```

[House Report 106-919]
[From the U.S. Government Publishing Office]

106th Congress                                                   Report
                        HOUSE OF REPRESENTATIVES
 2d Session                                                     106-919

======================================================================

 
                         PRIVACY COMMISSION ACT

                                _______
                                

 September 29, 2000.--Committed to the Committee of the Whole House on 
            the State of the Union and ordered to be printed

                                _______
                                

    Mr. Burton of Indiana, from the Committee on Government Reform, 
                        submitted the following

                              R E P O R T

                             together with

                             MINORITY VIEWS

                        [To accompany H.R. 4049]

      [Including cost estimate of the Congressional Budget Office]

  The Committee on Government Reform, to whom was referred the 
bill (H.R. 4049) to establish the Commission for the 
Comprehensive Study of Privacy Protection, having considered 
the same, report favorably thereon with an amendment and 
recommend that the bill as amended do pass.

                                CONTENTS

                                                                   Page
  I. Summary of Legislation...........................................6
 II. Background and Need for the Legislation..........................6
III. Legislative Hearings and Committee Actions.......................7
 IV. Explanation of the Bill..........................................8
  V. Committee Oversight Findings....................................14
 VI. Budget Analysis and Projections.................................14
VII. Cost Estimate of the Congressional Budget Office................15
VIII.Statement of Constitutional Authority...........................16

 IX. Committee Recommendation........................................16
  X. Congressional Accountability Act; P.L. 104-1....................16
 XI. Unfunded Mandates Reform Act; P.L. 104-4, Section 423...........16
XII. Federal Advisory Committee Act (5 U.S.C. App.) Section 5(b).....16
XIII.Changes in Existing Law.........................................16

  The amendment is as follows:
  Strike out all after the enacting clause and insert in lieu 
thereof the following:

SECTION 1. SHORT TITLE.

  This Act may be cited as the ``Privacy Commission Act''.

SEC. 2. FINDINGS.

  The Congress finds the following:
          (1) Americans are increasingly concerned about their civil 
        liberties and the security and use of their personal 
        information, including medical records, educational records, 
        library records, magazine subscription records, records of 
        purchases of goods and other payments, and driver's license 
        numbers.
          (2) Commercial entities are increasingly aware that consumers 
        expect them to adopt privacy policies and take all appropriate 
        steps to protect the personal information of consumers.
          (3) There is a growing concern about the confidentiality of 
        medical records, because there are inadequate Federal 
        guidelines and a patchwork of confusing State and local rules 
        regarding privacy protection for individually identifiable 
        patient information.
          (4) In light of recent changes in financial services laws 
        allowing for increased sharing of information between 
        traditional financial institutions and insurance entities, a 
        coordinated and comprehensive review is necessary regarding the 
        protections of personal data compiled by the health care, 
        insurance, and financial services industries.
          (5) The use of Social Security numbers has expanded beyond 
        the uses originally intended.
          (6) Use of the Internet has increased at astounding rates, 
        with approximately 5 million current Internet sites and 64 
        million regular Internet users each month in the United States 
        alone.
          (7) Financial transactions over the Internet have increased 
        at an astounding rate, with 17 million American households 
        spending $20 billion shopping on the Internet last year.
          (8) Use of the Internet as a medium for commercial activities 
        will continue to grow, and it is estimated that by the end of 
        2000, 56 percent of the companies in the United States will 
        sell their products on the Internet.
          (9) There have been reports of surreptitious collection of 
        consumer data by Internet marketers and questionable 
        distribution of personal information by on-line companies.
          (10) In 1999, the Federal Trade Commission found that 87 
        percent of Internet sites provided some form of privacy notice, 
        which represented an increase from 15 percent in 1998.
          (11) The United States is the leading economic and social 
        force in the global information economy, largely because of a 
        favorable regulatory climate and the free flow of information. 
        It is important for the United States to continue that 
        leadership. As nations and governing bodies around the world 
        begin to establish privacy standards, these standards will 
        directly affect the United States.
          (12) The shift from an industry-focused economy to an 
        information-focused economy calls for a reassessment of the 
        most effective way to balance personal privacy and information 
        use, keeping in mind the potential for unintended effects on 
        technology development, innovation, the marketplace, and 
        privacy needs.
          (13) This Act shall not be construed to prohibit the 
        enactment of legislation on privacy issues by the Congress 
        during the existence of the Commission. It is the 
        responsibility of the Congress to act to protect the privacy of 
        individuals, including individuals' medical and financial 
        information. Various committees of the Congress are currently 
        reviewing legislation in the area of medical and financial 
        privacy. Further study by the Commission established by this 
        Act should not be considered a prerequisite for further 
        consideration or enactment of financial or medical privacy 
        legislation by the Congress.

SEC. 3. ESTABLISHMENT.

  There is established a commission to be known as the ``Commission for 
the Comprehensive Study of Privacy Protection'' (in this Act referred 
to as the ``Commission'').

SEC. 4. DUTIES OF COMMISSION.

  (a) Study.--The Commission shall conduct a study of issues relating 
to protection of individual privacy and the appropriate balance to be 
achieved between protecting individual privacy and allowing appropriate 
uses of information, including the following:
          (1) The monitoring, collection, and distribution of personal 
        information by Federal, State, and local governments, including 
        personal information collected for a decennial census, and such 
        personal information as a driver's license number.
          (2) Current efforts to address the monitoring, collection, 
        and distribution of personal information by Federal and State 
        governments, individuals, or entities, including--
                  (A) existing statutes and regulations relating to the 
                protection of individual privacy, such as section 552a 
                of title 5, United States Code (commonly referred to as 
                the Privacy Act of 1974) and section 552 of title 5, 
                United States Code (commonly referred to as the Freedom 
                of Information Act);
                  (B) legislation pending before the Congress;
                  (C) privacy protection efforts undertaken by the 
                Federal Government, State governments, foreign 
                governments, and international governing bodies;
                  (D) privacy protection efforts undertaken by the 
                private sector; and
                  (E) self-regulatory efforts initiated by the private 
                sector to respond to privacy issues.
          (3) The monitoring, collection, and distribution of personal 
        information by individuals or entities, including access to and 
        use of medical records, financial records (including credit 
        cards, automated teller machine cards, bank accounts, and 
        Internet transactions), personal information provided to on-
        line sites accessible through the Internet, Social Security 
        numbers, insurance records, education records, and driver's 
        license numbers.
          (4) Employer practices and policies with respect to the 
        financial and health information of employees, including--
                  (A) whether employers use or disclose employee 
                financial or health information for marketing, 
                employment, or insurance underwriting purposes;
                  (B) what restrictions employers place on disclosure 
                or use of employee financial or health information;
                  (C) employee rights to access, copy, and amend their 
                own health records and financial information;
                  (D) what type of notice employers provide to 
                employees regarding employer practices with respect to 
                employee financial and health information; and
                  (E) practices of employer medical departments with 
                respect to disclosing employee health information to 
                administrative or other personnel of the employer.
          (5) The extent to which individuals in the United States can 
        obtain redress for privacy violations.
          (6) The extent to which older individuals and disabled 
        individuals are subject to exploitation involving the 
        disclosure or use of their financial information.
  (b) Field Hearings.--
          (1) In general.--The Commission shall conduct at least 2 
        field hearings in each of the 5 geographical regions of the 
        United States.
          (2) Boundaries.--For purposes of this subsection, the 
        Commission may determine the boundaries of the five 
        geographical regions of the United States.
  (c) Report.--
          (1) In general.--Not later than 18 months after appointment 
        of all members of the Commission--
                  (A) a majority of the members of the Commission shall 
                approve a report; and
                  (B) the Commission shall submit the approved report 
                to the Congress and the President.
          (2) Contents.--The report shall include a detailed statement 
        of findings, conclusions, and recommendations, including the 
        following:
                  (A) Findings on potential threats posed to individual 
                privacy.
                  (B) Analysis of purposes for which sharing of 
                information is appropriate and beneficial to consumers.
                  (C) Analysis of the effectiveness of existing 
                statutes, regulations, private sector self-regulatory 
                efforts, technology advances, and market forces in 
                protecting individual privacy.
                  (D) Recommendations on whether additional legislation 
                is necessary, and if so, specific suggestions on 
                proposals to reform or augment current laws and 
                regulations relating to individual privacy.
                  (E) Analysis of purposes for which additional 
                regulations may impose undue costs or burdens, or cause 
                unintended consequences in other policy areas, such as 
                security, law enforcement, medical research, or 
                critical infrastructure protection.
                  (F) Cost analysis of legislative or regulatory 
                changes proposed in the report.
                  (G) Recommendations on non-legislative solutions to 
                individual privacy concerns, including education, 
                market-based measures, industry best practices, and new 
                technology.
                  (H) Review of the effectiveness and utility of third-
                party verification of privacy statements, including 
                specifically with respect to existing private sector 
                self-regulatory efforts.
  (d) Additional Report.--Together with the report under subsection 
(c), the Commission shall submit to the Congress and the President any 
additional report of dissenting opinions or minority views by a member 
of the Commission.
  (e) Interim Report.--The Commission may submit to the Congress and 
the President an interim report approved by a majority of the members 
of the Commission.

SEC. 5. MEMBERSHIP.

  (a) Number and Appointment.--The Commission shall be composed of 17 
members appointed as follows:
          (1) 4 members appointed by the President.
          (2) 4 members appointed by the majority leader of the Senate.
          (3) 2 members appointed by the minority leader of the Senate.
          (4) 4 members appointed by the Speaker of the House of 
        Representatives.
          (5) 2 members appointed by the minority leader of the House 
        of Representatives.
          (6) 1 member, who shall serve as Chairperson of the 
        Commission, appointed jointly by the President, the majority 
        leader of the Senate, and the Speaker of the House of 
        Representatives.
  (b) Diversity of Views.--The appointing authorities under subsection 
(a) shall seek to ensure that the membership of the Commission has a 
diversity of views and experiences on the issues to be studied by the 
Commission, such as views and experiences of Federal, State, and local 
governments, the media, the academic community, consumer groups, public 
policy groups and other advocacy organizations, business and industry 
(including small business), the medical community, civil liberties 
experts, and the financial services industry.
  (c) Date of Appointment.--The appointment of the members of the 
Commission shall be made not later than 30 days after the date of the 
enactment of this Act.
  (d) Terms.--Each member of the Commission shall be appointed for the 
life of the Commission.
  (e) Vacancies.--A vacancy in the Commission shall be filled in the 
same manner in which the original appointment was made.
  (f) Compensation; Travel Expenses.--Members of the Commission shall 
serve without pay, but shall receive travel expenses, including per 
diem in lieu of subsistence, in accordance with sections 5702 and 5703 
of title 5, United States Code.
  (g) Quorum.--A majority of the members of the Commission shall 
constitute a quorum, but a lesser number may hold hearings.
  (h) Meetings.--
          (1) In general.--The Commission shall meet at the call of the 
        Chairperson or a majority of its members.
          (2) Initial meeting.--Not later than 45 days after the date 
        of the enactment of this Act, the Commission shall hold its 
        initial meeting.

SEC. 6. DIRECTOR; STAFF; EXPERTS AND CONSULTANTS.

  (a) Director.--
          (1) In general.--On or after October 1, 2000, the Commission 
        shall appoint a Director without regard to the provisions of 
        title 5, United States Code, governing appointments to the 
        competitive service.
          (2) Pay.--The Director shall be paid at the rate payable for 
        level III of the Executive Schedule established under section 
        5314 of such title.
  (b) Staff.--The Director may appoint staff as the Director determines 
appropriate.
  (c) Applicability of Certain Civil Service Laws.--
          (1) In general.--The staff of the Commission shall be 
        appointed without regard to the provisions of title 5, United 
        States Code, governing appointments in the competitive service.
          (2) Pay.--The staff of the Commission shall be paid in 
        accordance with the provisions of chapter 51 and subchapter III 
        of chapter 53 of that title relating to classification and 
        General Schedule pay rates, but at rates not in excess of the 
        maximum rate for grade GS-15 of the General Schedule under 
        section 5332 of that title.
  (d) Experts and Consultants.--The Director may procure temporary and 
intermittent services under section 3109(b) of title 5, United States 
Code.
  (e) Staff of Federal Agencies.--
          (1) In general.--Upon request of the Director, the head of 
        any Federal department or agency may detail, on a reimbursable 
        basis, any of the personnel of that department or agency to the 
        Commission to assist it in carrying out this Act.
          (2) Notification.--Before making a request under this 
        subsection, the Director shall give notice of the request to 
        each member of the Commission.

SEC. 7. POWERS OF COMMISSION.

  (a) Hearings and Sessions.--The Commission may, for the purpose of 
carrying out this Act, hold hearings, sit and act at times and places, 
take testimony, and receiveevidence as the Commission considers 
appropriate. The Commission may administer oaths or affirmations to 
witnesses appearing before it.
  (b) Powers of Members and Agents.--Any member or agent of the 
Commission may, if authorized by the Commission, take any action which 
the Commission is authorized to take by this section.
  (c) Obtaining Official Information.--
          (1) In general.--Except as provided in paragraph (2), if the 
        Chairperson of the Commission submits a request to a Federal 
        department or agency for information necessary to enable the 
        Commission to carry out this Act, the head of that department 
        or agency shall furnish that information to the Commission.
          (2) Exception for national security.--If the head of that 
        department or agency determines that it is necessary to guard 
        that information from disclosure to protect the national 
        security interests of the United States, the head shall not 
        furnish that information to the Commission.
  (d) Mails.--The Commission may use the United States mails in the 
same manner and under the same conditions as other departments and 
agencies of the United States.
  (e) Administrative Support Services.--Upon the request of the 
Director, the Administrator of General Services shall provide to the 
Commission, on a reimbursable basis, the administrative support 
services necessary for the Commission to carry out this Act.
  (f) Gifts and Donations.--The Commission may accept, use, and dispose 
of gifts or donations of services or property to carry out this Act, 
but only to the extent or in the amounts provided in advance in 
appropriation Acts.
  (g) Contracts.--The Commission may contract with and compensate 
persons and government agencies for supplies and services, without 
regard to section 3709 of the Revised Statutes (41 U.S.C. 5).
  (h) Subpoena Power.--
          (1) In general.--The Commission may issue subpoenas requiring 
        the attendance and testimony of witnesses and the production of 
        any evidence relating to any matter that the Commission is 
        empowered to investigate by section 4. The attendance of 
        witnesses and the production of evidence may be required by 
        such subpoena from any place within the United States and at 
        any specified place of hearing within the United States.
          (2) Failure to obey a subpoena.--If a person refuses to obey 
        a subpoena issued under paragraph (1), the Commission may apply 
        to a United States district court for an order requiring that 
        person to appear before the Commission to give testimony, 
        produce evidence, or both, relating to the matter under 
        investigation. The application may be made within the judicial 
        district where the hearing is conducted or where that person is 
        found, resides, or transacts business. Any failure to obey the 
        order of the court may be punished by the court as civil 
        contempt.
          (3) Service of subpoenas.--The subpoenas of the Commission 
        shall be served in the manner provided for subpoenas issued by 
        a United States district court under the Federal Rules of Civil 
        Procedure for the United States district courts.
          (4) Service of process.--All process of any court to which 
        application is made under paragraph (2) may be served in the 
        judicial district in which the person required to be served 
        resides or may be found.

SEC. 8. TERMINATION.

  The Commission shall terminate 30 days after submitting a report 
under section 4(c).

SEC. 9. AUTHORIZATION OF APPROPRIATIONS.

  (a) In General.--There are authorized to be appropriated to the 
Commission $5,000,000 to carry out this Act.
  (b) Availability.--Any sums appropriated pursuant to the 
authorization in subsection (a) shall remain available until expended.

SEC. 10. BUDGET ACT COMPLIANCE.

  Any new contract authority authorized by this Act shall be effective 
only to the extent or in the amounts provided in advance in 
appropriation Acts.

SEC. 11. PRIVACY PROTECTIONS.

  (a) Destruction or Return of Information Required.--Upon the 
conclusion of the matter or need for which individually identifiable 
information was disclosed to the Commission, the Commission shall 
either destroy the individually identifiable information or return it 
to the person or entity from which it was obtained, unless the 
individual that is the subject of the individually identifiable 
information has authorized its disclosure.
  (b) Disclosure of Information Prohibited.--The Commission--
          (1) shall protect individually identifiable information from 
        improper use; and
          (2) may not disclose such information to any person, 
        including the Congress or the President, unless the individual 
        that is the subject of the information has authorized such a 
        disclosure.
  (c) Proprietary Business Information and Financial Information.--The 
Commission shall protect from improper use, and may not disclose to any 
person, proprietary business information and proprietary financial 
information that may be viewed or obtained by the Commission in the 
course of carrying out its duties under this Act.
  (d) Individually Identifiable Information Defined.--For the purposes 
of this Act, the term ``individually identifiable information'' means 
any information, whether oral or recorded in any form or medium, that 
identifies an individual, or with respect to which there is a 
reasonable basis to believe that the information can be used to 
identify an individual.

                       I. Summary of Legislation

    H.R. 4049, the ``Privacy Commission Act,'' establishes a 
17-member commission to study issues relating to the protection 
of individual privacy and the appropriate balance to be 
achieved between protecting such privacy and allowing 
appropriate uses of information. The Commission also will make 
recommendations to Congress.

              II. Background and Need for the Legislation

    Americans are increasingly concerned that their personal 
information is no longer confidential. Recent public opinion 
polls have found that the threat of the loss of personal 
privacy is one of the leading issues concerning Americans 
today.
    Although personal privacy has been a concern of Americans, 
recent developments in information technology and changes in 
existing law have heightened attention to privacy issues. 
Increased access to the Internet now allows millions of 
Americans to access computer networks each month. Internet 
financial transactions have grown at an astounding rate. In the 
year 2000, an estimated 17 million U.S. households will spend 
approximately $30 billion shopping on-line. This number is 
expected to grow with predictions that 42 million households 
will purchase over $64 billion worth of on-line goods and 
services by the end of 2001.\1\ Commercial use of the Internet 
will continue to grow, with predictions that 56 percent of U.S. 
companies will sell their products on-line by the end of the 
year 2000.
---------------------------------------------------------------------------
    \1\ ``The Whole View'' by Forrester Research, Inc., Cambridge, 
Mass., September 19, 2000.
---------------------------------------------------------------------------
    In addition to the resultant flow of information allowed by 
the Internet, changes in financial laws and changes in medical 
records policy, a number of traditional barriers protecting 
individual privacy have been eliminated. Advances in genetic 
testing and the sharing of medical records among insurance 
entities, pharmaceutical companies, and other health-related 
entities alarm many American who are concerned that their 
medical history could become available to inappropriate 
individuals.
    Along with consumers, local, State, and Federal lawmakers 
have increasingly become concerned about privacy issues leading 
to a rapid increase in the number of privacy-related 
legislative proposals. Yet few of these bills have been 
enacted, largely because of the issues' complexity and the lack 
of consensus on an appropriate approach to resolve the 
problems. Of the laws that have been enacted, several resulted 
in unintended consequences, and at least one has been repealed.
    H.R. 4049 would establish a commission to examine privacy 
issues at all levels of government and make recommendations to 
Congress regarding needed legislative initiatives to protect 
personally identifiable information.\2\ This Commission will 
have the authority to examine privacy from a broad perspective 
in contrast to previous approaches, which have examined privacy 
from a narrower spectrum.
---------------------------------------------------------------------------
    \2\ As defined by the bill, ``individually identifiable 
information'' is any information, whether verbal or recorded in any 
form or medium, that identifies an individual, for which there is a 
reasonable basis to believe could be used to identify an individual.
---------------------------------------------------------------------------
    This legislation is the first congressional effort in more 
than 25 years to address privacy issues via a commission. H.R. 
4049 will build upon the work of the 1974 Privacy Commission by 
venturing into new areas of privacy concerns, such as the 
Internet.\3\ As the 1974 Commission helped set parameters for 
the privacy debate of the last 25 years, H.R. 4049 will assist 
in establishing principles that will serve as a guide 
throughout the beginning of the 21st century.
---------------------------------------------------------------------------
    \3\ Legislative Hearing to Establish the Commission for the 
Comprehensive Study of Privacy Protection, 106th Congress, 2nd session 
(2000) Statement of Sandra Parker, Director of Government Affairs and 
Health Policy, Maine Hospital Association. (Transcript not printed at 
the time of this report's publication.)
---------------------------------------------------------------------------

            III. Legislative Hearings and Committee Actions

    H.R. 4049 was introduced on March 21, 2000, by the Rep. Asa 
Hutchinson (R-AR) and the Rep. Jim Moran (D-VA). Original co-
sponsors include Rep. Kay Granger (R-TX), Rep. Kevin Brady (R-
TX), Rep. Jim Davis (D-FL), Rep. Deborah Pryce (R-OH), Rep. 
John Sununu (R-NH), Rep. Thomas Barrett (D-WI), Rep. Tom Coburn 
(R-OK), Rep. Jay Dickey (R-AR), Rep. Gerald Kleczka (D-WI), 
Rep. Joseph Pitts (R-PA), Rep. James Greenwood (R-PA), Rep. Bob 
Riley (R-AL), Rep. John Duncan (R-TN), Rep. Frank Lucas (R-OK), 
Rep. Jim Kolbe (R-AZ), Rep. Tom Campbell (R-CA), Rep. Sue Kelly 
(R-NY), Rep. Thomas Davis (R-VA), and Rep. David Vitter (R-LA).
    On March 29, 2000, H.R. 4049 was referred to the Committee 
on Government Reform, and subsequently to its Subcommittee on 
Government Management, Information, and Technology. The 
subcommittee held three days of legislative hearings on the 
legislation on April 12, 2000, and May 15-16, 2000. The 
subcommittee held a mark-up of the bill on June 14, 2000, at 
which time subcommittee Chairman Stephen Horn (R-CA) offered an 
amendment in the nature of a substitute to H.R. 4049. The 
amended bill was favorably reported to the full Committee by 
voice vote.
    On June 29, 2000, the full Committee on Government Reform 
met to consider H.R. 4049. An amendment by Representative 
Carolyn Maloney (D-NY) was acceptedrequiring the Commission to 
review the effectiveness and utility of third-party verification of 
privacy statements. In addition, another amendment offered by Mrs. 
Maloney was adopted, requiring the Commission to review the extent to 
which older or disabled individuals are subjected to exploitation 
because of the disclosure or inappropriate use of their financial 
information. Representative Janice Schakowsky (D-IL) offered an 
amendment, which was approved, that inserted ``civil liberties 
experts'' into the section of the bill that addresses the Commission's 
recommended composition. Representative Henry Waxman (D-CA) offered an 
amendment, also adopted, that added a finding stating that the Act 
should not be construed to prohibit enactment of legislation on privacy 
issues by Congress during the existence of the Commission, and that 
further study by the Commission should not be considered a prerequisite 
for further consideration or enactment of financial or medical privacy 
legislation by the Congress. Following the adoption of the aforesaid, 
the Committee favorably reported H.R. 4049, as amended, to the full 
House by voice vote.

                      IV. Explanation of the Bill

Sec. 1. Short title

    Section 1 provides that the Act may be cited as the 
``Privacy Commission Act.''

Sec. 2. Finding and purposes

    Section 2 provides a statement of findings and purposes for 
the legislation.

Sec. 3. Establishment of Commission

    Section 3 establishes the Commission.

Sec. 4. Duties of the Commission

    Section 4 of the Act establishes the responsibilities and 
goals of the Commission and offers broad recommendations on 
those areas the Commission should review.
    Subsection (a) directs the Commission to examine issues 
relating to the protection of personal privacy and the need to 
achieve a balance between protecting individual privacy and 
allowing appropriate uses of information. During the hearings, 
the Committee found that the privacy debate centers around the 
issue of permissible and non-permissible uses of personally 
identifiable information, as this information becomes 
increasingly available. The testimony focused on the need to 
strike a balance between protecting individually identifiable 
information and the sharing of that information for purposes of 
business, medicine, and other uses.
    Under section (a)(1) the Commission is instructed to review 
Federal, State and local governments' monitoring, collection 
and distribution of personally identifiable information, and 
the use of documents such as the decennial census and drivers 
license applications.
    Section (a)(2), instructs the Commission to examine 
existing laws to protect individuals' privacy, including but 
not limited to: the Privacy Act of 1974 and the Freedom of 
Information Act. The Commission shall examine extant efforts to 
address monitoring, collection and distribution of personal 
information by the Federal Government, State Governments, 
individuals and other entities.
    During the Committee mark-up, some Committee members raised 
concerns regarding the use of individually identifiable 
information by Congress and the Executive Office of the 
President. Presently, Congress is not covered by the 1974 
Privacy Act or the Freedom of Information Act and the 
longstanding position of the Department of Justice is that 
certain components of the Executive Office of the President are 
also not covered by those acts. The Committee believes that the 
Commission should study the implications of applying the 
Privacy Act and Freedom of Information Act to Congress and to 
all components of the Executive Office of the President.
    Under section (a)(2)(B) of the Act, the Commission is 
directed to examine privacy-related legislation pending before 
the Congress. There are currently many bills before Congress, 
both in the Senate and House that address the issue of privacy. 
The Commission should consider the differing congressional 
views on the privacy debate.
    Under section (a)(2)(C), the Commission is directed to 
review the privacy protection efforts previously undertaken by 
Federal and State governments, foreign bodies, and 
international governing bodies. With thousands of privacy bills 
introduced at the State and local levels, as well as 
international bodies and sovereign nations implementing their 
own privacy laws, the Commission needs to understand how these 
different initiatives will interact and what can be learned 
from them. The Commission should look at such questions as: 
Should there be Federally guaranteed minimum levels of privacy 
protections? Should there be Federal preemption for privacy 
issues, particularly in light of the explosion in Internet use? 
What occurs when privacy laws conflict? How will U.S. privacy 
laws be affected by implementation of external regulations and 
directives, such as the European Directive?
    Under sections (a)(2)(D) and (a)(2)(E), the Commission is 
directed to review privacy protection efforts undertaken by the 
private sector, as well as self-regulated efforts initiated by 
the private sector. In response to the growing concern of 
individuals about their personal information, the Committee 
found that some in the private sector--including high tech 
companies, financial services, medical entities, and others--
are developing or have implemented new technologies and 
practices designed to ensure the protection of individual 
privacy. The Commission should review these policies and 
procedures to determine their efficacy, as well as their impact 
on consumers and others.
    Under section (a)(3), the Commission is instructed to 
examine the monitoring, collection, and distribution of 
personal information by individuals or entities, both public 
and private, including access to and the use of medical 
records, financial records (such as credit cards, automated 
teller machine cards, bank accounts, and Internet 
transactions), personal information provided to on-line sites 
accessible through the Internet, Social Security numbers, 
insurance records, education records, and drivers license 
numbers. In addition, the Committee believes that the 
Commission should examine the use to which that information is 
being employed once it has been collected.
    Section (a)(4), instructs the Commission to review employer 
practices and policies with respect to the financial and health 
information of employees, including: under section (a)(4)(A), 
whether employers use or disclose employee financial or health 
information for marketing employment or insurance underwriting 
purposes; under section (a)(4)(B), what restrictions employers 
place on disclosure or use of employee financial or health 
information; under section (a)(4)(C), what rights employees 
have to access, copy, and amend their own health records and 
financial information; under section (a)(4)(D), what type of 
notice is provided to employees regarding employer practices 
with respect to employee financial and health information; and, 
under section (a)(4)(E), what practices employer medical 
departments use regarding the disclosure of employee health 
information to the employer. During the hearings, some 
Committee members raised the point that employers collect 
information on employees so that an employer may fulfil his or 
her obligation to provide information to health insurance or 
retirement plans. It is the view of the Committee that the 
Commission should review the potential uses of any collected 
information, as well as current trends among employers 
regarding that information.
    Section (a)(5), requires the Commission to review the 
extent to which individuals in the United States can obtain 
redress for privacy violations. The Commission should examine 
whether mechanisms exist to assist people who believe their 
privacy has been inappropriately compromised, and if so, 
whether these mechanisms are effective.
    Under section (a)(6), the Commission is to review the 
extent to which older individuals and disabled individuals are 
subject to exploitation involving the disclosure or use of 
their financial information. The Committee believes that the 
Commission should evaluate present trends occurring in the 
financial community and their impact on seniors and the 
disabled.
    Section (b) directs the Commission to hold at least two 
field hearings in five geographical regions of the United 
States. For purposes of these field hearings, the Commission is 
charged with the responsibility of designating the boundaries 
that constitute the geographical areas. Field hearings may be 
held with less than a majority of Commission members present. 
During the course of the Committee hearings, it was suggested 
that requiring members to be at every meeting would be 
unnecessarily burdensome, and that the field hearings could be 
equally effective with less than a majority of the Commission 
present. The Committee agrees.
    Section (c) requires that no later than 18 months after the 
appointment of all members of the Commission, a majority of the 
Commission's members shall submit a report to Congress and the 
President.
    Section (c)(2), delineates the minimum content of the 
report. Section (c)(2)(H), requires the Commission to review 
the effectiveness and utility of third-party verification of 
privacy statements, including existing private sector self-
regulatory efforts. This provision contains language that may 
lead the private and public sectors to a mutually satisfactory 
solution on the broad privacy concerns of the American public 
and the business community. The private sector has a long 
history of securing objective, third party professionals to 
undertake reviews of the financial and business records of 
American industry. These reviews are, primarily, initiated by 
the private sector. Arms-length reviews have been and remain an 
important tradition in reassuring the American public that the 
corporate sector can be depended upon for honest business 
dealings. Now, more than ever, the public trusts the corporate 
sector with its personal investments and savings. This trust 
must include the maintenance of Americans' most private 
information as well. This is why the Committee is specifically 
asking the Commission to review and report to the Congress on 
the efficacy of third-party verification and assurance services 
for protecting individual private information. This objective 
is critically important, in that it may protect the future of 
the evolving e-commerce industry as well as the private 
information of American citizens.
    Subsection (d) allows for the submission of additional 
reports in the event of dissenting points of view. Any 
additional reports shall also be made public so that all points 
of view can be disseminated.
    Pursuant to section (e), the Commission has the authority 
to issue interim reports approved by a majority of members of 
the Commission. The Committee was concerned that during the 
operation of the Commission, the Commission may determine that 
certain aspects of the privacy debate require immediate 
attention, and that the Commission might be prepared to make a 
recommendation before the final report of the Commission. 
Because governmental bodies and private entities continue to 
question the appropriate relationships between protecting 
privacy and the sharing of information, the Committee believes 
that the Commission may want to issue interim reports on time-
sensitive privacy issues, so that the Commission's findings may 
be used to assist entities that are moving forward on the 
privacy front.

Sec. 5. Membership

    Under section 5 of the Act, the Commission shall be 
composed of 17 members--4 members appointed by the President; 4 
members appointed by the Majority Leader of the Senate; 2 
members appointed by the Minority Leader of the Senate; 4 
members appointed by the Speaker of the House of 
Representatives; 2 members appointed by the Minority Leader of 
the House of Representatives; and 1 member, who shall serve as 
Chairperson of the Commission, appointed jointly by the 
President, the Majority Leader of the Senate, and the Speaker 
of the House of Representatives.
    Under subsection (b), the Committee firmly believes that it 
is important for the Commission to be composed of individuals 
who have a wide diversity of viewpoints as well as those who 
deal with privacy issues on a regular basis. Furthermore, the 
Committee believes that Commission members should possess 
practical knowledge and experience in balancing individual 
privacy interests with the legitimate needs of the public, 
government, commercial interests, and news organizations to 
gain access to and use information. The individuals appointed 
should be open-minded and willing to look at new ideas and 
possibilities. During the mark-up, the Committee included 
language offering a broad outline of groups that should 
comprise the Commission, including representatives from groups 
such as: Federal, State and local governments who can provide 
insight on the government's collection of information and 
existing State and Federal laws; the news media, who have a 
working familiarity with the use of public documents for the 
dissemination of public information; the academic community, 
who can provide expertise in the history and theories of 
privacy policy; consumer groups, who can represent individual 
consumers and their privacy concerns; public policy groups who 
are knowledgeable on legislative policies and privacy policies 
within private industry; the business community, including 
small business, who can share information about developing 
technologies and discuss the impact of privacy protections on 
business endeavors including Internet and e-commerce; the 
medical community, who can provide the Commission with an 
understanding of the intricacies of privacy issues in the 
medical profession; civil liberties organizations, who can help 
raise awareness of privacy issues; and the financial community, 
who can provide expertise regarding financial modernization 
laws and can explain the need for allowing the free flow of 
information while protecting privacy.
    Under subsection (c), the appointment of the members of the 
Commission shall be made no later than 30 days after the date 
of the enactment of the Act.
    Under subsection (d), each member of the Commission will 
serve for the life of the Commission.
    Under subsection (e), in the event of a vacancy, the 
position will be filled in the same manner as the original 
appointment. The individual serving in the capacity of the 
appointing official (e.g., the Majority Leader of the House) 
has the authority to appoint a replacement to fill the vacancy.
    Pursuant to subsection (f), members of the Commission shall 
serve without pay, but shall receive travel expenses, including 
per diem in lieu of subsistence.
    Subsection (g) establishes that a majority of the 
Commission shall constitute a quorum, but a lesser number may 
hold hearings.
    Under subsection (h), the Commission shall meet at the call 
of the Chairperson or a majority of its members. The initial 
meeting of the Commission shall not be later than 45 days after 
the date of enactment of this Act.

Sec. 6. Director; staff; experts and consultants

    Section 6 of the Act addresses the staff of the Commission. 
The Commission shall appoint a director, who will be paid at 
the rate payable for level III of the Executive Schedule 
established under section 5314 of Title 5, United States Code. 
The Director may appoint staff, who will be paid in accordance 
with the provisions of chapter 51 and subchapter III of chapter 
53 of that title relating to classification and General 
Schedule pay rates, but at rates not in excess of the maximum 
rate for grade GS-15 of the General Schedule under section 5332 
of that title. The Director may procure temporary and 
intermittent services under section 3109(b) of Title 5, United 
States Code. Finally, the Director, if it is deemed necessary, 
may request the head of any Federal department or agency to 
detail personnel of that department or agency on a reimbursable 
to the Commission to assist in the carrying out of this Act. 
However, before making such a request, the Director shall give 
notice of the request to each member of the Commission.

Sec. 7. Powers of Commission

    Pursuant to subsection (a), the Commission may hold 
hearings, sit and act at times and places, take testimony, and 
receive evidence, as the Commission considers appropriate. The 
Commission may administer oaths or affirmation to witnesses 
appearing before it.
    Under subsection (b), any member or agent of the Commission 
may, if authorized by the Commission, take any action which the 
Commission is authorized to take by this section.
    Under subsection (c), except as provided for by section 
(7)(c)(2), if the Chairperson of the Commission submits a 
request to a Federal department or agency for information 
necessary to enable the Commission to carry out this Act, the 
head of the department or agency shall furnish that information 
to the Commission. However, if the head of the department or 
agency determines that this information should not be furnished 
due toissues of national security, the department or agency 
head shall not furnish that information to the Commission. During the 
hearings, witnesses representing the Administration raised the issue 
that some agencies may need to withhold information from the Commission 
that is deemed vital to the national security. It is the firm belief of 
the Committee that the collection of information by the Commission 
should in no way threaten the national security of the United States. 
However, the determination to withhold information should be used 
sparingly, and departments and agencies should work with the Commission 
to ensure that information contained in said documents that can be 
segregated and released without threatening national security are 
released.
    Under subsection (d), the Commission may use the United 
States mail in the same manner and under the same conditions as 
other departments and agencies of the United States.
    Under subsection (e), upon request of the Director, the 
Administrator of General Services shall provide to the 
Commission, on a reimbursable basis, the administrative support 
services necessary for the Commission to carry out this bill.
    Subsection (f) provides that, the Commission may accept, 
use, and dispose of gifts or donations of services or property 
to carry out this bill, but only to the extent or in the 
amounts provided in advance in appropriation Acts.
    Pursuant to subsection (g), the Commission may contract 
with and compensate individuals and government agencies for 
supplies and services.
    Subsection (h) allows the Commission to issue subpoenas 
requiring the attendance and testimony of witnesses and the 
production of any evidence relating to any matter that the 
Commission is empowered to investigate. The attendance of 
witnesses and the production of evidence may be required by 
such subpoena from any place within the United States and at 
any specified place of hearing within the United States. Should 
a witness fail to obey a subpoena, the Commission may apply to 
a United States district court for an order requiring the 
witness to appear before the Commission to give testimony, 
produce evidence, or both. The application may be made within 
the judicial district where the hearing is conducted or where 
that person is found, resides, or transacts business. Any 
failure to obey the order of the court may be punished by the 
court as civil contempt. Subpoenas of the Commission shall be 
served in the manner provided for subpoenas issued by a United 
States district court under the Federal Rules of Civil 
Procedure for the United States district courts. All process of 
any court to which application is made under this subsection 
may be served in the judicial district, in which the person 
required to be served resides or may be found.

Sec. 8. Termination

    Under section 8, the Commission shall terminate 30 days 
after submitting a report under section 4(c).

Sec. 9. Authorization of appropriations

    Section 9 authorizes $5 million to be appropriated to the 
Commission to carry out this Act. Any sum appropriated pursuant 
to the authorization in subsection (a) shall remain available 
until expended.

Sec. 10. Budget Act compliance

    Under section 10, any new contract authority authorized by 
this Act shall be effective only to the extent or in the 
amounts provided in advance in appropriation Acts.

Sec. 11. Privacy protections

    Section 11 directs the Commission upon conclusion of its 
work or upon making a determination that individually 
identifiable information disclosed to the Commission is no 
longer needed, to either destroy the individually identifiable 
information or return it to the person or entity from which it 
was obtained, unless the subject of the individually 
identifiable information has authorized its disclosure. The 
Commission shall protect individually identifiable information 
from improper use, and it may not disclose such information to 
any person, including the Congress or the President, unless the 
individual that is the subject of the information has 
authorized such a disclosure. In addition, the Commission will 
protect from improper use and may not disclose to any person, 
proprietary business and financial information that may be 
viewed or obtained by the Commission in the course of carrying 
out its duties under this bill. It is the Committee's view that 
as the Commission is reviewing the question concerning the 
appropriate level of protection for personally identifiable 
information, so, too, the Commission should be aware of how it 
uses, discloses, and disposes of personally identifiable 
information.

                    V. Committee Oversight Findings

    Pursuant to rule XIII, clause 3(c)(1) of the Rules of the 
House of Representatives, the results and findings of those 
oversight activities are incorporated in the recommendations 
found in the bill and in this report.

                  VI. Budget Analysis and Projections

    Clause 3(c)(2) of rule XIII of the Rules of the House of 
Representatives isinapplicable because the bill does not 
provide new budget authority, new spending authority, new credit 
authority, or an increase or decrease in revenues or tax expenditures.

         VII. Cost Estimate of the Congressional Budget Office

                                     U.S. Congress,
                               Congressional Budget Office,
                                     Washington, DC, July 26, 2000.
Hon. Dan Burton,
Chairman, Committee on Government Reform,
House of Representatives, Washington, DC.
    Dear Mr. Chairman: The Congressional Budget Office has 
prepared the enclosed cost estimate for H.R. 4049, the Privacy 
Commission Act.
    If you wish further details on this estimate, we will be 
pleased to provide them. The CBO staff contacts are John R. 
Righter (for the federal costs); Susan Sieg Tompkins (for state 
and local impact); and Sarah E. Sitarek (for the private-sector 
impact).
            Sincerely,
                                        Steven M. Lieberman
                                    (For Dan L. Crippen, Director).
    Enclosure.

H.R. 4049--Privacy Commission Act

    H.R. 4049 would establish the Commission for the 
Comprehensive Study of Privacy Protection to study issues 
related to the protection of individual privacy. The bill would 
direct the commission to discuss potential threats to such 
privacy, assess when the sharing of personal information is 
appropriate and beneficial to consumers, analyze the 
effectiveness of existing statutes and regulations, and 
recommend legislative and regulatory changes to improve the 
security of personal information. The commission would have 18 
months from the time all 17 members are appointed to issue its 
report to the Congress and the President. To cover the costs of 
the commission, the bill would authorize the appropriation of 
$5 million. The commission would terminate 30 days after 
submitting its report.
    Assuming appropriation of the authorized amount, CBO 
estimates that implementing the bill would cost $5 million over 
fiscal years 2001 and 2002. Because the bill would not affect 
direct spending or receipts, pay-as-you-go procedures would not 
apply.
    H.R. 4049 would require state, local, or tribal governments 
and entities in the private sector, if subpoenaed, to provide 
testimony and evidence related to matters the privacy 
commission would be empowered to investigate. Such a 
requirement would be a federal mandate under the Unfunded 
Mandates Reform Act (UMRA). The bill would authorize the 
commission to subpoena the attendance of witnesses and the 
production of evidence from any place within the United States 
and at any specified place of hearing within the United States. 
CBO expects that the commission would likely exercise its 
subpoena power sparingly and that the costs to comply with a 
subpoena would not be significant. Thus, CBO estimates that the 
intergovernmental and private-sector costs of the mandate would 
be small and well below the relevant thresholds established by 
UMRA ($55 million for intergovernmental mandates and $109 
million for private-sector mandates in 2000, adjusted annually 
for inflation).
    The CBO staff contacts for this estimate are John R. 
Righter (for the federal costs); Susan Sieg Tompkins (for the 
state and local impact); and Sarah E. Sitarek (for the private-
sector impact). The estimate was approved by Robert A. 
Sunshine, Assistant Director for Budget Analysis.

              VIII. Statement of Constitutional Authority

    Pursuant to rule XIII, clause 3(d)(1), the Committee finds 
that clauses 14 and 18 of Article I, Section 8 of the U.S. 
Constitution grants Congress the power to enact this law.

                      IX. Committee Recommendation

    On Wednesday, June 28, 2000, a quorum being present, the 
Committee on Government Reform ordered the bill, as amended, 
favorably reported to the House for consideration by voice 
vote.

         X. Congressional Accountability Act; Public Law 104-1

    The Committee finds that the legislation does not relate to 
the terms and conditions of employment or access to public 
services or accommodations within the meaning of section 
102(B)(3) of the Congressional Accountability Act (P.L. 104-1).

    XI. Unfunded Mandates Reform Act; Public Law 104-4, Section 423

    The Committee finds that the legislation does not impose 
any Federal mandates within the meaning of section 423 of the 
Unfunded Mandates Reform Act (P.L. 104-4).

    XII. Federal Advisory Committee Act (5 U.S.C. App.) Section 5(B)

    The functions of the proposed advisory committee authorized 
in the bill are not currently being nor could they be performed 
by one or more agencies, an advisory committee already in 
existence or by enlarging the mandate of an existing advisory 
committee.

      XIII. Changes in Existing Law Made by the Bill, as Reported

    In compliance with clause 3 of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italic, existing law in which no change is 
proposed is shown in Roman):
  Be it enacted by the Senate and House of Representatives of 
the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

  This Act may be cited as the ``Privacy Commission Act''.

SEC. 2. FINDINGS.

  The Congress finds the following:
          (1) Americans are increasingly concerned about their 
        civil liberties and the security and use of their 
        personal information, including medical records, 
        educational records, library records, magazine 
        subscription records, records of purchases of goods and 
        other payments, and driver's license numbers.
          (2) Commercial entities are increasingly aware that 
        consumers expect them to adopt privacy policies and 
        take all appropriate steps to protect the personal 
        information of consumers.
          (3) There is a growing concern about the 
        confidentiality of medical records, because there are 
        inadequate Federal guidelines and a patchwork of 
        confusing State and local rules regarding privacy 
        protection for individually identifiable patient 
        information.
          (4) In light of recent changes in financial services 
        laws allowing for increased sharing of information 
        between traditional financial institutions and 
        insurance entities, a coordinated and comprehensive 
        review is necessary regarding the protections of 
        personal data compiled by the health care, insurance, 
        and financial services industries.
          (5) The use of Social Security numbers has expanded 
        beyond the uses originally intended.
          (6) Use of the Internet has increased at astounding 
        rates, with approximately 5 million current Internet 
        sites and 64 million regular Internet users each month 
        in the United States alone.
          (7) Financial transactions over the Internet have 
        increased at an astounding rate, with 17 million 
        American households spending $20 billion shopping on 
        the Internet last year.
          (8) Use of the Internet as a medium for commercial 
        activities will continue to grow, and it is estimated 
        that by the end of 2000, 56 percent of the companies in 
        the United States will sell their products on the 
        Internet.
          (9) There have been reports of surreptitious 
        collection of consumer data by Internet marketers and 
        questionable distribution of personal information by 
        on-line companies.
          (10) In 1999, the Federal Trade Commission found that 
        87 percent of Internet sites provided some form of 
        privacy notice, which represented an increase from 15 
        percent in 1998.
          (11) The United States is the leading economic and 
        social force in the global information economy, largely 
        because of a favorable regulatory climate and the free 
        flow of information. It is important for the United 
        States to continue that leadership. As nations and 
        governing bodies around the world begin to establish 
        privacy standards, these standards will directly affect 
        the United States.
          (12) The shift from an industry-focused economy to an 
        information-focused economy calls for a reassessment of 
        the most effective way to balance personal privacy and 
        information use, keeping in mind the potential for 
        unintended effects on technology development, 
        innovation, the marketplace, and privacy needs.
          (13) This Act shall not be construed to prohibit the 
        enactment of legislation on privacy issues by the 
        Congress during the existence of the Commission. It is 
        the responsibility of the Congress to act to protect 
        the privacy of individuals, including individuals' 
        medical and financial information. Various committees 
        of the Congress are currently reviewing legislation in 
        the area of medical and financial privacy. Further 
        study by the Commission established by this Act should 
        not be considered a prerequisite for further 
        consideration or enactment of financial or medical 
        privacy legislation by the Congress.

SEC. 3. ESTABLISHMENT.

  There is established a commission to be known as the 
``Commission for the Comprehensive Study of Privacy 
Protection'' (in this Act referred to as the ``Commission'').

SEC. 4. DUTIES OF COMMISSION.

  (a) Study.--The Commission shall conduct a study of issues 
relating to protection of individual privacy and the 
appropriate balance to be achieved between protecting 
individual privacy and allowing appropriate uses of 
information, including the following:
          (1) The monitoring, collection, and distribution of 
        personal information by Federal, State, and local 
        governments, including personal information collected 
        for a decennial census, and such personal information 
        as a driver's license number.
          (2) Current efforts to address the monitoring, 
        collection, and distribution of personal information by 
        Federal and State governments, individuals, or 
        entities, including--
                  (A) existing statutes and regulations 
                relating to the protection of individual 
                privacy, such as section 552a of title 5, 
                United States Code (commonly referred to as the 
                Privacy Act of 1974) and section 552 of title 5, 
                United States Code (commonly referred to as the 
                Freedom of Information Act);
                  (B) legislation pending before the Congress;
                  (C) privacy protection efforts undertaken by 
                the Federal Government, State governments, 
                foreign governments, and international 
                governing bodies;
                  (D) privacy protection efforts undertaken by 
                the private sector; and
                  (E) self-regulatory efforts initiated by the 
                private sector to respond to privacy issues.
          (3) The monitoring, collection, and distribution of 
        personal information by individuals or entities, 
        including access to and use of medical records, 
        financial records (including credit cards, automated 
        teller machine cards, bank accounts, and Internet 
        transactions), personal information provided to on-line 
        sites accessible through the Internet, Social Security 
        numbers, insurance records, education records, and 
        driver's license numbers.
          (4) Employer practices and policies with respect to 
        the financial and health information of employees, 
        including--
                  (A) whether employers use or disclose 
                employee financial or health information for 
                marketing, employment, or insurance 
                underwriting purposes;
                  (B) what restrictions employers place on 
                disclosure or use of employee financial or 
                health information;
                  (C) employee rights to access, copy, and 
                amend their own health records and financial 
                information;
                  (D) what type of notice employers provide to 
                employees regarding employer practices with 
                respect to employee financial and health 
                information; and
                  (E) practices of employer medical departments 
                with respect to disclosing employee health 
                information to administrative or other 
                personnel of the employer.
          (5) The extent to which individuals in the United 
        States can obtain redress for privacy violations.
          (6) The extent to which older individuals and 
        disabled individuals are subject to exploitation 
        involving the disclosure or use of their financial 
        information.
  (b) Field Hearings.--
          (1) In general.--The Commission shall conduct at 
        least 2 field hearings in each of the 5 geographical 
        regions of the United States.
          (2) Boundaries.--For purposes of this subsection, the 
        Commission may determine the boundaries of the five 
        geographical regions of the United States.
  (c) Report.--
          (1) In general.--Not later than 18 months after 
        appointment of all members of the Commission--
                  (A) a majority of the members of the 
                Commission shall approve a report; and
                  (B) the Commission shall submit the approved 
                report to the Congress and the President.
          (2) Contents.--The report shall include a detailed 
        statement of findings, conclusions, and 
        recommendations, including the following:
                  (A) Findings on potential threats posed to 
                individual privacy.
                  (B) Analysis of purposes for which sharing of 
                information is appropriate and beneficial to 
                consumers.
                  (C) Analysis of the effectiveness of existing 
                statutes, regulations, private sector self-
                regulatory efforts, technology advances, and 
                market forces in protecting individual privacy.
                  (D) Recommendations on whether additional 
                legislation is necessary, and if so, specific 
                suggestions on proposals to reform or augment 
                current laws and regulations relating to 
                individual privacy.
                  (E) Analysis of purposes for which additional 
                regulations may impose undue costs or burdens, 
                or cause unintended consequences in other 
                policy areas, such as security, law 
                enforcement, medical research, or critical 
                infrastructure protection.
                  (F) Cost analysis of legislative or 
                regulatory changes proposed in the report.
                  (G) Recommendations on non-legislative 
                solutions to individual privacy concerns, 
                including education, market-based measures, 
                industry best practices, and new technology.
                  (H) Review of the effectiveness and utility 
                of third-party verification of privacy 
                statements, including specifically with respect 
                to existing private sector self-regulatory 
                efforts.
  (d) Additional Report.--Together with the report under 
subsection (c), the Commission shall submit to the Congress and 
the President any additional report of dissenting opinions or 
minority views by a member of the Commission.
  (e) Interim Report.--The Commission may submit to the 
Congress and the President an interim report approved by a 
majority of the members of the Commission.

SEC. 5. MEMBERSHIP.

  (a) Number and Appointment.--The Commission shall be composed 
of 17 members appointed as follows:
          (1) 4 members appointed by the President.
          (2) 4 members appointed by the majority leader of the 
        Senate.
          (3) 2 members appointed by the minority leader of the 
        Senate.
          (4) 4 members appointed by the Speaker of the House 
        of Representatives.
          (5) 2 members appointed by the minority leader of the 
        House of Representatives.
          (6) 1 member, who shall serve as Chairperson of the 
        Commission, appointed jointly by the President, the 
        majority leader of the Senate, and the Speaker of the 
        House of Representatives.
  (b) Diversity of Views.--The appointing authorities under 
subsection (a) shall seek to ensure that the membership of the 
Commission has a diversity of views and experiences on the 
issues to be studied by the Commission, such as views and 
experiences of Federal, State, and local governments, the 
media, the academic community, consumer groups, public policy 
groups and other advocacy organizations, business and industry 
(including small business), the medical community, civil 
liberties experts, and the financial services industry.
  (c) Date of Appointment.--The appointment of the members of 
the Commission shall be made not later than 30 days after the 
date of the enactment of this Act.
  (d) Terms.--Each member of the Commission shall be appointed 
for the life of the Commission.
  (e) Vacancies.--A vacancy in the Commission shall be filled 
in the same manner in which the original appointment was made.
  (f) Compensation; Travel Expenses.--Members of the Commission 
shall serve without pay, but shall receive travel expenses, 
including per diem in lieu of subsistence, in accordance with 
sections 5702 and 5703 of title 5, United States Code.
  (g) Quorum.--A majority of the members of the Commission 
shall constitute a quorum, but a lesser number may hold 
hearings.
  (h) Meetings.--
          (1) In general.--The Commission shall meet at the 
        call of the Chairperson or a majority of its members.
          (2) Initial meeting.--Not later than 45 days after 
        the date of the enactment of this Act, the Commission 
        shall hold its initial meeting.

SEC. 6. DIRECTOR; STAFF; EXPERTS AND CONSULTANTS.

  (a) Director.--
          (1) In general.--On or after October 1, 2000, the 
        Commission shall appoint a Director without regard to 
        the provisions of title 5, United States Code, 
        governing appointments to the competitive service.
          (2) Pay.--The Director shall be paid at the rate 
        payable for level III of the Executive Schedule 
        established under section 5314 of such title.
  (b) Staff.--The Director may appoint staff as the Director 
determines appropriate.
  (c) Applicability of Certain Civil Service Laws.--
          (1) In general.--The staff of the Commission shall be 
        appointed without regard to the provisions of title 5, 
        United States Code, governing appointments in the 
        competitive service.
          (2) Pay.--The staff of the Commission shall be paid 
        in accordance with the provisions of chapter 51 and 
        subchapter III of chapter 53 of that title relating to 
        classification and General Schedule pay rates, but at 
        rates not in excess of the maximum rate for grade GS-15 
        of the General Schedule under section 5332 of that 
        title.
  (d) Experts and Consultants.--The Director may procure 
temporary and intermittent services under section 3109(b) of 
title 5, United States Code.
  (e) Staff of Federal Agencies.--
          (1) In general.--Upon request of the Director, the 
        head of any Federal department or agency may detail, on 
        a reimbursable basis, any of the personnel of that 
        department or agency to the Commission to assist it in 
        carrying out this Act.
          (2) Notification.--Before making a request under this 
        subsection, the Director shall give notice of the 
        request to each member of the Commission.

SEC. 7. POWERS OF COMMISSION.

  (a) Hearings and Sessions.--The Commission may, for the 
purpose of carrying out this Act, hold hearings, sit and act at 
times and places, take testimony, and receiveevidence as the 
Commission considers appropriate. The Commission may administer oaths 
or affirmations to witnesses appearing before it.
  (b) Powers of Members and Agents.--Any member or agent of the 
Commission may, if authorized by the Commission, take any 
action which the Commission is authorized to take by this 
section.
  (c) Obtaining Official Information.--
          (1) In general.--Except as provided in paragraph (2), 
        if the Chairperson of the Commission submits a request 
        to a Federal department or agency for information 
        necessary to enable the Commission to carry out this 
        Act, the head of that department or agency shall 
        furnish that information to the Commission.
          (2) Exception for national security.--If the head of 
        that department or agency determines that it is 
        necessary to guard that information from disclosure to 
        protect the national security interests of the United 
        States, the head shall not furnish that information to 
        the Commission.
  (d) Mails.--The Commission may use the United States mails in 
the same manner and under the same conditions as other 
departments and agencies of the United States.
  (e) Administrative Support Services.--Upon the request of the 
Director, the Administrator of General Services shall provide 
to the Commission, on a reimbursable basis, the administrative 
support services necessary for the Commission to carry out this 
Act.
  (f) Gifts and Donations.--The Commission may accept, use, and 
dispose of gifts or donations of services or property to carry 
out this Act, but only to the extent or in the amounts provided 
in advance in appropriation Acts.
  (g) Contracts.--The Commission may contract with and 
compensate persons and government agencies for supplies and 
services, without regard to section 3709 of the Revised 
Statutes (41 U.S.C. 5).
  (h) Subpoena Power.--
          (1) In general.--The Commission may issue subpoenas 
        requiring the attendance and testimony of witnesses and 
        the production of any evidence relating to any matter 
        that the Commission is empowered to investigate by 
        section 4. The attendance of witnesses and the 
        production of evidence may be required by such subpoena 
        from any place within the United States and at any 
        specified place of hearing within the United States.
          (2) Failure to obey a subpoena.--If a person refuses 
        to obey a subpoena issued under paragraph(1), the 
Commission may apply to a United States district court for an order 
requiring that person to appear before the Commission to give 
testimony, produce evidence, or both, relating to the matter under 
investigation. The application may be made within the judicial district 
where the hearing is conducted or where that person is found, resides, 
or transacts business. Any failure to obey the order of the court may 
be punished by the court as civil contempt.
          (3) Service of subpoenas.--The subpoenas of the 
        Commission shall be served in the manner provided for 
        subpoenas issued by a United States district court 
        under the Federal Rules of Civil Procedure for the 
        United States district courts.
          (4) Service of process.--All process of any court to 
        which application is made under paragraph (2) may be 
        served in the judicial district in which the person 
        required to be served resides or may be found.

SEC. 8. TERMINATION.

  The Commission shall terminate 30 days after submitting a 
report under section 4(c).

SEC. 9. AUTHORIZATION OF APPROPRIATIONS.

  (a) In General.--There are authorized to be appropriated to 
the Commission $5,000,000 to carry out this Act.
  (b) Availability.--Any sums appropriated pursuant to the 
authorization in subsection (a) shall remain available until 
expended.

SEC. 10. BUDGET ACT COMPLIANCE.

  Any new contract authority authorized by this Act shall be 
effective only to the extent or in the amounts provided in 
advance in appropriation Acts.

SEC. 11. PRIVACY PROTECTIONS.

  (a) Destruction or Return of Information Required.--Upon the 
conclusion of the matter or need for which individually 
identifiable information was disclosed to the Commission, the 
Commission shall either destroy the individually identifiable 
information or return it to the person or entity from which it 
was obtained, unless the individual that is the subject of the 
individually identifiable information has authorized its 
disclosure.
  (b) Disclosure of Information Prohibited.--The Commission--
          (1) shall protect individually identifiable 
        information from improper use; and
          (2) may not disclose such information to any person, 
        including the Congress or the President, unless the 
        individual that is the subject of the information has 
        authorized such a disclosure.
  (c) Proprietary Business Information and Financial 
Information.--The Commission shall protect from improper use, 
and may not disclose to any person, proprietary business 
information and proprietary financial information that may be 
viewed or obtained by the Commission in the course of carrying 
out its duties under this Act.
  (d) Individually Identifiable Information Defined.--For the 
purposes of this Act, the term ``individually identifiable 
information'' means any information, whether oral or recorded 
in any form or medium, that identifies an individual, or with 
respect to which there is a reasonable basis to believe that 
the information can be used to identify an individual.

                             MINORITY VIEWS

    We are strongly in favor of protecting the privacy of 
consumers' information, including health, financial, and other 
personal information. We believe that Congress has an essential 
role in protecting privacy, and should act now to pass 
meaningful privacy protection legislation.
    We have differing views about H.R. 4049. Some of us believe 
that a Privacy Commission could contribute to the development 
of public policy regarding privacy protections. Others believe 
that it may serve to delay privacy protection initiatives. 
Indeed, an April 17, 2000, editorial in the National 
Underwriter magazine urged support of the bill specifically on 
the grounds that a commission could delay privacy protection 
measures. The editorial noted that enactment of the bill could 
be a ``golden opportunity to forestall highly restrictive 
privacy measures that will be introduced both in Congress and 
in state legislatures around the country.'' It further stated:

          If the financial services industry can make a strong 
        economic case for the consumer benefits of information 
        sharing, the bipartisan commission proposed by Reps. 
        Hutchinson and Moran provides the best forum to do it. 
        Moreover, the presence of such a commission will 
        provide a strong argument for Congress and the state 
        legislatures to wait for the results before enacting 
        highly restrictive privacy legislation.

    We are pleased that the markup process strengthened the 
Privacy Commission bill. For example, the legislation now 
contains instructions that ensure that the Commission will 
examine several important privacy issues, including employer 
privacy practices regarding the health and financial 
information of employees, the type of redress currently 
available regarding privacy violations, exploitation of older 
and disabled Americans through the use of their financial 
information, and the use of third parties to monitor internet 
privacy practices. Amendments also strengthened the legislation 
by including consideration of civil liberties experts for 
inclusion on the Commission.
    It is important to emphasize, however, that further study 
by a Commission is not necessary before enactment of 
substantive privacy protections. The Privacy Commission should 
serve as a complement to ongoing privacy protection 
initiatives. Congress should be taking action now to enact 
privacy protections regarding consumers' financial and health 
information, among other initiatives. The recent breakthrough 
in mapping the human genome underscores the need to ensure that 
privacy protections are in place immediately for individuals' 
genetic information so that insurers, employers, and others 
cannot inappropriately access this personal information. For 
this reason, we are pleased that an amendment was accepted to 
include in the bill's findings that the Commission is not 
intended to delay privacy protection initiatives.
    We are disappointed, however, that agreement could not be 
reached to include in the bill a commitment by Congress to 
enact important privacy protections. Rep. Waxman offered an 
amendment that focused on financial privacy. It would have set 
an 18-month deadline on Congress to enact comprehensive 
protections, and would have given relevant regulatory entities 
authority to regulate if the deadline was not met. Such a 
commitment is important to ensuring that the study of privacy 
will not constitute the only action Congress takes on privacy 
protection. We regret that the amendment was rejected on a 
point of order and not incorporated into the bill.

                                   Henry A. Waxman.
                                   Carolyn B. Maloney.
                                   Major R. Owens.
                                   Danny K. Davis.
                                   John F. Tierney.
                                   Thomas H. Allen.
                                   Dennis J. Kucinich.
                                   Eleanor Holmes Norton.
                                   Rod R. Blagojevich.
                                   Paul E. Kanjorski.
                                   Tom Lantos.
                                   Edolphus Towns.
                                   Janice D. Schakowsky.
                                   Bernard Sanders.
                                   Patsy T. Mink.
                                   Elijah E. Cummings.
                                   Harold E. Ford, Jr.

                                  

```