I 

114TH CONGRESS 

1ST SESSION H. R. 451 

To ensure the functionality and security of new Federal websites that collect 

personally identifiable information, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JANUARY 21, 2015 

Mr. FLEISCHMANN introduced the following bill; which was referred to the 

Committee on Oversight and Government Reform 

A BILL 

To ensure the functionality and security of new Federal 

websites that collect personally identifiable information, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Safe and Secure Fed5 eral Websites Act of 2015’’. 

6 SEC. 2. ENSURING FUNCTIONALITY AND SECURITY OF NEW 

7 FEDERAL WEBSITES THAT COLLECT PERSON8 ALLY IDENTIFIABLE INFORMATION. 

9 (a) CERTIFICATION REQUIREMENT.— 


tkelley on DSK3SPTVN1PROD with BILLS
2 

•HR 451 IH

1 (1) IN GENERAL.—Except as otherwise pro2 vided under this subsection, an agency may not de3 ploy or make available to the public a new Federal 

4 PII website until the date on which the chief infor5 mation officer of the agency submits a certification 

6 to Congress that the website is fully functional and 

7 secure. 

8 (2) TRANSITION.—In the case of a new Federal 

9 PII website that is operational on the date of the en10 actment of this Act, paragraph (1) shall not apply 

11 until the end of the 90-day period beginning on such 

12 date of enactment. If the certification required under 

13 paragraph (1) for such website has not been sub14 mitted to Congress before the end of such period, 

15 the head of the responsible agency shall render the 

16 website inaccessible to the public until such certifi17 cation is submitted to Congress. 

18 (3) EXCEPTION FOR BETA WEBSITE WITH EX19 PLICIT PERMISSION.—Paragraph (1) shall not apply 

20 to a website (or portion thereof) that is in a develop21 ment or testing phase, if the following conditions are 

22 met: 

23 (A) A member of the public may access 

24 PII-related portions of the website only after 


tkelley on DSK3SPTVN1PROD with BILLS
3 

•HR 451 IH

1 executing an agreement that acknowledges the 

2 risks involved. 

3 (B) No agency compelled, enjoined, or oth4 erwise provided incentives for such a member to 

5 access the website for such purposes. 

6 (4) CONSTRUCTION.—Nothing in this section 

7 shall be construed as applying to a website that is 

8 operated entirely by an entity (such as a State or lo9 cality) that is independent of the Federal Govern10 ment, regardless of the receipt of funding in support 

11 of such website from the Federal Government. 

12 (b) DEFINITIONS.—In this section: 

13 (1) AGENCY.—The term ‘‘agency’’ has the 

14 meaning given that term under section 551 of title 

15 5, United States Code. 

16 (2) FULLY FUNCTIONAL.—The term ‘‘fully 

17 functional’’ means, with respect to a new Federal 

18 PII website, that the website can fully support the 

19 activities for which it is designed or intended with 

20 regard to the eliciting, collection, storage, or mainte21 nance of personally identifiable information, includ22 ing handling a volume of queries relating to such in23 formation commensurate with the purpose for which 

24 the website is designed. 


tkelley on DSK3SPTVN1PROD with BILLS
4 

•HR 451 IH

1 (3) NEW FEDERAL PERSONALLY IDENTIFIABLE

2 INFORMATION WEBSITE (NEW FEDERAL PII

3 WEBSITE).—The terms ‘‘new Federal personally 

4 identifiable information website’’ and ‘‘new Federal 

5 PII website’’ mean a website that— 

6 (A) is operated by (or under a contract 

7 with) an agency; 

8 (B) elicits, collects, stores, or maintains 

9 personally identifiable information of individuals 

10 and is accessible to the public; and 

11 (C) is first made accessible to the public 

12 and collects or stores personally identifiable in13 formation of individuals, on or after October 1, 

14 2012. 

15 (4) OPERATIONAL.—The term ‘‘operational’’ 

16 means, with respect to a website, that such website 

17 elicits, collects, stores, or maintains personally iden18 tifiable information of members of the public and is 

19 accessible to the public. 

20 (5) PERSONALLY IDENTIFIABLE INFORMATION

21 (PII).—The terms ‘‘personally identifiable informa22 tion’’ and ‘‘PII’’ mean any information about an in23 dividual elicited, collected, stored, or maintained by 

24 an agency, including— 


tkelley on DSK3SPTVN1PROD with BILLS
5 

•HR 451 IH

1 (A) any information that can be used to 

2 distinguish or trace the identity of an indi3 vidual, such as a name, a social security num4 ber, a date and place of birth, a mother’s maid5 en name, or biometric records; and 

6 (B) any other information that is linked or 

7 linkable to an individual, such as medical, edu8 cational, financial, and employment informa9 tion. 

10 (6) RESPONSIBLE AGENCY.—The term ‘‘respon11 sible agency’’ means, with respect to a new Federal 

12 PII website, the agency that is responsible for the 

13 operation (whether directly or through contracts 

14 with other entities) of the website. 

15 (7) SECURE.—The term ‘‘secure’’ means, with 

16 respect to a new Federal PII website, that the fol17 lowing requirements are met: 

18 (A) The website is in compliance with sub19 chapter II of chapter 35 of title 44, United 

20 States Code. 

21 (B) The website ensures that personally 

22 identifiable information elicited, collected, 

23 stored, or maintained in connection with the 

24 website is captured at the latest possible step in 

25 a user input sequence. 


tkelley on DSK3SPTVN1PROD with BILLS
6 

•HR 451 IH

1 (C) The responsible agency for the website 

2 has taken reasonable efforts to minimize do3 main name confusion, including through addi4 tional domain registrations. 

5 (D) The responsible agency requires all 

6 personnel who have access to personally identi7 fiable information in connection with the 

8 website to have completed a Standard Form 

9 85P and signed a non-disclosure agreement 

10 with respect to personally identifiable informa11 tion, and the agency takes proper precautions 

12 to ensure only trustworthy persons may access 

13 such information. 

14 (E) The responsible agency maintains (ei15 ther directly or through contract) sufficient per16 sonnel to respond in a timely manner to issues 

17 relating to the proper functioning and security 

18 of the website, and to monitor on an ongoing 

19 basis existing and emerging security threats to 

20 the website. 

21 (8) STATE.—The term ‘‘State’’ means each 

22 State of the United States, the District of Columbia, 

23 each territory or possession of the United States, 

24 and each federally recognized Indian tribe. 


tkelley on DSK3SPTVN1PROD with BILLS
7 

•HR 451 IH

1 SEC. 3. PRIVACY BREACH REQUIREMENTS. 

2 (a) INFORMATION SECURITY AMENDMENT.—Sub3 chapter II of chapter 35 of title 44, United States Code, 

4 is amended by adding at the end the following: 

5 ‘‘§ 3559. Privacy breach requirements 

6 ‘‘(a) POLICIES AND PROCEDURES.—The Director of 

7 the Office of Management and Budget shall establish and 

8 oversee policies and procedures for agencies to follow in 

9 the event of a breach of information security involving the 

10 disclosure of personally identifiable information, including 

11 requirements for— 

12 ‘‘(1) not later than 72 hours after the agency 

13 discovers such a breach, or discovers evidence that 

14 reasonably indicates such a breach has occurred, no15 tice to the individuals whose personally identifiable 

16 information could be compromised as a result of 

17 such breach; 

18 ‘‘(2) timely reporting to a Federal cybersecurity 

19 center, as designated by the Director of the Office 

20 of Management and Budget; and 

21 ‘‘(3) any additional actions that the Director 

22 finds necessary and appropriate, including data 

23 breach analysis, fraud resolution services, identity 

24 theft insurance, and credit protection or monitoring 

25 services. 


tkelley on DSK3SPTVN1PROD with BILLS
8 

•HR 451 IH

1 ‘‘(b) REQUIRED AGENCY ACTION.—The head of each 

2 agency shall ensure that actions taken in response to a 

3 breach of information security involving the disclosure of 

4 personally identifiable information under the authority or 

5 control of the agency comply with policies and procedures 

6 established by the Director of the Office of Management 

7 and Budget under subsection (a). 

8 ‘‘(c) REPORT.—Not later than March 1 of each year, 

9 the Director of the Office of Management and Budget 

10 shall report to Congress on agency compliance with the 

11 policies and procedures established under subsection (a). 

12 ‘‘(d) FEDERAL CYBERSECURITY CENTER DE13 FINED.—The term ‘Federal cybersecurity center’ means 

14 any of the following: 

15 ‘‘(1) The Department of Defense Cyber Crime 

16 Center. 

17 ‘‘(2) The Intelligence Community Incident Re18 sponse Center. 

19 ‘‘(3) The United States Cyber Command Joint 

20 Operations Center. 

21 ‘‘(4) The National Cyber Investigative Joint 

22 Task Force. 

23 ‘‘(5) Central Security Service Threat Oper24 ations Center of the National Security Agency. 


tkelley on DSK3SPTVN1PROD with BILLS
9 

•HR 451 IH

1 ‘‘(6) The United States Computer Emergency 

2 Readiness Team. 

3 ‘‘(7) Any successor to a center, team, or task 

4 force described in paragraphs (1) through (6). 

5 ‘‘(8) Any center that the Director of the Office 

6 of Management and Budget determines is appro7 priate to carry out the requirements of this sec8 tion.’’. 

9 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

10 The table of sections for subchapter II of chapter 35 of 

11 title 44, United States Code, is amended by adding at the 

12 end the following: 

‘‘3559. Privacy breach requirements.’’. 

Æ 


tkelley on DSK3SPTVN1PROD with BILLS