Tramadol prescription Cheap tramadol online Purchase tramadol Buy soma online Zithromax Discount viagra Football handicapping Nfl predictions Viagra sale online Generic ultram Order xenical online Xanax online Buying viagra Buy paxil Discount soma Vardenafil Soma watson Best poker software Generic paxil Generic ambien Internet casino Credit card debt Valium for sale Personal loan Soma online pharmacy Carisoprodol soma Pokerstars com Online slot Zoloft Asthma Motrin Lipitor Dental assistant Mental health Tramadol capsules Buy zoloft Lasix Sale tramadol Order meridia online Generic phentermine Cheap flight Cheapflights Health insurance Auto insurances Airlines Abilify Adultfriendfinder House Work at home Education Soma and loracet Broadway Pa System antivirus 2008 Servers Insurance rates Xnxx Phones Xanax generic blue Health 

Jim Harper

GAO Issues Report on Privacy

This week, for a hearing in the Senate Homeland Security and Government Reform Committee, the Government Accountability Office released a report on privacy titled “Alternatives Exist for Enhancing Protection of Personally Identifiable Information.” (GAO testimony based on the report is here.) I served on a National Academy of Sciences “Expert Panel” that gave the GAO some perspectives on issues related to the Privacy Act.

The report had three main conclusions, which follow with my comments:

The Privacy Act’s definition of a “system of records” (any grouping of records containing personal information retrieved by individual identifier), which sets the scope of the act’s protections, does not always apply whenever personal information is obtained and processed by federal agencies. One alternative to address this concern would be revising the system-of-records definition to cover all personally identifiable information collected, used, and maintained systematically by the federal government.

The “system of records” definition has indeed fallen out of date. Thanks to the growth of search and other technological developments, records not organized by personal identifier can be accessed and used by the federal government, but they fall outside the purview of the Privacy Act. This should change. The report also highlights the fact that data used by the federal government, but held by information resellers, escapes the purview of the Privacy Act. This should also change.

According to generally accepted privacy principles of purpose specification, collection limitation, and use limitation, the collection of personal information should be limited, and its use should be limited to a specified purpose. Yet, current laws and guidance impose only the modest requirements in these areas. . . . Alternatives to address this area of concern include requiring agencies to justify the collection and use of key elements of personally identifiable information and to establish agreements before sharing such information with other agencies.

Once they have collected it, federal agencies can do anything they want with personal information simply by declaring their plan to do so in the Federal Register through a “System of Records Notice” or “SORN.” The statements agencies may make when they collect information do not bind them in the slightest. This is wrong and it should change. GAO’s recommendations to limit collection and sharing of information are rather tepid, alas, and they wouldn’t change agencies’ institutional incentives to over-collect and promiscuously share the personal information of the citizenry.

Privacy Act notices may not effectively inform the public about government uses of personal information. For example, system-of-records notices published in the Federal Register (the government’s official vehicle for issuing public notices) may be difficult for the general public to fully understand. Layered notices, which provide only the most important summary facts up front, have been used as a solution in the private sector. In addition, publishing such notices at a central location on the Web would help make them more accessible.

It’s true that Privacy Act notices don’t inform the public well. They are obscurely written documents in an obscure publication. But I’m not sure that the publication of “layered notices” would be an improvement. Sure, there’s a consensus among government types that layered notices are the next big thing, but I don’t believe that they will change citizen understanding or behavior in any significant respect. Notices are also not terribly relevant in the government environment because a person can’t decline to do business with a government based on its privacy practices or promises.

There’s more to learn on “notice” and its importance or relevance for getting people more privacy. The thing we know is that reducing data collection and use leads directly to privacy. Getting policymakers to understand the privacy costs they’re imposing on the public would be as effective, if not more, than notifying the public about what’s been done to them after a policy is made and the horse is out of the barn.

June 20, 2008 | Comments |

blog comments powered by Disqus