Privacy, IT officers come together to create policy

The Bush administration’s effort to improve how agencies protect personally identifiable information and report breaches has pushed federal privacy and information technology officers to work together, according to federal privacy and data security executives.A May 22 Office of Management and Budget memorandum expanded on the 2002 Federal Information Security Management Act and the 1974 Privacy Act to require agencies to develop and implement a breach notification policy in 120 days. The directive also requires agencies to review the amount of personal data they store and work to decrease it. Working to draft a plan has brought privacy and IT officers together, said Toby Levin, senior adviser to the Homeland Security Department’s Privacy Office. The policy was due last week.“We have found the efforts to implement it a good vehicle for meshing [the IT and privacy office’s] roles together,” she said. “I think they quickly saw that most IT incidents involve [personally identifiable information], so there is a natural synergy between our programs and missions.”Agencies must encrypt sensitive data on mobile devices by using only National Institute of Standards and Technology standards, use two-factor identification to control remote access, block remote devices from access after 30 minutes without activity, and log and verify all data extracts. Also, employees with access to personally identifiable information must sign a statement at least once a year stating that they understand their responsibilities.OMB also requires that all data breaches be reported to the U.S. Computer Emergency Readiness Team within an hour of discovery, but it is up to the agency to notify affected individuals or the media.Concerns about how to protect employees’ private data have underscored the importance and challenges associated with the relationship between chief privacy and chief information officers, said Marc Groman, the Federal Trade Commission’s chief privacy officer. Groman and Levin spoke on the same panel Sept 25 at an American Society of Access Professionals conference on privacy issues.“I think there is possibly no more important relationship than the relationship between the chief privacy officer and the chief information officer,” Groman said.