We recommend EAC management: 1) perform an inventory of EAC's PII data and how it is used within the agency; 2) document and implement a process for the Privacy Officer to periodically report to the Office of Inspector General on the Agency's use of information in an identifiable form, and verify compliance with privacy and data protection policies and procedures.