"Embedding Privacy in Federal Information Systems"

Professor Peter P. Swire

Ohio State University

Consultant, Morrison & Foerster LLP

MITRE Corp. Workshop

March 27, 2003

Overview

Agency privacy before 2001 E-Government Act of 2002 Beyond E-Gov Total Information Awareness Conclusions on security and privacy

I. Government Systems Thru 2000 Privacy Act of 1974

– “System of Records”– Notice, consent, access, reasonable

administrative and technical measures– OMB Guidance

Limits of the Privacy Act

Only applies to “systems of records”– Not, e.g., to queries of commercial databases

Large “routine uses” Uneven compliance

1999 Web Policies

OMB Directive from Jack Lew June, 1999– June 2, 1999, OMB M-99-18

Available at www.privacy2000.org, under “Presidential Privacy Archives”

Guidance and model language for federal sites

1999 OMB Policy

Principal agency web sites “Known, major entry points” “Substantial collection of personal

information”

2000 OMB Cookies Policy

Issued June 22, 2000, OMB M-00-13 Reaction to cookies set for the National

Office of Drug Control Policy Cookies need

– Clear and conspicuous notice– Compelling need to gather the data– Publicly disclosed safeguards– Personal approval by the agency head

2000 OMB Guidance

Agencies should comply with requirements of Children’s Online Privacy Protection Act

Description of privacy practices and steps for compliance on cookies incorporated into annual submission to OMB for IT budgets

OMB/OIRA has sent out guidance for annual budget submissions

II. E-Government Act of 2002

Spotlight on Privacy Impact Assessments PIAs before the Act

– IRS PIA adopted as best practice by Federal CIO Council

– CIO Council encouraged wider use– Only moderate adoption in the agencies– CIO Council subcommittee on privacy did not

continue after January, 2001

PIAs under the E-Gov Act

PIA required where “developing or procuring IT that collects, maintains, or disseminates information that is in identifiable form”

Also “new collection of information” that includes information collected from federal reporting requirements affecting 10+ people (Paperwork Reduction Act extension)

PIAs

Review by agency CIO or equivalent official “If practicable”, after completion of the

review, publish the PIA That can be waived “for security reasons, or

to protect classified, sensitive, or private information”

Copy to OMB

Contents of the PIA

OMB to issue guidance– Perhaps this April or May

PIAs to be commensurate with– size of IT system– sensitivity of information– risk of harm from unauthorized release

Contents of PIA

PIA should include– what information is to be collected– why information is to be collected– intended use of the information– with whom the information is shared– notice or consent for individuals– how information is secured– whether it is a system of records

Other E-Gov Provisions

Statutory version of OMB 1999 guidance for privacy policies on agency web pages– More detail on notice, choice, access, security

Privacy policies in machine-readable formats– OMB guidance– P3P the likely current use

“Identifiable” permits the identity “to be reasonably inferred”, directly or indirectly

III. Beyond E-Gov

HIPAA and federal agencies– Privacy rule this April 14– Transaction rule this October– Security rule in 2 years, and also by April 14

What agencies?– VA, DOD, other federal/state health providers– Research on human subjects– Federal/state health insurance– Business associates -- receive data from others

Court Records and Privacy

OMB/DOJ/Treasury study in Jan. 2001 on bankruptcy records and privacy

SEARCH and criminal records PACER and court records as a current

major debate

IV. Total Information Awareness Surveillance after September 11 Wiretap/surveillance changes in USA-

PATRIOT Act Philosophy of “information sharing”

– Among agencies– Between federal and state/local

TIA

Does not look like “embedding privacy in federal information systems”

Contrasting trends– Embedding privacy– Increasing surveillance (data gathering) and

data sharing

Conclusion

Will need to build federal systems better for security and privacy

They work together on the level of good data practices

They can work against each other with surveillance and data sharing proposals

Not clear how the cross-currents will change practices in coming years

Contact information

Professor Peter Swire www.peterswire.net peter@peterswire.net (240) 994-4142