IB 

Union Calendar No. 408 

109TH CONGRESS 

2D SESSION H. R. 2840 

[Report No. 109–675] 

To amend title 5, United States Code, to require that agencies, in promulgating rules, take into consideration the impact of such rules on the 

privacy of individuals, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JUNE 9, 2005 

Mr. CHABOT (for himself, Mr. NADLER, Mr. CANNON, and Mr. DELAHUNT) 

introduced the following bill; which was referred to the Committee on the 

Judiciary 

SEPTEMBER 25, 2006 

Additional sponsors: Mr. BOUCHER, Mr. MCDERMOTT, Mr. KENNEDY of 

Minnesota, and Mr. PAUL

SEPTEMBER 25, 2006 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on June 9, 2005] 

A BILL 

To amend title 5, United States Code, to require that agencies, in promulgating rules, take into consideration the 

impact of such rules on the privacy of individuals, and 

for other purposes. 


hmoore on PROD1PC68 with HMBILLS
2 

•HR 2840 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Agency Protec5 tion of Privacy Act of 2005’’. 

6 SEC. 2. REQUIREMENT THAT AGENCY RULEMAKING TAKE 

7 INTO CONSIDERATION IMPACTS ON INDI8 VIDUAL PRIVACY. 

9 (a) IN GENERAL.—Title 5, United States Code, is 

10 amended by adding after section 553 the following new sec11 tion: 

12 ‘‘§ 553a. Privacy impact assessment in rulemaking 

13 ‘‘(a) INITIAL PRIVACY IMPACT ASSESSMENT.— 

14 ‘‘(1) IN GENERAL.—Whenever an agency is re15 quired by section 553 of this title, or any other law, 

16 to publish a general notice of proposed rulemaking for 

17 a proposed rule, or publishes a notice of proposed 

18 rulemaking for an interpretative rule involving the 

19 internal revenue laws of the United States, and such 

20 rule or proposed rulemaking pertains to the collection, 

21 maintenance, use, or disclosure of personally identifi22 able information from 10 or more individuals, other 

23 than agencies, instrumentalities, or employees of the 

24 Federal government, the agency shall prepare and 

25 make available for public comment an initial privacy 


hmoore on PROD1PC68 with HMBILLS
3 

•HR 2840 RH

1 impact assessment that describes the impact of the 

2 proposed rule on the privacy of individuals. Such as3 sessment or a summary thereof shall be signed by the 

4 senior agency official with primary responsibility for 

5 privacy policy and be published in the Federal Reg6 ister at the time of the publication of a general notice 

7 of proposed rulemaking for the rule. 

8 ‘‘(2) CONTENTS.—Each initial privacy impact 

9 assessment required under this subsection shall con10 tain the following: 

11 ‘‘(A) A description and analysis of the ex12 tent to which the proposed rule will impact the 

13 privacy interests of individuals, including the 

14 extent to which the proposed rule— 

15 ‘‘(i) provides notice of the collection of 

16 personally identifiable information, and 

17 specifies what personally identifiable infor18 mation is to be collected and how it is to be 

19 collected, maintained, used, and disclosed; 

20 ‘‘(ii) allows access to such information 

21 by the person to whom the personally iden22 tifiable information pertains and provides 

23 an opportunity to correct inaccuracies; 


hmoore on PROD1PC68 with HMBILLS
4 

•HR 2840 RH

1 ‘‘(iii) prevents such information, which 

2 is collected for one purpose, from being used 

3 for another purpose; and 

4 ‘‘(iv) provides security for such infor5 mation, including the provision of written 

6 notice to any individual, within 14 days of 

7 the date of compromise, whose privacy in8 terests are compromised by the unauthorized 

9 release of personally identifiable informa10 tion as a result of a breach of security at 

11 or by the agency. 

12 ‘‘(B) A description of any significant alter13 natives to the proposed rule which accomplish 

14 the stated objectives of applicable statutes and 

15 which minimize any significant privacy impact 

16 of the proposed rule on individuals. 

17 ‘‘(b) FINAL PRIVACY IMPACT ASSESSMENT.— 

18 ‘‘(1) IN GENERAL.—Whenever an agency promul19 gates a final rule under section 553 of this title, after 

20 being required by that section or any other law to 

21 publish a general notice of proposed rulemaking, or 

22 promulgates a final interpretative rule involving the 

23 internal revenue laws of the United States, and such 

24 rule or proposed rulemaking pertains to the collection, 

25 maintenance, use, or disclosure of personally identifiVerDate Aug 31 2005 00:26 Sep 26, 2006 Jkt 049200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6203 E:\BILLS\H2840.RH H2840

hmoore on PROD1PC68 with HMBILLS
5 

•HR 2840 RH

1 able information from 10 or more individuals, other 

2 than agencies, instrumentalities, or employees of the 

3 Federal government, the agency shall prepare a final 

4 privacy impact assessment, signed by the senior agen5 cy official with primary responsibility for privacy 

6 policy. 

7 ‘‘(2) CONTENTS.—Each final privacy impact as8 sessment required under this subsection shall contain 

9 the following: 

10 ‘‘(A) A description and analysis of the ex11 tent to which the final rule will impact the pri12 vacy interests of individuals, including the ex13 tent to which such rule— 

14 ‘‘(i) provides notice of the collection of 

15 personally identifiable information, and 

16 specifies what personally identifiable infor17 mation is to be collected and how it is to be 

18 collected, maintained, used, and disclosed; 

19 ‘‘(ii) allows access to such information 

20 by the person to whom the personally iden21 tifiable information pertains and provides 

22 an opportunity to correct inaccuracies; 

23 ‘‘(iii) prevents such information, which 

24 is collected for one purpose, from being used 

25 for another purpose; and 


hmoore on PROD1PC68 with HMBILLS
6 

•HR 2840 RH

1 ‘‘(iv) provides security for such infor2 mation, including the provision of written 

3 notice to any individual, within 14 days of 

4 the date of compromise, whose privacy in5 terests are compromised by the unauthorized 

6 release of personally identifiable informa7 tion as a result of a breach of security at 

8 or by the agency. 

9 ‘‘(B) A summary of any significant issues 

10 raised by the public comments in response to the 

11 initial privacy impact assessment, a summary of 

12 the analysis of the agency of such issues, and a 

13 statement of any changes made in such rule as 

14 a result of such issues. 

15 ‘‘(C) A description of the steps the agency 

16 has taken to minimize the significant privacy 

17 impact on individuals consistent with the stated 

18 objectives of applicable statutes, including a 

19 statement of the factual, policy, and legal reasons 

20 for selecting the alternative adopted in the final 

21 rule and why each one of the other significant al22 ternatives to the rule considered by the agency 

23 which affect the privacy interests of individuals 

24 was rejected. 


hmoore on PROD1PC68 with HMBILLS
7 

•HR 2840 RH

1 ‘‘(3) AVAILABILITY TO PUBLIC.—The agency 

2 shall make copies of the final privacy impact assess3 ment available to members of the public and shall 

4 publish in the Federal Register such assessment or a 

5 summary thereof. 

6 ‘‘(c) WAIVERS.— 

7 ‘‘(1) EMERGENCIES.—An agency head may 

8 waive or delay the completion of some or all of the 

9 requirements of subsections (a) and (b) to the same 

10 extent as the agency head may, under section 608, 

11 waive or delay the completion of some or all of the 

12 requirements of sections 603 and 604, respectively. 

13 ‘‘(2) NATIONAL SECURITY.—An agency head 

14 may, for national security reasons, or to protect from 

15 disclosure classified information, confidential com16 mercial information, or information the disclosure of 

17 which may adversely affect a law enforcement effort, 

18 waive or delay the completion of some or all of the 

19 following requirements: 

20 ‘‘(A) The requirement of subsection (a)(1) to 

21 make an assessment available for public com22 ment, provided that such assessment is made 

23 available, in classified form, to the Committees 

24 on the Judiciary of the House of Representatives 


hmoore on PROD1PC68 with HMBILLS
8 

•HR 2840 RH

1 and the Senate, in lieu of making such assess2 ment available to the public. 

3 ‘‘(B) The requirement of subsection (a)(1) to 

4 have an assessment or summary thereof pub5 lished in the Federal Register, provided that such 

6 assessment or summary is made available, in 

7 classified form, to the Committees on the Judici8 ary of the House of Representatives and the Sen9 ate, in lieu of publishing such assessment or 

10 summary in the Federal Register. 

11 ‘‘(C) The requirements of subsection (b)(3), 

12 provided that the final privacy impact assess13 ment is made available, in classified form, to the 

14 Committees on the Judiciary of the House of 

15 Representatives and the Senate, in lieu of mak16 ing such assessment available to the public and 

17 publishing such assessment in the Federal Reg18 ister. 

19 ‘‘(d) PROCEDURES FOR GATHERING COMMENTS.— 

20 When any rule is promulgated which may have a signifi21 cant privacy impact on individuals, or a privacy impact 

22 on a substantial number of individuals, the head of the 

23 agency promulgating the rule or the official of the agency 

24 with statutory responsibility for the promulgation of the 

25 rule shall assure that individuals have been given an opporVerDate Aug 31 2005 00:26 Sep 26, 2006 Jkt 049200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6203 E:\BILLS\H2840.RH H2840

hmoore on PROD1PC68 with HMBILLS
9 

•HR 2840 RH

1 tunity to participate in the rulemaking for the rule through 

2 techniques such as— 

3 ‘‘(1) the inclusion in an advance notice of pro4 posed rulemaking, if issued, of a statement that the 

5 proposed rule may have a significant privacy impact 

6 on individuals, or a privacy impact on a substantial 

7 number of individuals; 

8 ‘‘(2) the publication of a general notice of pro9 posed rulemaking in publications of national circula10 tion likely to be obtained by individuals; 

11 ‘‘(3) the direct notification of interested individ12 uals; 

13 ‘‘(4) the conduct of open conferences or public 

14 hearings concerning the rule for individuals, includ15 ing soliciting and receiving comments over computer 

16 networks; and 

17 ‘‘(5) the adoption or modification of agency pro18 cedural rules to reduce the cost or complexity of par19 ticipation in the rulemaking by individuals. 

20 ‘‘(e) PERIODIC REVIEW OF RULES.— 

21 ‘‘(1) IN GENERAL.—Each agency shall carry out 

22 a periodic review of the rules promulgated by the 

23 agency that have a significant privacy impact on in24 dividuals, or a privacy impact on a substantial num25 ber of individuals. Under such periodic review, the 


hmoore on PROD1PC68 with HMBILLS
10 

•HR 2840 RH

1 agency shall determine, for each such rule, whether 

2 the rule can be amended or rescinded in a manner 

3 that minimizes any such impact while remaining in 

4 accordance with applicable statutes. For each such de5 termination, the agency shall consider the following 

6 factors: 

7 ‘‘(A) The continued need for the rule. 

8 ‘‘(B) The nature of complaints or comments 

9 received from the public concerning the rule. 

10 ‘‘(C) The complexity of the rule. 

11 ‘‘(D) The extent to which the rule overlaps, 

12 duplicates, or conflicts with other Federal rules, 

13 and, to the extent feasible, with State and local 

14 governmental rules. 

15 ‘‘(E) The length of time since the rule was 

16 last reviewed under this subsection. 

17 ‘‘(F) The degree to which technology, eco18 nomic conditions, or other factors have changed 

19 in the area affected by the rule since the rule was 

20 last reviewed under this subsection. 

21 ‘‘(2) PLAN REQUIRED.—Each agency shall carry 

22 out the periodic review required by paragraph (1) in 

23 accordance with a plan published by such agency in 

24 the Federal Register. Each such plan shall provide for 

25 the review under this subsection of each rule promulVerDate Aug 31 2005 00:26 Sep 26, 2006 Jkt 049200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6203 E:\BILLS\H2840.RH H2840

hmoore on PROD1PC68 with HMBILLS
11 

•HR 2840 RH

1 gated by the agency not later than 10 years after the 

2 date on which such rule was published as the final 

3 rule and, thereafter, not later than 10 years after the 

4 date on which such rule was last reviewed under this 

5 subsection. The agency may amend such plan at any 

6 time by publishing the revision in the Federal Reg7 ister. 

8 ‘‘(3) ANNUAL PUBLICATION.—Each year, each 

9 agency shall publish in the Federal Register a list of 

10 the rules to be reviewed by such agency under this 

11 subsection during the following year. The list shall in12 clude a brief description of each such rule and the 

13 need for and legal basis of such rule and shall invite 

14 public comment upon the determination to be made 

15 under this subsection with respect to such rule. 

16 ‘‘(f) JUDICIAL REVIEW.— 

17 ‘‘(1) IN GENERAL.—For any rule subject to this 

18 section, an individual who is adversely affected or ag19 grieved by final agency action is entitled to judicial 

20 review of agency compliance with the requirements of 

21 subsections (b) and (c) in accordance with chapter 7. 

22 Agency compliance with subsection (d) shall be judi23 cially reviewable in connection with judicial review of 

24 subsection (b). 


hmoore on PROD1PC68 with HMBILLS
12 

•HR 2840 RH

1 ‘‘(2) JURISDICTION.—Each court having juris2 diction to review such rule for compliance with sec3 tion 553, or under any other provision of law, shall 

4 have jurisdiction to review any claims of noncompli5 ance with subsections (b) and (c) in accordance with 

6 chapter 7. Agency compliance with subsection (d) 

7 shall be judicially reviewable in connection with judi8 cial review of subsection (b). 

9 ‘‘(3) LIMITATIONS.— 

10 ‘‘(A) An individual may seek such review 

11 during the period beginning on the date of final 

12 agency action and ending 1 year later, except 

13 that where a provision of law requires that an 

14 action challenging a final agency action be com15 menced before the expiration of 1 year, such less16 er period shall apply to an action for judicial re17 view under this subsection. 

18 ‘‘(B) In the case where an agency delays the 

19 issuance of a final privacy impact assessment 

20 pursuant to subsection (c), an action for judicial 

21 review under this section shall be filed not later 

22 than— 

23 ‘‘(i) 1 year after the date the assess24 ment is made available to the public; or 


hmoore on PROD1PC68 with HMBILLS
13 

•HR 2840 RH

1 ‘‘(ii) where a provision of law requires 

2 that an action challenging a final agency 

3 regulation be commenced before the expira4 tion of the 1-year period, the number of 

5 days specified in such provision of law that 

6 is after the date the assessment is made 

7 available to the public. 

8 ‘‘(4) RELIEF.—In granting any relief in an ac9 tion under this subsection, the court shall order the 

10 agency to take corrective action consistent with this 

11 section and chapter 7, including, but not limited to— 

12 ‘‘(A) remanding the rule to the agency; and 

13 ‘‘(B) deferring the enforcement of the rule 

14 against individuals, unless the court finds that 

15 continued enforcement of the rule is in the public 

16 interest. 

17 ‘‘(5) RULE OF CONSTRUCTION.—Nothing in this 

18 subsection shall be construed to limit the authority of 

19 any court to stay the effective date of any rule or pro20 vision thereof under any other provision of law or to 

21 grant any other relief in addition to the requirements 

22 of this subsection. 

23 ‘‘(6) RECORD OF AGENCY ACTION.—In an action 

24 for the judicial review of a rule, the privacy impact 

25 assessment for such rule, including an assessment preVerDate Aug 31 2005 00:26 Sep 26, 2006 Jkt 049200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6203 E:\BILLS\H2840.RH H2840

hmoore on PROD1PC68 with HMBILLS
14 

•HR 2840 RH

1 pared or corrected pursuant to paragraph (4), shall 

2 constitute part of the entire record of agency action 

3 in connection with such review. 

4 ‘‘(7) EXCLUSIVITY.—Compliance or noncompli5 ance by an agency with the provisions of this section 

6 shall be subject to judicial review only in accordance 

7 with this subsection. 

8 ‘‘(8) SAVINGS CLAUSE.—Nothing in this sub9 section bars judicial review of any other impact state10 ment or similar assessment required by any other law 

11 if judicial review of such statement or assessment is 

12 otherwise permitted by law. 

13 ‘‘(g) DEFINITION.—For purposes of this section, the 

14 term ‘personally identifiable information’ means informa15 tion that can be used to identify an individual, including 

16 such individual’s name, address, telephone number, photo17 graph, social security number or other identifying informa18 tion. It includes information about such individual’s med19 ical or financial condition.’’. 

20 (b) PERIODIC REVIEW TRANSITION PROVISIONS.— 

21 (1) INITIAL PLAN.—For each agency, the plan 

22 required by subsection (e) of section 553a of title 5, 

23 United States Code (as added by subsection (a)), shall 

24 be published not later than 180 days after the date of 

25 the enactment of this Act. 


hmoore on PROD1PC68 with HMBILLS
15 

•HR 2840 RH

1 (2) REVIEW PERIOD.—In the case of a rule pro2 mulgated by an agency before the date of the enact3 ment of this Act, such plan shall provide for the peri4 odic review of such rule before the expiration of the 

5 10-year period beginning on the date of the enactment 

6 of this Act. For any such rule, the head of the agency 

7 may provide for a 1-year extension of such period if 

8 the head of the agency, before the expiration of the pe9 riod, certifies in a statement published in the Federal 

10 Register that reviewing such rule before the expiration 

11 of the period is not feasible. The head of the agency 

12 may provide for additional 1-year extensions of the 

13 period pursuant to the preceding sentence, but in no 

14 event may the period exceed 15 years. 

15 (c) CONGRESSIONAL REVIEW.—Section 801(a)(1)(B) 

16 of title 5, United States Code, is amended— 

17 (1) by redesignating clauses (iii) and (iv) as 

18 clauses (iv) and (v), respectively; and 

19 (2) by inserting after clause (ii) the following 

20 new clause: 

21 ‘‘(iii) the agency’s actions relevant to section 

22 553a;’’. 

23 (d) CLERICAL AMENDMENT.—The table of sections at 

24 the beginning of chapter 5 of title 5, United States Code, 


hmoore on PROD1PC68 with HMBILLS
16 

•HR 2840 RH

1 is amended by adding after the item relating to section 553 

2 the following new item: 

‘‘553a. Privacy impact assessment in rulemaking.’’. 


hmoore on PROD1PC68 with HMBILLS

hmoore on PROD1PC68 with HMBILLS
Union Calendar No. 408 

109TH CONGRESS 

2D SESSION H. R. 2840 

[Report No. 109

–675] 

A BILL 

To amend title 5, United States Code, to require 

vacy of individuals, and for other purposes. consideration the impact of such rules on the prithat agencies, in promulgating rules, take into 

SEPTEMBER 25, 2006 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


hmoore on PROD1PC68 with HMBILLS