Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 05/17/04 issue

Serious about privacy

By Jason Miller, GCN Staff

Agencies lag in assessing the impact of systems upgrades

Agencies are making strides in e-government, but ensuring the privacy of citizens’ data has proved to be a struggle.

In reviewing agencies’ privacy impact assessments for the fiscal 2005 budget, the Office of Management and Budget found that few agencies have adequately considered how new or upgraded systems could compromise the privacy of citizens who submit personal information.

“When we talk about e-government, citizens really do want it faster, cheaper and now,” said Karen Evans, OMB administrator for e-government and IT. “But they also expect us to secure the data as well. That is balancing we need to do. That is the challenge for us.”

The E-Government Act of 2002 required agencies to conduct privacy assessments. The first round was due last September with agencies’ 2005 budget submissions. In the more than 300 assessments submitted, agencies struggled to integrate privacy efforts with their IT business cases, said an OMB official who requested anonymity.

It’s too soon to determine what effect merely writing the assessments has had on agencies’ efforts to protect privacy, but the process is more than an exercise in paperwork, officials said.

“It shouldn’t just be a check box to OMB to say ‘We’ve done it,’ ” Evans said. Agencies, she said, should think seriously about how they will use citizens’ data and incorporate that thinking as they plan new systems and upgrades.

Agencies also are supposed to take that approach to information security, incorporating it into business cases for major IT projects.

The E-Government Act’s privacy provisions were intended to make systems development a multidisciplinary effort, involving systems owners, IT specialists, and security and privacy experts, the OMB official said.

Eva Kleederman, an OMB policy analyst working on privacy issues, said at a recent conference that an assessment must be a multidisciplinary effort in which privacy officials and IT officials work closely together.

“The PIAs must bring to bear technical, legal and programmatic expertise,” she said at a discussion on privacy hosted by the Council for Excellence in Government. “All of the areas must work hand in glove in doing the PIAs.”

More news on related topics: Homeland Security, Management, IT Security