{"database": "openregs", "table": "ig_reports", "rows": [["3-year-exposure-privacy-act-protected-data-revealed-uspto-mismanagement-safeguarding", "A 3-Year Exposure of Privacy Act-Protected Data Revealed USPTO Mismanagement in Safeguarding the Sensitive PII of Trademark Filers", "2024-06-24", "OIG-24-029-I", "Inspection / Evaluation", "Department of Commerce", "Department of Commerce OIG", "Agency-Wide", "The objective of our evaluation was to assess USPTO\u2019s actions in response to the exposure of domicile addresses to determine whether USPTO complied with federal and U.S. Department of Commerce (the Department) information technology (IT) security standards.We found that USPTO mishandled the required reporting and notification to the affected trademark filers after domicile addresses had been exposed for 3 years. We also found that USPTO leadership allowed domicile addresses to remain publicly accessible after they were aware of the exposure, risking unauthorized disclosures in violation of the Privacy Act. Additionally, USPTO did not report that additional sensitive PII was exposed during the incident or notify the affected filers that additional data had been exposed. Lastly, the Department\u2019s Chief Privacy Officer (CPO) did not assist USPTO in responding to this incident because of a lapse in the Department reporting process. See appendix B for a timeline of the events discussed in our findings.USPTO\u2019s exposure of trademark filer data may not only reduce public confidence, but also may have equipped bad actors with additional data that could be used to defraud trademark holders. Bad actors could aggregate the pieces of exposed data to convincingly create official-looking USPTO correspondence or impersonate a filer\u2019s attorney. Despite these risks, USPTO leadership did not comply with federal, departmental, and USPTO incident response reporting requirements and knowingly allowed domicile addresses to remain publicly accessible during incident mitigation.  USPTO must improve its efforts in safeguarding trademark filers\u2019 personal data to rebuild public trust and honor trademark holders\u2019 privacy.", 10, 0, 0, "https://www.oversight.gov/sites/default/files/documents/reports/2024-06/OIG-24-029-ISECURED.pdf", "https://www.oversight.gov/reports/3-year-exposure-privacy-act-protected-data-revealed-uspto-mismanagement-safeguarding"]], "columns": ["report_id", "title", "date_issued", "report_number", "report_type", "agency_reviewed", "submitting_oig", "location", "description", "num_recommendations", "questioned_costs", "funds_for_better_use", "pdf_url", "detail_url"], "primary_keys": ["report_id"], "primary_key_values": ["3-year-exposure-privacy-act-protected-data-revealed-uspto-mismanagement-safeguarding"], "units": {}, "query_ms": 24.505825014784932, "source": "Federal Register API & Regulations.gov API", "source_url": "https://www.federalregister.gov/developers/api/v1", "license": "Public Domain (U.S. Government data)", "license_url": "https://www.regulations.gov/faq"}