OMB honing privacy guidance

E-Government Act

Federal agencies should have new privacy guidance from the Office of Management and Budget by April, highlighting changes in requirements set out in the E-Government Act of 2002.

In Section 208, the act sets out the first major changes to federal privacy policies since the Privacy Act of 1974. It updates requirements for agencies to perform privacy impact assessments on every information system and program, and it codifies OMB's policy for agencies to put clearly marked privacy policies on their Web sites.

The most difficult part of OMB's task is developing guidance on machine-readable privacy policies for Web sites, said Eva Kleederman, privacy policy analyst with the Information Technology Policy Branch of OMB's Office of Information and Regulatory Affairs. She was speaking March 12 at a meeting of the Information Security and Privacy Advisory Board.

Machine-readable technologies enable organizations to post privacy policies that can be automatically read by a user's Web browser to determine whether the policy meets the user's privacy preferences.

However, the technology is still in its early stages, making it hard for OMB to come up with a policy, Kleederman said. The World Wide Web Consortium's Platform for Privacy Preferences project is doing most of the work on machine-readable technologies.

"The intention is to disseminate a policy that allows for innovation and development in the field," she said.

Several groups in academia are also looking at privacy issues in online services and OMB can likely draw on their experience, said John Sabo, business manager for security, privacy and trust initiatives at Computer Associates Inc. However, "this is a very big can of worms that has to be looked at carefully," he said.

The biggest problem is that many groups are so focused on the front end and making sure that users see the policy itself that few are looking at the back-end issues of enforcing those policies and fixing problems when the policy is not followed, he said.