U.S. Postal Service: Improved Oversight Needed to Protect Privacy of Address Changes GAO/GGD-96-119) Part 1
U.S. Postal Service: Improved Oversight Needed to Protect Privacy of Address Changes GAO/GGD-96-119) Part 1
One of many documents that validate this startup
Pursuant to a congressional request, GAO examined the U.S. Postal
Service's oversight of the National Change of Address (NCOA) program,
focusing on: (1) how the Postal Service collects, disseminates, and uses
NCOA data; and (2) whether the Postal Service adequately oversees the
release of NCOA data in accordance with privacy laws.
GAO found that: (1) the Postal Service uses 24 licensees to collect and
disseminate address-correction information; (2) the licensees provide
address services to other private firms and organizations in accordance
with standard licensing agreements; (3) the Postal Service has been
unable to prevent, detect, or correct potential breaches in the
licensing agreement; (4) the Postal Service audits the software that
licensees use to match their mailing lists with NCOA files, reviews NCOA
advertisements that licensees propose to use, and investigates
complaints concerning the NCOA program; (5) Postal Service officials
believe that the NCOA licensing agreement helps to ensure that federal
privacy guarantees are not compromised through the operation of the NCOA
program; (6) the Postal Service has not expressed a clear and consistent
position regarding the use of NCOA data to create new-movers lists; (7)
the Postal Service failed to terminate the license of any licensee that
failed successive process audits in 1992; (8) the NCOA program office is
not terminating licensees that fail to maintain address-matching
software or enforcing the performance standards prescribed in the
license agreements; and (9) the Postal Service needs to enforce these
limitations to ensure that the use of NCOA-derived data is limited to
the purpose for which it was intended.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: GGD-96-119
TITLE: U.S. Postal Service: Improved Oversight Needed to Protect
Privacy of Address Changes
DATE: 08/13/96
SUBJECT: Postal service
Postal law
Privacy law
Proprietary data
Mailing lists
Information disclosure
Data collection operations
Government sponsored enterprises
Mail delivery problems
IDENTIFIER: USPS National Change of Address Program
USPS Computerized Forwarding System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved. Major **
** divisions and subdivisions of the text, such as Chapters, **
** Sections, and Appendixes, are identified by double and **
** single lines. The numbers on the right end of these lines **
** indicate the position of each of the subsections in the **
** document outline. These numbers do NOT correspond with the **
** page numbers of the printed product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************
Cover
================================================================ COVER
Report to Congressional Requesters
August 1996
U.S. POSTAL SERVICE - IMPROVED
OVERSIGHT NEEDED TO PROTECT
PRIVACY OF ADDRESS CHANGES
GAO/GGD-96-119
U.S. Postal Service's NCOA Program
(240157)
Abbreviations
=============================================================== ABBREV
GAO - General Accounting Office
NCOA - National Change of Address
Letter
=============================================================== LETTER
B-258950
August 13, 1996
The Honorable John M. McHugh
Chairman, Subcommittee on the Postal Service
Committee on Government Reform and Oversight
House of Representatives
The Honorable Gary A. Condit
House of Representatives
This report responds to your request that we examine the U.S. Postal
Service's oversight of the National Change of Address (NCOA) program.
The Postal Service's ability to quickly and accurately correct
customers' addresses is key to effective mail delivery; however, it
has also raised concerns about potential misuse of NCOA data. Our
report objectives were to determine (1) how the Postal Service
collects, disseminates, and uses NCOA data and (2) whether the Postal
Service adequately oversees the release of NCOA data in accordance
with privacy provisions of relevant federal laws.
RESULTS IN BRIEF
------------------------------------------------------------ Letter :1
Through the NCOA program, the Postal Service collects and widely
disseminates change-of-address information reported by postal
customers. To do this, the Postal Service uses 24 licensees,
primarily mail advertising and credit information firms, to provide
the address-correction service. The licensees pay the Postal Service
to receive and use the electronic master NCOA file and Postal
Service-approved computer software that is used for updating mailing
lists. The licensees are to use NCOA data and provide address
services to other private firms and organizations in accordance with
the standards and procedures specified in the licensing agreement.
The Postal Service's oversight of NCOA program licensees and controls
over the release of NCOA data have not been adequate to prevent,
detect, and correct potential breaches of the licensing agreement and
potential violations of federal privacy law in a timely manner.
Specifically, we identified weaknesses in the Postal Service's
licensee oversight activities for (1) "seeding"\1 NCOA files to
detect unauthorized uses of addresses, (2) auditing the performance
of software that licensees use to match their mailing lists with NCOA
files, (3) reviewing NCOA advertisements that licensees propose to
use, and (4) investigating complaints about the NCOA program.
Postal Service officials said they believe that neither the Privacy
Act nor the Postal Reorganization Act of 1970 limit licensees' use of
address data that have been properly updated or corrected through the
NCOA service. In our view, use of NCOA-linked data by a licensee to
create a new-movers list would not be consistent with the limitations
imposed by the Privacy Act. The Postal Service had not explained in
the acknowledgment form--to be signed by customers of licensees--that
NCOA data are not to be used to create or maintain new-movers lists.
Unless the Postal Service implements and attempts to enforce these
limitations, it cannot be assured that the use of NCOA-derived data
is limited to the purpose for which it was gathered.
--------------------
\1 Seeding is a commonly used practice in the mailing industry to
control proprietary information. A "seed" record planted in a file
can be used to detect the inappropriate release of a record or file.
BACKGROUND
------------------------------------------------------------ Letter :2
Automating mail sorting with state-of-the-art technology is at the
core of Postal Service initiatives to provide efficient, economically
priced mail service. Mail addressed accurately and in the Postal
Service's standardized format is more compatible with these automated
processes. However, the Manager of Address Management at Postal
Service headquarters said that the single greatest barrier to the
Postal Service's effort to automate mail processing is "the poor
quality of the address on the mail piece."
Mail addressed incorrectly or inadequately cannot be processed and
delivered as quickly and efficiently as properly addressed mail.
When mail is misaddressed, the Postal Service incurs added costs for
sorting, transporting, delivering, and, in some cases, disposing of
that mail. Of the 177 billion pieces of mail the Postal Service
handled in 1994, nearly 5 billion pieces were addressed incorrectly.
The Postal Service estimated that it incurred a cost of about $1.5
billion a year in compensating for poor address quality. However,
the Postal Service had no information on the portion of this cost
associated with a change of address.
Because accurate addressing is essential for efficient mail service,
the Postal Service and its predecessor, the Post Office Department,
have provided address-correction services since 1924. These
services, among other things, assist mailers in obtaining and using
accurate, properly formatted addresses that are automation
compatible.
NATIONAL CUSTOMER SUPPORT
CENTER ADMINISTERS NCOA
PROGRAM
---------------------------------------------------------- Letter :2.1
In 1986, the Postal Service implemented the NCOA program, which
extends the Postal Service's use of mail forwarding information to
update business mailers' address lists.\2 The NCOA program is
administered by the NCOA program office within the National Customer
Support Center, which is located in Memphis, TN. The Center's
Director reports to the Manager, Address Management, under the Vice
President for Operations Support. Before introducing this program,
the Postal Service notified business mailers of changed addresses
after their mail had been sent out and forwarded, returned, or
discarded. The NCOA program, however, confronts this problem before
the mail piece enters the mail stream by using contractors licensed
by the Postal Service to provide business mailers updated
change-of-address information.
--------------------
\2 The NCOA program is one of several address-correction services
offered by the Postal Service to help ensure that accurate addresses
are available to and used by mailers.
PRIVACY LAWS RESTRICT POSTAL
SERVICE USE OF NAME AND
ADDRESS DATA
---------------------------------------------------------- Letter :2.2
The Postal Service's authority to disclose address information about
its customers is limited by certain privacy guarantees in two federal
laws. Section 412 of the Postal Reorganization Act of 1970 (39
U.S.C. 412) restricts the Service's release of certain names or
addresses as follows:
"Except as specifically provided by law, no officer or employee
of the Postal Service shall make available to the public by any
means or for any purpose any mailing or other list of names or
addresses (past or present) of postal patrons or other persons."
Subsequently, in 1974, Congress passed the Privacy Act (5 U.S.C.
552a) to more broadly protect individuals from the unauthorized use
of records that federal agencies maintain about them and to give them
right of access to those records. Subsection (n) of this act also
applies to address correction but, in contrast to related provisions
of the 1970 Act, restricts certain uses of a name and address as
follows: "An individual's name and address may not be sold or rented
by an agency unless such action is specifically authorized by law."
In 1991 and again in 1992, Congress held hearings addressing the
privacy implications of the Postal Service's address-correction
services.\3 These hearings focused on public concerns about the
increasing volume of mail generated through the use of mailing lists,
and raised questions about (1) the legality of certain Postal Service
address-correction processes and (2) the adequacy of Postal Service
oversight of the NCOA program to ensure compliance with the privacy
provisions in federal law. A bill (H.R. 434) introduced in January
1995 would, among other provisions, allow any person notifying the
Postal Service of a change of address to deny it permission to
disclose such information.
--------------------
\3 Hearings before the Subcommittee on Postal Operations and
Services, House Committee on Post Office and Civil Service (October
10, 1991), and before the Subcommittee on Government Information,
Justice, and Agriculture, House Committee on Government Operations
(May 14, 1992).
OBJECTIVES, SCOPE, AND
METHODOLOGY
------------------------------------------------------------ Letter :3
The objectives of our review were to determine (1) how the Postal
Service collects, disseminates, and uses NCOA program data to provide
mailers with accurate change-of-address information and (2) whether
the Postal Service adequately oversees the release of NCOA data in
accordance with privacy provisions of relevant federal laws. Because
we were asked to review only the NCOA program, we did not review
other Postal Service address-correction programs.
To meet our first objective, we interviewed Postal Service
headquarters officials in the Office of Address Management Systems,
Operations Support Division, and officials and technical support
staff at the National Customer Support Center and the NCOA program
office in Memphis, TN. We also reviewed relevant records provided by
these officials on the NCOA data gathering and dissemination process,
including some correspondence from licensees on how they used NCOA
data.
To meet our second objective, we obtained and reviewed federal laws,
legislative histories, congressional hearings, and other pertinent
literature on privacy issues to better understand Congress' concerns
about U.S. citizens' privacy rights and their relation to the name
and address records the Postal Service uses to provide
address-correction services. As we did in responding to objective
one, we met with Postal Service representatives in Memphis to discuss
and document how NCOA program oversight is maintained and what
controls the Postal Service uses to ensure that the release of NCOA
address information complies with applicable statutory constraints.
Additionally, we reviewed files and other records of Postal Service
NCOA program oversight activities; however, finding them to be
incomplete, we relied more on information obtained from our
interviews of Postal Service officials. Finally, we obtained written
explanations from the Postal Service's Chief Counsel for Ethics and
Information Law regarding privacy issues pertinent to our second
objective.
To meet both objectives, we met with representatives of TRW Target
Marketing Services, located in Allen, TX--which in 1994 was one of
the NCOA program's largest licensees in terms of volume of client
address records processed. In this meeting, we obtained information
and company views on how the NCOA program works, as well as on the
Postal Service's oversight of the program.
On May 30, 1996, the Postmaster General provided written comments on
a draft of this report, which are discussed beginning at page 20 and
reprinted as appendix II. Our review was conducted from August 1994
through October 1995 in accordance with generally accepted government
auditing standards.
HOW THE NCOA PROGRAM IS USED TO
COLLECT AND DISSEMINATE NEW
ADDRESS DATA
------------------------------------------------------------ Letter :4
Since its implementation, the NCOA program has effectively reduced
the volume of misaddressed mail processed through the Postal
Service's Computerized Forwarding System,\4 according to the program
manager. Before 1986, the volume of such mail was increasing
annually, along with the overall volume of all mail. However, during
the period in which the NCOA program has been operational, the volume
of mail processed through the forwarding system has remained
relatively constant, averaging about 2.4 billion pieces annually,
while the total mail volume has continued to increase--by about 27
percent from late 1985 to 1995.
The address-correction process begins when a postal customer submits
a signed Change of Address Order (Postal Service Form 3575) to a
local post office to have mail forwarded. (See app. I for a copy of
the July 1995 form). Post office employees are to verify that the
form is complete and then pass it on to one of 212 Computerized
Forwarding System units located in the United States and Puerto Rico.
These units are to convert the data to electronic form for use in the
mail forwarding process and in the NCOA program. Using the completed
change-of-address form, the Postal Service follows a policy of
forwarding first-class mail to new addresses for 1 year. Although
filing a change-of-address order is voluntary, customers who want
their mail forwarded after moving must submit the form and must
accept that the Postal Service will further disseminate the new
addresses to commercial mailing list holders through the NCOA
program.
Each workday, the National Customer Support Center collects
change-of-address data from the forwarding units. These data are
then to be standardized into the Postal Service's "preferred address
with ZIP\5 + 4 code" format and used to update a centralized database
of change of address records--i.e., the master NCOA file. This file
contains more than 110 million permanent change-of-address records.
It covers the most recent 36-month period based on the move dates
that customers report. Newly reported moves are to be added and
those dated over 36 months are to be deleted biweekly. The computer
programs used to maintain the master NCOA file and all data released
from it are to be controlled by the National Customer Support Center.
--------------------
\4 This system is used to forward mail that cannot be delivered as
addressed.
\5 Zoning Improvement Plan.
LICENSEES ARE TO RECEIVE NEW
ADDRESS DATA BIWEEKLY
---------------------------------------------------------- Letter :4.1
The Postal Service has licensed, for a fee paid by the licensees, the
master NCOA file to a limited number of companies, which in turn use
the file to correct addresses on their mailing lists and sell
address-correction services to other businesses. As of December
1995, 24 companies were licensed, including some of the nation's
largest firms in the direct marketing and credit reporting
industries, such as Donnelly Marketing, Inc., a leading direct mail
marketing company; TRW Target Marketing Services, which operates
primarily in the direct marketing industry; and Metromail
Corporation, which primarily provides address services for direct
marketing purposes.\6 In 1995, 22 companies each paid $80,000, and
the remaining 2 each paid $120,000, to the Postal Service under the
licensing agreements.
Each licensee is responsible for maintaining a complete and current
NCOA file. Every 2 weeks, the NCOA program office within the
National Customer Support Center is to provide licensees with a copy
of the NCOA file update tapes, which on average contain about 1.1 to
1.5 million change-of-address records. Licensees are to use these
tapes, which include address deletions, additions, and changes, to
update the NCOA files they maintain. Licensees then use the NCOA
files and address-matching logic designed into their computer
software to update addresses on their customers' mailing lists as
well as their own mailing lists.
Since all records in the NCOA file are to be in the Postal Service's
standardized address format, licensees must convert customers'
mailing lists, to the extent possible, into the same standardized
address format before any matching occurs. This initial step may
also identify and correct incomplete or inaccurate addresses on the
licensee's list. The resulting standardized lists are to be matched
with the NCOA file by the licensees using address-matching computer
software tested and approved by the NCOA program office, as required
by the Postal Service. Each licensee's software must meet the
performance standards specified in the licensing agreement, and only
approved software may be used to provide NCOA services.
Under these procedures and conditions, each licensee is to update an
address on a mailing list only when a name and address on that list
matches a name and old address in the NCOA file. Licensees are to
provide their customers the original address as it was presented on
each customer's list; the standardized address, including the correct
ZIP + 4 code; and a new address where a match was found. When a
match is found and a new address is disclosed, licensees may also
disclose other information, such as whether the address is for a
family, individual, or business and when the move became effective.
--------------------
\6 Direct marketing refers to the use of mail services to target
advertising materials to specific segments of the American
population. Since the mid-1980s, direct marketing has flourished
primarily because of the ability to use large-scale, integrated,
automated files to combine various demographic characteristics of the
consuming public--such as age, income, neighborhood, etc., for
increasing the return on advertising and marketing investments.
THE POSTAL SERVICE RESTRICTS
LICENSEES' USE OF NAME AND
ADDRESS DATA
---------------------------------------------------------- Letter :4.2
Postal Service officials said they believe that the design and
implementation of the NCOA program fully complies with applicable
federal privacy laws. Postal Service officials said that they
analyzed federal privacy laws and that releasing the NCOA file to
licensees to provide address-correction services and licensees'
subsequent release of new addresses of postal customers--whose names
and old addresses are already on a licensee's or its customer's
lists--are lawful when done in accordance with the provisions and
conditions of the licensing agreement. In a July 12, 1995, letter to
us, the Postal Service's Chief Counsel for Ethics and Information Law
said that disclosure of the NCOA file to the licensee is supported by
subsection (m)(1) of the Privacy Act.\7 He said that because
licensees act as representatives of the Postal Service when
performing the list correction function, disclosure to the licensees
does not constitute disclosure to the "public" within the meaning of
section 412 of the Postal Reorganization Act of 1970. Furthermore,
the Chief Counsel said that release of the information by a licensee
to its customer for the limited purpose of list correction is
permissible routine use.
Postal Service officials emphasized that the Postal Service does not
provide names to be included on any lists, whether held by its
licensees or by their customers. Postal Service officials said that
the information provided to licensees, and by licensees to their
customers, under the NCOA program is limited to the new addresses of
persons whose names and addresses are already on the licensee's or
the customer's list. Thus, Postal Service officials said they
believe that the NCOA program does not violate the prohibition in the
Privacy Act against the unauthorized disclosure of an individual's
"name and address."
--------------------
\7 Under 5 U.S.C. 552a(m)(1), contractors and their employees are
treated as agency employees for the purpose of assessing criminal
penalties for unauthorized disclosures as set forth in that section.
PRIVACY PROVISIONS OF THE
LICENSING AGREEMENT
---------------------------------------------------------- Letter :4.3
Postal Service officials said they believe that the NCOA licensing
agreement, with its conditions and performance provisions, helps to
ensure that federal privacy guarantees are not compromised through
the operation of the NCOA program. The licensing agreement requires
licensees to provide mailing-list correction services according to
standards set by the Postal Service, and specifies licensees'
obligations under the Privacy Act.
Postal Service officials said they believe that the prescribed
standards for licensee performance provide the Postal Service a basis
for monitoring performance to ensure the quality of the service
provided and compliance with the privacy restrictions of federal law.
For example, the agreement sets minimum standards for the performance
of the computer software that licensees use to provide the NCOA
service. It also establishes requirements for maintaining a current
NCOA file, for timeliness of the service, and for safeguarding the
NCOA file and the lists that customers submit for the
address-correction service.
The licensing agreement specifies the Privacy Act restrictions that
Postal Service officials said they believe apply to the release and
use of NCOA address information. The agreement states that the NCOA
file is a system of records, as defined in subsection (a)(5) of the
Privacy Act, and is subject to its provisions. It states that if, at
any time during the term of the agreement, the licensee fails to
comply with or fulfill any of the terms or conditions of the
agreement, the Postal Service may, at its discretion, terminate the
agreement.
The agreement prohibits licensees from disclosing or using the
information in the NCOA file for any purpose other than correcting
addresses on preexisting lists. Licensees are required to institute
procedural and physical safeguards to ensure the security of the
information in the NCOA file, as well as to maintain an accurate
accounting of all disclosures of information in the file in
accordance with subsection (c) of the Privacy Act. The agreement
points out that the Postal Service may conduct impromptu audits to
evaluate the potential for unauthorized access, disclosure, or misuse
of the NCOA file, as well as to ensure that all performance
requirements are met. The agreement also points out that the
licensee and its employees are subject to the criminal penalties set
out in subsection (i)(1) of the Privacy Act for any willful
disclosure prohibited by the act.
LICENSING AGREEMENT MODIFIED
TO STRENGTHEN CONTROL AND
OVERSIGHT
---------------------------------------------------------- Letter :4.4
After the congressional hearings held in 1991 and 1992, mentioned
previously, the Postal Service modified, in May 1994, certain
provisions of the licensing agreement.\8 The Service took steps to
clarify the licensing agreement restrictions on the use of NCOA data,
strengthen its oversight of licensee performance, and provided for
suspending any licensee who fails to comply with the terms and
conditions of the agreement.
--------------------
\8 The Postal Service and its licensees refer to this change to the
agreement as "Modification 75."
PROHIBITION ON USE OF
NCOA SERVICES
-------------------------------------------------------- Letter :4.4.1
As modified, the agreement specifies certain practices that are
prohibited, such as the creation of new-movers lists. The use of
new-movers lists is reportedly an important and common practice in
the mail marketing industry. New-movers lists can be created by
updating an existing list of names and addresses using NCOA data or
other sources of current-address data. Individuals on the existing
list whose addresses have changed are considered to have "moved," and
the names and new addresses of these individuals can be used to
create or supplement a new-movers list. These lists can be used by
list holders for their marketing purposes--e.g., to offer products or
services to anyone who moves into a new home, or they can be sold to
others.
The use of NCOA services to create or maintain new-movers lists has
been controversial and, as explained hereafter, the Postal Service
has not expressed a clear and consistent position regarding
prohibitions on using NCOA data to create such lists. During
congressional hearings in May 1992 on the NCOA program and privacy
issues, evidence was presented that some licensees were producing and
selling new-movers lists using NCOA-linked data. At that time, the
Postal Service Director, Office of Address Management Systems,\9
testified that the protections afforded individuals by federal
privacy law do not extend to proprietary lists that have been
appropriately updated by the NCOA service and that the Postal Service
was not responsible for how such lists are used. The Director said,
in part, that
"Licensees, as well as their customers, hold mailing lists which
are their intellectual property. We believe that by availing
themselves of the NCOA and other services, those lists are
legally and properly updated and that our management of these
services fully comports with all of the laws which you have
listed, as well as any others which may exist.
"The simple fact of the matter is that once a list holder has
acquired a corrected address through address correction service,
we do not believe it is the intent of the law, nor do we believe
it is the role of the Postal Service to attempt to police how
the private sector uses their own intellectual property for
their business reasons."
This position, however, is contrary to the conclusion reached by the
Committee on Government Operations in its November 24, 1992, report
(House Report 102-1067) following the 1992 congressional hearings.
The Committee found that the NCOA program contravenes section 412 of
the Postal Reorganization Act and subsection (n) of the Privacy Act.
Among its other reasons for this conclusion, the Committee focused on
the creation and sale of NCOA-linked new-mover lists by licensees as
violating the restrictions imposed by the Privacy Act.
The Postal Service later added a prohibition in the licensing
agreement on the creation of new-movers lists. Specifically, the
licensing agreement was modified in May 1994 to read, in part, as
follows:
"The sole purpose of this license and of the standardized name
and address matching services is to provide a mailing list
correction service for lists that will be used for the
preparation of mailings. Information obtained or derived from
the NCOA file or service shall NOT be used by the Licensee,
either on its own behalf or knowingly for its customers, for the
purpose of creating or maintaining "new-movers" lists.
"As with the NCOA file itself, no proprietary Licensee list,
which contains both old and corresponding new address records,
if it is updated by use of the NCOA file, shall be rented or
sold or otherwise provided, in whole or in part, to Licensee
customers or anyone else."
Postal Service officials said that the above prohibition was not new
but, rather, that the above language clarified restrictions that were
already stated in broader terms in the original licensing agreement.
However, the statement that the prohibition was not new appears to be
contrary to the testimony quoted previously from the May 1992
congressional hearings.
Further, in the May 1994 modification, the Postal Service imposed new
requirements to limit the use of NCOA-linked data by the customers of
licensees. However, in contrast to the modification provision
applicable to licensees, this new requirement does not state
explicitly that the prohibition on the use of NCOA-linked data to
create new-movers list applies to the licensees' customers.
Specifically, the Postal Service added a requirement to the licensing
agreement that, at least once each year, licensees are to have
customers sign an "NCOA Processing Acknowledgement Form." By signing
the form, customers acknowledge their understanding that "the sole
purpose of the NCOA service is to provide a mailing list correction
service for lists that will be used for the preparation of mailings."
However, the form is not clear as to any specific prohibitions on the
use of NCOA services by licensees' customers because the form does
not explicitly state that NCOA data are not to be used to create or
maintain new-movers lists.
Postal Service officials said they continue to believe that neither
the Privacy Act nor the Postal Reorganization Act of 1970 limit in
any way licensees' and customers' use of address data that have been
properly updated or corrected through the NCOA service. The Manager,
Address Management said that the change to the licensing agreement
cited above was made as a "good business practice" to address
concerns raised by Congress and the public in the 1992 congressional
hearings.
We do not question the Postal Service's view that the disclosure of
NCOA data to licensees for the specific and limited purpose of
address list correction is permitted under the Privacy Act and the
1970 Act. However, we do not agree that the Privacy Act allows
licensees to use NCOA-linked data to create new-movers lists, which
may then be sold to their customers. As the Postal Service
acknowledges, under the Privacy Act
(5 U.S.C. 552a (m)(1)), the NCOA licensees operate on behalf of the
Postal Service. As such, they are subject to provisions of the
Privacy Act that allow an agency record to be disclosed provided that
it is used for a purpose compatible with the purpose for which it was
collected. Like the Postal Service, licensees may use the
information disclosed only for the limited purpose of address-list
correction, which is the routine use and purpose for which the Postal
Service collected such information. Thus, in our view, use of
NCOA-linked data by a licensee for the purpose of creating a
new-movers list would not be consistent with the limitations imposed
by the Privacy Act.
--------------------
\9 At the time of our review this position was entitled Manager,
Address Management.
OTHER PROVISIONS ADDED ON
AUDIT AND SUSPENSION OF
LICENSEES
---------------------------------------------------------- Letter :4.5
In addition to the above changes, the May 1994 modification called
for increasing the frequency of Postal Service audits that licensees
must pass, from one to at least three each contract year. The
modification further added the alternative of suspending a licensee
for failure to comply with the terms and conditions of the agreement
pending verification that the deficiencies have been corrected.
Previously, the agreement provided only for the outright
termination--at the Service's discretion--of a licensee who failed to
comply with provisions of the agreement.
THE POSTAL SERVICE HAS NOT
REASONABLY ENSURED LICENSEES'
COMPLIANCE WITH LICENSING
AGREEMENT PRIVACY PROVISIONS
------------------------------------------------------------ Letter :5
The Postal Service's oversight fell short of ensuring that licensees
have met the provisions and conditions of the licensing agreement
and, thus, did not ensure that the NCOA program was operating in
compliance with federal privacy laws. The Postal Service's oversight
procedures and processes have been weak with regard to (1) "seeding"
the NCOA files with fictitious records to discourage unauthorized
name and address disclosure by licensees; (2) auditing the
performance of licensees' NCOA software and conducting impromptu site
visits to monitor whether licensees are complying with various
licensing agreement requirements; (3) reviewing licensees' proposed
advertisements for NCOA services they sell; and (4) investigating
NCOA program-related complaints.
WEAKNESSES IN THE SEEDING
PROCESS