Agencies’ efforts to protect personal information vary widely

On the one-year anniversary of the E-Government Act, some federal agencies remain ill-prepared to implement privacy provisions required by the law, analysts say.

The law, signed by President Bush on Dec. 17, 2002, requires agencies to ensure that they adequately protect personal information submitted over the Internet or stored on computers. Under the law, agencies must review their privacy measures and share the results in reports to the Office of Management and Budget and Congress.

Agencies submitted privacy assessments along with their fiscal 2005 budget requests, and also included privacy reviews in e-government reports due to OMB on Monday. But agencies are "all over the map" on their ability to fully comply with privacy guidelines in the E-Government Act, said Ari Schwartz, associate director of the Center for Democracy and Technology, a Washington-based advocacy group.

The center sponsored a workshop on privacy assessments in late November that drew a crowd of about 150 federal information technology specialists, Schwartz said. IT experts at some agencies seemed ahead of the game on privacy protections, he said, but others appeared to have done "no work whatsoever" to comply with the requirements in the E-Government Act.

Still others were at least interested in "doing it right," but were confused by the law, Schwartz said. David McClure, vice president of e-government at the Council for Excellence in Government, said he has also noticed that many agencies are either unaware of, or confused by, the law's privacy provisions.

OMB is partly to blame, for taking several months to issue final guidelines on complying with the act's privacy requirements, Schwartz and McClure said. The e-government law took effect on April 17, 2003, but OMB did not publish the final guidelines until late September.

"Guidance should have come out about the same time the law went into effect," Schwartz said. OMB is "understaffed on these issues," making it understandable that the guidelines took several months, he added.

But the belated guidelines are not really an adequate excuse for agencies that remain unprepared to comply with the law, Schwartz said. "Agencies should still be responsible," he said. "The fact that there are some agencies that are prepared shows agencies that cared about privacy are able to meet the guidelines."

An OMB official declined to discuss the contents of the privacy reports agencies submitted, but said all agencies handed them in on time. Some are clearly ahead of others on privacy protections, she said. Those that are ahead tend to be agencies that handle higher volumes of personal data, she added.

Even though OMB did not issue final privacy guidelines until late September, the instructions circulated earlier in draft form, she said. "Agencies knew that this was happening," the official added. "It didn't come out of the blue."

OMB will publish summaries of agencies' privacy assessments and make other sections of the e-government status reports public around the time that the White House releases President Bush's 2005 budget request, she said.

Privacy reports are an important component of the E-Government Act, McClure said. A survey conducted by the council last winter found that the public remains wary of divulging personal information over the Internet. This skepticism poses a challenge for agencies looking to boost use of their Web sites, he said.

By reporting on the steps they take to protect privacy, agencies may be able to assuage citizens' concerns, McClure said. The E-Government Act requires agencies to make the privacy reports they prepare for OMB and lawmakers available to the public. It would behoove agencies to not only make these reports available, but make them as accessible and clear to the layman as possible, McClure said.

Even if agencies are not actually enhancing their privacy protections, people will feel more comfortable knowing that "there are processes in place to examine what [information] is being collected and for what purposes," McClure said. People will also want to know if agencies are sharing their personal information with anyone, he added.