E-Government Act of 2002

The availability of information, from personal information to public information, is made all the easier today due to technological changes in computers, digitized networks, Internet access and the creation of new information products.  The E-Government Act of 2002 (Public Law 107-347) recognized that these advances also have important ramifications for the protection of personal information contained in government records and systems.  Federal agency implementation guidance is contained in OMB Memorandum-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.  As a requirement under the Act, the CMS Privacy Office is required to implement and provide guidance for the privacy provisions of the E-Government Act of 2002 for the agency.  This includes the following:  

• Conduct privacy impact assessments (PIAs) for electronic information systems and collections and, in general, make them publicly available (see Section II below)
• Post privacy policies on agency websites used by the public (see Section III below)
• Translate privacy policies into a standardized machine-readable format (Section IV of the Act)
• Report annually to OMB on compliance with section 208 of the E-Government Act of 2002 (Section VII of the Act)

Highlighted sections of the act:

Title II, Section 208

• Ensures sufficient protections for the privacy of personal information as agencies implement citizen-centered electronic Government
• Emphasizes the importance of the "development of a comprehensive framework to protect the government’s information, operations, and assets"
• Requires agencies to conduct privacy impact assessments (PIAs) for information technology (IT) systems

CMS Privacy Impact Assessments(PIAs) are for all development or procurement of new information technology involving the collection, maintenance, or dissemination of information in identifiable form or that make substantial changes to existing information technology that manages information in identifiable form. A PIA is an analysis of how information in identifiable form is collected, stored, protected, shared, and managed. The purpose of a PIA is to demonstrate that system owners and developers have incorporated privacy protections throughout the entire life cycle of a system. The Act requires an agency to make PIAs publicly available, except when an agency in its discretion determines publication of the PIA would raise security concerns, reveal ified (i.e., national security) information, or sensitive (e.g., potentially damaging to a nation interest, law enforcement effort or competitive business interest contained in the assessment) information.

Title III

• Referred to as the Federal Information Security Management Act (FISMA), Title III of the E-Government Act provides a framework for protecting personal information and information systems from unauthorized access, use, disclosure, modification or destruction
• Seeks to ensure integrity, confidentiality and availability of personal information and add valuable government-wide management of risks to information security
• Requires agencies to perform program management, evaluation, and reporting activities, such as conducting annual self-assessments and independent assessments by the agency’s Inspector General (IG)