Washington, D.C. -- Agencies are not following key procedures to protect personal information in federal data mining systems according to a new Government Accountability Office (GAO) report requested by Senator Daniel K. Akaka (D-Hawaii), Ranking Member of the Senate Subcommittee on the Oversight of Government Management. The report is the second of two requested by Senator Akaka to examine data mining activities in the federal government and the privacy implication of those activities. The first report provided a list of all data mining activities in the federal government.

In its latest report, GAO reviewed data mining efforts at the Internal Revenue Service, the Federal Bureau of Investigation, the Small Business Administration, the Department of Agriculture Risk Management Agency, and the Department of State. Each of these activities use personal information and obtain data from another agency or a private sector source.

GAO found that while these agencies took many of the key steps to protect personal information, none followed all of the key procedures. Some of the agencies failed to follow the notice requirements in the Privacy Act, others had privacy impact assessments (PIA) that were not in compliance with Office of Management and Budget guidance, and still others failed to meet key information security requirements.

"The failure of agencies to follow key privacy and security requirements limits the ability of the public to participate in the management of their personal information and risks improper disclosure or alteration of personal data," Senator Akaka said. "Although GAO found these lapses at the five agencies it reviewed, this is a troubling trend given the number of data mining activities in the federal government that use personal information."

According to the May 2004 GAO report for Senator Akaka, federal agencies are using or plan to use 199 data mining activities of which 122 involved the use of personal information. Forty-six of the federal data mining activities involve sharing personal information between agencies and 36 programs use personal information from the private sector. The personal information used in these data mining activities includes credit reports, credit card transactions, student loan application data, bank account numbers, and taxpayer identification numbers.

"It is imperative that agencies are in compliance with federal privacy and security laws to protect personal information. In light of the high number of data mining activities in the federal government and the use of personal information, we must ensure that the federal government is following the laws set up to protect the privacy rights of all Americans. Having policies and safeguards in place will not work if agencies are not following the law," declared Senator Akaka.