1
The Need for Government-Wide Privacy Policy

• Professor Peter P. Swire
• Ohio State University
• Consultant, Morrison Foerster, LLP
• DHS Privacy Advisory Committee
• April 6, 2004

2
Overview

• Observations from my time as Chief Counselor for
  Privacy in OMB, 1999 to early 2001
• How to build privacy in a world of information
  sharing?
• Create institutions for appropriate privacy
  protection
• Improving the agency CPO law from 12/04
• Implementing the Privacy Civil Liberties
  Oversight Board from 12/04 intelligence reform
  bill

3
Appropriate Institutions

• Much policy debate is on the substantive rules
  for privacy, such as types of notice and choice
• As the Privacy Advisory Board, you can also
  advise on the institutions that will build
  appropriate privacy into government action
• Look for specific recommendations that will
  improve the institutional response

4
Agency CPOs Can Help

• Nuala Kellys actions, including creation of this
  advisory committee, show the effects of an agency
  CPO office
• 12/04 appropriations bill required a CPO for each
  federal agency
• A positive development, especially for agencies
  with substantial privacy issues

5
Rep. Davis Criticism of CPOs

• Chairman Tom Davis has criticized the law, and
  stated that the CPO functions should be placed
  under the CIO
• He says this will promote unified
  responsibility/accountability over information
  flows
• Based on my government experience, I strongly
  disagree with having CIOs supervise these issues

6
CIOs Not the Right Answer

• 1999 process for federal Web privacy policies
• We included one CIO on the committee, and her
  contributions were very helpful
• Overwhelmingly, we faced policy issues rather
  than technical issues
• What to say in notices
• Which types of sites should have notices
• Many CIOs do not feel comfortable or expert at
  making those policy choices they look for
  leadership from policy experts

7
Flaws in the CPO Statute

• Some bad drafting, and too large an emphasis on
  expensive outside audits of agency privacy
  activities
• More importantly, the law uses a silo approach,
  with privacy policy only agency-by-agency
• Thats a very bad match with modern information
  sharing, which emphasizes multi-agency,
  multi-function systems
• How produce good government-wide policy?

8
White House Privacy Policy

• Intelligence Reform bill established 5 person
  Privacy and Civil Liberties Board
• In the Executive Office of the President, and can
  thus address multi-agency issues
• Limited to intelligence-related issues, so not a
  full answer to the need for coordination of
  privacy policy across agencies

9
Privacy Civil Liberties Board

• Board was an explicit part of the legislative
  package
• Get new info-sharing for intelligence
• Have the Board as effective watchdog
• Today, no appointees or staff for the Board
• My proposal to you no contracts for the
  information sharing systems until the Board is in
  place

10
Conclusions

• The Advisory Committee should consider what
  institutions will improve privacy policy
• Agency CPOs are good, but we should not make
  agency-by-agency privacy policy when the
  information systems are multi-agency
• Dont make the mistake that privacy is a
  technical issue that should be managed only by
  CIOs
• Do insist that the Privacy Civil Liberties
  Board be implemented, as a pre-requisite to
  information sharing
• Build government-wide privacy policy, to achieve
  national security as well as privacy and civil
  liberties