demographic information of the sort that Federal statistical agencies have traditionally collected-much of it on a sample basis-to which our proposed National Data Center is directed, and assembly of the sort of personal history information on named individuals that is contained in a personnel file or police file.

Finally, the Subcommittee has raised certain questions as to the technical security of data stored in machine readable form, and accessible through machine operations. Here again, this is not a new problem, and both organizational and technical means are available to control and limit the risks. Though bank robbers have not been totally eliminated, we have not on that account abandoned banks and banking, and the analogy seems to us perfectly appropriate. We think that the maintenance of privacy against both unwitting and illegal disclosure of information made available to the Government are real problems, to which our proposed new Center must direct attention and effort. However they are neither insoluble problems, nor ones of such magnitude as to make the organization and effective functioning of a National Data Center possible only at the expense of significant inroads on liberty and privacy.

Senator LONG. Doctor, I believe that is all. Your statement has been very helpful and, as Mr. Kass suggested, maybe there are other questions we would want to confer with you about, and maybe some other problems. The committee will be in touch with you.

Dr. KAYSEN. Thank you, Senator; and, of course, if there are any other questions I will be glad to answer them.

Our next witness is Mr. Charles J. Zwick, Assistant Director of the Bureau of the Budget.

Mr. ZwICK. Thank you, Mr. Chairman.

Senator LONG. And the gentleman with you is who?

STATEMENT OF CHARLES J. ZWICK, ASSISTANT DIRECTOR, BUREAU OF THE BUDGET; ACCOMPANIED BY RAYMOND T. BOWMAN, ASSISTANT DIRECTOR FOR STATISTICAL STANDARDS, BUREAU OF THE BUDGET

Mr. ZWICK. Mr. Bowman is Assistant Director for Statistical Services.

Senator LONG. Will you state your name and state your position for the record, and then I believe you have a statement, if you would care to proceed, sir.

Mr. Zwick. My name is Charles J. Zwick.

Senator LONG. Our time is running reasonably short. I wonder if it would not be possible for you to summarize or do it as expeditiously as you can. Your entire statement will be printed in the record.

Mr. ZwICK. My name is Charles J. Zwick. I am an Assistant Director. Mr. Bowman is Assistant Director for Statistical Standards. I will summarize quickly the highlights of my prepared statement, Mr. Chairman.

It starts out by indicating the current status of this proposal, since there seems to be some confusion about this.

First, no such center has been organized, and further, that the administration will not undertake to create one without first submitting to the Congress specific plans for its review and approval.

As of today, we are still reviewing the desirability of proposing legislation in this area. In other words, we are still trying to be more specific about the proposal.

Our problem is basically threefold. We believe we are not today making adequate use of the data that the Government is now collect

ing. We must devise ways to increase the usefulness of information already collected by Government agencies.

Senator LONG. If I may interrupt you, could there be the possibility that they are collecting too much? Just because we have it, there is no need to make use of it.

Mr. Zwick. One of the three issues we have is that we must hold down the burden of statistical reporting, and while it is hard to predict, I think there is a possibility that with data scattered throughout the Government, agencies have to get duplicate information to carry out their responsibilities.

I would be out of order if I guaranteed that it would be cut down. We certainly look to improvements here, and most importantly we must do both of these functions while insuring adequate provision against invasion of privacy.

So those are the three aspects of the problem as we see it.

Now, during the last year there has been a great deal written in news stories, columns, editorials and newspapers about the grave dangers of data centers. We recognize and share in this concern. But we believe that much of the alarm stems from misunderstanding. To try to advance the discussion this morning, I would like to give you a brief summary of a hypothetical center-I underline hypothetical, because we are still trying to think this through in our own minds.

What would its functions be and under what conditions would it operate, and then lastly what privacy provisions would there be? The principal functions of this center would be:

1. To establish and maintain an inventory of data collected by Government agencies, useful for statistical compilation and analysis. As you pointed out earlier, we just do not know today exactly what there is throughout the Government in terms of data collection efforts. 2. To assemble and preserve data in the form and detail necessary to facilitate authorized access and retrieval.

And then, to the extent permitted by disclosure limitations, to make the data available to users within and outside the Government.

These functions are solely statistical in character. The preservation of the confidential responses to statistical inquiries has always been recognized as the keystone of our Federal statistical program and, we emphasize, this protection of individual privacy must be maintained if our system is going to work.

Senator LONG. Do you feel, Mr. Zwick, that regulations and restrictions and safeguards can be put into the system so there would be no invasion of privacy?

Mr. ZWICK. Perhaps the most accurate statement is we believe we can make the system at least as good as it is now, and probably better. Senator LONG. About one of the only safeguards we have now which citizens can depend on for privacy is the inefficiency of some of the agencies. Otherwise we would not have any.

Mr. ZWICK. We are saying we can do at least as well and probably better. But as Dr. Kaysen suggested in his testimony, we do think that the time is appropriate for an overall review of the privacy provisions. Are they adequate today? We want to do at least as well as we are now doing or even better. This is a very fundamental issue.

Senator LONG. You do not see any danger of this system setting up a cradle-to-the-grave operation as these agencies grow and become overzealous again in their accumulating of information about an individual? Do you see any danger in it?

Mr. ZwICK. As we conceive it in this hypothetical center, which I would like to outline, there would not be that danger.

Senator LONG. Have you considered that possibility?

Mr. ZwICK. Well, certainly there always is the possibility that this would happen, and again I think one comes back to both legislative and executive branch responsibility to see that it does not happen, and we have in our thinking several checks which would help prevent public disclosure of what is in there. We would also recommend review by an outside distinguished panel of how it is being operated, so that we do think there is obviously a danger here.

The issue is can we minimize this danger by, first, legislative intent which clearly defines what the center can and cannot do; and then, secondly, adequate supervision of the operation of the center once it is created.

We first talk about the types of information that might be put in the center. We can limit access and invasion of privacy by the types of information put in the center, obviously. We envision three types of data going in:

First, much of the data would be in the form of summaries at appropriate levels of statistical aggregation. Since these would contain no identification of individual persons or businesses, they would present no problem in disclosure or invasion of privacy.

The second type of data, would be information on individuals, whether they are persons, businesses or other organizations. And here we would conceive that as normal practice only samples rather than whole populations or universes which would be transferred to the

center.

Senator LONG. Are you speaking of the individuals or of each individual

Mr. ZwICK. No, of individuals. You would use, for example, the one percent sample of the social security system rather than the complete set of records.

Senator LONG. But it would be on that one individual, it would be a hundred percent.

Mr. ZWICK. Yes. On that one percent you clearly would have, from that source, information on the individual.

A third way to control the type of data going into the center would be excluded by statute certain types of information characterized as dossier or case file information.

The sorts of information which we think should be excluded would be as follows:

Individual personnel records of government agencies and civil service commission files on individual employees and applicants (letters of reference, performance ratings, test scores, etc.)

Files compiled by FBI, regulatory or other agencies as a result of investigations on individual persons, or businesses or other organizations.

FBI fingerprint files and files on persons convicted of crimes.

Files or revoked driver's permits.

Medical records on government employees or applicants and patients of government institutions.'

In other words, there are ways that you can get at the privacy issue by limiting types of data you can put in the center. You can exclude certain dossier type information.

Secondly, if you put it in terms of summary form, you obviously cannot get back to the individual; and, thirdly, with regard to individual data this would go in on a sample basis rather than the complete universe.

Senator LONG. What is your thought about IRS files?

Mr. ZWICK. We have not looked in great detail here. But I would think you would have a sample of individual tax returns, and the income statistics, which are again a statistical summary; but you would not have any investigatory files of the IRS, for example.

Senator LONG. But you would have the regular returns in your other files.

Mr. ZWICK. That is right. You would have a sample of those and, perhaps, as Dr. Kaysen suggested earlier this morning only certain information off those tax returns. We have not looked at this level of detail yet.

Senator LONG. It would be possible then for you to push a button and get Tom Smith's return if he was part of the one percent that you put in?

Mr. ZwICK. If he was in the one percent sample and it was legal to do this, yes. We are proposing that this would be illegal to get Tom Smith's file.

Senator LONG. How about the safeguards?

Mr. ZWICK. Then the question is, while it is illegal to do it, and he happens to be the one in the hundred that is in the file, somebody will in an unauthorized way pull the file; yes, sir.

Senator LONG. If Tom Smith is one out of a hundred, what would be the advantage of putting Tom Smith's file in there or his return in there?

Mr. ZWICK. This gets us to why you want a center in the first place? And it is, we believe, critical to improved decisionmaking on a whole range of public policy issues.

For example, there is today a sample on individual taxpayers which is used to analyze the impact of a tax change. If we change the tax law by changing the rate or the exemptions, we would like to know what the impact of this is going to be by classes of taxpayers.

There is such a sample. We can run through new tax policies and come out in statistical form with the results of a new tax policy on people by income level, age, family size, and so forth.

Senator LONG. It would be necessary, then, that there would be some department or some other group set up to scrutinize that hundred income tax returns before you pick out this one to put in the computer; would there not?

Mr. ZWICK. You draw a list on a sampling basis. You go into the total IRS file and pull out a sample which is representative of all taxpavers in the United States.

Senator LONG. How do you know whether it is representative unless you look at quite a group of them?

Mr. ZWICK. You pull out by various income classes, family size classes, and so forth.

Senator LONG. Does the Internal Revenue keep them filed like that now?

Mr. ZWICK. Yes. They have classifications for a sample.

Senator LONG. What I was concerned about, I think they reported 40-some-odd different agencies in the bureaus and so on, that can, without too much effort, reach in and pull your income tax return to look at it. It is not so confidential as we thought. I was curious whether this would be another group or committee set up to have access to the returns.

Mr. ZWICK. As we envision it, the sample of the Internal Revenue Service for returns would go into the Data Center.

This data can be operated on for certain statistical purposes, but it would be illegal for the Data Center to provide any information on an individual, which is not the case now with the IRS.

There are, as you pointed out, particular exceptions in which the Internal Revenue Service can make available tax information. In the Data Center under this example there would be, first, only a sample and, secondly, the Center would be subject to more strict disclosure rules then is now the case with the Internal Revenue Service.

So you have the legislative process which defines what is going into the Center and what can come out. We would only allow statistical information out.

Second, you limit what data you put into the center; and then, thirdly, you can have a process of checking.

Certainly there are come possibilities of invasion, and this concentration of data, as was pointed out earlier this morning, increasing the incentive for violation. If you cracked the information system you would get more out of it.

On the other hand, the establishment of a Center would promote and facilitate greater attention to technological design features, both hardware and software, which we believe would assist in safeguarding against improper disclosure.

However, we would say that sole reliance cannot be placed on technology, and it would be desirable to fix responsibility and accountability for the design and exercise of these safeguards. In other words, you would have somebody legally responsible, subject to certain criminal actions if he violates the law.

We would propose also that periodic reports should be made public identifying the various bodies of information which have been transferred to the Center for storage, and describing what and to whom information has been made available, so that you have a public disclosure of what information is in the system and what information and to whom it has been made available.

We would propose further that a public advisory council be established to be composed of members from outside the Federal Government representing the public interest generally.

This council should include State and local government representatives, constitutional lawyers, computer scientists and users and suppliers of information from the business and academic communities. Its function would be to advise on the public interest and policies,