In recent years, controversies over privacy and government data banks have arisen after executive branch decisions have been made. The Commission will serve the important purposes of raising and resolving privacy questions before government plans are put in operation. Agencies need help to incorporate newly-refined concepts of individual liberty into their current procedures without unnecessary disruption and confusion. Congress and the President need help in identifying those areas in which privacy safeguards are most urgently needed and in drafting legislation specifically tailored to those problem

areas.

There are now over 100 privacy bills before Congress. Most are of unquestionable merit, but only a few can receive the kind of sustained attention to survive the legislative gauntlet. The proposed Commission would help Congress deal with those bills in two ways. First, it would obviate the necessity of enacting many of them into law by inducing agencies and industries to adopt their own fair information practices. Second, the Commission would help Congress and the President by narrowing down the range of legislative options and drafting bills designed to achieve a good "fit" between privacy values and other values in the context of often unique data-keeping activities.

It may well be that regulatory functions will eventually have to be added to the Commission's powers in order to assure that privacy, confidentiality, and due process become an integral part of governmental and private data systems. However, the Committee has decided not to address this area in the legislation pending the Commission's study.

The original version of S. 3418 would have created a Federal policy board with regulatory powers to investigate and issue cease and desist orders for violations of the Act. The Committee believes that it does not have sufficient evidence to support a case for vesting broad regulatory powers in a board charged with administrating the Act. Rather, a much more effective and less cumbersome procedure will permit an individual to seek enforcement of his rights under procedures established by each Federal agency. Ultimate enforcement of those rights and challenges to agency judgments would rest with United States District Courts. By taking this action, the Committee did not mean to preclude a future decision by the Congress to vest regulatory functions in the Commission to assure that privacy, confidentiality, and due process become an integral part of governmental and private data systems.

Public administration and privacy experts have urged à cautious approach to regulation on two grounds. First, there is much more. that privacy advocates need to know about information systems before they are in a position to make demonstrably constructive regulatory policy proposals. Second, there is substantial evidence that agencies and companies are not inherently hostile to letting individuals have more of a say in what the files say about them, provided that the changes can be made in an orderly, efficient, and economically sound manner. The work of the Secretary of Health, Education, and Welfare's Advisory Committee on Automated Data Systems, Vice President Ford's Domestic Council Committee on the Right of Privacy, and the National Academy of Sciences Project on Computer Data Banks, clearly demonstrate that the right of privacy has its advocates within the executive branch. Testimony before the Committee by

41-950 O 74-4

State officials was nearly unanimous in citing a need for higher standards and better regulation of privacy practices in their jurisdictions. Statements by private industry representatives have persuaded the Committee that a substantial measure of industry cooperation can be anticipated.

Thus, the Committee believes that it would be a mistake for the Privacy Protection Commission to begin its work in an adversarial posture, either as a regulatory or ombudsman-type agency. Those roles may come in time, but they should be the product of specific legislation and come only after efforts to achieve voluntary reforms have failed. Meanwhile, awareness that the Commission might be vested by Congress with regulatory powers at some future time should have a salutory effect on those agencies which may be tempted to ignore its suggestions, or which fail to give its model guidelines the deference due them.

LOCATING THE PRIVACY UNIT

The Committee has concluded that the best place to vest these new functions would be in an independent commission. The decision was arrived at with some reluctance, because members of the Committee share the unwillingness of many Members of Congress to create still more independent commissions. On balance, however, the commission route seemed the best solution for the abuses and potential threats which have been documented.

Having concluded that an expert staff and an independent body was needed somewhere in the Federal Government to supply information and advice and conduct investigations, the Committee considered three alternatives, as described in testimony before Committee by Dr. Christopher H. Pyle. The first was to place the unit in the General Accounting Office, modeled on the Office of Federal Elections. The second was to locate it in the Office of Management and Budget, much like the Statistical Policy Division which polices Federal questionnaires. The third alternative was to create an independent commission.

The Committee chose not to recommend vesting the investigatory and advisory functions in the GAO because it would be unwise to dilute the GAO's important auditing function with this kind of substantive policy assignment. Except in rare instances, responsibility within Congress for policy development should rest with its committees. Also, placing the investigative role in the GAO might limit the unit's ability to study multi-state and commercial information systems not dependent upon the Federal budget, which is the focus of the GAO's attention.

Similar considerations persuaded the Committee that the unit could not achieve its full potential as part of the Office of Management and Budget. Moreover, the Committee was of the opinion that the privacy protection unit should be available to congressional committees as well as executive agencies-a relationship which could not be guaranteed by making it part of the President's staff. On the other hand, by creating the unit as a commission, its reports and expertise could be available to both the GAO and OMB.

The Committee received suggestions that creation of such an independent commission should be delayed in order to develop legislation charging it with the functions of dealing with classification and freedom of information issues, as well as privacy and civil liberties.

While they pose significant problems, these other two subject areas go to different considerations of government. Creation of a privacy commission is recognition of the fact that the Congress intends to afford access to the decision-making centers of government to interests which promote the privacy of individual Americans against overly-intrusive or arbitrary government information policies. To dilute the quality of that access, as institutionalized in the structure by the Privacy Commission, would defeat the purpose of the legislation. It would reduce the viability of privacy as a matter of concern in the Federal Government. By thus denying itself the full strength of the investigative help needed to protect privacy and due process in the years ahead, Congress would dilute, in turn, the quality of protections which it and the other branches of Government might otherwise afford to those amendments in the Bill of Rights which safeguard privacy.

The administration has opposed the creation of a commission partly for reasons of cost. It is the Committee's belief, however, that the Commission is vitally needed to promote the quality of legislative and administrative oversight which will provide a privacy bulwark for Americans in the years ahead. It is expected, furthermore, that the savings it will effect in the Federal Government will far outweigh the immediate cost.

ENFORCEMENT

The Act is enforceable in the courts with the aid of Congress and the Privacy Commission.

As Elliot Richardson, former Secretary of three executive branch Departments, informed the Committee:

The requirements of fair information practice are so much in the interest of organizations, as well as of the individuals about whom records are maintained, that there should be little difficulty in agencies adhering to them and little occasion for court enforcement suits. Enforcement provisions are needed, however, to create a strong and reliable incentive to overcome the initial bureaucratic resistance to change that might otherwise prove to be a crucial obstacle to the prompt and full achievement of fair information practice. Frivolous suits, no doubt a matter of concern to some, would be promptly subject to motions for summary dismissal.

Except for the act of keeping secret data banks and improper disclosure by Commission employees, there are no criminal penalties in the Act. As introduced, the original bill contained strong criminal penalties for employees and others who violated or contributed to the violation of the Act. These penalties were deleted in Committee for two main reasons: the difficulties of effective enforcement through such criminal prosecutions and the possibility that the threat of prosecution may preclude that "Whistleblowing" and disclosure of wrongdoing to

Congress and the press which helps to promote "open government." Instead, the mandates of S. 3418 are enforceable through the civil challenges of the Attorney General or of private citizens with real or suspected grievances or claims of violations of the Act. Given the difficulties of time and resources, private enforcement through litigation is not likely to affect more than glaring violations of the Act. Much will depend on the zeal and the good faith of the Attorney General and the President in enforcing the terms of the new law.

As always, the press and communications media will contribute to the enforcement of the Act through its investigation and exposure of wrongdoing, a function eased by the requirements in S. 3418 that decisions be made on the open record by responsible officials and that precise notices be published containing the details of government policy where it affects personal privacy.

Administratively, the agencies may be called to account by Congress and the President through the monitoring and investigative activities of the Privacy Commission and its reporting of violations.

Despite these guarantees, the Committee acknowledges there is no way that the Congress, the press, or the public can assure strict administrative observance of the exercise of the power of the Federal Government pursuant to the standards of the Act. There will no doubt be some diversity of views as to what constitutes compliance within particular agencies.

Realistically, therefore, the implementation of the Act rests, finally, with the departments and agencies of the executive branch and the good faith, ethical conduct and integrity of the Federal employees who serve in them.

SOCIAL SECURITY NUMBER AND IDENTIFIERS

As introduced, S. 3418 made it unlawful for any person to require an individual to disclose or furnish his Social Security account number for any purpose in connection with any business transaction or commercial or other activity, or to refuse to extend credit or make a loan or to enter into any other business transaction or commercial relationship with an individual because of refusal to disclose or furnish the number, unless the disclosure or furnishing of the number was specifically required by Federal law.

The Committee considers this usage of the number of a government file one of the most serious manifestations of privacy concerns in the Nation. However, it received conflicting evidence about the effects of this section, particularly the inordinate costs to the Federal Government and private businesses of changing to another identifier and reprogramming computers or reindexing files.

In view of the lack of ready independent data about the probable costs and effects of such a prohibition and in view of stricter limitations on transfer of and access to government files, the section was deleted in Committee by an 8 to 1 vote. At the same time, the issue was designated as a priority issue for study by the Privacy Commission and for report to Congress of specific legislative recommendations to meet the serious public concerns reflected in the original bill. In subsection 106(b)(1)(C), the Commission is required to examine and analyze "the use of license plate numbers, Social Security numbers,

universal identifiers, and other symbols to identify individuals in data banks and to access, integrate or centralize information systems and files."

The Committee realizes that the number is a major element in the national debate over privacy since a common numerical identifier or symbol to designate and index each person is an essential feature of a national data bank, or indeed, of any information system which allows creation of an instant dossier or which permits quick retrieval of all personal information which flows through that system about an individual.

In recent years the Social Security number has been the identifier most used in common by government agencies and private organizations to improve efficiency of services, aid management functions, prevent fraud and reduce errors in identification of people.

Citizens' complaints to Congress and the findings of several expert study groups have illustrated common belief that a threat to individual privacy and confidentiality of information is posed by such practices. The concern goes both to the development of one common number to label a person throughout society and to the fact that the symbol most in demand is the Social Security number, the key to one government dossier.

Of major concern is the possibility that the number may become a means of violating civil liberties by easing the way for intelligence and surveillance uses of the number for indexing or locating the person.

In this connection, a Constitutional Rights Subcommittee report on the intelligence-gathering by the military from its own agents and the files of other Government agencies, shows that individuals were often indexed in the Army computers by their Social Security numbers. Complaints to the Constitutional Rights Subcommittee also showed that government pressures people to disclose their Social Security number on administrative, statistical, and research questionnaires of all kinds, including income tax forms, HEW questionnaires asking whether elderly people buy newspapers and wear false teeth, and many others.

Every serviceman is now identified by his Social Security number, a development of intense concern to some groups who were not able to persuade congressional committees or the Pentagon to reverse the

course.

A cross-section of such complaints appearing in the subcommittee hearings shows that people are pressured in the private sector to surrender their numbers in order to get telephones, to check out books in university libraries, to get checks cashed, to vote, to obtain drivers' licenses, to be considered for bank loans, and many other benefits, rights or privileges.

In many cases in the private sector, he is informed that the number is necessary for identification purposes, yet on its face, the Social Security card states that it is not to be used for identification purposes. This proviso was initially included in the Social Security program to prevent reliance on the card for identification because a person could acquire several of them under several identities and there frequently was no agency investigation of the information provided in order to obtain a number.