```

[House Report 107-701]
[From the U.S. Government Publishing Office]

107th Congress                                                   Report
                        HOUSE OF REPRESENTATIVES
 2d Session                                                     107-701

======================================================================

 
                FEDERAL AGENCY PROTECTION OF PRIVACY ACT

                                _______
                                

 September 30, 2002.--Committed to the Committee of the Whole House on 
            the State of the Union and ordered to be printed

                                _______
                                

 Mr. Sensenbrenner, from the Committee on the Judiciary, submitted the 
                               following

                              R E P O R T

                        [To accompany H.R. 4561]

      [Including cost estimate of the Congressional Budget Office]

    The Committee on the Judiciary, to whom was referred the 
bill (H.R. 4561) to amend title 5, United States Code, to 
require that agencies, in promulgating rules, take into 
consideration the impact of such rules on the privacy of 
individuals, and for other purposes, having considered the 
same, reports favorably thereon without amendment and 
recommends that the bill do pass.

                                CONTENTS

                                                                   Page
Purpose and Summary..............................................     1
Background and Need for the Legislation..........................     2
Hearings.........................................................     9
Committee Consideration..........................................     9
Vote of the Committee............................................     9
Committee Oversight Findings.....................................     9
Performance Goals and Objectives.................................     9
New Budget Authority and Tax Expenditures........................     9
Congressional Budget Office Cost Estimate........................     9
Constitutional Authority Statement...............................    11
Section-by-Section Analysis and Discussion.......................    11
Changes in Existing Law Made by the Bill, as Reported............    12
Markup Transcript................................................    17

                          Purpose and Summary

    H.R. 4561, the ``Federal Agency Protection of Privacy 
Act,'' preserves and promotes the privacy rights of all 
Americans by requiring Federal agencies to assess and mitigate 
the adverse privacy impact of rules noticed for public comment 
pursuant to the Administrative Procedure Act \1\ (APA). H.R. 
4561 helps safeguard privacy rights by requiring that rules 
noticed for public comment by Federal agencies be accompanied 
by an initial assessment of the rule's impact on personal 
privacy interests, including the extent to which the proposed 
rule provides notice of the collection of personally 
identifiable information, the type of personally identifiable 
information to be obtained, and the manner in which this 
information will be collected, maintained, protected, 
transferred, or disclosed by the Federal Government.
---------------------------------------------------------------------------
    \1\ 5 U.S.C. Sec. 553 et seq. (2001).
---------------------------------------------------------------------------
    The bill further provides that final rules be accompanied 
by a final privacy impact analysis which details how the 
issuing agency considered and responded to privacy concerns 
raised by the public during the comment period and explains 
whether the agency issuing the rule could have taken an 
approach less burdensome to personal privacy. Of critical 
importance, H.R. 4561 contains a provision for judicial review 
to ensure agency compliance with its requirements. While 
existing Federal statutes protect against the disclosure of 
information already obtained by the Federal Government, the 
Federal Agency Protection of Privacy Act provides the public 
with prospective notice and an opportunity to comment on how 
proposed Federal rules might affect personal privacy before 
they become binding regulations.

                Background and Need for the Legislation

                            PUBLIC CONCERNS

    There is growing public anxiety toward the diminishing 
sphere of personal privacy brought about by the rapid pace of 
technological and social change. Many have decried the 
perceived encroachment by outside entities into areas until 
recently considered part of our private lives. Examples 
include: facial recognition software linked to video cameras 
that can identify individuals in public places; tracking 
devices that monitor online activity; cameras that record our 
movements at traffic intersections and whose photographs serve 
as an exclusive basis for traffic fines and other penalties; 
Government-mandated devices in cellular phones that record the 
physical movements of their users; and the proliferation of 
Global Position Satellite (GPS) technologies that can be used 
to monitor a range of personal public and private activity.
    The effort to create a Federal Department of Homeland 
Security and America's ongoing war against terrorism has 
heightened public sensitivity toward Government policies which 
might intrude upon personal privacy interests. H.R. 4561 would 
help address these concerns by ensuring that the privacy impact 
of proposed regulations are considered by Federal agencies when 
rules are noticed for public comment under the Administrative 
Procedure Act.

              GOVERNMENT COLLECTION OF PRIVATE INFORMATION

    The compulsory nature of Government collection of 
personally identifiable information raises serious concerns. 
Unlike private entities, with which consumers voluntarily 
interact, the Government often requires the disclosure of 
personal information under penalty of law. The Government 
collects and maintains large volumes of personally-identifiable 
information. Much of this information is available to the 
public. While the legitimacy of our judicial system is premised 
on public access to court documents, this information might be 
susceptible to misuse. For example, section 107 of the 
Bankruptcy Code makes any filing in a bankruptcy case a matter 
of public record.\2\ With bankruptcy records increasingly 
available online, the potential for identity theft has greatly 
multiplied. In addition, the Social Security card has been 
widely adopted by both governments and the public as a standard 
identifier. Social Security numbers are now used for tax 
collection, credit and banking transactions, Federal Government 
security, State-level record keeping, passport issuance, and 
other purposes. Public transmission of this information further 
heightens the potential for identity fraud, a growing problem 
which impacted over 700 thousand Americans last year.\3\ While 
the Identity Theft and Assumption Deterrence Act of 1998 \4\ 
was enacted to address this problem, persistent concerns remain 
unaddressed.
---------------------------------------------------------------------------
    \2\ 11 U.S.C. Sec. 107 (2002).
    \3\ Identity Theft Resource Center, available at http://
www.idtheftcenter.org/.
    \4\ Pub. L. No. 105-318, 112 Stat. 3007 (1998), codified at 18 
U.S.C. Sec. 1028 (2001).
---------------------------------------------------------------------------
    States also maintain large, comprehensive databases of 
personal information, some of which are susceptible to 
intrusion. In 1994, Congress enacted the Driver's Privacy 
Protection Act \5\ after the murder of actress Rebecca Shaeffer 
by an assailant who obtained her address from the California 
Department of Motor Vehicles. While responsibility for this 
crime lies squarely with the assailant, the Shaeffer case 
highlights the potential vulnerability of personal information 
in public records databases.
---------------------------------------------------------------------------
    \5\ 18 U.S.C. Sec. 2721-2725 (2001).
---------------------------------------------------------------------------
    Federal agencies collect and maintain large volumes of 
personally-identifiable, private information in computer 
databases. Much of this information is obtained from 
individuals pursuant to regulations issued by Federal agencies 
in accordance with their organic statutes and the procedural 
requirements of the APA. While Federal agencies are required to 
conduct a cost-benefit analysis of rules noticed for public 
comment, privacy concerns often go unaddressed. Currently, 
there is no requirement that agencies issuing rules in 
accordance with the APA specifically examine the privacy 
implications of rules they promulgate. As a result, agencies 
are free to issue rules without considering how personally-
sensitive information may be stored, protected, and transmitted 
among Federal agencies. The public is often uninformed about 
the privacy impact of proposed rules. The following is a 
summary of the major databases containing private information 
currently operated by the Federal Government.

         FEDERAL BUREAU OF INVESTIGATION ``BRADY LAW'' DATABASE

    The Brady Handgun Violence Prevention Act \6\ requires 
firearms dealers to submit information about prospective 
firearms purchasers to the Department of Justice. Required 
information includes the potential purchaser's name, sex, race, 
date of birth, and State of residence. This information is then 
cross-referenced with existing databases to prevent firearms 
sales to convicted felons, fugitives from justice, and other 
disqualified buyers. The Brady Law requires the National 
Instant Check System to ``destroy all records'' relating to the 
backgrounds of individuals cleared to purchase a firearm under 
the law. In regulations implementing this legislation, however, 
the FBI provided for an ``Audit Log'' of background checks. 
This log is maintained for as long as 6 months after a firearm 
transaction. Upon taking office, Attorney General Ashcroft 
considerably shortened this time period. While some insist the 
Audit Log might serve creditable auditing and oversight 
purposes, the collection, storage, and dissemination of private 
information relating to legal purchasers of firearms raise 
considerable constitutional concerns.
---------------------------------------------------------------------------
    \6\ Pub. L. No. 103-159 (1993), 107 Stat. 1536, codified at 18 
U.S.C. Sec. 921 et seq. (2001).
---------------------------------------------------------------------------

                        ICANN ``WHOIS'' DATABASE

    The ``Whois'' database consists of the names, e-mail 
addresses, postal addresses, and telephone numbers for the 
holders of the more than 24 million Internet domain names. The 
Internet Corporation for Assigned Names and Numbers (ICANN), 
which oversees Network Solutions, the record keeper of Internet 
addresses and the domain registration companies, currently 
requires disclosure of contact information for holders of 
``.com,'' ``.net,'' and ``.org'' Internet addresses. Compulsory 
disclosure of this information helps ensure the veracity of the 
identity of website operators. This information can reduce 
fraud, defamation, copyright infringements, and trademark 
violations. While some contend this database is private or 
quasi-governmental, ICANN exercises control of Network 
Solutions and the Whois database under authority granted by the 
U.S. Department of Commerce. It is thus best viewed as a 
Government database.

                VETERANS ADMINISTRATION COMPUTER SYSTEM

    The Veterans Administration (VA) maintains detailed records 
that facilitate the management of its finances, the oversight 
of its employees, and the delivery of health care benefits to 
military veterans and their families. The VA has not taken 
sufficient steps to protect electronic data that it maintains. 
Poor management of personal information by the VA has led to 
invasions of the privacy of those who receive treatment in VA 
facilities. Testimony received by the House Veterans Affairs 
Committee revealed that a security company hired by the VA's 
Office of Inspector General easily entered and gained control 
over VA computer system.\7\ Poor computer security has also 
produced fraud and financial mismanagement, permitting VA 
employees to write more than $1.2 million in fraudulent benefit 
checks from 1998 to 2001.\8\ While ameliorative steps have been 
taken by the agency, concerns about the security of this 
information persist.
---------------------------------------------------------------------------
    \7\ VA Computer Security, 2000, Hearings Before the House Comm. on 
Veterans' Affairs, Subcomm. on Oversight and Investigations, 106th 
Cong. (2000) (statement of Michael Slachta, Jr. Assistant Inspector 
General for Auditing Office of Inspector General Department of Veterans 
Affairs Va's Information Security Program).
    \8\ Id. (statement of Joel C. Willemsen, Director of Civil Agencies 
Information Systems Accounting and Information Management Division).
---------------------------------------------------------------------------

        HEALTH CARE FINANCING ADMINISTRATION ``OASIS'' DATABASE

    In 1999, the Health Care Financing Administration announced 
a final effective date for the mandatory use, collection, 
encoding, and transmission of OASIS data for all Medicare and 
Medicaid patients receiving skilled services.\9\ OASIS is the 
acronym for ``Outcome and Assessment Information Set.''
---------------------------------------------------------------------------
    \9\ Privacy Act of 1974, Report of New System, 64 Fed. Reg. 32,992 
(1999).
---------------------------------------------------------------------------
    Medicare and Medicaid recipients are required to submit 
highly detailed and personal medical information in accordance 
with this regulation. A cursory review of OASIS ``data sets'' 
reveals their breadth. Patients are required to submit their 
name, Social Security number, residence, birth date, gender, 
payment sources for health care, past and recent medical 
treatment, current condition, medical risk factors, living 
arrangements, residential safety hazards, the identity of those 
who have assisted or are currently assisting the patient, the 
patient's vision and speech status, and a host of other data. 
While information concerning a patient's history ensures the 
delivery of the proper medical care, the public must be assured 
that adequate safeguards exist to protect this highly personal 
information.

           FEDERAL BUREAU OF INVESTIGATION ``CODIS'' DATABASE

    CODIS, the Combined DNA Index System, was established by 
Congress in 1994.\10\ It gives Federal funds to States that 
assist the FBI in collecting DNA information. By 1998, all 50 
States had passed laws requiring local police departments to 
collect DNA samples. CODIS was intended to help Federal law 
enforcement collect information about convicted sex offenders. 
Since its inception, some have called for considerable 
expansion of the database. While modern technology plays an 
increasingly important and necessary part in modern law 
enforcement, steps must also be taken to ensure the security of 
this information.
---------------------------------------------------------------------------
    \10\ DNA Analysis Backlog Elimination Act of 2000, Pub. L. No. 106-
546, 114 Stat. 2726 (2000).
---------------------------------------------------------------------------

                               THE CENSUS

    The Constitution authorizes the Federal Government to 
``enumerate'' persons in order to apportion congressional 
representatives among the States.\11\ To accomplish this 
purpose, the Government needs only to know how many individuals 
reside at a given residence. This question appears on the first 
page of the census. The remaining questions which appear on the 
census long form require Americans to provide information which 
has little or nothing to do with apportioning electoral votes. 
The current census form requires all Americans to provide 
detailed information concerning income, modes of 
transportation, family status, ethnicity, and other personal 
data. Census forms also ask detailed questions about 
employment, the number of household toilets, and the annual 
cost of electricity, gas, water, and other municipal services. 
Responding to the census is not optional, it is required under 
penalty of Federal law. For this reason, all questions beyond 
those needed for apportionment are a threat to the privacy of 
Americans who do not wish to have information about their lives 
and habits collected and catalogued. In addition, the potential 
misuse of this information raises significant privacy concerns.
---------------------------------------------------------------------------
    \11\ U.S. CONST., art. 1, Sec. 8, cl. 2.
---------------------------------------------------------------------------

                TREASURY DEPARTMENT ``FINCEN'' DATABASE

    The Financial Crimes Enforcement Network (FinCEN), is a 
network of databases and financial records maintained by the 
Federal Government. Housed within the Treasury Department, 
FinCEN contains data compiled from 21,000 depository 
institutions and 200,000 nonbank financial institutions. Banks, 
casinos, brokerage firms and money transmitters all must file 
reports with FinCEN if cash transactions exceed $10,000.
    The Bank Secrecy Act authorizes the Treasury Department to 
require financial institutions to maintain records of personal 
financial transactions that ``have a high degree of usefulness 
in criminal, tax and regulatory investigations and 
proceedings.'' \12\ It also authorizes the Treasury Department 
to require any financial institution to report any ``suspicious 
transaction relevant to a possible violation of law or 
regulation.'' \13\ This is done secretly, without the consent 
or knowledge of bank customers, any time a financial 
institution decides that a transaction is ``suspicious.'' The 
reports are made available electronically to every U.S. 
Attorney's Office and to 59 law enforcement agencies, including 
the FBI, Secret Service, and Customs Service. A law enforcement 
agency does not have to be suspicious of an actual crime before 
it accesses a report, and no court order, warrant, subpoena, or 
even written request is needed. While this information serves 
legitimate law enforcement objectives, the security of this 
information should be maintained.
---------------------------------------------------------------------------
    \12\ 12 U.S.C. Sec. 951 (2002).
    \13\ Bank Secrecy Act of 1970, 31 U.S.C. Sec. Sec. 5311-5330 
(2002).
---------------------------------------------------------------------------

            HEALTH AND HUMAN SERVICES ``NEW HIRES'' DATABASE

    The Personal Responsibility and Work Opportunity 
Reconciliation Act of 1996 \14\ requires the Secretary of 
Health and Human Services to develop a National Directory of 
recently employed ``New Hires.'' This directory contains 
information on all newly hired employees, quarterly wage 
reports, and unemployment insurance claims in the United 
States. The National Directory of New Hires is maintained by 
the Federal Office of Child Support Enforcement in the 
Administration for Children and Families at the U.S. Department 
of Health and Human Services, and is located at the Social 
Security Administration's National Computer Center.
---------------------------------------------------------------------------
    \14\ Pub. L. No. 104-193, 109 Stat. 961 (1996) (codified in 
scattered sections of 42 U.S.C.).
---------------------------------------------------------------------------
    This database has helped States locate parents who evade 
their child support obligations. However, it has also been 
employed for purposes which exceed its original scope.\15\ The 
National Directory of New Hires has already been expanded to 
track down defaulters on student loans.\16\ Additional 
expansions have been proposed that would give State 
unemployment insurance officials access to the database. A 
centralized database containing detailed personal information 
on every working American raises considerable privacy concerns.
---------------------------------------------------------------------------
    \15\ Solveig Singleton, How Big Brother Began, Cato Institute (Nov. 
25, 1997), available at: http://www.cato.org/dailys/11-25-97.html.
    \16\ See Greg Langois, Fed. Computer Week, ``Education Touts New 
Loan Default Tool,'' Sept. 24, 2001, available at: http://www.fcw.com/
fcw/articles/2001/0924/news-edu-09-24-01.asp.
---------------------------------------------------------------------------

             INTER-AGENCY TRANSFER OF PERSONAL INFORMATION

    While Federal agencies individually collect a wealth of 
personal information, this information is often shared with 
other Federal agencies in a manner which compounds the risks of 
unauthorized disclosure. According to a report prepared by 
Privacilla.org entitled ``Government Exchange and Merger of 
Citizens' Personal Information is Systematic and Routine,'' 
Federal agencies routinely share personally-identifiable 
information with other Federal agencies without the knowledge 
or consent of those whose information is being exchanged.\17\ 
The report cites 47 specific instances between September 1999 
and February 2001 when Federal agencies announced their 
intention to exchange personal data and combine it into their 
own databases.\18\ The transfer of personal information between 
and among Federal agencies without the consent of those in 
question heightens concern that personal information could be 
utilized for a purpose inconsistent with that for which it was 
originally obtained.
---------------------------------------------------------------------------
    \17\ Report available at: http://www.privacilla.org/releases/
Government--Data--Merger.html
    \18\ Id. at 1.
---------------------------------------------------------------------------

    GOVERNMENT USE AND MISUSE OF PERSONALLY-IDENTIFIABLE INFORMATION

GAO Studies of Government Federal Government Privacy Practices
    A series of General Accounting Office (GAO) reports have 
demonstrated the vulnerability of personal information 
maintained in several Federal databases. On September 5, 2000, 
the GAO released a study that revealed that Federal agencies 
largely ignore Office of Management and Budget guidelines on 
the maintenance of computer websites.\19\ In a survey of online 
privacy protections at Government-run websites, the GAO found 
that 23 of the 70 agencies it surveyed had disclosed personal 
information gathered from websites to third parties, mostly 
other Government agencies. At least four agencies had shared 
information with private entities.
---------------------------------------------------------------------------
    \19\ Internet Privacy: Agencies' Efforts to Implement OMB's Privacy 
Policy, Report of the General Accounting Office, September 5, 2000, 
available at: http://www.gao.gov/new.items/gg00191.pdf.
---------------------------------------------------------------------------
    On September 6, 2000, the GAO issued a second study which 
concluded that security practices at Federal Government 
agencies are fraught with weaknesses.\20\ The study concluded 
that ``information security weaknesses place enormous amounts 
of confidential data, ranging from personal and tax to 
proprietary business information, at risk of inappropriate 
disclosure.'' \21\
---------------------------------------------------------------------------
    \20\ Information Security: Serious and Widespread Risks Persist At 
Federal Agencies, Report of the General Accounting Office, Sept. 6, 
2000, available at: http://www.gao.gov/news items/ai00295.pdf.
    \21\ Id. at 7.
---------------------------------------------------------------------------
    Finally, a third GAO study, released on September 12, 2000, 
found that a staggering 97 percent of Federal websites did not 
adhere to the principles of notice, choice, access, and 
security that the Federal Trade Commission has imposed on 
private-sector websites.\22\ This study is particularly 
significant because while consumers may freely decide whether 
to disclose information to private, commercial entities, the 
compulsory nature of Government collection of personal 
information forecloses this option.
---------------------------------------------------------------------------
    \22\ Internet Privacy: Comparison of Federal Agency Practices With 
FTC's Fair Information Principles, Report of the General Accounting 
Office, September 12, 2000, available at: http://www.gao.gov/new.items/
ai00296r.pdf.
---------------------------------------------------------------------------
    The vulnerability of private information collected and 
maintained by the Federal Government is clearly established and 
well-documented. A legislative solution is a necessary first 
step toward addressing this pervasive problem.

            FEDERAL AGENCY PROTECTION OF PRIVACY ACT (FAPPA)

    On April 24, 2002, Subcommittee on Commercial and 
Administrative Law Chairman Bob Barr introduced H.R. 4561. 
Original cosponsors included: Subcommittee Ranking Member 
Melvin Watt (D-NC); Rep. George W. Gekas (R-PA); Rep. Gerrold 
Nadler (D-NY); and Rep. Steve Chabot (R-OH). Since its 
introduction, Judiciary Committee Chairman F. James 
Sensenbrenner, Jr. (R-WI), Ranking Member John Conyers, Jr. (D-
MI), and several other Committee Members have joined as 
cosponsors. While H.R. 4561 makes no substantive demands on 
Federal agencies with respect to privacy, it would ensure that 
Federal agencies consider the privacy implications of proposed 
rules and regulations when they are noticed for public comment. 
Specifically, FAPPA would help ensure Federal agencies consider 
ways to: (1) protect the individual privacy rights of all 
Americans; (2) safeguard personal information collected and 
maintained by the Federal Government; and (3) indicate how 
personally-identifiable information will be used by the Federal 
Government; and (4) specify if and how this information will be 
disseminated among Federal agencies or State governments. The 
Federal Agency Protection of Privacy Act seeks to improve the 
regulatory process and protect Americans from unjustified or 
unintended invasions of privacy, by:

         Lensuring Federal agencies consider the impact 
        of proposed regulations on individual privacy;

         Lrequiring agencies to include an initial 
        privacy impact analysis with proposed regulations that 
        are circulated for public notice and comment;

         Lrequiring agencies, after the notice and 
        comment period, to include a final privacy impact 
        analysis that describes the steps that were taken to 
        minimize the significant privacy impact of proposed 
        regulations and that justifies the alternative with 
        respect to privacy that was chosen by the agency;

         Lpermitting judicial review of the adequacy of 
        an agency's final privacy impact, similar to that 
        provided by the Regulatory Flexibility Act for small 
        businesses; and

         Lrequiring agencies to periodically review 
        rules that have either a significant privacy impact on 
        individuals or a privacy impact on a significant number 
        or individuals.

    H.R. 4561 does not unduly burden agencies in the 
development and issuance of proposed rules, because:

         Lit would require a privacy impact analysis 
        only when an agency is already required to publish a 
        general notice of proposed rulemaking; and

         Lan agency would not be required to do 
        anything that it presumably had not already done, i.e. 
        consider the consequences of the proposed rule. It 
        would only have to publicly articulate how its proposed 
        rule would effect privacy interests.

                                Hearings

    The Subcommittee on Commercial and Administrative Law held 
1 day of hearings on H.R. 4561 on May 1, 2002. Testimony was 
received from an ideologically-diverse panel comprised of the 
following witnesses: Lori Waters, Executive Director, the Eagle 
Forum; Gregory Nojeim, Associate Director and Chief Legislative 
Counsel, American Civil Liberties Union; James Harper, Editor, 
Privacilla.com, and Adjunct Fellow, Progress & Freedom 
Foundation; and Edward Mierzwinski, Consumer Program Director, 
United States Public Interest Group.

                        Committee Consideration

    On July 9, 2002, the Subcommittee on Commercial and 
Administrative Law met in open session and ordered favorably 
reported the bill H.R.4561, without amendment by voice vote, a 
quorum being present. On September 10, 2002, the Committee met 
in open session and ordered favorably reported the bill H.R. 
4561 without amendment by voice vote, a quorum being present.

                         Vote of the Committee

    There were no recorded votes on H.R. 4561.

                      Committee Oversight Findings

    In compliance with clause 3(c)(1) of rule XIII of the Rules 
of the House of Representatives, the Committee reports that the 
findings and recommendations of the Committee, based on 
oversight activities under clause 2(b)(1) of rule X of the 
Rules of the House of Representatives, are incorporated in the 
descriptive portions of this report.

                    Performance Goals and Objectives

    H.R. 4561 does not authorize funding. Therefore, clause 
3(c) of rule XIII of the Rules of the House of Representatives 
is inapplicable. H.R. 4561 protects the privacy rights of all 
Americans by requiring that Federal agencies assess, consider, 
and inform the public about the privacy impact of rules noticed 
for public comment under the Administrative Procedure Act.

               New Budget Authority and Tax Expenditures

    Clause 3(c)(2) of House rule XIII is inapplicable because 
this legislation does not provide new budgetary authority or 
increased tax expenditures.

               Congressional Budget Office Cost Estimate

    In compliance with clause 3(c)(3) of rule XIII of the Rules 
of the House of Representatives, the Committee sets forth, with 
respect to the bill, H.R. 4561, the following estimate and 
comparison prepared by the Director of the Congressional Budget 
Office under section 402 of the Congressional Budget Act of 
1974:

                                     U.S. Congress,
                               Congressional Budget Office,
                                Washington, DC, September 10, 2002.
Hon. F. James Sensenbrenner, Jr., Chairman,
Committee on the Judiciary,
House of Representatives, Washington, DC.
    Dear Mr. Chairman: The Congressional Budget Office has 
prepared the enclosed cost estimate for H.R. 4561, the Federal 
Agency Protection of Privacy Act.
    If you wish further details on this estimate, we will be 
pleased to provide them. The CBO staff contact is Matthew 
Pickford, who can be reached at 226-2860.
            Sincerely,
                                  Dan L. Crippen, Director.

Enclosure

cc:
        Honorable John Conyers, Jr.
        Ranking Member
H.R. 4561--Federal Agency Protection of Privacy Act.
    H.R. 4561 would require Federal agencies to analyze 
proposed regulations to determine their impact on the privacy 
of individuals. H.R. 4561 also would require agencies issuing 
rules with a potentially significant impact on individual 
privacy to ensure that individuals have been given ample 
opportunity to participate in such rulemakings. Finally, 
agencies would have to review existing rules to consider 
impacts on the privacy of individuals at least every 10 years.
    CBO estimates that implementing H.R. 4561 would have no 
significant effect on Federal spending. Based on a review on 
the number and types of agency rules published in recent years, 
we expect the privacy of individuals is of concern for less 
than 2 percent of the rules published annually. H.R. 4561 would 
add to the existing regulatory procedures for considering 
impacts on the privacy of individuals that are already 
performed by agencies under the Privacy Act of 1974, the 
Paperwork Reduction Act, and current Office of Management and 
Budget requirements concerning information collected from the 
public. Based on information from some agencies that would be 
affected by the bill, we expect that implementing this bill 
would not require significant additional efforts by rulemaking 
agencies. Thus, its implementation would not have a significant 
cost.
    H.R. 4561 also could affect direct spending by increasing 
the administrative costs of rulemaking agencies that receive no 
annual appropriations; therefore, pay-as-you-go procedures 
would apply. CBO estimates, however, that any increase in 
direct spending would not be significant. The bill contains no 
intergovernmental or private-sector mandates as defined in the 
Unfunded Mandates Reform Act and would not affect the budgets 
of State, local, or tribal governments.
    The CBO staff contact for this estimate is Matthew 
Pickford, who can be reached at 226-2860. This estimate was 
approved by Peter H. Fontaine, Deputy Assistant Director for 
Budget Analysis.

                   Constitutional Authority Statement

    Pursuant to clause 3(d)(1) of rule XIII of the Rules of the 
House of Representatives, the Committee finds the authority for 
this legislation in article I, section 8, clause 14 of the 
Constitution.

               Section-by-Section Analysis and Discussion

Section 1. Short Title
    The title of this bill is the ``Federal Agency Protection 
of Privacy Act.''
Section 2. Requirement that Agency Rulemaking Take Into Consideration 
        Impacts on Individual Privacy
    This section amends the Administrative Procedure Act to 
require agencies to provide an initial privacy impact analysis 
when publishing rules requiring notice and comment under 5 
U.SC. Sec. 553 or other laws. The analysis must describe the 
impact of the proposed rule or IRS interpretive statement on 
individual privacy and be signed by the senior agency official 
with primary responsibility for privacy policy and be published 
in the Federal Register at the time the rule is published.
    The initial privacy impact analysis must contain: a 
description and assessment of the rule's impact on personal 
privacy interests, including the extent to which the proposed 
rule provides notice of the collection of personally 
identifiable information; what information will be obtained, 
how it is to be collected, maintained, used and disclosed. The 
initial statement must also provide the person to whom the 
personal information pertains an opportunity to correct 
inaccuracies, prevent the information from being used for 
another purpose, provide security for such information, and 
contain a description of any significant alternatives to the 
proposed rule that would advance its goals while protecting 
private information.
    This section also requires an agency to issue a final 
privacy impact analysis to accompany rules published for notice 
and comment under 5 U.S.C. Sec. 553 or issued by the IRS. The 
final statement must be signed by the senior agency official 
responsible for privacy policy, and contain an assessment of 
the extent to which the final rule will impact the privacy of 
individuals, including the degree to which the proposed rule: 
provides notice of the collection of private information, 
specifies what information is to be collected, maintained and 
disclosed, allows access and opportunity to correct 
inaccuracies to the person whose information is obtained, 
prevents this information from being used for another purpose, 
and provides security for this information.
    This statement must contain a summary of the significant 
issues raised by the public comments in response to the initial 
privacy analysis, a summary of the assessment of the agency, 
and a statement of any changes made in the proposed rule. This 
statement must also contain a description of the steps the 
agency has taken to minimize the significant privacy impact on 
individuals consistent with the objective of the rules and 
applicable statutes, including a Statement of the factual and 
legal basis for selection of the final rule as well as other 
alternatives that might have a less adverse impact on privacy. 
The final privacy impact analysis shall be made available to 
the public and published in the Federal Register.
    This section also provides heads of agencies authority to 
waive or delay the completion of the final privacy impact 
analysis in specified circumstances. It further provides for 
procedures designed to ensure that the public adequately 
participates in the rulemaking process by including in the 
advance notice of proposed rulemaking, a statement that the 
proposed rule may have a significant impact on personal 
privacy, or a privacy impact on a substantial number of 
individuals, the publication of a general notice of proposed 
rulemaking in national publications, direct notification of 
affected individuals, and the adoption of agency procedural 
rules to reduce the cost and complexity of participation in the 
rulemaking by individuals.
    In addition, this section requires that agencies conduct 
periodic reviews of rules having a significant privacy impact 
to determine whether the rule can be amended or rescinded in a 
manner that minimizes any such impact while remaining 
accordance with applicable statutes. In making this 
determination, the agency should examine the need for the rule, 
the nature of complaints or comments received from the public 
concerning the rule, the complexity of the rule, the extent to 
which the rule is duplicative, the length of time since the 
rule was last reviewed, and changing technology. Each agency is 
required to carry out its periodic reviews in accordance with a 
plan published in the Federal Register, and each rule shall be 
examined no later than 10 years after its finalization. The 
agency in question shall annually publish a list of all rules 
to be reviewed.
    Of critical importance, this section allows individuals 
adversely affected by a final agency action to seek judicial 
review of agency compliance with the requirements of this 
legislation. Jurisdiction is conferred upon all courts which 
currently have jurisdiction over 5 U.S.C. Sec. 553. There are 
limitations on this standing. For example, an individual is 
permitted to challenge the rule only after the rule has been in 
existence for 1 year, unless otherwise specified. In the case 
where an agency delays the issuance of a final privacy impact 
analysis, an action for judicial review under this section 
shall be filed not later than 1 year after the date the 
analysis is made public, unless otherwise specified.
    In granting relief under this section, a court may remand 
the rule to the agency, or defer the enforcement of the rule 
unless the court finds the rule is in the public interest. This 
section also contains a savings clause, which permits judicial 
review of other privacy-related claims if otherwise not 
prohibited.
    This section defines personally identifiable information as 
data that can be used to identify an individual, including the 
individual's name, address, telephone number, photograph, 
Social Security number, other identifying information. This 
definition encompasses information related to medical or 
financial condition. Finally, this section amends the 
Congressional Review Act to permit Congress to strike agency 
rules inconsistent with the requirements of this legislation.

         Changes in Existing Law Made by the Bill, as Reported

    In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italics, existing law in which no change 
is proposed is shown in roman):

                      TITLE 5, UNITED STATES CODE

           *       *       *       *       *       *       *
PART I--THE AGENCIES GENERALLY

           *       *       *       *       *       *       *

                  CHAPTER 5--ADMINISTRATIVE PROCEDURE

                    SUBCHAPTER I--GENERAL PROVISIONS

Sec.
500.    Administrative practice; general provisions.
     * * * * * * *

                 SUBCHAPTER II--ADMINISTRATIVE PROCEDURE

551.    Definitions.
     * * * * * * *
553a.   Privacy impact analysis in rulemaking.

           *       *       *       *       *       *       *

SUBCHAPTER II--ADMINISTRATIVE PROCEDURE

           *       *       *       *       *       *       *

Sec. 553a. Privacy impact analysis in rulemaking

    (a) Initial Privacy Impact Analysis.--
            (1) In general.--Whenever an agency is required by 
        section 553 of this title, or any other law, to publish 
        a general notice of proposed rulemaking for any 
        proposed rule, or publishes a notice of proposed 
        rulemaking for an interpretative rule involving the 
        internal revenue laws of the United States, the agency 
        shall prepare and make available for public comment an 
        initial privacy impact analysis. Such analysis shall 
        describe the impact of the proposed rule on the privacy 
        of individuals. The initial privacy impact analysis or 
        a summary shall be signed by the senior agency official 
        with primary responsibility for privacy policy and be 
        published in the Federal Register at the time of the 
        publication of a general notice of proposed rulemaking 
        for the rule.
            (2) Contents.--Each initial privacy impact analysis 
        required under this subsection shall contain the 
        following:
                    (A) A description and assessment of the 
                extent to which the proposed rule will impact 
                the privacy interests of individuals, including 
                the extent to which the proposed rule--
                            (i) provides notice of the 
                        collection of personally identifiable 
                        information, and specifies what 
                        personally identifiable information is 
                        to be collected and how it is to be 
                        collected, maintained, used, and 
                        disclosed;
                            (ii) allows access to such 
                        information by the person to whom the 
                        personally identifiable information 
                        pertains and provides an opportunity to 
                        correct inaccuracies;
                            (iii) prevents such information, 
                        which is collected for one purpose, 
                        from being used for another purpose; 
                        and
                            (iv) provides security for such 
                        information.
                    (B) A description of any significant 
                alternatives to the proposed rule which 
                accomplish the stated objectives of applicable 
                statutes and which minimize any significant 
                privacy impact of the proposed rule on 
                individuals.
    (b) Final Privacy Impact Analysis.--
            (1) In general.--Whenever an agency promulgates a 
        final rule under section 553 of this title, after being 
        required by that section or any other law to publish a 
        general notice of proposed rulemaking, or promulgates a 
        final interpretative rule involving the internal 
        revenue laws of the United States, the agency shall 
        prepare a final privacy impact analysis, signed by the 
        senior agency official with primary responsibility for 
        privacy policy.
            (2) Contents.--Each final privacy impact analysis 
        required under this subsection shall contain the 
        following:
                    (A) A description and assessment of the 
                extent to which the final rule will impact the 
                privacy interests of individuals, including the 
                extent to which the proposed rule--
                            (i) provides notice of the 
                        collection of personally identifiable 
                        information, and specifies what 
                        personally identifiable information is 
                        to be collected and how it is to be 
                        collected, maintained, used, and 
                        disclosed;
                            (ii) allows access to such 
                        information by the person to whom the 
                        personally identifiable information 
                        pertains and provides an opportunity to 
                        correct inaccuracies;
                            (iii) prevents such information, 
                        which is collected for one purpose, 
                        from being used for another purpose; 
                        and
                            (iv) provides security for such 
                        information.
                    (B) A summary of the significant issues 
                raised by the public comments in response to 
                the initial privacy impact analysis, a summary 
                of the assessment of the agency of such issues, 
                and a statement of any changes made in the 
                proposed rule as a result of such issues.
                    (C) A description of the steps the agency 
                has taken to minimize the significant privacy 
                impact on individuals consistent with the 
                stated objectives of applicable statutes, 
                including a statement of the factual, policy, 
                and legal reasons for selecting the alternative 
                adopted in the final rule and why each one of 
                the other significant alternatives to the rule 
                considered by the agency which affect the 
                privacy interests of individuals was rejected.
            (3) Availability to public.--The agency shall make 
        copies of the final privacy impact analysis available 
        to members of the public and shall publish in the 
        Federal Register such analysis or a summary thereof.
    (c) Procedure for Waiver or Delay of Completion.--An agency 
head may waive or delay the completion of some or all of the 
requirements of subsections (a) and (b) to the same extent as 
the agency head may, under section 608, waive or delay the 
completion of some or all of the requirements of sections 603 
and 604, respectively.
    (d) Procedures for Gathering Comments.--When any rule is 
promulgated which may have a significant privacy impact on 
individuals, or a privacy impact on a substantial number of 
individuals, the head of the agency promulgating the rule or 
the official of the agency with statutory responsibility for 
the promulgation of the rule shall assure that individuals have 
been given an opportunity to participate in the rulemaking for 
the rule through techniques such as--
            (1) the inclusion in an advance notice of proposed 
        rulemaking, if issued, of a statement that the proposed 
        rule may have a significant privacy impact on 
        individuals, or a privacy impact on a substantial 
        number of individuals;
            (2) the publication of a general notice of proposed 
        rulemaking in publications of national circulation 
        likely to be obtained by individuals;
            (3) the direct notification of interested 
        individuals;
            (4) the conduct of open conferences or public 
        hearings concerning the rule for individuals, including 
        soliciting and receiving comments over computer 
        networks; and
            (5) the adoption or modification of agency 
        procedural rules to reduce the cost or complexity of 
        participation in the rulemaking by individuals.
    (e) Periodic Review of Rules.--
            (1) In general.--Each agency shall carry out a 
        periodic review of the rules promulgated by the agency 
        that have a significant privacy impact on individuals, 
        or a privacy impact on a substantial number of 
        individuals. Under such periodic review, the agency 
        shall determine, for each such rule, whether the rule 
        can be amended or rescinded in a manner that minimizes 
        any such impact while remaining in accordance with 
        applicable statutes. For each such determination, the 
        agency shall consider the following factors:
                    (A) The continued need for the rule.
                    (B) The nature of complaints or comments 
                received from the public concerning the rule.
                    (C) The complexity of the rule.
                    (D) The extent to which the rule overlaps, 
                duplicates, or conflicts with other Federal 
                rules, and, to the extent feasible, with State 
                and local governmental rules.
                    (E) The length of time since the rule was 
                last reviewed under this subsection.
                    (F) The degree to which technology, 
                economic conditions, or other factors have 
                changed in the area affected by the rule since 
                the rule was last reviewed under this 
                subsection.
            (2) Plan required.--Each agency shall carry out the 
        periodic review required by paragraph (1) in accordance 
        with a plan published by such agency in the Federal 
        Register. Each such plan shall provide for the review 
        under this subsection of each rule promulgated by the 
        agency not later than 10 years after the date on which 
        such rule was published as the final rule and, 
        thereafter, not later than 10 years after the date on 
        which such rule was last reviewed under this 
        subsection. The agency may amend such plan at any time 
        by publishing the revision in the Federal Register.
            (3) Annual publication.--Each year, each agency 
        shall publish in the Federal Register a list of the 
        rules to be reviewed by such agency under this 
        subsection during the following year. The list shall 
        include a brief description of each such rule and the 
        need for and legal basis of such rule and shall invite 
        public comment upon the determination to be made under 
        this subsection with respect to such rule.
    (f) Judicial Review.--
            (1) In general.--For any rule subject to this 
        section, an individual who is adversely affected or 
        aggrieved by final agency action is entitled to 
        judicial review of agency compliance with the 
        requirements of subsections (b) and (c) in accordance 
        with chapter 7. Agency compliance with subsection (d) 
        shall be judicially reviewable in connection with 
        judicial review of subsection (b).
            (2) Jurisdiction.--Each court having jurisdiction 
        to review such rule for compliance with section 553, or 
        under any other provision of law, shall have 
        jurisdiction to review any claims of noncompliance with 
        subsections (b) and (c) in accordance with chapter 7. 
        Agency compliance with subsection (d) shall be 
        judicially reviewable in connection with judicial 
        review of subsection (b).
            (3) Limitations.--
                    (A) An individual may seek such review 
                during the period beginning on the date of 
                final agency action and ending 1 year later, 
                except that where a provision of law requires 
                that an action challenging a final agency 
                action be commenced before the expiration of 1 
                year, such lesser period shall apply to an 
                action for judicial review under this 
                subsection.
                    (B) In the case where an agency delays the 
                issuance of a final privacy impact analysis 
                pursuant to subsection (c), an action for 
                judicial review under this section shall be 
                filed not later than--
                            (i) 1 year after the date the 
                        analysis is made available to the 
                        public; or
                            (ii) where a provision of law 
                        requires that an action challenging a 
                        final agency regulation be commenced 
                        before the expiration of the 1-year 
                        period, the number of days specified in 
                        such provision of law that is after the 
                        date the analysis is made available to 
                        the public.
            (4) Relief.--In granting any relief in an action 
        under this subsection, the court shall order the agency 
        to take corrective action consistent with this section 
        and chapter 7, including, but not limited to--
                    (A) remanding the rule to the agency; and
                    (B) deferring the enforcement of the rule 
                against individuals, unless the court finds 
                that continued enforcement of the rule is in 
                the public interest.
            (5) Rule of construction.--Nothing in this 
        subsection shall be construed to limit the authority of 
        any court to stay the effective date of any rule or 
        provision thereof under any other provision of law or 
        to grant any other relief in addition to the 
        requirements of this subsection.
            (6) Record of agency action.--In an action for the 
        judicial review of a rule, the privacy impact analysis 
        for such rule, including an analysis prepared or 
        corrected pursuant to paragraph (4), shall constitute 
        part of the entire record of agency action in 
        connection with such review.
            (7) Exclusivity.--Compliance or noncompliance by an 
        agency with the provisions of this section shall be 
        subject to judicial review only in accordance with this 
        subsection.
            (8) Savings clause.--Nothing in this subsection 
        bars judicial review of any other impact statement or 
        similar analysis required by any other law if judicial 
        review of such statement or analysis is otherwise 
        permitted by law.
    (g) Definition.--For purposes of this section, the term 
``personally identifiable information'' means information that 
can be used to identify an individual, including such 
individual's name, address, telephone number, photograph, 
social security number or other identifying information. It 
includes information about such individual's medical or 
financial condition.

           *       *       *       *       *       *       *

CHAPTER 8--CONGRESSIONAL REVIEW OF AGENCY RULEMAKING

           *       *       *       *       *       *       *

Sec. 801. Congressional review

    (a)(1)(A) * * *
    (B) On the date of the submission of the report under 
subparagraph (A), the Federal agency promulgating the rule 
shall submit to the Comptroller General and make available to 
each House of Congress--
            (i) * * *

           *       *       *       *       *       *       *

            (iii) the agency's actions relevant to section 
        553a;
            [(iii)] (iv) the agency's actions relevant to 
        sections 202, 203, 204, and 205 of the Unfunded 
        Mandates Reform Act of 1995; and
            [(iv)] (v) any other relevant information or 
        requirements under any other Act and any relevant 
        Executive orders.

           *       *       *       *       *       *       *

                           Markup Transcript

                            BUSINESS MEETING

                      TUESDAY, SEPTEMBER 10, 2002

                  House of Representatives,
                                Committee on the Judiciary,
                                                    Washington, DC.
    The Committee met, pursuant to notice, at 10:00 a.m., in 
Room 2141, Rayburn House Office Building, Hon. F. James 
Sensenbrenner, Jr. [chairman of the Committee] presiding.
    Chairman Sensenbrenner. The Committee will be in order, and 
a working quorum is present.

           *       *       *       *       *       *       *

    The next item on the agenda is the adoption of H.R.4561, 
the ``Federal Agency Protection of Privacy Act.'' The chair 
recognizes the gentleman from Georgia, Mr. Barr, for a motion.
    Mr. Barr. Mr. Chairman, the Subcommittee on Commercial and 
Administrative Law reports favorably the bill H.R.4561 and 
moves its favorable recommendation to the full House.
    Chairman Sensenbrenner. Without objection, H.R.4561 will be 
considered as read and open for amendment at any point.
    [The bill, H.R.4561, follows:]
    
    
    Chairman Sensenbrenner. The chair again makes the same 
admonition about opening statements. Without objection, all 
opening statements will appear in the record at this point.
    Chairman Sensenbrenner. Are there amendments? If there are 
no amendments, the chair notes the presence of a reporting 
quorum.
    The question occurs on the motion to report the bill H.R. 
4561 favorably. All in favor say aye.
    Opposed, no. The ayes appear to have it. The ayes have it. 
The motion to report favorably is adopted. Without objection, 
the bill will be reported to the House favorably in the form of 
a single amendment in the nature of a substitute.
    Without objection, the Chairman is authorized to move to go 
to conference pursuant to House rules.
    Without objection, the staff is directed to make any 
technical and conforming changes and all Members will be given 
2 days, pursuant to House rules, in which to submit additional 
dissenting, supplemental or minority views.

                                

```