Privacy risk as two bills would expand federal data holdings

Two House bills would dramatically expand the Do Not Pay database and consolidate sensitive government data.

The decision to move H.R. 8312 and H.R. 8464 through the House Committee on Oversight and Government Reform on April 29 puts a spotlight on a familiar struggle in federal policy: how to prevent fraud without turning government data into a privacy minefield. The Center for Democracy and Technology is among the vocal critics, arguing that while fraud prevention is essential for safeguarding tax dollars and program integrity, the bills would consolidate personal information across agencies and weaken privacy protections rather than strengthen them. The critics warn that more data on more Americans, stored and shared across departments, increases exposure to data breaches, misuse, and surveillance.

Public sentiment already skews toward tighter privacy safeguards. CDT notes bipartisan polling showing that three in four Americans are worried about the privacy and security of personal data held by government agencies. A striking 79 percent agree that Congress should use its authority to hold agencies accountable when they ignore privacy laws protecting personal data. Those numbers, CDT argues, run counter to the direction of the two bills, which proponents say are aimed at tightening fraud controls but critics say would erode privacy if enacted without robust protections.

H.R. 8312 is described in the filing as the Fraud Prevention and Accountability Act. CDT highlights that expanding the Treasury Department's Do Not Pay system, which is already a contentious data collection and matching tool, would magnify the reach of a federal data footprint. H.R. 8464's counterparts in the same package likewise seek broader data consolidation across federal programs, creating a shared repository that could be accessed or cross-referenced by multiple agencies. The combination raises practical questions for compliance teams and technology leadership in both the public and, where applicable, contractor ecosystems.

For compliance officers and tech leaders, the implications are concrete. First, there would be new or expanded data governance obligations to track who can access what data, under what conditions, and for which purposes. Second, the push to broaden cross-agency data sharing heightens the need for rigorous access controls, audit trails, and privacy-by-design protections to mitigate the risk of internal misuse or external breaches. Third, the initiative would likely prompt expanded data retention and data lifecycle management requirements, with potential obligations to conduct regular privacy impact assessments as data ecosystems grow.

Practitioner insights to watch:

As the bills advance, compliance officers and tech leaders should prepare for a potential shift toward larger, more interconnected data ecosystems within the federal government. The stakes are not merely procedural; they touch the core balance between preventing fraud and preserving personal privacy.