IB 

Union Calendar No. 352

108TH CONGRESS 

2D SESSION H. R. 338

[Report No. 108–587] 

To amend title 5, United States Code, to require that agencies, in promulgating rules, take into consideration the impact of such rules on the 

privacy of individuals, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JANUARY 27, 2003

Mr. CHABOT introduced the following bill; which was referred to the 

Committee on the Judiciary 

JULY 7, 2004

Additional sponsors: Mr. NADLER, Mr. BOUCHER, Mr. PAUL, Mr. FILNER, 

Mr. BARTLETT of Maryland, Mr. STUPAK, and Mr. CANNON

JULY 7, 2004

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on January 27, 2003] 

A BILL

To amend title 5, United States Code, to require that agencies, in promulgating rules, take into consideration the 

impact of such rules on the privacy of individuals, and 

for other purposes.
2

•HR 338 RH 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Agency Protec5 tion of Privacy Act of 2004’’. 

6 SEC. 2. REQUIREMENT THAT AGENCY RULEMAKING TAKE 

7 INTO CONSIDERATION IMPACTS ON INDI8 VIDUAL PRIVACY. 

9 (a) IN GENERAL.—Title 5, United States Code, is 

10 amended by adding after section 553 the following new sec11 tion: 

12 ‘‘§ 553a. Privacy impact assessment in rulemaking 

13 ‘‘(a) INITIAL PRIVACY IMPACT ASSESSMENT.—

14 ‘‘(1) IN GENERAL.—Whenever an agency is re15 quired by section 553 of this title, or any other law, 

16 to publish a general notice of proposed rulemaking for 

17 a proposed rule, or publishes a notice of proposed 

18 rulemaking for an interpretative rule involving the 

19 internal revenue laws of the United States, and such 

20 rule or proposed rulemaking pertains to the collection, 

21 maintenance, use, or disclosure of personally identifi22 able information from 10 or more individuals, other 

23 than agencies, instrumentalities, or employees of the 

24 Federal government, the agency shall prepare and 

25 make available for public comment an initial privacy 
3

•HR 338 RH 

1 impact assessment that describes the impact of the 

2 proposed rule on the privacy of individuals. Such as3 sessment or a summary thereof shall be signed by the 

4 senior agency official with primary responsibility for 

5 privacy policy and be published in the Federal Reg6 ister at the time of the publication of a general notice 

7 of proposed rulemaking for the rule. 

8 ‘‘(2) CONTENTS.—Each initial privacy impact 

9 assessment required under this subsection shall con10 tain the following: 

11 ‘‘(A) A description and analysis of the ex12 tent to which the proposed rule will impact the 

13 privacy interests of individuals, including the 

14 extent to which the proposed rule—

15 ‘‘(i) provides notice of the collection of 

16 personally identifiable information, and 

17 specifies what personally identifiable infor18 mation is to be collected and how it is to be 

19 collected, maintained, used, and disclosed; 

20 ‘‘(ii) allows access to such information 

21 by the person to whom the personally iden22 tifiable information pertains and provides 

23 an opportunity to correct inaccuracies; 
4

•HR 338 RH 

1 ‘‘(iii) prevents such information, which 

2 is collected for one purpose, from being used 

3 for another purpose; and 

4 ‘‘(iv) provides security for such infor5 mation. 

6 ‘‘(B) A description of any significant alter7 natives to the proposed rule which accomplish 

8 the stated objectives of applicable statutes and 

9 which minimize any significant privacy impact 

10 of the proposed rule on individuals. 

11 ‘‘(b) FINAL PRIVACY IMPACT ASSESSMENT.—

12 ‘‘(1) IN GENERAL.—Whenever an agency promul13 gates a final rule under section 553 of this title, after 

14 being required by that section or any other law to 

15 publish a general notice of proposed rulemaking, or 

16 promulgates a final interpretative rule involving the 

17 internal revenue laws of the United States, and such 

18 rule or proposed rulemaking pertains to the collection, 

19 maintenance, use, or disclosure of personally identifi20 able information from 10 or more individuals, other 

21 than agencies, instrumentalities, or employees of the 

22 Federal government, the agency shall prepare a final 

23 privacy impact assessment, signed by the senior agen24 cy official with primary responsibility for privacy 

25 policy. 
5

•HR 338 RH 

1 ‘‘(2) CONTENTS.—Each final privacy impact as2 sessment required under this subsection shall contain 

3 the following: 

4 ‘‘(A) A description and analysis of the ex5 tent to which the final rule will impact the pri6 vacy interests of individuals, including the ex7 tent to which such rule—

8 ‘‘(i) provides notice of the collection of 

9 personally identifiable information, and 

10 specifies what personally identifiable infor11 mation is to be collected and how it is to be 

12 collected, maintained, used, and disclosed; 

13 ‘‘(ii) allows access to such information 

14 by the person to whom the personally iden15 tifiable information pertains and provides 

16 an opportunity to correct inaccuracies; 

17 ‘‘(iii) prevents such information, which 

18 is collected for one purpose, from being used 

19 for another purpose; and 

20 ‘‘(iv) provides security for such infor21 mation. 

22 ‘‘(B) A summary of any significant issues 

23 raised by the public comments in response to the 

24 initial privacy impact assessment, a summary of 

25 the analysis of the agency of such issues, and a 
6

•HR 338 RH 

1 statement of any changes made in such rule as 

2 a result of such issues. 

3 ‘‘(C) A description of the steps the agency 

4 has taken to minimize the significant privacy 

5 impact on individuals consistent with the stated

6 objectives of applicable statutes, including a 

7 statement of the factual, policy, and legal reasons 

8 for selecting the alternative adopted in the final 

9 rule and why each one of the other significant 

10 alternatives to the rule considered by the agency 

11 which affect the privacy interests of individuals 

12 was rejected. 

13 ‘‘(3) AVAILABILITY TO PUBLIC.—The agency 

14 shall make copies of the final privacy impact assess15 ment available to members of the public and shall 

16 publish in the Federal Register such assessment or a 

17 summary thereof. 

18 ‘‘(c) WAIVERS.—

19 ‘‘(1) EMERGENCIES.—An agency head may 

20 waive or delay the completion of some or all of the 

21 requirements of subsections (a) and (b) to the same 

22 extent as the agency head may, under section 608, 

23 waive or delay the completion of some or all of the 

24 requirements of sections 603 and 604, respectively. 
7

•HR 338 RH 

1 ‘‘(2) NATIONAL SECURITY.—An agency head 

2 may, for national security reasons, or to protect from 

3 disclosure classified information, confidential com4 mercial information, or information the disclosure of 

5 which may adversely affect a law enforcement effort, 

6 waive or delay the completion of some or all of the 

7 following requirements: 

8 ‘‘(A) The requirement of subsection (a)(1) to 

9 make an assessment available for public com10 ment. 

11 ‘‘(B) The requirement of subsection (a)(1) to 

12 have an assessment or summary thereof pub13 lished in the Federal Register. 

14 ‘‘(C) The requirements of subsection (b)(3). 

15 ‘‘(d) PROCEDURES FOR GATHERING COMMENTS.—

16 When any rule is promulgated which may have a signifi17 cant privacy impact on individuals, or a privacy impact 

18 on a substantial number of individuals, the head of the 

19 agency promulgating the rule or the official of the agency 

20 with statutory responsibility for the promulgation of the 

21 rule shall assure that individuals have been given an oppor22 tunity to participate in the rulemaking for the rule through 

23 techniques such as—

24 ‘‘(1) the inclusion in an advance notice of pro25 posed rulemaking, if issued, of a statement that the 
8

•HR 338 RH 

1 proposed rule may have a significant privacy impact 

2 on individuals, or a privacy impact on a substantial 

3 number of individuals; 

4 ‘‘(2) the publication of a general notice of pro5 posed rulemaking in publications of national circula6 tion likely to be obtained by individuals; 

7 ‘‘(3) the direct notification of interested individ8 uals; 

9 ‘‘(4) the conduct of open conferences or public 

10 hearings concerning the rule for individuals, includ11 ing soliciting and receiving comments over computer 

12 networks; and 

13 ‘‘(5) the adoption or modification of agency pro14 cedural rules to reduce the cost or complexity of par15 ticipation in the rulemaking by individuals. 

16 ‘‘(e) PERIODIC REVIEW OF RULES.—

17 ‘‘(1) IN GENERAL.—Each agency shall carry out 

18 a periodic review of the rules promulgated by the 

19 agency that have a significant privacy impact on in20 dividuals, or a privacy impact on a substantial num21 ber of individuals. Under such periodic review, the 

22 agency shall determine, for each such rule, whether 

23 the rule can be amended or rescinded in a manner 

24 that minimizes any such impact while remaining in 

25 accordance with applicable statutes. For each such de-
9

•HR 338 RH 

1 termination, the agency shall consider the following 

2 factors: 

3 ‘‘(A) The continued need for the rule. 

4 ‘‘(B) The nature of complaints or comments 

5 received from the public concerning the rule. 

6 ‘‘(C) The complexity of the rule. 

7 ‘‘(D) The extent to which the rule overlaps, 

8 duplicates, or conflicts with other Federal rules, 

9 and, to the extent feasible, with State and local 

10 governmental rules. 

11 ‘‘(E) The length of time since the rule was 

12 last reviewed under this subsection. 

13 ‘‘(F) The degree to which technology, eco14 nomic conditions, or other factors have changed 

15 in the area affected by the rule since the rule was 

16 last reviewed under this subsection. 

17 ‘‘(2) PLAN REQUIRED.—Each agency shall carry 

18 out the periodic review required by paragraph (1) in 

19 accordance with a plan published by such agency in 

20 the Federal Register. Each such plan shall provide for 

21 the review under this subsection of each rule promul22 gated by the agency not later than 10 years after the 

23 date on which such rule was published as the final 

24 rule and, thereafter, not later than 10 years after the 

25 date on which such rule was last reviewed under this 
10

•HR 338 RH 

1 subsection. The agency may amend such plan at any 

2 time by publishing the revision in the Federal Reg3 ister. 

4 ‘‘(3) ANNUAL PUBLICATION.—Each year, each 

5 agency shall publish in the Federal Register a list of 

6 the rules to be reviewed by such agency under this 

7 subsection during the following year. The list shall in8 clude a brief description of each such rule and the 

9 need for and legal basis of such rule and shall invite 

10 public comment upon the determination to be made 

11 under this subsection with respect to such rule. 

12 ‘‘(f) JUDICIAL REVIEW.—

13 ‘‘(1) IN GENERAL.—For any rule subject to this 

14 section, an individual who is adversely affected or ag15 grieved by final agency action is entitled to judicial 

16 review of agency compliance with the requirements of 

17 subsections (b) and (c) in accordance with chapter 7. 

18 Agency compliance with subsection (d) shall be judi19 cially reviewable in connection with judicial review of 

20 subsection (b). 

21 ‘‘(2) JURISDICTION.—Each court having juris22 diction to review such rule for compliance with sec23 tion 553, or under any other provision of law, shall 

24 have jurisdiction to review any claims of noncompli25 ance with subsections (b) and (c) in accordance with 
11

•HR 338 RH 

1 chapter 7. Agency compliance with subsection (d) 

2 shall be judicially reviewable in connection with judi3 cial review of subsection (b).

4 ‘‘(3) LIMITATIONS.—

5 ‘‘(A) An individual may seek such review 

6 during the period beginning on the date of final 

7 agency action and ending 1 year later, except 

8 that where a provision of law requires that an 

9 action challenging a final agency action be com10 menced before the expiration of 1 year, such less11 er period shall apply to an action for judicial re12 view under this subsection. 

13 ‘‘(B) In the case where an agency delays the 

14 issuance of a final privacy impact assessment 

15 pursuant to subsection (c), an action for judicial 

16 review under this section shall be filed not later 

17 than—

18 ‘‘(i) 1 year after the date the assess19 ment is made available to the public; or 

20 ‘‘(ii) where a provision of law requires 

21 that an action challenging a final agency 

22 regulation be commenced before the expira23 tion of the 1-year period, the number of 

24 days specified in such provision of law that 
12

•HR 338 RH 

1 is after the date the assessment is made 

2 available to the public. 

3 ‘‘(4) RELIEF.—In granting any relief in an ac4 tion under this subsection, the court shall order the 

5 agency to take corrective action consistent with this 

6 section and chapter 7, including, but not limited to—

7 ‘‘(A) remanding the rule to the agency; and 

8 ‘‘(B) deferring the enforcement of the rule 

9 against individuals, unless the court finds that 

10 continued enforcement of the rule is in the public 

11 interest. 

12 ‘‘(5) RULE OFCONSTRUCTION.—Nothing in this 

13 subsection shall be construed to limit the authority of 

14 any court to stay the effective date of any rule or pro15 vision thereof under any other provision of law or to 

16 grant any other relief in addition to the requirements 

17 of this subsection. 

18 ‘‘(6) RECORD OFAGENCY ACTION.—In an action 

19 for the judicial review of a rule, the privacy impact 

20 assessment for such rule, including an assessment pre21 pared or corrected pursuant to paragraph (4), shall 

22 constitute part of the entire record of agency action 

23 in connection with such review. 

24 ‘‘(7) EXCLUSIVITY.—Compliance or noncompli25 ance by an agency with the provisions of this section 
13

•HR 338 RH 

1 shall be subject to judicial review only in accordance 

2 with this subsection. 

3 ‘‘(8) SAVINGS CLAUSE.—Nothing in this sub4 section bars judicial review of any other impact state5 ment or similar assessment required by any other law 

6 if judicial review of such statement or assessment is 

7 otherwise permitted by law. 

8 ‘‘(g) DEFINITION.—For purposes of this section, the 

9 term ‘personally identifiable information’ means informa10 tion that can be used to identify an individual, including 

11 such individual’s name, address, telephone number, photo12 graph, social security number or other identifying informa13 tion. It includes information about such individual’s med14 ical or financial condition.’’. 

15 (b) PERIODIC REVIEW TRANSITION PROVISIONS.—

16 (1) INITIAL PLAN.—For each agency, the plan 

17 required by subsection (e) of section 553a of title 5, 

18 United States Code (as added by subsection (a)), shall 

19 be published not later than 180 days after the date of 

20 the enactment of this Act. 

21 (2) In the case of a rule promulgated by an 

22 agency before the date of the enactment of this Act, 

23 such plan shall provide for the periodic review of such 

24 rule before the expiration of the 10-year period begin25 ning on the date of the enactment of this Act. For any 
14

•HR 338 RH 

1 such rule, the head of the agency may provide for a 

2 1-year extension of such period if the head of the 

3 agency, before the expiration of the period, certifies in 

4 a statement published in the Federal Register that re5 viewing such rule before the expiration of the period 

6 is not feasible. The head of the agency may provide 

7 for additional 1-year extensions of the period pursu8 ant to the preceding sentence, but in no event may the 

9 period exceed 15 years. 

10 (c) CONGRESSIONAL REVIEW.—Section 801(a)(1)(B) 

11 of title 5, United States Code, is amended—

12 (1) by redesignating clauses (iii) and (iv) as 

13 clauses (iv) and (v), respectively; and 

14 (2) by inserting after clause (ii) the following 

15 new clause: 

16 ‘‘(iii) the agency’s actions relevant to section 

17 553a;’’. 

18 (d) CLERICAL AMENDMENT.—The table of sections at 

19 the beginning of chapter 5 of title 5, United States Code, 

20 is amended by adding after the item relating to section 553 

21 the following new item:

‘‘553a. Privacy impact assessment in rulemaking.’’.

Union Calendar No. 352

108TH CONGRESS 

2D SESSION H. R. 338

[Report No. 108–587] 

A BILL

To amend title 5, United States Code, to require 

vacy of individuals, and for other purposes. consideration the impact of such rules on the prithat agencies, in promulgating rules, take into 

JULY 7, 2004

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union,