U.S. Postal Service: Improved Oversight Needed to Protect Privacy of Address Changes GAO/GGD-96-119)

Part 2

---------------------------------------------------------- Letter :5.1

Our review of files and discussion of the seeding process with NCOA

program officials disclosed certain management practices and

inattention to procedure that, we believe, have limited the value of

seeding as a control to ensure against the improper disclosure of

NCOA data. Seeding is commonly used in the mailing industry to

control proprietary records. The Postal Service periodically plants

"seed" records when updating licensees' NCOA files. A seed record is

any nonmatch data placed in the NCOA file by the Postal Service and

so designed that it will be released to mailing list holders only

through improper use of the NCOA file. Licensees are aware that the

NCOA files are seeded by the Postal Service, but according to NCOA

program officials, specific seeding data are guarded against

disclosure to licensees and the public.

Postal Service officials said they believe that, if a licensee

disclosed information from the NCOA file by any means other than

through the approved computer software, fictitious seed address

records would also be disclosed. Mail sent to seed record addresses

would then be retrieved by the NCOA program office, alerting it to a

possible improper disclosure of NCOA information. The NCOA program

office would then trace the seed record back to the licensee who

released it, and the Postal Service would take disciplinary and/or

corrective action. The NCOA program manager reported that he was not

aware that any seed mail had ever been received.

Program officials told us that they had seeded NCOA files since the

program began but had not retained historical records of seeding for

the complete period. Available documentation of seeding activities

began with the NCOA file update in July 1990. Our review of this

documentation and information provided by program officials disclosed

several weaknesses in the seeding process and documentation of the

process as an NCOA program control measure.

-- From July 1993 to April 1994, the NCOA files contained no seed

records because the program office neglected to replace those

records when they became 36 months old and were deleted. Seed

records loaded in July 1990 were deleted in July 1993, some 36

months later. Seed records were not replaced in licensees' NCOA

files until April 1994.

-- Program officials were not aware of this gap in seed coverage

until our review. They said the gap was a "technical" error

that was not particularly serious because the main value of

seeding as a control comes from the licensees' awareness that

the Postal Service seeds the NCOA files. Program officials said

they did not believe that licensees were aware that the gap in

seed coverage had occurred.

-- Program officials told us that before November 1994, the program

office used only seed records unique to each licensee. All name

and address updates to the licensees' NCOA files by the Postal

Service were identical, except for seed record names and

addresses unique to each licensee. Program officials said they

believed that this feature would enable them to trace any mail

received at seed addresses to the licensee who released the

record. However, it is possible that seed records could be

identified and neutralized by two or more licensees who agreed

to compare their NCOA files.

-- After we discussed our concerns with NCOA program officials, in

November 1994, the program office began using some "common" seed

records. Under this new feature, a quantity of identical seed

records are introduced into the NCOA files of all licensees,

along with some seed records that are unique to each licensee.

Although this procedure may help to identify any improper

disclosure of addresses by licensees, it will not allow the

Postal Service to identify which licensee was responsible for

the impropriety if licensees compared their NCOA files to

identify unique seed records because all licensees will have had

access to a common seed record.

-- The Postal Service process for seeding, identifying, and

responding to mail that might be sent to a seed address was

informal. There were no written procedures on the seeding

process, the process for retrieving mail sent to seed addresses,

or the process for investigating mail sent to seed addresses and

then reporting the results of the investigation internally.

-- The National Customer Support Center manager stated that the

informal mail retrieval process was tested in 1990 and again in

1992. He said that the test results showed that this process

worked in that test mail sent to the seed addresses through the

regular mail stream was properly forwarded back to the NCOA

program office. However, the manager told us that there was no

record of these tests and that the results were not reported

within the Postal Service. He said that procedures were revised

in January 1995 to specifically cover what postal field

personnel are required to do when they identify mail to be

delivered to seed addresses.

QUESTIONABLE EFFECTIVENESS

OF LICENSEE AUDITS

---------------------------------------------------------- Letter :5.2

On the basis of our examination of poorly maintained audit files and

subsequent discussions with NCOA program officials, we were unable to

(1) confirm that we had identified all Postal Service audits of

licensees or (2) fully assess the Postal Service's management of

audits. However, on the basis of our review of the records available

and on interviews with program officials and staff, we question

whether the licensee audits, as administered by the program office,

provided a meaningful oversight measure of compliance with the

applicable privacy provisions of federal law.

During most of the program's history, unannounced on-site audits were

to be conducted annually at the licensees' facilities. These audits

were to include tests of licensees' NCOA software accuracy and

verification of licensees' compliance with other licensing agreement

provisions, such as the provision to prevent unauthorized access to

the NCOA file. Under the licensing agreement, the Postal Service

allows a licensee that fails an audit 30 days to correct the problem

and be retested. This period is to begin when the Postal Service's

contracting officer notifies the licensee of the audit results.

In 1992, the program office introduced an "automated" audit

administered through a test tape mailed to each licensee. According

to the program manager, the automated audit focused on a more

comprehensive assessment of the accuracy of the licensees' NCOA

software. The audits are designed to detect both the failure of

licensees' NCOA software to make appropriate matches and instances of

incorrect matches. Matching of names and addresses results in the

release of new addresses to the mailing list holders and, eventually,

into the mail stream. Incorrect matches, therefore, are more serious

because they can result in the release of new addresses in violation

of federal privacy laws.

The Postal Service has set a high standard for the performance of

licensees' address-matching software. The licensing agreement

specifies that a licensee's address-matching software must achieve a

99-percent matching accuracy rate. That is, the software may produce

no more than one error per 100 name and address matches as analyzed

and scored by the program office.

In May 1994, the Postal Service significantly modified the licensing

agreement to, among other things, strengthen the Service's oversight

of licensees through audits. Before this modification, NCOA program

officials said that licensees were audited at least once a year and

that the only option available to the Postal Service under the

licensing agreement was to terminate the license of a licensee who

failed successive audits. The modification requires licensees to

pass at least three audits each contract year and provides the option

of either suspending or terminating licensees that fail two

consecutive process audits or that fail to comply with other terms or

conditions of the licensing agreement. Further, the modification

requires the Postal Service to terminate the license of any licensee

that fails three consecutive audits.

Since 1992, the NCOA program office has maintained a separate file on

each licensee containing various items of correspondence, internal

memorandums, notes, and other information relating to process audits

performed. We reviewed the files for details of process audits

conducted during 1992 and 1993. The files we reviewed, however,

generally did not contain complete records of the audits performed,

audit results, or resolution of audit findings.

We were able to ascertain from the files, however, that in 1992 at

least 65 automated audits were made of the 25 firms licensed at that

time to provide NCOA services. All but one licensee failed the

initial audit. Seven licensees passed the first follow-up audit.

Another seven licensees failed the first follow-up audit but passed a

second follow-up audit. However, 10 licensees failed all automated

process audits performed that year.

The Postal Service did not terminate the license of any of the 10

licensees who failed successive process audits during 1992. In fact,

these licensees continued to provide NCOA services with

address-matching software that had failed repeatedly to meet the

performance standards for accuracy required by the licensing

agreement. For example, four licensees failed an initial audit in

May 1992, and then failed two follow-up audits, before finally

passing an audit conducted in March 1993. However, these same

licensees were allowed to continue providing NCOA services during the

10-month period in which their software failed to meet the Service's

minimum standard for accuracy.

The NCOA program manager explained that the pattern of repeated audit

failures resulted from the increased thoroughness, coverage, and

focus on software accuracy of the new automated process audit as

compared with earlier process audits. He acknowledged that program

oversight had not been carried out as strictly as it could have been

because program officials did not want to terminate licensees from

the program, which was the only option available under the licensing

agreement at that time.

The program manager believed that the Postal Service correctly opted

to work with the licensees to resolve the software deficiencies

identified in the 1992 audits. He indicated that, among other

things, most of the software performance errors involved failures to

make any matches rather than making inappropriate matches. He also

said that the program office staff responded promptly to ensure that

licensees corrected software weaknesses identified in the audits,

which may have affected compliance with federal privacy laws.

During 1993, the Postal Service audited the 10 licensees who failed

all audits conducted during 1992. Each of these 10 licensees passed

the 1993 audit. The NCOA program manager explained that other

licensees were not audited during 1993 because, starting in about

March of that year, the entire master NCOA file was redesigned, and

licensees had to change their software to accommodate this redesign.

Further, the NCOA program office had a contract with one of its NCOA

licensees for computer support to build and maintain the master NCOA

file. The program office brought this function in-house in October

1993. Consequently, according to the program manager, all program

staff who would have done the licensee audits were instead used to

support this transition and maintain the NCOA file.

INADEQUATE INFORMATION TO

DETERMINE THE EFFECTIVENESS

OF ADVERTISING REVIEW

---------------------------------------------------------- Letter :5.3

We were unable to completely evaluate this oversight activity because

the NCOA program office did not have historical records of any

advertisements either submitted or reviewed. However, the

information that we were able to obtain indicated that the program

office was not effectively overseeing licensees' advertising

activities. Specifically, we found that although at least two

licensees had advertised NCOA-linked new-movers lists and had

submitted these advertisements to the Postal Service for review, no

action had been subsequently taken by the Postal Service to

disapprove the advertisements. The May 1994 modification stated that

a licensee's advertising will be disapproved if it includes any

reference to NCOA or the Postal Service.

The licensing agreement requires licensees to submit all proposed

advertising and methods of selling NCOA program-related services to

the NCOA program office for review and approval. The purpose of this

requirement is to ensure that licensees' customers are not misled by

the advertising or sales methods used, as well as to specifically

ensure that the relationship between the Postal Service and the

licensee is correctly represented. The licensing agreement states

that the Postal Service will provide the licensee with a written

response on the acceptability of proposed advertising within 20

working days of receipt of the material. However, if the licensee

does not receive a written response within this time, the agreement

states that the licensee may consider the proposed advertisements or

sales methods approved for use.

The program manager told us that licensees had regularly submitted

their proposed NCOA-related advertisements to the program office for

review. However, our review of licensee contract files and

discussions with a licensee disclosed that at least two licensees had

regularly submitted advertising materials for NCOA-linked new-movers

lists for Postal Service review and approval and that the program

office had not responded. For example, a May 19, 1994, letter from a

licensee stated that it had regularly submitted for review copies of

its advertisements promoting NCOA-linked new-movers lists since

inception of the NCOA program but that the Postal Service had never

responded.

As noted earlier, Postal Service officials said that the change to

the licensing agreement that specifically prohibited the creation of

NCOA-linked new-movers lists was to make more explicit the existing

restrictions on uses of NCOA data. Therefore, even before the

licensing agreement was modified in 1994, the exercise of effective

oversight should have dictated that the Service inform licensees who

proposed advertisements promoting NCOA-linked new-movers lists that

such advertisements were not permitted by the licensing agreement.

However, the Postal Service failed to respond to these proposed

advertisements.

In discussing this issue with the program manager, we were told that,

notwithstanding the advertisements submitted for review, the Postal

Service had not fully understood how licensees were using the NCOA

file--i.e., to create NCOA-linked new-movers lists. When it became

clear that licensees were creating such lists, the licensing

agreement was modified to specifically (1) preclude licensees from

creating and maintaining new-movers lists for either their own use or

the use of their customers and (2) state that a licensee's

advertising will be disapproved if it includes any reference to NCOA

or the Postal Service anywhere in any text or graphics that include a

reference to nonmailing products and services, such as new-movers

lists.

UNCERTAIN EFFECTIVENESS OF

COMPLAINT INVESTIGATIONS

---------------------------------------------------------- Letter :5.4

Another oversight or control mechanism over licensees that the Postal

Service reportedly uses is the investigation of NCOA-related

complaints emanating from the public, the licensees themselves, or

their customers. However, because the program office had no records

of complaints received or related investigations, we could not assess

the effectiveness of the complaint investigation process as a control

mechanism.

The NCOA program office's complaint investigation process was

informal and lacked structure. The office could provide us with no

record of complaints received. Further, we found no evidence of a

formal process for logging complaints, investigating complaints, and

reporting the results of investigations internally or to

complainants. According to the program manager, a few complaints had

been received, which were mainly related to customer

misunderstandings about the NCOA-related services that licensees

provide.

CONCLUSIONS

------------------------------------------------------------ Letter :6

In establishing the NCOA program, the Postal Service took a positive

step toward dealing with the inefficiencies of processing

misaddressed mail. In setting up and using a nationwide database of

postal customer names and addresses to provide this address

correction service, the Postal Service has tried, primarily through

changes to licensing agreements, to create controls that help ensure

that the release and use of NCOA information complies with the

provisions of federal privacy laws. The Postal Service said it

believes that it has met its legal responsibilities through program

design and oversight.

However, at the time of our review, the NCOA program was operating

without clearly delineated procedures and without sufficient

management attention to ensure that the program was operating in

compliance with the privacy provisions of federal laws.

Specifically, the Postal Service lacked adequate written procedures

and oversight processes regarding

-- seeding the NCOA files with fictitious records to discourage

unauthorized name and address disclosure by licensees;

-- obtaining and reviewing, in a timely manner, licensees' proposed

advertisements that mention the NCOA program, taking prompt

action to disapprove inappropriate advertisements, and

documenting the results; and

-- documenting all NCOA-related complaints received and actions

taken to address the complaints.

The NCOA program office's absence of written procedures and

inattention to processes allowed seeding control features to lapse

for a 9-month period before the condition was discovered and

corrected. Also, several licensees had advertised NCOA-linked

new-movers lists, submitted the advertisements to the Postal Service

for review, and yet the Postal Service had taken no action to

disapprove the advertisements. Further, with regard to complaints,

the NCOA program office had no records of complaints received or

related investigations, although officials said that complaints had

been received.

The NCOA program office had not implemented and enforced some

provisions of the licensing agreement, including those requiring a

minimum number of licensee audits each year and the termination of

licensees that failed to maintain address-matching software that

meets the performance standards prescribed in the license agreements.

Ten licensees failed successive audits of their software and

continued to provide NCOA services in 1992. When licensees' software

does not perform according to the standards, the Postal Service

cannot be sure that the NCOA program is operating in compliance with

federal privacy laws.

Finally, we found that the Postal Service had not clearly

communicated, through licensees, to licensees' customers, the

restrictions on the use of NCOA data to create or maintain new-movers

lists. That is, the Postal Service had not explicitly stated in the

acknowledgment form--to be signed by customers of licensees--that

NCOA data are not to be used to create or maintain new-movers lists,

a restriction that the Service has communicated to licensees.

RECOMMENDATIONS

------------------------------------------------------------ Letter :7

To strengthen oversight of the NCOA program, we recommend that the

Postmaster General require the NCOA program office to

-- develop and implement written oversight procedures, which should

include (1) the responsibilities and timetables for using seed

records to help verify that licensees release new addresses only

as a result of accurate name and address matching; (2)

requirements to obtain and review licensees' NCOA-related

proposed advertisements, document the review, and notify

licensees of the results within the time period prescribed in

the licensing agreement; and (3) requirements for systematically

recording all NCOA-related complaints received, including

actions taken to resolve complaints; and in addition,

-- enforce all provisions of the licensing agreement, including (1)

conducting at least the prescribed minimum number of licensee

audits, currently three per contract year; and (2) suspending or

terminating, as appropriate, licensees that fail two consecutive

audits or that are determined to be in noncompliance with other

terms or conditions of the licensing agreement. (As provided in

the agreement, licensees that fail three consecutive audits

should be terminated.)

We also recommend that the Postmaster General further restrict the

use of NCOA-linked data to create or maintain new-movers lists by

explicitly stating it on the acknowledgment form that is signed by

customers of NCOA licensees.

POSTAL SERVICE COMMENTS AND OUR

EVALUATION

------------------------------------------------------------ Letter :8

In a May 30, 1996, letter (see app. I) the Postmaster General

commented on a draft of this report. He said that the Postal Service

had implemented our recommendations to develop written oversight

procedures for conducting NCOA seeding operations, reviewing and

responding to NCOA-related advertisements, and investigating

complaints about the program. He said also that the Postal Service

was pleased that we did not question the lawfulness of licensing NCOA

data for the purpose of address-list correction. It is important to

note that, while we did not question the legality of the Postal

Service's arrangements with licensees to provide address list

correction services, we disagree with its view that the Privacy Act

allows licensees to use NCOA-linked data to create new-movers lists.

The Postal Service did not adopt our recommendation that restrictions

on the use of NCOA-linked data to create or maintain new-movers lists

be included in the acknowledgment form that is to be signed by NCOA

licensees' customers. The Postal Service primarily provided three

reasons for its decision to not adopt our recommendation, which are

summarized below along with our evaluation.

First, the Postal Service said it does not believe that a restriction

on the creation and maintenance of new-movers lists from NCOA-derived

data is required by privacy law. For the reasons stated earlier in

this report, we continue to believe that use of NCOA-linked data by a

licensee for creating a new-movers list would not be consistent with

the limitations imposed by the Privacy Act. The Postal Service did

not provide any new evidence or rationale for its view that the

Privacy Act permits licensees to use NCOA-derived data for purposes

other than address-list correction, which is the routine use or

purpose for which the Postal Service collected such information.

Second, the Postal Service said that effective enforcement of such a

restriction on customers of licensees would be impracticable. The

Postal Service said that the Privacy Act does not govern the private

sector and provides no basis for requiring the Service to control

what the private sector does with address corrections legitimately

obtained from the Postal Service. The Postal Service said it

believes that it would be inappropriate to place limitations on

licensees' customers, with whom the Service has no formal

relationship.

Regarding this second point, we recognize that enforcement of the

restrictions on third parties, i.e, licensees' customers, might be

difficult because the Postal Service has no contractual relationship

with licensees' customers. However, we do not believe that a

potential difficulty of enforcing such restrictions under

arrangements made with licensees means that the Postal Service should

not clearly communicate what those restrictions are. NCOA licensees

operate on behalf of the Postal Service and are subject to the same

provisions of the Privacy Act as the Service, which allows an agency

record to be disclosed provided the record is used for a purpose

compatible with that for which it was collected. These records were

collected by the Postal Service for address-list corrections, not to

create new-movers lists.

As a practical matter, it appears that the Postal Service could, at a

minimum, communicate through licensees to the licensees' customers

any restrictions on the use of NCOA data to create or maintain

new-movers lists. Acting on behalf of the Postal Service, licensees

could help ensure compliance with the restrictions by explaining to

their customers the limitations on the release and use of NCOA data

under the Privacy Act. Unless the Postal Service implements and

attempts to enforce these limitations, it cannot ensure that use of

NCOA-derived data is limited to the purpose for which it was

gathered.

Third, the Service said that we misinterpreted the purpose of the

acknowledgment form when we said that it was "to limit the use of

NCOA-linked data by the customers of licensees." The Service said

that the purpose of the form is to ensure that lists presented to

licensees for correction are really mailing lists. The

acknowledgment form states that the sole purpose of the NCOA service

is to provide a mailing-list correction service for lists that will

be used to prepare mailings. We believe that this language does

limit the use of NCOA-linked data. However, the Postal Service had

not explicitly stated in the acknowledgment form the specific

restriction that it communicated to licensees, namely, that NCOA data

are not to be used to create or maintain new-movers lists. We are

recommending that the Postmaster General explicitly state this

restriction on the acknowledgment form. Also, the Postal Service

said that it has never acknowledged that the creation of new-movers

lists by customers is prohibited. We clarified in our report that

the Postal Service had communicated the prohibition on the creation

of new-movers list to licensees--but not to their customers.

---------------------------------------------------------- Letter :8.1

We are sending copies of this report to the Ranking Minority Member

of this Subcommittee, the Postmaster General, and other interested

parties. Copies will also be made available to others upon request.

The major contributors to this report are listed in appendix III. If

you have any questions about the report, please call me on (202)

512-8387.

J. William Gadsby

Director, Government Business

Operations Issues

U.S. POSTAL SERVICE CHANGE OF

ADDRESS ORDER (POSTAL SERVICE FORM

3575, JULY 1995)

=========================================================== Appendix I

(See figure in printed

edition.)

(Front of form)

(See figure in printed

edition.)

(See figure in printed

edition.)

(Back of form)

(See figure in printed

edition.)

(See figure in printed edition.)Appendix II

COMMENTS FROM THE U.S. POSTAL

SERVICE

=========================================================== Appendix I

(See figure in printed edition.)

MAJOR CONTRIBUTORS TO THIS REPORT

========================================================= Appendix III

GENERAL GOVERNMENT DIVISION,

WASHINGTON, D.C.

Michael E. Motley, Associate Director, Government Business

Operations Issues

James T. Campbell, Assistant Director

OFFICE OF GENERAL COUNSEL,

WASHINGTON, D.C.

Alan N. Belkin, Assistant General Counsel

Robert J. Heitzman, Senior Attorney

DALLAS REGIONAL OFFICE

Sherrill H. Johnson, Core Group Leader

Robert T. Griffis, Evaluator-in-Charge

*** End of document. ***