A Government Accountability Office (GAO) official warned on Tuesday that the Office of Management and Budget (OMB) is falling behind in issuing guidance to help federal agencies address artificial intelligence (AI) privacy risks.
Speaking on July 28 at the 930gov conference in Washington, D.C., Marisol Cruz Cain, a director on GAO’s Information Technology and Cybersecurity team, said existing federal privacy guidance has struggled to keep pace with rapid advances in AI.
“OMB guidance is trying to get up to date with our technology these days, but is very lagging and very sort of reactive to the things going on today,” Cruz Cain said.
Cruz Cain pointed to a March GAO report that indicated OMB’s existing AI guidance does not adequately address many of the privacy risks agencies face when deploying AI systems.
In the report, GAO made two recommendations to OMB. First, GAO recommended that OMB provide agencies with examples of known AI privacy risks to consider when updating their policies. Second, GAO recommended that OMB issue additional government-wide guidance on protecting privacy throughout the AI lifecycle, including evaluating AI models that contain sensitive information and implementing privacy best practices.
Asked by MeriTalk whether OMB has responded to GAO’s recommendations since the report was issued, Cruz Cain said the watchdog has yet to receive a response.
“We have heard absolutely nothing from OMB,” she said, adding, “I do know that they’re working on guidance. They’re always working on AI guidance. AI is actually a really important subject for the administration. They haven’t gotten back to us on whether they’re going to include some of those recommendations in the guidance.”
She noted that the White House’s national cybersecurity strategy, which the Office of the National Cyber Director issued in March, also heavily discussed AI.
“We’re waiting for the implementation part of that strategy, and we are hoping to see a little bit more about privacy in it. A lot had to do with cyber,” Cruz Cain said.
Additionally, Cruz Cain said the federal privacy framework has not kept pace with advances in AI. She noted that the Privacy Act of 1974 predates the technology and that the United States still lacks a comprehensive federal privacy law.
She also said the federal government lacks guidance for auditing AI models from a privacy perspective.
“We’re trying to see if NIST or someone in the federal government will put out an evaluation model to really look at an AI model to see how we can evaluate it for sensitive information to see if they have the appropriate protections,” Cruz Cain said.
“There’s a lot of work for OMB to do to help federal agencies address these privacy challenges,” she said.