GAO finds holes in privacy laws
A new report concludes that privacy laws do not fully protect personal data when it is sold by information resellers.
A new Government Accountability Office report concludes that privacy laws do not fully protect personal data when sold by information resellers. GAO suggests that Congress tighten the laws and provide civil penalties to enforce them.
The report, released today, examines how financial institutions such as banks, securities firms and credit card companies, use personal data obtained from information resellers. Agency officials assessed documents and interviewed major resellers and financial institutions for almost a year.
GAO said the country’s primary federal privacy and data security laws – the Fair Credit Reporting Act (FCRA) and the Gramm-Leach-Bliley Act (GLBA) – have limited ability to police infractions or punish resellers that flout the law.
FCRA requires companies to safeguard and restrict their use and dissemination of consumer information that they analyze when making eligibility determinations for insurance, loans, credit and mortgages. Some companies use the data to comply with the Patriot Act.
GLBA’s privacy provisions cover the sharing of nonpublic data collected by or acquired only from financial institutions.
GAO found the laws had limited jurisdiction and that the sensitive personal data resellers amassed “is often not covered by explicit statutory safeguarding requirements.”
As an example, the report states that some resellers maintain Social Security numbers in antifraud databases or household incomes in marketing databases “that they do not consider subject to FCRA’s or GLBA’s safeguarding provisions.”
The report also found that since 1972 the Federal Trade Commission, the primary agency responsible for enforcing privacy law compliance, has initiated more than 20 formal enforcement actions against resellers, including the three national credit reporting bureaus. But the FTC has no civil penalty authority under GLBA.
GAO recommended that Congress consider amending the laws to require resellers to safeguard all sensitive personal data and give the FTC civil penalty authority.