GAO finds holes in privacy laws

A new Government Accountability Office report concludes that privacy laws do not fully protect personal data when sold by information resellers. GAO suggests that Congress tighten the laws and provide civil penalties to enforce them.

The report, released today, examines how financial institutions such as banks, securities firms and credit card companies, use personal data obtained from information resellers. Agency officials assessed documents and interviewed major resellers and financial institutions for almost a year.

GAO said the country’s primary federal privacy and data security laws – the Fair Credit Reporting Act (FCRA) and the Gramm-Leach-Bliley Act (GLBA) – have limited ability to police infractions or punish resellers that flout the law.

FCRA requires companies to safeguard and restrict their use and dissemination of consumer information that they analyze when making eligibility determinations for insurance, loans, credit and mortgages. Some companies use the data to comply with the Patriot Act.

GLBA’s privacy provisions cover the sharing of nonpublic data collected by or acquired only from financial institutions.

GAO found the laws had limited jurisdiction and that the sensitive personal data resellers amassed “is often not covered by explicit statutory safeguarding requirements.”

As an example, the report states that some resellers maintain Social Security numbers in antifraud databases or household incomes in marketing databases “that they do not consider subject to FCRA’s or GLBA’s safeguarding provisions.”

The report also found that since 1972 the Federal Trade Commission, the primary agency responsible for enforcing privacy law compliance, has initiated more than 20 formal enforcement actions against resellers, including the three national credit reporting bureaus. But the FTC has no civil penalty authority under GLBA.

GAO recommended that Congress consider amending the laws to require resellers to safeguard all sensitive personal data and give the FTC civil penalty authority.

About the Author

David Hubler is the former print managing editor for GCN and senior editor for Washington Technology. He is freelance writer living in Annandale, Va.


  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.