Briefs

Data Mining: Agencies Have Taken Key Steps to Protect Privacy in Selected Efforts, but Significant Compliance Issues Remain. GAO-05-866, August 15.

By Eric Chabrow, InformationWeek Federal investigators say the government isn't doing all it should to notify citizens that information about them is being collected by systems employing data-mining techniques.

The Government Accountability Office, the investigative arm of Congress, reviewed five data-mining efforts employed by the Small Business Administration, Agriculture's Risk Management Agency, the Internal Revenue Service, the State Department, and the FBI.

In an 82-page report requested by Sen. Daniel Akaka, D-Hawaii, the ranking minority member of the Homeland Security and Government Affairs Subcommittee on Oversight of Government Management, the GAO said the five agencies didn't comply with all related laws and guidance to protect personal information, though they did take some key stops to offer those safeguards.

While the agencies responsible for these five efforts took many of the key steps required by federal law and executive branch guidance for the protection of personal information, they did not comply with all related laws and guidance. Specifically, most agencies notified the general public that they were collecting and using personal information and provided opportunities for individuals to review personal information when required by the Privacy Act.

However, agencies are also required to provide notice to individual respondents explaining why the information is being collected; two agencies provided this notice, one did not provide it, and two claimed an allowable exemption from this requirement because the systems were used for law enforcement. In addition, agency compliance with key security requirements was inconsistent. Finally, three of the five agencies completed privacy impact assessments -- important for analyzing the privacy implications of a system or data collection -- but none of the assessments fully complied with Office of Management and Budget guidance. Until agencies fully comply with these requirements, they lack assurance that individual privacy rights are being appropriately protected.

Full report: http://www.gao.gov/cgi-bin/getrpt?GAO-05-866

Highlights: http://www.gao.gov/highlights/d05866high.pdf

Here is the rest of the story from InformationWeek.