United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office General Government Division author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2000-09-05 monographic deposited born digital 72 p. GA 1.13:GGD-00-191 https://www.govinfo.gov/app/details/GAOREPORTS-GGD-00-191 P0b002ee180372bd5 f:gg00191 DGPO 2010-08-12 2011-03-24 GAOREPORTS-GGD-00-191 machine generated eng fdlp REPORT GAOREPORTS-GGD-00-191 GGD-00-191 Computer security Information resources management Confidential communication Data collection Privacy law Computer networks Internet Letter Report GGD

Pursuant to a congressional request, GAO provided information on whether agencies were adhering to the Office of Management and Budget's (OMB) memorandum requiring federal agencies to post privacy policies on their Internet Websites, focusing on: (1) whether agencies have clearly labelled and easily accessed privacy policies posted on their principal Web sites; (2) whether agencies' privacy policies posted on their principal Web sites inform visitors about what information an agency collects, why the agency collects it, and how the agency will use the information; (3) how selected agencies have interpreted the requirement to post privacy policies at major entry points; and (4) whether selected agencies have posted privacy policies on Web pages where the agency collects substantial personal information or when applicable, notices that refer to the Privacy Act of 1974.<p/>GAO noted that: (1) of the 70 agencies' principal Web sites that GAO reviewed on April 14, 2000, 69 had privacy policies posted on their principal Web sites, and 1 did not; (2) in addition, of the 69 agency Web sites, 2 had privacy policies that GAO determined were not clearly labelled and easily accessed; (3) thus, 67 of the 70, agency principal Web sites GAO reviewed had privacy policies that were clearly labelled and easily accessed; (4) this appears to be considerable progress from a 1999 survey of selected federal home pages by a public interest group; (5) of the 70 agencies' principal Web sites GAO reviewed, 63 had privacy policies that addressed the automatic collection of information, and 46 of those agencies generally followed all 3 elements of the OMB memorandum's requirement for the agencies to disclose in their privacy policies what information they were automatically collecting, why they were collecting it, and how they planned to use it; (6) although OMB requires agencies to post privacy policies at major entry points to their Web sites, the privacy policy guidance does not define major entry point; (7) however, using a sample of six agencies that had a large number of Web sites or frequent contact with the public, GAO found that these agencies generally used similar criteria to determine the major entry points to their Web sites; (8) the OMB memorandum requires agencies to post privacy policies on pages where they collect substantial personal information, but the guidance does not define substantial personal information; (9) therefore, to assess OMB's requirement, GAO developed its own criteria defining personal information and reviewed the Web sites of 31 high-impact agencies for Web pages that collected any personal information; (10) GAO defined personal information to include an individual's name, e-mail address, postal address, telephone number, Social Security number, or credit card number; (11) most high-impact agencies did not post privacy policies on all pages that GAO identified as collecting personal information; and (12) in comparing the OMB memorandum and guidance to the Privacy Act and fair information principles, the OMB memorandum is narrower in scope than the Privacy Act and the fair information principles, and the act and principles also differ in some respect. https://www.govinfo.gov/content/pkg/GAOREPORTS-GGD-00-191/html/GAOREPORTS-GGD-00-191.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-GGD-00-191/pdf/GAOREPORTS-GGD-00-191.pdf GAO/GGD-00-191 https://www.govinfo.gov/app/details/GAOREPORTS-GGD-00-191 Letter Report GAO/GGD-00-191; Internet Privacy: Agencies' Efforts to Implement OMB's; Computer security Information resources management Confidential communication Data collection Privacy law Computer networks Internet Title 5 Section 552a 5 U.S.C. 552a Public Law 89-487 Public Law 93-547 Public Law 93-579 Public Law 96-511 Public Law 100-235 Public Law 100-503 Public Law 104-13