69–006 

110TH CONGRESS REPORT " ! HOUSE OF REPRESENTATIVES 2d Session 110–755 

DEPARTMENT OF HOMELAND SECURITY COMPONENT 

PRIVACY OFFICER ACT OF 2008 

JULY 10, 2008.—Committed to the Committee of the Whole House on the State of 

the Union and ordered to be printed 

Mr. THOMPSON of Mississippi, from the Committee on Homeland 

Security, submitted the following 

R E P O R T 

[To accompany H.R. 5170] 

[Including cost estimate of the Congressional Budget Office] 

The Committee on Homeland Security, to whom was referred the 

bill (H.R. 5170) to amend the Homeland Security Act of 2002 to 

provide for a privacy official within each component of the Department of Homeland Security, and for other purposes, having considered the same, report favorably thereon with an amendment and 

recommend that the bill as amended do pass. 

CONTENTS 

Page 

Purpose and Summary ............................................................................................ 3 

Background and Need for Legislation .................................................................... 3 

Hearings ................................................................................................................... 3 

Committee Consideration ........................................................................................ 3 

Committee Votes ...................................................................................................... 4 

Committee Oversight Findings ............................................................................... 4 

New Budget Authority, Entitlement Authority, and Tax Expenditures ............. 4 

Congressional Budget Office Estimate ................................................................... 4 

Statement of General Performance Goals and Objectives .................................... 5 

Congressional Earmarks, Limited Tax Benefits, and Limited Tariff Benefits ... 6 

Federal Mandates Statement ................................................................................. 6 

Advisory Committee Statement .............................................................................. 6 

Constitutional Authority Statement ...................................................................... 6 

Applicability to Legislative Branch ........................................................................ 6 

Section-by-Section Analysis of the Legislation ...................................................... 6 

Changes in Existing Law Made by the Bill, as Reported ..................................... 7 

The amendment is as follows: 

Strike all after the enacting clause and insert the following: 


erowe on PROD1PC71 with REPORTS
2 

SECTION 1. SHORT TITLE. 

This Act may be cited as the ‘‘Department of Homeland Security Component Privacy Officer Act of 2008’’. 

SEC. 2. ESTABLISHMENT OF PRIVACY OFFICIAL WITHIN EACH COMPONENT OF DEPARTMENT 

OF HOMELAND SECURITY. 

(a) IN GENERAL.—Subtitle C of title II of the Homeland Security Act of 2002 (6 

U.S.C. 141 et seq.) is amended by inserting after section 222 the following new section: 

‘‘SEC. 222A. PRIVACY OFFICIALS. 

‘‘(a) DESIGNATION.— ‘‘(1) IN GENERAL.—For each component of the Department under paragraph 

(2), the Secretary shall, in consultation with the head of the component, designate a full-time privacy official, who shall report directly to the senior official 

appointed under section 222. Each such component privacy official shall have 

primary responsibility for its component in implementing the privacy policy for 

the Department established by the senior official appointed under section 222. ‘‘(2) COMPONENTS.—The components of the Department referred to in this 

subparagraph are as follows: ‘‘(A) The Transportation Security Administration. 

‘‘(B) The Bureau of Citizenship and Immigration Services. 

‘‘(C) Customs and Border Protection. 

‘‘(D) Immigration and Customs Enforcement. 

‘‘(E) The Federal Emergency Management Agency. 

‘‘(F) The Coast Guard. 

‘‘(G) The Directorate of Science and Technology. 

‘‘(H) The Office of Intelligence and Analysis. 

‘‘(I) The Directorate for National Protection and Programs. ‘‘(b) RESPONSIBILITIES.—Each privacy official designated under subsection (a) shall 

report directly to both the head of the official’s component and the senior official 

appointed under section 222, and shall have the following responsibilities with respect to the component: 

‘‘(1) Serve as such senior official’s main point of contact at the component to 

implement the polices and directives of such senior official in carrying out section 222. 

‘‘(2) Advise the head of that component on privacy considerations when any 

law, regulation, program, policy, procedure, or guideline is proposed, developed, 

or implemented. 

‘‘(3) Assure that the use of technologies by the component sustain or enhance 

privacy protections relating to the use, collection, and disclosure of personal information within the component. 

‘‘(4) Identify privacy issues related to component programs and apply appropriate privacy policies in accordance with Federal privacy law and Departmental policies developed to ensure that the component protects the privacy of 

individuals affected by its activities. 

‘‘(5) Monitor the component’s compliance with all applicable Federal privacy 

laws and regulations, implement corrective, remedial, and preventive actions 

and notify the senior official appointed under section 222 of privacy issues or 

non-compliance, whenever necessary. ‘‘(6) Ensure that personal information contained in Privacy Act systems of 

records is handled in full compliance with section 552a of title 5, United States 

Code. 

‘‘(7) Assist in drafting and reviewing privacy impact assessments, privacy 

threshold assessments, and system of records notices, in conjunction with and 

under the direction of the senior official appointed under section 222, for any 

new or substantially changed program or technology that collects, maintains, or 

disseminates personally identifiable information within the official’s component. 

‘‘(8) Assist in drafting and reviewing privacy impact assessments, privacy 

threshold assessments, and system of records notices in conjunction with and 

under the direction of the senior official appointed under section 222, for proposed rulemakings and regulations within the component. 

‘‘(9) Conduct supervision of programs, regulations, policies, procedures, or 

guidelines to ensure the component’s protection of privacy and, as necessary, 

promulgate guidelines and conduct oversight to ensure the protection of privacy. 

‘‘(10) Implement and monitor privacy training for component employees and 

contractors in coordination with the senior official appointed under section 222. 

‘‘(11) Provide the senior official appointed under section 222 with written materials and information regarding the relevant activities of the component, including privacy violations and abuse, that are needed by the senior official to 


erowe on PROD1PC71 with REPORTS
3 

successfully prepare the reports the senior official submits to Congress and prepares on behalf of the Department. 

‘‘(12) Any other responsibilities assigned by the Secretary or the senior official 

appointed under section 222. 

‘‘(c) ROLE OF COMPONENT HEADS.—The head of a component identified in subsection (a)(2) shall ensure that the privacy official designated under subsection (a) 

for that component—

‘‘(1) has the information, material, and resources necessary to fulfill the responsibilities of such official under this section; 

‘‘(2) is advised of proposed policy changes and the development of new programs, rules, regulations, procedures, or guidelines during the planning stage 

and is included in the decision-making process; and 

‘‘(3) is given access to material and personnel the privacy official deems necessary to carry out the official’s responsibilities. 

‘‘(d) LIMITATION.—Nothing in this section shall be considered to abrogate the role 

and responsibilities of the senior official appointed under section 222.’’. 

(b) CLERICAL AMENDMENT.—The table of contents in section 1(b) of such Act is 

amended by inserting after the item related to section 222 the following new item: 

‘‘Sec. 222A. Privacy officials.’’. 

PURPOSE AND SUMMARY

The purpose of H.R. 5170 is to amend the Homeland Security Act 

of 2002 to provide for a privacy official within each component of 

the Department of Homeland Security, and for other purposes. 

BACKGROUND AND NEED FOR LEGISLATION

Under the current structure, the Chief Privacy Officer works 

closely with other departmental components, such as the General 

Counsel’s Office, the Policy Office and the Office for Civil Rights 

and Civil Liberties in addressing privacy issues; however, many of 

the Department Components operate without an on-site full time 

privacy professional. 

Additionally, components with a designated privacy officer have 

generally produced more Privacy Impact Assessments (PIAs) than 

components without privacy officers. In fact, of the eleven DHS 

components that have published PIAs, only three have designated 

privacy officers. Yet these three components account for 57 percent 

of all published DHS PIAs. Moreover, according to the DHS Office 

of Privacy 2007 Annual Report to Congress ‘‘establishing and increasing the number of well-trained privacy officers at the component level helps to ensure that privacy is built into new and existing programs at the beginning of the development process.’’ Additionally, the presence of a full-time Component Privacy Officer 

would ensure that privacy considerations are integrated into the 

decision-making process at all of the DHS Components. 

HEARINGS

No hearings were held on H.R. 5170. 

COMMITTEE CONSIDERATION

H.R. 5170 was introduced in the House on January 29, 2008, by 

Mr. Carney and Mr. Thompson of Mississippi and referred solely 

to the Committee on Homeland Security. Within the Committee 

H.R. 5170 was referred to the Subcommittee on Management, Investigations, and Oversight. 

On June 26, 2008, the Chairman discharged the Subcommittee 

on Management, Investigations, and Oversight from further considVerDate Aug 31 2005 00:49 Jul 12, 2008 Jkt 069006 PO 00000 Frm 00003 Fmt 6659 Sfmt 6602 E:\HR\OC\HR755.XXX HR755

erowe on PROD1PC71 with REPORTS
4 

eration of H.R. 5170. The Committee then proceeded to the consideration of H.R. 5170 and ordered the measure to be reported to the 

House favorably, as amended, by voice vote. 

The Committee adopted the measure, as amended, by unanimous 

consent. 

The following amendment was offered: 

An Amendment in the Nature of a Substitute offered by Mr. Carney (#1); was AGREED TO by unanimous consent. 

COMMITTEE VOTES

Clause 3(b) of rule XIII of the Rules of the House of Representatives requires the Committee to list the recorded votes on the motion to report legislation and amendments thereto. 

No recorded votes were requested during Committee consideration. 

COMMITTEE OVERSIGHT FINDINGS

Pursuant to clause 3(c)(1) of rule XIII of the Rules of the House 

of Representatives, the Committee has held oversight hearings and 

made findings that are reflected in this report. 

NEW BUDGET AUTHORITY, ENTITLEMENT AUTHORITY, AND TAX

EXPENDITURES

In compliance with clause 3(c)(2) of rule XIII of the Rules of the 

House of Representatives, the Committee finds that H.R. 5170, the 

Department of Homeland Security Component Privacy Officer Act 

of 2008, would result in no new or increased budget authority, entitlement authority, or tax expenditures or revenues. 

CONGRESSIONAL BUDGET OFFICE ESTIMATE

The Committee adopts as its own the cost estimate prepared by 

the Director of the Congressional Budget Office pursuant to section 

402 of the Congressional Budget Act of 1974. 

U.S. CONGRESS, CONGRESSIONAL BUDGET OFFICE, Washington, DC, July 8, 2008. 

Hon. BENNIE G. THOMPSON, Chairman, Committee on Homeland Security, 

House of Representatives, Washington, DC. 

DEAR MR. CHAIRMAN: The Congressional Budget Office has prepared the enclosed cost estimate for H.R. 5170, the Department of 

Homeland Security Component Privacy Officer Act of 2008. 

If you wish further details on this estimate, we will be pleased 

to provide them. The CBO staff contact is Mark Grabowicz. 

Sincerely, 

ROBERT A. SUNSHINE

(For Peter R. Orszag, Director). 

Enclosure. 


erowe on PROD1PC71 with REPORTS
5 

H.R. 5170—Department of Homeland Security Component Privacy 

Officer Act of 2008 

CBO estimates that implementing H.R. 5170 would cost about $1 

million annually, assuming the availability of appropriated funds. 

Enacting the bill would not affect direct spending or revenues. H.R. 

5170 contains no intergovernmental or private-sector mandates as 

defined in the Unfunded Mandates Reform Act and would impose 

no costs on state, local, or tribal governments. 

H.R. 5170 would direct the Department of Homeland Security 

(DHS) to designate full-time officials to oversee privacy considerations and policies for each of the department’s nine components, 

including the Federal Emergency Management Agency, the Coast 

Guard, and the other agencies specified in the bill. Those individuals would coordinate all privacy matters for their respective agencies, including training and compliance, and would report to the 

Chief Privacy Officer of DHS. 

According to DHS, four of the nine department components already have full-time privacy officials, so implementing H.R. 5170 

would require filling five positions. We expect that each new official 

would be compensated at level 14 or 15 of the General Schedule. 

CBO estimates that the costs for those positions would total about 

$1 million annually, including salaries and benefits for those officials and for the costs of any support staff. 

The CBO staff contact for this estimate is Mark Grabowicz. This 

estimate was approved by Peter H. Fontaine, Assistant Director for 

Budget Analysis. 

STATEMENT OF GENERAL PERFORMANCE GOALS AND OBJECTIVES

Pursuant to clause 3(c)(4) of rule XIII of the Rules of the House 

of Representatives, H.R. 5170 contains the following general performance goals and objectives, including outcome related goals and 

objectives authorized. 

The purpose of this legislation is to create Component Privacy 

Officers in the Department of Homeland Security component agencies. Unfortunately, public trust in the Department’s ability to protect personal privacy rights is abysmally low. This bill should aid 

in improving the manner in which the Department handles privacy 

related issues and should also foster the Department’s mandate to 

sustain privacy protections. In turn, public trust with respect to the 

Department should improve. H.R. 5170 adds a new section 222A to 

the Homeland Security Act of 2002 (6 U.S.C. 361 et seq.), which 

requires the Secretary of Homeland Security, in consultation with 

the Component Head, to create Component Privacy Officers at the 

following Department of Homeland Security components: The 

Transportation Security Administration; The Bureau of Citizenship 

and Immigration Services; Customs and Border Protection; Immigration and Customs Enforcement; The Federal Emergency Management Agency; The Coast Guard; The Directorate of Science and 

Technology; The Office of Intelligence and Analysis; and The Directorate for National Protection and Programs. 


erowe on PROD1PC71 with REPORTS
6 

CONGRESSIONAL EARMARKS, LIMITED TAX BENEFITS, AND LIMITED

TARIFF BENEFITS

In compliance with rule XXI of the Rules of the House of Representatives, this bill, as reported, contains no congressional earmarks, limited tax benefits, or limited tariff benefits as defined in 

clause 9(d), 9(e), or 9(f) of the rule XXI. 

FEDERAL MANDATES STATEMENT

The Committee adopts as its own the estimate of Federal mandates prepared by the Director of the Congressional Budget Office 

pursuant to section 423 of the Unfunded Mandates Reform Act. 

ADVISORY COMMITTEE STATEMENT

No advisory committees within the meaning of section 5(b) of the 

Federal Advisory Committee Act were created by this legislation. 

CONSTITUTIONAL AUTHORITY STATEMENT

Pursuant to clause 3(d)(1) of rule XIII of the Rules of the House 

of Representatives, the Committee finds that the Constitutional authority for this legislation is provided in Article I, section 8, clause 

1, which grants Congress the power to provide for the common Defense of the United States. 

APPLICABILITY TO LEGISLATIVE BRANCH

The Committee finds that the legislation does not relate to the 

terms and conditions of employment or access to public services or 

accommodations within the meaning of section 102(b)(3) of the Congressional Accountability Act. 

SECTION-BY-SECTION ANALYSIS OF THE LEGISLATION

Section 1. Short title 

This section designates the short title as the ‘‘Department of 

Homeland Security Component Privacy Act of 2008.’’

Section 2. Establishment of privacy official within each component 

of Department of Homeland Security 

The Homeland Security Act of 2002 (P. L. 107–296) is amended 

by inserting after Section 222, which creates the ‘‘senior official’’ at 

the Department that is responsible for privacy policy, a new section 

222A, which will govern the component privacy officers. 

Section 222A. Privacy officials 

This section indicates that the Secretary, in consultation with 

the head of each Component, shall designate a full-time privacy official in certain components of the Department of Homeland Security. 

This section states that the components referred to in the bill 

are: The Transportation Security Administration; the Bureau of 

Citizenship and Immigration Services; Customs and Border Protection; Immigration and Customs Enforcement; the Federal Emergency Management Agency; the Coast Guard; the Directorate of 


erowe on PROD1PC71 with REPORTS
7 

Science and Technology; the Office of Intelligence and Analysis; 

and the Directorate for National Protection and Programs. 

Responsibilities. This section states that the Component Privacy 

Officers shall have primary responsibility for implementing the Department’s privacy policy in the Component Privacy Officer’s component agency. Additionally, it indicates that the Component Privacy Officers shall report directly to the senior official appointed 

under section 222, hereinafter referred to for clarification purposes 

as the ‘‘DHS Chief Privacy Officer.’’ This section also states that in addition to the directly reporting 

to the DHS Chief Privacy Officer, each Component Privacy Officer 

shall also report directly to the head of that officer’s component. 

This section also lists the responsibilities of the Component Privacy 

Officers and describes in detail the manner in which they will monitor and exercise oversight over privacy matters within their respective components. This section also indicates that in addition to 

the responsibilities enumerated in the bill, the Component Privacy 

Officers shall also execute any other responsibilities assigned by 

the Secretary or the DHS Chief Privacy Officer. 

This section states that the head of the components shall assist 

the Component Privacy Officers in carrying out their duties by ensuring that the officers have the information, material, and resources necessary to fulfill their responsibilities. This section also 

provides that the head of the components shall make certain that 

the Component Privacy Officers are advised of proposed policy 

changes and the development of new programs, rules, regulations, 

procedures, or guidelines during the planning stage. This section 

also states that the Component Privacy Officers shall be included 

in the component’s decision-making process and be given access to 

the necessary material and personnel to carry out the responsibilities set forth in the bill. 

This section states that it is not the intention of this bill to abrogate the current role and responsibilities of the DHS Privacy Officer. 

CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

In compliance with clause 3(e) of rule XIII of the Rules of the 

House of Representatives, changes in existing law made by the bill, 

as reported, are shown as follows (new matter is printed in italic 

and existing law in which no change is proposed is shown in 

roman): 

HOMELAND SECURITY ACT OF 2002 

SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

(a) * * * 

(b) TABLE OF CONTENTS.—The table of contents for this Act is as 

follows: 

* * * * * * * 

TITLE II—INFORMATION ANALYSIS AND INFRASTRUCTURE PROTECTION 

* * * * * * * 


erowe on PROD1PC71 with REPORTS
8 

Subtitle C—Information Security 

* * * * * * * 

Sec. 222A. Privacy officials. 

* * * * * * * 

TITLE II—INFORMATION ANALYSIS AND 

INFRASTRUCTURE PROTECTION 

* * * * * * * 

Subtitle C—Information Security 

* * * * * * * 

SEC. 222A. PRIVACY OFFICIALS. 

(a) DESIGNATION.— (1) IN GENERAL.—For each component of the Department 

under paragraph (2), the Secretary shall, in consultation with 

the head of the component, designate a full-time privacy official, 

who shall report directly to the senior official appointed under 

section 222. Each such component privacy official shall have 

primary responsibility for its component in implementing the 

privacy policy for the Department established by the senior official appointed under section 222. 

(2) COMPONENTS.—The components of the Department referred to in this subparagraph are as follows: 

(A) The Transportation Security Administration. 

(B) The Bureau of Citizenship and Immigration Services. 

(C) Customs and Border Protection. 

(D) Immigration and Customs Enforcement. 

(E) The Federal Emergency Management Agency. 

(F) The Coast Guard. 

(G) The Directorate of Science and Technology. 

(H) The Office of Intelligence and Analysis. 

(I) The Directorate for National Protection and Programs. 

(b) RESPONSIBILITIES.—Each privacy official designated under 

subsection (a) shall report directly to both the head of the official’s 

component and the senior official appointed under section 222, and 

shall have the following responsibilities with respect to the component: 

(1) Serve as such senior official’s main point of contact at the 

component to implement the polices and directives of such senior official in carrying out section 222. 

(2) Advise the head of that component on privacy considerations when any law, regulation, program, policy, procedure, or 

guideline is proposed, developed, or implemented. 

(3) Assure that the use of technologies by the component sustain or enhance privacy protections relating to the use, collection, and disclosure of personal information within the component. 

(4) Identify privacy issues related to component programs and 

apply appropriate privacy policies in accordance with Federal 

privacy law and Departmental policies developed to ensure that 


erowe on PROD1PC71 with REPORTS
9 

the component protects the privacy of individuals affected by its 

activities. 

(5) Monitor the component’s compliance with all applicable 

Federal privacy laws and regulations, implement corrective, remedial, and preventive actions and notify the senior official appointed under section 222 of privacy issues or non-compliance, 

whenever necessary. 

(6) Ensure that personal information contained in Privacy 

Act systems of records is handled in full compliance with section 552a of title 5, United States Code. 

(7) Assist in drafting and reviewing privacy impact assessments, privacy threshold assessments, and system of records notices, in conjunction with and under the direction of the senior 

official appointed under section 222, for any new or substantially changed program or technology that collects, maintains, 

or disseminates personally identifiable information within the 

official’s component. 

(8) Assist in drafting and reviewing privacy impact assessments, privacy threshold assessments, and system of records notices in conjunction with and under the direction of the senior 

official appointed under section 222, for proposed rulemakings 

and regulations within the component. 

(9) Conduct supervision of programs, regulations, policies, 

procedures, or guidelines to ensure the component’s protection of 

privacy and, as necessary, promulgate guidelines and conduct 

oversight to ensure the protection of privacy. 

(10) Implement and monitor privacy training for component 

employees and contractors in coordination with the senior official appointed under section 222. 

(11) Provide the senior official appointed under section 222 

with written materials and information regarding the relevant 

activities of the component, including privacy violations and 

abuse, that are needed by the senior official to successfully prepare the reports the senior official submits to Congress and prepares on behalf of the Department. 

(12) Any other responsibilities assigned by the Secretary or 

the senior official appointed under section 222. 

(c) ROLE OF COMPONENT HEADS.—The head of a component identified in subsection (a)(2) shall ensure that the privacy official designated under subsection (a) for that component— (1) has the information, material, and resources necessary to 

fulfill the responsibilities of such official under this section; 

(2) is advised of proposed policy changes and the development 

of new programs, rules, regulations, procedures, or guidelines 

during the planning stage and is included in the decision-making process; and 

(3) is given access to material and personnel the privacy official deems necessary to carry out the official’s responsibilities. 

(d) LIMITATION.—Nothing in this section shall be considered to 

abrogate the role and responsibilities of the senior official appointed 

under section 222. 

* * * * * * * 

Æ 


erowe on PROD1PC71 with REPORTS