I 

109TH CONGRESS 

1ST SESSION H. R. 2840

To amend title 5, United States Code, to require that agencies, in promulgating rules, take into consideration the impact of such rules on the 

privacy of individuals, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JUNE 9, 2005

Mr. CHABOT (for himself, Mr. NADLER, Mr. CANNON, and Mr. DELAHUNT) 

introduced the following bill; which was referred to the Committee on the 

Judiciary 

A BILL

To amend title 5, United States Code, to require that agencies, in promulgating rules, take into consideration the 

impact of such rules on the privacy of individuals, and 

for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Agency Pro5 tection of Privacy Act of 2005’’. 
2

•HR 2840 IH 

1 SEC. 2. REQUIREMENT THAT AGENCY RULEMAKING TAKE 

2 INTO CONSIDERATION IMPACTS ON INDI3 VIDUAL PRIVACY. 

4 (a) IN GENERAL.—Title 5, United States Code, is 

5 amended by adding after section 553 the following new 

6 section: 

7 ‘‘§ 553a. Privacy impact assessment in rulemaking 

8 ‘‘(a) INITIAL PRIVACY IMPACT ASSESSMENT.—

9 ‘‘(1) IN GENERAL.—Whenever an agency is re10 quired by section 553 of this title, or any other law, 

11 to publish a general notice of proposed rulemaking 

12 for a proposed rule, or publishes a notice of pro13 posed rulemaking for an interpretative rule involving 

14 the internal revenue laws of the United States, and 

15 such rule or proposed rulemaking pertains to the 

16 collection, maintenance, use, or disclosure of person17 ally identifiable information from 10 or more indi18 viduals, other than agencies, instrumentalities, or 

19 employees of the Federal Government, the agency 

20 shall prepare and make available for public comment 

21 an initial privacy impact assessment that describes 

22 the impact of the proposed rule on the privacy of in23 dividuals. Such assessment or a summary thereof 

24 shall be signed by the senior agency official with pri25 mary responsibility for privacy policy and be pub26 lished in the Federal Register at the time of the 
3

•HR 2840 IH 

1 publication of a general notice of proposed rule2 making for the rule. 

3 ‘‘(2) CONTENTS.—Each initial privacy impact 

4 assessment required under this subsection shall con5 tain the following: 

6 ‘‘(A) A description and analysis of the ex7 tent to which the proposed rule will impact the 

8 privacy interests of individuals, including the 

9 extent to which the proposed rule—

10 ‘‘(i) provides notice of the collection of 

11 personally identifiable information, and 

12 specifies what personally identifiable infor13 mation is to be collected and how it is to 

14 be collected, maintained, used, and dis15 closed; 

16 ‘‘(ii) allows access to such information 

17 by the person to whom the personally iden18 tifiable information pertains and provides 

19 an opportunity to correct inaccuracies; 

20 ‘‘(iii) prevents such information, 

21 which is collected for one purpose, from 

22 being used for another purpose; and 

23 ‘‘(iv) provides security for such infor24 mation. 
4

•HR 2840 IH 

1 ‘‘(B) A description of any significant alter2 natives to the proposed rule which accomplish 

3 the stated objectives of applicable statutes and 

4 which minimize any significant privacy impact 

5 of the proposed rule on individuals. 

6 ‘‘(b) FINAL PRIVACY IMPACT ASSESSMENT.—

7 ‘‘(1) IN GENERAL.—Whenever an agency pro8 mulgates a final rule under section 553 of this title, 

9 after being required by that section or any other law 

10 to publish a general notice of proposed rulemaking, 

11 or promulgates a final interpretative rule involving 

12 the internal revenue laws of the United States, and 

13 such rule or proposed rulemaking pertains to the 

14 collection, maintenance, use, or disclosure of person15 ally identifiable information from 10 or more indi16 viduals, other than agencies, instrumentalities, or 

17 employees of the Federal Government, the agency 

18 shall prepare a final privacy impact assessment, 

19 signed by the senior agency official with primary re20 sponsibility for privacy policy. 

21 ‘‘(2) CONTENTS.—Each final privacy impact as22 sessment required under this subsection shall con23 tain the following: 

24 ‘‘(A) A description and analysis of the ex25 tent to which the final rule will impact the pri-
5

•HR 2840 IH 

1 vacy interests of individuals, including the ex2 tent to which such rule—

3 ‘‘(i) provides notice of the collection of 

4 personally identifiable information, and 

5 specifies what personally identifiable infor6 mation is to be collected and how it is to 

7 be collected, maintained, used, and dis8 closed; 

9 ‘‘(ii) allows access to such information 

10 by the person to whom the personally iden11 tifiable information pertains and provides 

12 an opportunity to correct inaccuracies; 

13 ‘‘(iii) prevents such information, 

14 which is collected for one purpose, from 

15 being used for another purpose; and 

16 ‘‘(iv) provides security for such infor17 mation. 

18 ‘‘(B) A summary of any significant issues 

19 raised by the public comments in response to 

20 the initial privacy impact assessment, a sum21 mary of the analysis of the agency of such 

22 issues, and a statement of any changes made in 

23 such rule as a result of such issues. 

24 ‘‘(C) A description of the steps the agency 

25 has taken to minimize the significant privacy 
6

•HR 2840 IH 

1 impact on individuals consistent with the stated 

2 objectives of applicable statutes, including a 

3 statement of the factual, policy, and legal rea4 sons for selecting the alternative adopted in the 

5 final rule and why each one of the other signifi6 cant alternatives to the rule considered by the 

7 agency which affect the privacy interests of in8 dividuals was rejected. 

9 ‘‘(3) AVAILABILITY TO PUBLIC.—The agency 

10 shall make copies of the final privacy impact assess11 ment available to members of the public and shall 

12 publish in the Federal Register such assessment or 

13 a summary thereof. 

14 ‘‘(c) WAIVERS.—

15 ‘‘(1) EMERGENCIES.—An agency head may 

16 waive or delay the completion of some or all of the 

17 requirements of subsections (a) and (b) to the same 

18 extent as the agency head may, under section 608, 

19 waive or delay the completion of some or all of the 

20 requirements of sections 603 and 604, respectively. 

21 ‘‘(2) NATIONAL SECURITY.—An agency head 

22 may, for national security reasons, or to protect 

23 from disclosure classified information, confidential 

24 commercial information, or information the disclo25 sure of which may adversely affect a law enforce-
7

•HR 2840 IH 

1 ment effort, waive or delay the completion of some 

2 or all of the following requirements: 

3 ‘‘(A) The requirement of subsection (a)(1) 

4 to make an assessment available for public com5 ment. 

6 ‘‘(B) The requirement of subsection (a)(1) 

7 to have an assessment or summary thereof pub8 lished in the Federal Register. 

9 ‘‘(C) The requirements of subsection 

10 (b)(3). 

11 ‘‘(d) PROCEDURES FOR GATHERING COMMENTS.—

12 When any rule is promulgated which may have a signifi13 cant privacy impact on individuals, or a privacy impact 

14 on a substantial number of individuals, the head of the 

15 agency promulgating the rule or the official of the agency 

16 with statutory responsibility for the promulgation of the 

17 rule shall assure that individuals have been given an op18 portunity to participate in the rulemaking for the rule 

19 through techniques such as—

20 ‘‘(1) the inclusion in an advance notice of pro21 posed rulemaking, if issued, of a statement that the 

22 proposed rule may have a significant privacy impact 

23 on individuals, or a privacy impact on a substantial 

24 number of individuals; 
8

•HR 2840 IH 

1 ‘‘(2) the publication of a general notice of pro2 posed rulemaking in publications of national circula3 tion likely to be obtained by individuals; 

4 ‘‘(3) the direct notification of interested individ5 uals; 

6 ‘‘(4) the conduct of open conferences or public 

7 hearings concerning the rule for individuals, includ8 ing soliciting and receiving comments over computer 

9 networks; and 

10 ‘‘(5) the adoption or modification of agency 

11 procedural rules to reduce the cost or complexity of 

12 participation in the rulemaking by individuals. 

13 ‘‘(e) PERIODIC REVIEW OF RULES.—

14 ‘‘(1) IN GENERAL.—Each agency shall carry 

15 out a periodic review of the rules promulgated by the 

16 agency that have a significant privacy impact on in17 dividuals, or a privacy impact on a substantial num18 ber of individuals. Under such periodic review, the 

19 agency shall determine, for each such rule, whether 

20 the rule can be amended or rescinded in a manner 

21 that minimizes any such impact while remaining in 

22 accordance with applicable statutes. For each such 

23 determination, the agency shall consider the fol24 lowing factors: 

25 ‘‘(A) The continued need for the rule. 
9

•HR 2840 IH 

1 ‘‘(B) The nature of complaints or com2 ments received from the public concerning the 

3 rule. 

4 ‘‘(C) The complexity of the rule. 

5 ‘‘(D) The extent to which the rule over6 laps, duplicates, or conflicts with other Federal 

7 rules, and, to the extent feasible, with State and 

8 local governmental rules. 

9 ‘‘(E) The length of time since the rule was 

10 last reviewed under this subsection. 

11 ‘‘(F) The degree to which technology, eco12 nomic conditions, or other factors have changed 

13 in the area affected by the rule since the rule 

14 was last reviewed under this subsection. 

15 ‘‘(2) PLAN REQUIRED.—Each agency shall 

16 carry out the periodic review required by paragraph 

17 (1) in accordance with a plan published by such 

18 agency in the Federal Register. Each such plan shall 

19 provide for the review under this subsection of each 

20 rule promulgated by the agency not later than 10 

21 years after the date on which such rule was pub22 lished as the final rule and, thereafter, not later 

23 than 10 years after the date on which such rule was 

24 last reviewed under this subsection. The agency may 
10

•HR 2840 IH 

1 amend such plan at any time by publishing the revi2 sion in the Federal Register. 

3 ‘‘(3) ANNUAL PUBLICATION.—Each year, each 

4 agency shall publish in the Federal Register a list of 

5 the rules to be reviewed by such agency under this 

6 subsection during the following year. The list shall 

7 include a brief description of each such rule and the 

8 need for and legal basis of such rule and shall invite 

9 public comment upon the determination to be made 

10 under this subsection with respect to such rule. 

11 ‘‘(f) JUDICIAL REVIEW.—

12 ‘‘(1) IN GENERAL.—For any rule subject to this 

13 section, an individual who is adversely affected or 

14 aggrieved by final agency action is entitled to judi15 cial review of agency compliance with the require16 ments of subsections (b) and (c) in accordance with 

17 chapter 7. Agency compliance with subsection (d) 

18 shall be judicially reviewable in connection with judi19 cial review of subsection (b). 

20 ‘‘(2) JURISDICTION.—Each court having juris21 diction to review such rule for compliance with sec22 tion 553, or under any other provision of law, shall 

23 have jurisdiction to review any claims of noncompli24 ance with subsections (b) and (c) in accordance with 

25 chapter 7. Agency compliance with subsection (d) 
11

•HR 2840 IH 

1 shall be judicially reviewable in connection with judi2 cial review of subsection (b). 

3 ‘‘(3) LIMITATIONS.—

4 ‘‘(A) An individual may seek such review 

5 during the period beginning on the date of final 

6 agency action and ending 1 year later, except 

7 that where a provision of law requires that an 

8 action challenging a final agency action be com9 menced before the expiration of 1 year, such 

10 lesser period shall apply to an action for judicial 

11 review under this subsection. 

12 ‘‘(B) In the case where an agency delays 

13 the issuance of a final privacy impact assess14 ment pursuant to subsection (c), an action for 

15 judicial review under this section shall be filed 

16 not later than—

17 ‘‘(i) 1 year after the date the assess18 ment is made available to the public; or 

19 ‘‘(ii) where a provision of law requires 

20 that an action challenging a final agency 

21 regulation be commenced before the expi22 ration of the 1-year period, the number of 

23 days specified in such provision of law that 

24 is after the date the assessment is made 

25 available to the public. 
12

•HR 2840 IH 

1 ‘‘(4) RELIEF.—In granting any relief in an ac2 tion under this subsection, the court shall order the 

3 agency to take corrective action consistent with this 

4 section and chapter 7, including, but not limited 

5 to—

6 ‘‘(A) remanding the rule to the agency; 

7 and 

8 ‘‘(B) deferring the enforcement of the rule 

9 against individuals, unless the court finds that 

10 continued enforcement of the rule is in the pub11 lic interest. 

12 ‘‘(5) RULE OF CONSTRUCTION.—Nothing in 

13 this subsection shall be construed to limit the au14 thority of any court to stay the effective date of any 

15 rule or provision thereof under any other provision 

16 of law or to grant any other relief in addition to the 

17 requirements of this subsection. 

18 ‘‘(6) RECORD OF AGENCY ACTION.—In an ac19 tion for the judicial review of a rule, the privacy im20 pact assessment for such rule, including an assess21 ment prepared or corrected pursuant to paragraph 

22 (4), shall constitute part of the entire record of 

23 agency action in connection with such review. 

24 ‘‘(7) EXCLUSIVITY.—Compliance or noncompli25 ance by an agency with the provisions of this section 
13

•HR 2840 IH 

1 shall be subject to judicial review only in accordance 

2 with this subsection. 

3 ‘‘(8) SAVINGS CLAUSE.—Nothing in this sub4 section bars judicial review of any other impact 

5 statement or similar assessment required by any 

6 other law if judicial review of such statement or as7 sessment is otherwise permitted by law. 

8 ‘‘(g) DEFINITION.—For purposes of this section, the 

9 term ‘personally identifiable information’ means informa10 tion that can be used to identify an individual, including 

11 such individual’s name, address, telephone number, photo12 graph, social security number or other identifying infor13 mation. It includes information about such individual’s 

14 medical or financial condition.’’. 

15 (b) PERIODIC REVIEW TRANSITION PROVISIONS.—

16 (1) INITIAL PLAN.—For each agency, the plan 

17 required by subsection (e) of section 553a of title 5, 

18 United States Code (as added by subsection (a)), 

19 shall be published not later than 180 days after the 

20 date of the enactment of this Act. 

21 (2) In the case of a rule promulgated by an 

22 agency before the date of the enactment of this Act, 

23 such plan shall provide for the periodic review of 

24 such rule before the expiration of the 10-year period 

25 beginning on the date of the enactment of this Act. 
14

•HR 2840 IH 

1 For any such rule, the head of the agency may pro2 vide for a 1-year extension of such period if the head 

3 of the agency, before the expiration of the period, 

4 certifies in a statement published in the Federal 

5 Register that reviewing such rule before the expira6 tion of the period is not feasible. The head of the 

7 agency may provide for additional 1-year extensions 

8 of the period pursuant to the preceding sentence, 

9 but in no event may the period exceed 15 years. 

10 (c) CONGRESSIONAL REVIEW.—Section 801(a)(1)(B) 

11 of title 5, United States Code, is amended—

12 (1) by redesignating clauses (iii) and (iv) as 

13 clauses (iv) and (v), respectively; and 

14 (2) by inserting after clause (ii) the following 

15 new clause: 

16 ‘‘(iii) the agency’s actions relevant to section 

17 553a;’’. 

18 (d) CLERICAL AMENDMENT.—The table of sections 

19 at the beginning of chapter 5 of title 5, United States 

20 Code, is amended by adding after the item relating to sec21 tion 553 the following new item:

‘‘553a. Privacy impact assessment in rulemaking.’’.

Æ