Three years after a data breach exposed personal information belonging to roughly 237,000 current and former federal employees, the Department of Transportation was still failing to consistently perform required annual privacy assessments on information systems containing personally identifiable information, according to a new inspector general audit.
The explanations were considerably less sophisticated than the technology involved.
At one DOT agency, officials could not fully explain why required privacy work had not been completed because the employees previously responsible for the program had left. At another, privacy responsibilities were divided among offices and officials acknowledged that completing the work had not been made a funded priority.
The findings come from a Department of Transportation Office of Inspector General audit examining whether DOT had established an effective privacy program and implemented required controls for protecting personally identifiable information, or PII.
OIG identified 247 DOT systems containing PII and selected a statistical sample of 55 for review. Nine of those 55 systems — roughly 16 percent of the sample — did not receive required annual privacy risk assessments.
The audit does not establish that those systems were breached or that information contained within them was improperly accessed. Rather, the missing assessments meant DOT could not demonstrate that it was consistently performing one of the controls intended to identify and address changing privacy risks.
That distinction matters. So does the history.
In May 2023, DOT disclosed a breach involving its Federal Transit Benefit Program that exposed PII belonging to approximately 237,000 current and former federal employees. OIG had also previously identified weaknesses in DOT’s implementation of privacy policies in audits issued in 2018 and 2019.
The latest audit suggests that some of the basic compliance problems persisted.
At the Federal Motor Carrier Safety Administration, OIG found that three systems did not receive required annual privacy assessments during fiscal years 2022 through 2024: SAFETYNET, the Enforcement Management Information System, and the National Consumer Complaint Database.
The National Consumer Complaint Database also lacked required Privacy Threshold Analyses during the period reviewed.
When auditors sought an explanation, FMCSA officials could not provide documentation or direct knowledge explaining why the assessments had not been completed.
There was a bureaucratic complication: according to OIG, the personnel responsible for managing FMCSA’s privacy program from fiscal years 2019 through 2024 had left the agency.
In other words, the institutional knowledge apparently departed with the employees.
The Federal Aviation Administration had its own version of the problem.
OIG found six FAA systems that had not received required annual privacy assessments during fiscal years 2022 through 2024. Another system received an assessment in fiscal 2023 but not in fiscal 2024.
The affected systems identified by OIG included the National Flight Data Center, National Airspace System Resource System, Flight Activity and Crew Tracking System, Weather Systems Processor and Weather Camera System.
FAA officials attributed the deficiencies partly to how privacy responsibilities were distributed between privacy personnel and individual system owners.
But OIG also reported a more straightforward explanation.
According to FAA’s chief privacy officer, Air Traffic Organization leadership had not made the required privacy work a funded priority, limiting the organization’s ability to complete necessary privacy documentation.
That left a federal privacy requirement competing for attention and resources inside an agency responsible for some of the country’s most consequential transportation systems.
OIG identified a broader management problem as well.
During the audit period, DOT lacked a formally approved department-wide privacy program plan meeting federal requirements. Department officials provided auditors with various policies, procedures, strategic documents and other materials that they maintained collectively constituted such a program.
OIG disagreed.
Auditors found DOT could not demonstrate that its senior agency official for privacy had formally approved or designated those materials as the Department’s privacy program plan. Some strategic documents were unsigned and lacked required goals and objectives.
DOT has since corrected that deficiency.
In January 2025 — after the fiscal 2024 period examined by auditors — the Department completed and formalized its privacy program plan. That makes the audit less a story about DOT currently operating without a privacy plan than one about how inconsistently required privacy controls were implemented before and during the period under review.
OIG ultimately issued just two recommendations.
The inspector general recommended that DOT maintain its newly established enterprise privacy plan and ensure that annual privacy risk assessments are performed for Department information systems.
DOT concurred with both recommendations. OIG considers them resolved but open until the Department completes the promised corrective actions.
The audit therefore stops short of uncovering another major DOT data breach.
Instead, it documents something less dramatic but arguably more familiar: federal agencies had established privacy requirements, officials knew assessments were supposed to be performed, and some of those assessments nevertheless went undone because personnel changed, responsibilities were fragmented and resources were directed elsewhere.
For a Department still operating in the shadow of a breach affecting 237,000 people, those are precisely the mundane administrative failures privacy controls are supposed to prevent from becoming something considerably less mundane.
