GAO’s Web 2.0 Proposals Could Stifle Digital Innovation

A new Government Accountability Office report finds that existing laws and regulations don't adequately reflect privacy needs in the changing technology landscape. The report highlights specifically that agencies using Web 2.0 and data mining tools need to find ways to protect private information.

The key findings address:

• Applying privacy protections consistently to all federal collection and use of personal information. The Privacy Act’s protections only apply to personal information when it is considered part of a “system of records” as defined by the act. However, agencies routinely access such information in ways that may not fall under this definition.
• Ensuring that use of personally identifiable information is limited to a stated purpose. Current law and guidance impose only modest requirements for describing the purposes for collecting personal information and how it will be used. This could allow for unnecessarily broad ranges of uses of the information.
• Establishing effective mechanisms for informing the public about privacy protections. Agencies are required to provide notices in the Federal Register of information collected, categories of individuals about whom information is collected, and the intended use of the information, among other things. However, concerns have been raised whether this is an effective mechanism for informing the public.

Agencies using Web 2.0 and data mining tools are instructed to take the following steps:

• Assess the privacy implications of a planned information system or data collection prior to implementation;
• Ensure the implementation of a robust information security program; and
• Limit the collection of personal information, the time it is retained, and who has access to it, as well as implementing encryption.