"Embedding Privacy in Federal Information Systems"
Professor Peter P. Swire
Ohio State University
Consultant, Morrison & Foerster LLP
MITRE Corp. Workshop
March 27, 2003
Overview
Agency privacy before 2001 E-Government Act of 2002 Beyond E-Gov Total Information Awareness Conclusions on security and privacy
I. Government Systems Thru 2000 Privacy Act of 1974
– “System of Records”– Notice, consent, access, reasonable
administrative and technical measures– OMB Guidance
Limits of the Privacy Act
Only applies to “systems of records”– Not, e.g., to queries of commercial databases
Large “routine uses” Uneven compliance
1999 Web Policies
OMB Directive from Jack Lew June, 1999– June 2, 1999, OMB M-99-18
Available at www.privacy2000.org, under “Presidential Privacy Archives”
Guidance and model language for federal sites
1999 OMB Policy
Principal agency web sites “Known, major entry points” “Substantial collection of personal
information”
2000 OMB Cookies Policy
Issued June 22, 2000, OMB M-00-13 Reaction to cookies set for the National
Office of Drug Control Policy Cookies need
– Clear and conspicuous notice– Compelling need to gather the data– Publicly disclosed safeguards– Personal approval by the agency head
2000 OMB Guidance
Agencies should comply with requirements of Children’s Online Privacy Protection Act
Description of privacy practices and steps for compliance on cookies incorporated into annual submission to OMB for IT budgets
OMB/OIRA has sent out guidance for annual budget submissions
II. E-Government Act of 2002
Spotlight on Privacy Impact Assessments PIAs before the Act
– IRS PIA adopted as best practice by Federal CIO Council
– CIO Council encouraged wider use– Only moderate adoption in the agencies– CIO Council subcommittee on privacy did not
continue after January, 2001
PIAs under the E-Gov Act
PIA required where “developing or procuring IT that collects, maintains, or disseminates information that is in identifiable form”
Also “new collection of information” that includes information collected from federal reporting requirements affecting 10+ people (Paperwork Reduction Act extension)
PIAs
Review by agency CIO or equivalent official “If practicable”, after completion of the
review, publish the PIA That can be waived “for security reasons, or
to protect classified, sensitive, or private information”
Copy to OMB
Contents of the PIA
OMB to issue guidance– Perhaps this April or May
PIAs to be commensurate with– size of IT system– sensitivity of information– risk of harm from unauthorized release
Contents of PIA
PIA should include– what information is to be collected– why information is to be collected– intended use of the information– with whom the information is shared– notice or consent for individuals– how information is secured– whether it is a system of records
Other E-Gov Provisions
Statutory version of OMB 1999 guidance for privacy policies on agency web pages– More detail on notice, choice, access, security
Privacy policies in machine-readable formats– OMB guidance– P3P the likely current use
“Identifiable” permits the identity “to be reasonably inferred”, directly or indirectly
III. Beyond E-Gov
HIPAA and federal agencies– Privacy rule this April 14– Transaction rule this October– Security rule in 2 years, and also by April 14
What agencies?– VA, DOD, other federal/state health providers– Research on human subjects– Federal/state health insurance– Business associates -- receive data from others
Court Records and Privacy
OMB/DOJ/Treasury study in Jan. 2001 on bankruptcy records and privacy
SEARCH and criminal records PACER and court records as a current
major debate
IV. Total Information Awareness Surveillance after September 11 Wiretap/surveillance changes in USA-
PATRIOT Act Philosophy of “information sharing”
– Among agencies– Between federal and state/local
TIA
Does not look like “embedding privacy in federal information systems”
Contrasting trends– Embedding privacy– Increasing surveillance (data gathering) and
data sharing
Conclusion
Will need to build federal systems better for security and privacy
They work together on the level of good data practices
They can work against each other with surveillance and data sharing proposals
Not clear how the cross-currents will change practices in coming years
Contact information
Professor Peter Swire www.peterswire.net [email protected] (240) 994-4142
Top Related