Protecting Privacy When Federal Agencies Use Commercially Available Information
By OIRA Administrator Richard L. Revesz
As Federal agencies increasingly use artificial intelligence (AI) in executing their various missions, how they collect, use, and maintain the information that powers that technology merits renewed attention. Along with the potential benefits of using such technology, there are potential risks. Executive Order 14110, Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, recognized “privacy risks potentially exacerbated by AI—including by AI’s facilitation of the collection or use of information about individuals” as one of these potential risks, and it tasked the Office of Management and Budget (OMB) with taking certain steps to mitigate them.
To better address these risks, OMB’s Office of Information and Regulatory Affairs (OIRA) is seeking input from the public on issues related to Federal agency collection, processing, maintenance, use, sharing, dissemination, and disposition of commercially available information (CAI) containing personally identifiable information (PII).
This Request For Information (RFI) is the latest in a series of efforts that OMB has undertaken in response to Executive Order 14110 to address agency management of risks associated with AI, including privacy risks. These efforts include an RFI on privacy impact assessments; issuance of OMB Memorandum M-24-10, Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence; and issuance of OMB Memorandum M-24-18, Advancing the Responsible Acquisition of Artificial Intelligence in Government.
Procuring CAI containing PII from third parties, such as data brokers, for use with AI and for other purposes raises privacy concerns stemming from a lack of transparency with respect to the collection and processing of high volumes of potentially sensitive information. Executive Order 14110 defined CAI as “any information or data about an individual or group of individuals, including an individual’s or group of individuals’ device or location, that is made available or obtainable and sold, leased, or licensed to the general public or to governmental or non-governmental entities.”
The participants at an August 2023 White House roundtable on data broker practices “explained how data brokers purchase or acquire large volumes of exceedingly detailed data about people including geolocation and health information—often without their knowledge or consent.” In addition, participants noted that “advancements in artificial intelligence . . . have rapidly expanded data brokers’ abilities to draw inferences about individuals’ lifestyles, desires, and weaknesses, and are incentivizing rampant data collection to fuel their development.”
The handling of PII by Federal agencies is already governed by a legal and policy framework that emphasizes providing transparency about agency practices, minimizing the PII they handle, involving individuals in the collection of their PII, giving those individuals opportunities to access and amend it, and ensuring the quality and integrity of the information. However, the privacy concerns associated with CAI containing PII raise questions about whether agencies need to take additional steps to apply the framework of privacy law and policy to mitigate the risks exacerbated by new technology.
As OMB noted in OMB Circular A-130, Managing Information as a Strategic Resource, “[A]s technology evolves, it is important that agencies manage information systems in a way that addresses and mitigates security and privacy risks associated with new information technologies and new information processing capabilities.”
We welcome your review and comment on this RFI through the Federal Register and the Regulations.gov website. Your input and insights on agency use of CAI containing PII will help OMB to evaluate the risks of these activities and consider the need for additional steps to help agencies maintain the public’s trust through strong privacy safeguards.
