Government Has 'Failed to Construct a Coherent Political Vision' for Data Protection, Experts Say

The U.S. House of Representatives heard testimony on Wednesday from leading advocates and academics on the need for comprehensive federal data protection laws in an era where most Americans’ personal data becomes digitally accessible. 

“The United States—in the world's liberal democracies—has thus far failed to construct a coherent political vision of a digital century that advances democratic values principles in government,” Shoshana Zuboff, a professor at Harvard Business School, testified. “This failure left a void where democracy should be, leaving our citizens now to march naked into the third decade of surveillance capitalism, without the rights, laws and institutions necessary for a democratic digital future.”

Lawmakers sitting on the House Committee on House Administration, led by Chair Zoe Lofgren, D-Calif., called the need for a broad federal data protection law “long overdue.”

Speaking to the current data protection practices within public agencies was Hugh Halpern, the director of the Government Publishing Office. He discussed his office’s strategies to safeguard personally identifiable information, denoted as PII.

The GPO, which is a public entity, is tasked with printing and distributing government documents and forms. It serves as a public repository for government information, often prompting concern over what information is publicly published. Halpern’s testimony focused on his agency’s strategies to safeguard personal data of both customers and employees. 

“Robust protection of PII is critical to building trust with our customers and stakeholders,” he began. “Without that trust, we can never achieve our vision of an America informed.”

Using an internal privacy program overseen by the GPO’s Information Technology Business Unit, Halpern described four key steps the agency takes in protecting data from exploitation. 

“First, access to PII is limited to only those agency teammates and contractors with the specific need,” he explained. “Second, each business unit has someone who is responsible for the privacy function and answers to that business units leadership. Third, any GPO teammate or contractor that suspects a breach in PII security is obligated to report the problem as soon as possible. And fourth, violations will be addressed by appropriate corrective action, including termination for our teammates, debarment for contractors and criminal prosecution if appropriate.”

Included in his written testimony, Halpern explained that the GPO’s Privacy Officer coordinates the agency’s PII management and administers evaluations within its business operations to ensure personal data is safeguarded and secured. 

“We are constantly going through our policies or procedures and our actual practices to make sure that we're doing our level best,” he said. 

Ensuring systems do not retain large volumes of sensitive PII for long periods of time is one key tactic the GPO uses to protect data of both stakeholders and employees. As more federal documentation is solely digital, GPO has also focused on using automated and manual systems to scan for PII within those documents and redact any potentially sensitive information. 

The GPO also classifies different types of PII and high and low impact, so that it allocates resources to protecting more vulnerable data. High impact PII would include passport numbers, biometrics and social security numbers, whereas low impact PII include names and addresses. These classifications help inform the GPO’s redacting and protecting procedures. 

The GPO’s relative success at securing personal data comes as recent surveys document uncertainty among public agencies regarding their data management techniques. 

Halpern noted that these mitigation efforts stem from lessons learned in the wake of major government data threats, specifically the Office of Personnel Management Data Breach in 2015. The OPM data breach compromised millions of federal employees’ and contractors’ personal data sourced from background records.  

He said that all government agencies learned how vulnerable their systems are to cyberattacks, and that the GPO is no exception. 

“We've got to secure our systems. And we spend a lot of resources; we have a dedicated appropriation for that purpose,” Halpern said. “Security needs to be everybody's job every single day.”