Actions the Government Should Take to Protect Personal Information

Jim Kouri wrote an interesting commentary in the Conservative Voice, where he outlined the steps the government should take to protect personal information in the wake of the recent VA and Nuclear Weapons Agency breaches:

"The first key step is to develop a privacy impact assessment -- an analysis of how personal information is collected, stored, shared, and managed -- whenever information technology is used to process personal information. These assessments are required by the E-Government Act of 2002. They are a tool for agencies to fully consider the privacy implications of planned systems and data collections before implementation, when it may be easier to make critical adjustments."

"The second key step is to ensure that a robust information security program is in place, as required by the Federal Information Security Management Act of 2002 (FISMA). Such a program includes periodic risk assessments; security awareness training; security policies, procedures, and practices, as well as tests of their effectiveness; and procedures for addressing deficiencies and for detecting, reporting, and responding to security incidents."

For Jim Kouri's full commentary, link here.

Right now there is a lot of emphasis on the government's mishandling of personal information, but in reality the private sector has been responsible for most of the breaches incurred thus far.

According to the Privacy Rights Organization, which has monitoring these breaches, almost 82 million Americans have had their identities compromised. You can view their chronology, here.

Maybe now that the government plans to show some leadership on this issue, the private sector will follow suit.

Here is a previous post, I did on this matter:

The VA Data Breach is a Symptom of a Bigger Problem