them, and the procedures individuals should use to review records pertaining to them. In June 2006, the General Services Administration (GSA) published a governmentwide system of records notice for the GSA SmartPay Purchase Card Program. Consistent with our recommendation, the notice includes the name of the system; the categories of individuals covered by the system; the categories of records in the system; the routine uses of the system records, including categories of users and their purpose for using the system; the policies and practices for storing, retrieving, accessing, retaining, and disposing of system records; the system manager; the process by which individuals can request notification about their records from a purchase card manager; and the procedure by which individuals can request access to their records. As a result of publishing a record of systems notice, privacy protections are strengthened. Further, those whose information is used by the system can better understand the use of such information, as well as understanding how to get that information.

In August 2005, we reported on the privacy and security protections used in several federal data mining systems. In the case of the General Service Administration (GSA), which contracts to use Citibank?s Custom Reporting System (CCRS), we recommended that the Administrator of GSA ensure that appropriate information security measures defined in Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) guidance are applied to the systems used in the CCRS data mining effort, including the development of a risk assessment, a system security plan, a tested contingency plan, the performance of regular testing and evaluation, and the completion of certification and accreditation by agency management. As we recommended, GSA developed a risk assessment report and system security plan, and regularly performed testing and evaluations on the Citibank Commercial Cards System that it uses. The CCRS is a subcomponent of this system. In addition, the CCRS was certified and issued an Authority to Operate Accreditation in November 2007. The performance of regular system testing and evaluation against NIST guidance helps ensure that this data mining effort includes adequate privacy protections.