GAO recommends new agency to streamline how US government protects citizens’ data

The U.S. Government Accountability Office (GAO) on Tuesday published a report recommending that Congress create a new federal office to offer government-wide guidance and promote laws regulating how all agencies safeguard the public’s civil rights and liberties while using personal data.

The recommendation follows a GAO survey of agencies which found vastly disparate approaches to protecting citizens’ personal data. The GAO is an independent government agency that aids Congress with auditing and investigations.

Facial recognition, artificial intelligence and other new technologies have led to an exponential increase in the amount of personal data government agencies traffic in, the report said.

How agencies handle this challenge varies widely across 24 agencies studied, according to the report. Eight agencies told the GAO they do not include civil rights or civil liberties protections at all in their rules governing data policy and compliance.

While all 24 agencies told the GAO they employ an official to manage civil rights protections, just seven of 24 designated an official overseeing civil liberties safeguards.

Sixteen of the 24 agencies told GAO that they address civil rights or civil liberties safeguards in separate policies or in privacy compliance programs. 

Twelve agencies told GAO they are challenged by how complex it is to safeguard data tied to new and emerging technologies while 11 said they lack staff with adequate skills.

“Existing federal laws and guidance do not provide a comprehensive government-wide and technology agnostic approach to protecting the public's civil rights and civil liberties while using sensitive data,” the report said. 

Until the federal government develops an approach for handling personal data with civil rights and civil liberties safeguards, there is a heightened risk that agencies' will gather, share and use data in a way which violates citizens’ rights, the report said.

Congress should consider establishing a new agency with “explicit authority to make needed technical and policy choices or explicitly stating Congress's own choices,” according to the report.

The report noted that facial recognition technology can be used to stifle free speech by being deployed at protests. The possibility of facial recognition and artificial intelligence technologies misidentifying individuals is also a concern, the report said.

“Governing statutes and federal guidance do not comprehensively address the use of large volumes of data by emerging technologies, particularly those with the potential to misidentify individuals and to introduce bias against people with certain racial and ethnic backgrounds,” the report says. “The need to mitigate those types of systemic risks is not addressed.”