99–006

107TH CONGRESS REPORT " HOUSE OF REPRESENTATIVES ! 2d Session 107–701

FEDERAL AGENCY PROTECTION OF PRIVACY ACT

SEPTEMBER 30, 2002.—Committed to the Committee of the Whole House on the 

State of the Union and ordered to be printed 

Mr. SENSENBRENNER, from the Committee on the Judiciary, 

submitted the following 

R E P O R T 

[To accompany H.R. 4561] 

[Including cost estimate of the Congressional Budget Office]

The Committee on the Judiciary, to whom was referred the bill 

(H.R. 4561) to amend title 5, United States Code, to require that 

agencies, in promulgating rules, take into consideration the impact 

of such rules on the privacy of individuals, and for other purposes, 

having considered the same, reports favorably thereon without 

amendment and recommends that the bill do pass.

CONTENTS 

Page 

Purpose and Summary ............................................................................................ 1

Background and Need for the Legislation ............................................................. 2

Hearings ................................................................................................................... 9

Committee Consideration ........................................................................................ 9

Vote of the Committee ............................................................................................. 9

Committee Oversight Findings ............................................................................... 9

Performance Goals and Objectives ......................................................................... 9

New Budget Authority and Tax Expenditures ...................................................... 9

Congressional Budget Office Cost Estimate .......................................................... 9

Constitutional Authority Statement ...................................................................... 11

Section-by-Section Analysis and Discussion .......................................................... 11

Changes in Existing Law Made by the Bill, as Reported ..................................... 12

Markup Transcript .................................................................................................. 17

PURPOSE AND SUMMARY

H.R. 4561, the ‘‘Federal Agency Protection of Privacy Act,’’ preserves and promotes the privacy rights of all Americans by requiring Federal agencies to assess and mitigate the adverse privacy impact of rules noticed for public comment pursuant to the AdminisVerDate Sep 04 2002 01:53 Oct 01, 2002 Jkt 099006 PO 00000 Frm 00001 Fmt 6659 Sfmt 6601 E:\HR\OC\HR701.XXX HR701
2

1 5 U.S.C. § 553 et seq. (2001). 

trative Procedure Act 1 (APA). H.R. 4561 helps safeguard privacy 

rights by requiring that rules noticed for public comment by Federal agencies be accompanied by an initial assessment of the rule’s 

impact on personal privacy interests, including the extent to which 

the proposed rule provides notice of the collection of personally 

identifiable information, the type of personally identifiable information to be obtained, and the manner in which this information will 

be collected, maintained, protected, transferred, or disclosed by the 

Federal Government. 

The bill further provides that final rules be accompanied by a 

final privacy impact analysis which details how the issuing agency 

considered and responded to privacy concerns raised by the public 

during the comment period and explains whether the agency 

issuing the rule could have taken an approach less burdensome to 

personal privacy. Of critical importance, H.R. 4561 contains a provision for judicial review to ensure agency compliance with its requirements. While existing Federal statutes protect against the disclosure of information already obtained by the Federal Government, the Federal Agency Protection of Privacy Act provides the 

public with prospective notice and an opportunity to comment on 

how proposed Federal rules might affect personal privacy before 

they become binding regulations. 

BACKGROUND AND NEED FOR THE LEGISLATION

PUBLIC CONCERNS

There is growing public anxiety toward the diminishing sphere 

of personal privacy brought about by the rapid pace of technological 

and social change. Many have decried the perceived encroachment 

by outside entities into areas until recently considered part of our 

private lives. Examples include: facial recognition software linked 

to video cameras that can identify individuals in public places; 

tracking devices that monitor online activity; cameras that record 

our movements at traffic intersections and whose photographs 

serve as an exclusive basis for traffic fines and other penalties; 

Government-mandated devices in cellular phones that record the 

physical movements of their users; and the proliferation of Global 

Position Satellite (GPS) technologies that can be used to monitor 

a range of personal public and private activity. 

The effort to create a Federal Department of Homeland Security 

and America’s ongoing war against terrorism has heightened public 

sensitivity toward Government policies which might intrude upon 

personal privacy interests. H.R. 4561 would help address these concerns by ensuring that the privacy impact of proposed regulations 

are considered by Federal agencies when rules are noticed for public comment under the Administrative Procedure Act. 

GOVERNMENT COLLECTION OF PRIVATE INFORMATION

The compulsory nature of Government collection of personally 

identifiable information raises serious concerns. Unlike private entities, with which consumers voluntarily interact, the Government 

often requires the disclosure of personal information under penalty 

of law. The Government collects and maintains large volumes of 

3

2 11 U.S.C. § 107 (2002). 3 Identity Theft Resource Center, available at http://www.idtheftcenter.org/. 4Pub. L. No. 105–318, 112 Stat. 3007 (1998), codified at 18 U.S.C. § 1028 (2001). 5 18 U.S.C. § 2721–2725 (2001). 6Pub. L. No. 103–159 (1993), 107 Stat. 1536, codified at 18 U.S.C. § 921 et seq. (2001). 

personally-identifiable information. Much of this information is 

available to the public. While the legitimacy of our judicial system 

is premised on public access to court documents, this information 

might be susceptible to misuse. For example, section 107 of the 

Bankruptcy Code makes any filing in a bankruptcy case a matter 

of public record.2 With bankruptcy records increasingly available 

online, the potential for identity theft has greatly multiplied. In addition, the Social Security card has been widely adopted by both 

governments and the public as a standard identifier. Social Security numbers are now used for tax collection, credit and banking 

transactions, Federal Government security, State-level record keeping, passport issuance, and other purposes. Public transmission of 

this information further heightens the potential for identity fraud, 

a growing problem which impacted over 700 thousand Americans 

last year.3 While the Identity Theft and Assumption Deterrence 

Act of 1998 4 was enacted to address this problem, persistent concerns remain unaddressed. 

States also maintain large, comprehensive databases of personal 

information, some of which are susceptible to intrusion. In 1994, 

Congress enacted the Driver’s Privacy Protection Act 5 after the 

murder of actress Rebecca Shaeffer by an assailant who obtained 

her address from the California Department of Motor Vehicles. 

While responsibility for this crime lies squarely with the assailant, 

the Shaeffer case highlights the potential vulnerability of personal 

information in public records databases. 

Federal agencies collect and maintain large volumes of personally-identifiable, private information in computer databases. Much 

of this information is obtained from individuals pursuant to regulations issued by Federal agencies in accordance with their organic 

statutes and the procedural requirements of the APA. While Federal agencies are required to conduct a cost-benefit analysis of 

rules noticed for public comment, privacy concerns often go 

unaddressed. Currently, there is no requirement that agencies 

issuing rules in accordance with the APA specifically examine the 

privacy implications of rules they promulgate. As a result, agencies 

are free to issue rules without considering how personally-sensitive 

information may be stored, protected, and transmitted among Federal agencies. The public is often uninformed about the privacy impact of proposed rules. The following is a summary of the major 

databases containing private information currently operated by the 

Federal Government. 

FEDERAL BUREAU OF INVESTIGATION ‘‘BRADY LAW’’ DATABASE

The Brady Handgun Violence Prevention Act 6 requires firearms 

dealers to submit information about prospective firearms purchasers to the Department of Justice. Required information includes the potential purchaser’s name, sex, race, date of birth, and 

State of residence. This information is then cross-referenced with 

existing databases to prevent firearms sales to convicted felons, fugitives from justice, and other disqualified buyers. The Brady Law 

4

7 VA Computer Security, 2000, Hearings Before the House Comm. on Veterans’ Affairs, 

Subcomm. on Oversight and Investigations, 106th Cong. (2000) (statement of Michael Slachta, 

Jr. Assistant Inspector General for Auditing Office of Inspector General Department of Veterans 

Affairs Va’s Information Security Program). 8 Id. (statement of Joel C. Willemsen, Director of Civil Agencies Information Systems Accounting and Information Management Division). 

requires the National Instant Check System to ‘‘destroy all records’’ relating to the backgrounds of individuals cleared to purchase a 

firearm under the law. In regulations implementing this legislation, however, the FBI provided for an ‘‘Audit Log’’ of background 

checks. This log is maintained for as long as 6 months after a firearm transaction. Upon taking office, Attorney General Ashcroft 

considerably shortened this time period. While some insist the 

Audit Log might serve creditable auditing and oversight purposes, 

the collection, storage, and dissemination of private information relating to legal purchasers of firearms raise considerable constitutional concerns. 

ICANN ‘‘WHOIS’’ DATABASE

The ‘‘Whois’’ database consists of the names, e-mail addresses, 

postal addresses, and telephone numbers for the holders of the 

more than 24 million Internet domain names. The Internet Corporation for Assigned Names and Numbers (ICANN), which oversees Network Solutions, the record keeper of Internet addresses 

and the domain registration companies, currently requires disclosure of contact information for holders of ‘‘.com,’’ ‘‘.net,’’ and ‘‘.org’’

Internet addresses. Compulsory disclosure of this information helps 

ensure the veracity of the identity of website operators. This information can reduce fraud, defamation, copyright infringements, and 

trademark violations. While some contend this database is private 

or quasi-governmental, ICANN exercises control of Network Solutions and the Whois database under authority granted by the U.S. 

Department of Commerce. It is thus best viewed as a Government 

database. 

VETERANS ADMINISTRATION COMPUTER SYSTEM

The Veterans Administration (VA) maintains detailed records 

that facilitate the management of its finances, the oversight of its 

employees, and the delivery of health care benefits to military veterans and their families. The VA has not taken sufficient steps to 

protect electronic data that it maintains. Poor management of personal information by the VA has led to invasions of the privacy of 

those who receive treatment in VA facilities. Testimony received by 

the House Veterans Affairs Committee revealed that a security 

company hired by the VA’s Office of Inspector General easily entered and gained control over VA computer system.7 Poor computer 

security has also produced fraud and financial mismanagement, 

permitting VA employees to write more than $1.2 million in fraudulent benefit checks from 1998 to 2001.8 While ameliorative steps 

have been taken by the agency, concerns about the security of this 

information persist. 

HEALTH CARE FINANCING ADMINISTRATION ‘‘OASIS’’ DATABASE

In 1999, the Health Care Financing Administration announced a 

final effective date for the mandatory use, collection, encoding, and 

5

9Privacy Act of 1974, Report of New System, 64 Fed. Reg. 32,992 (1999). 

10DNA Analysis Backlog Elimination Act of 2000, Pub. L. No. 106–546, 114 Stat. 2726 (2000). 11 U.S. CONST., art. 1, § 8, cl. 2. 

transmission of OASIS data for all Medicare and Medicaid patients 

receiving skilled services.9 OASIS is the acronym for ‘‘Outcome and 

Assessment Information Set.’’

Medicare and Medicaid recipients are required to submit highly 

detailed and personal medical information in accordance with this 

regulation. A cursory review of OASIS ‘‘data sets’’ reveals their 

breadth. Patients are required to submit their name, Social Security number, residence, birth date, gender, payment sources for 

health care, past and recent medical treatment, current condition, 

medical risk factors, living arrangements, residential safety hazards, the identity of those who have assisted or are currently assisting the patient, the patient’s vision and speech status, and a 

host of other data. While information concerning a patient’s history 

ensures the delivery of the proper medical care, the public must be 

assured that adequate safeguards exist to protect this highly personal information. 

FEDERAL BUREAU OF INVESTIGATION ‘‘CODIS’’ DATABASE

CODIS, the Combined DNA Index System, was established by 

Congress in 1994.10 It gives Federal funds to States that assist the 

FBI in collecting DNA information. By 1998, all 50 States had 

passed laws requiring local police departments to collect DNA samples. CODIS was intended to help Federal law enforcement collect 

information about convicted sex offenders. Since its inception, some 

have called for considerable expansion of the database. While modern technology plays an increasingly important and necessary part 

in modern law enforcement, steps must also be taken to ensure the 

security of this information. 

THE CENSUS

The Constitution authorizes the Federal Government to ‘‘enumerate’’ persons in order to apportion congressional representatives 

among the States.11 To accomplish this purpose, the Government 

needs only to know how many individuals reside at a given residence. This question appears on the first page of the census. The 

remaining questions which appear on the census long form require 

Americans to provide information which has little or nothing to do 

with apportioning electoral votes. The current census form requires 

all Americans to provide detailed information concerning income, 

modes of transportation, family status, ethnicity, and other personal data. Census forms also ask detailed questions about employment, the number of household toilets, and the annual cost of electricity, gas, water, and other municipal services. Responding to the 

census is not optional, it is required under penalty of Federal law. 

For this reason, all questions beyond those needed for apportionment are a threat to the privacy of Americans who do not wish to 

have information about their lives and habits collected and 

catalogued. In addition, the potential misuse of this information 

raises significant privacy concerns. 

6

12 12 U.S.C. § 951 (2002). 13 Bank Secrecy Act of 1970, 31 U.S.C. §§ 5311–5330 (2002). 14Pub. L. No. 104–193, 109 Stat. 961 (1996) (codified in scattered sections of 42 U.S.C.). 15Solveig Singleton, How Big Brother Began, Cato Institute (Nov. 25, 1997), available at:

http://www.cato.org/dailys/11–25–97.html. 16See Greg Langois, Fed. Computer Week, ‘‘Education Touts New Loan Default Tool,’’ Sept. 

24, 2001, available at: http://www.fcw.com/fcw/articles/2001/0924/news-edu-09-24-01.asp. 

TREASURY DEPARTMENT ‘‘FINCEN’’ DATABASE

The Financial Crimes Enforcement Network (FinCEN), is a network of databases and financial records maintained by the Federal 

Government. Housed within the Treasury Department, FinCEN 

contains data compiled from 21,000 depository institutions and 

200,000 nonbank financial institutions. Banks, casinos, brokerage 

firms and money transmitters all must file reports with FinCEN if 

cash transactions exceed $10,000. 

The Bank Secrecy Act authorizes the Treasury Department to require financial institutions to maintain records of personal financial transactions that ‘‘have a high degree of usefulness in criminal, 

tax and regulatory investigations and proceedings.’’ 12 It also authorizes the Treasury Department to require any financial institution to report any ‘‘suspicious transaction relevant to a possible violation of law or regulation.’’ 13 This is done secretly, without the 

consent or knowledge of bank customers, any time a financial institution decides that a transaction is ‘‘suspicious.’’ The reports are 

made available electronically to every U.S. Attorney’s Office and to 

59 law enforcement agencies, including the FBI, Secret Service, 

and Customs Service. A law enforcement agency does not have to 

be suspicious of an actual crime before it accesses a report, and no 

court order, warrant, subpoena, or even written request is needed. 

While this information serves legitimate law enforcement objectives, the security of this information should be maintained. 

HEALTH AND HUMAN SERVICES ‘‘NEW HIRES’’ DATABASE

The Personal Responsibility and Work Opportunity Reconciliation Act of 1996 14 requires the Secretary of Health and Human 

Services to develop a National Directory of recently employed ‘‘New 

Hires.’’ This directory contains information on all newly hired employees, quarterly wage reports, and unemployment insurance 

claims in the United States. The National Directory of New Hires 

is maintained by the Federal Office of Child Support Enforcement 

in the Administration for Children and Families at the U.S. Department of Health and Human Services, and is located at the Social Security Administration’s National Computer Center. 

This database has helped States locate parents who evade their 

child support obligations. However, it has also been employed for 

purposes which exceed its original scope.15 The National Directory 

of New Hires has already been expanded to track down defaulters 

on student loans.16 Additional expansions have been proposed that 

would give State unemployment insurance officials access to the 

database. A centralized database containing detailed personal information on every working American raises considerable privacy 

concerns. 

7

17 Report available at: http://www.privacilla.org/releases/Government—Data—Merger.html 18 Id. at 1. 19 Internet Privacy: Agencies’ Efforts to Implement OMB’s Privacy Policy, Report of the General 

Accounting Office, September 5, 2000, available at: http://www.gao.gov/new.items/gg00191.pdf. 20 Information Security: Serious and Widespread Risks Persist At Federal Agencies, Report of 

the General Accounting Office, Sept. 6, 2000, available at: http://www.gao.gov/news items/

ai00295.pdf. 21 Id. at 7. 22 Internet Privacy: Comparison of Federal Agency Practices With FTC’s Fair Information Principles, Report of the General Accounting Office, September 12, 2000, available at: http://

www.gao.gov/new.items/ai00296r.pdf. 

INTER-AGENCY TRANSFER OF PERSONAL INFORMATION

While Federal agencies individually collect a wealth of personal 

information, this information is often shared with other Federal 

agencies in a manner which compounds the risks of unauthorized 

disclosure. According to a report prepared by Privacilla.org entitled 

‘‘Government Exchange and Merger of Citizens’ Personal Information is Systematic and Routine,’’ Federal agencies routinely share 

personally-identifiable information with other Federal agencies 

without the knowledge or consent of those whose information is 

being exchanged.17 The report cites 47 specific instances between 

September 1999 and February 2001 when Federal agencies announced their intention to exchange personal data and combine it 

into their own databases.18 The transfer of personal information 

between and among Federal agencies without the consent of those 

in question heightens concern that personal information could be 

utilized for a purpose inconsistent with that for which it was originally obtained. 

GOVERNMENT USE AND MISUSE OF PERSONALLY-IDENTIFIABLE

INFORMATION

GAO Studies of Government Federal Government Privacy Practices 

A series of General Accounting Office (GAO) reports have demonstrated the vulnerability of personal information maintained in 

several Federal databases. On September 5, 2000, the GAO released a study that revealed that Federal agencies largely ignore 

Office of Management and Budget guidelines on the maintenance 

of computer websites.19 In a survey of online privacy protections at 

Government-run websites, the GAO found that 23 of the 70 agencies it surveyed had disclosed personal information gathered from 

websites to third parties, mostly other Government agencies. At 

least four agencies had shared information with private entities. 

On September 6, 2000, the GAO issued a second study which 

concluded that security practices at Federal Government agencies 

are fraught with weaknesses.20 The study concluded that ‘‘information security weaknesses place enormous amounts of confidential 

data, ranging from personal and tax to proprietary business information, at risk of inappropriate disclosure.’’ 21

Finally, a third GAO study, released on September 12, 2000, 

found that a staggering 97 percent of Federal websites did not adhere to the principles of notice, choice, access, and security that the 

Federal Trade Commission has imposed on private-sector 

websites.22 This study is particularly significant because while consumers may freely decide whether to disclose information to priVerDate Sep 04 2002 01:01 Oct 01, 2002 Jkt 099006 PO 00000 Frm 00007 Fmt 6659 Sfmt 6601 E:\HR\OC\HR701.XXX HR701
8

vate, commercial entities, the compulsory nature of Government 

collection of personal information forecloses this option. 

The vulnerability of private information collected and maintained 

by the Federal Government is clearly established and well-documented. A legislative solution is a necessary first step toward addressing this pervasive problem. 

FEDERAL AGENCY PROTECTION OF PRIVACY ACT (FAPPA)

On April 24, 2002, Subcommittee on Commercial and Administrative Law Chairman Bob Barr introduced H.R. 4561. Original cosponsors included: Subcommittee Ranking Member Melvin Watt 

(D-NC); Rep. George W. Gekas (R-PA); Rep. Gerrold Nadler (DNY); and Rep. Steve Chabot (R-OH). Since its introduction, Judiciary Committee Chairman F. James Sensenbrenner, Jr. (R-WI), 

Ranking Member John Conyers, Jr. (D-MI), and several other Committee Members have joined as cosponsors. While H.R. 4561 makes 

no substantive demands on Federal agencies with respect to privacy, it would ensure that Federal agencies consider the privacy 

implications of proposed rules and regulations when they are noticed for public comment. Specifically, FAPPA would help ensure 

Federal agencies consider ways to: (1) protect the individual privacy rights of all Americans; (2) safeguard personal information 

collected and maintained by the Federal Government; and (3) indicate how personally-identifiable information will be used by the 

Federal Government; and (4) specify if and how this information 

will be disseminated among Federal agencies or State governments. The Federal Agency Protection of Privacy Act seeks to improve the regulatory process and protect Americans from unjustified or unintended invasions of privacy, by:

• ensuring Federal agencies consider the impact of proposed 

regulations on individual privacy;

• requiring agencies to include an initial privacy impact analysis with proposed regulations that are circulated for public 

notice and comment;

• requiring agencies, after the notice and comment period, to 

include a final privacy impact analysis that describes the 

steps that were taken to minimize the significant privacy impact of proposed regulations and that justifies the alternative 

with respect to privacy that was chosen by the agency;

• permitting judicial review of the adequacy of an agency’s 

final privacy impact, similar to that provided by the Regulatory Flexibility Act for small businesses; and

• requiring agencies to periodically review rules that have either a significant privacy impact on individuals or a privacy 

impact on a significant number or individuals.

H.R. 4561 does not unduly burden agencies in the development 

and issuance of proposed rules, because:

• it would require a privacy impact analysis only when an 

agency is already required to publish a general notice of proposed rulemaking; and

• an agency would not be required to do anything that it presumably had not already done, i.e. consider the consequences 

9

of the proposed rule. It would only have to publicly articulate 

how its proposed rule would effect privacy interests. 

HEARINGS

The Subcommittee on Commercial and Administrative Law held 

1 day of hearings on H.R. 4561 on May 1, 2002. Testimony was received from an ideologically-diverse panel comprised of the following witnesses: Lori Waters, Executive Director, the Eagle 

Forum; Gregory Nojeim, Associate Director and Chief Legislative 

Counsel, American Civil Liberties Union; James Harper, Editor, 

Privacilla.com, and Adjunct Fellow, Progress & Freedom Foundation; and Edward Mierzwinski, Consumer Program Director, 

United States Public Interest Group. 

COMMITTEE CONSIDERATION

On July 9, 2002, the Subcommittee on Commercial and Administrative Law met in open session and ordered favorably reported the 

bill H.R.4561, without amendment by voice vote, a quorum being 

present. On September 10, 2002, the Committee met in open session and ordered favorably reported the bill H.R. 4561 without 

amendment by voice vote, a quorum being present. 

VOTE OF THE COMMITTEE

There were no recorded votes on H.R. 4561. 

COMMITTEE OVERSIGHT FINDINGS

In compliance with clause 3(c)(1) of rule XIII of the Rules of the 

House of Representatives, the Committee reports that the findings 

and recommendations of the Committee, based on oversight activities under clause 2(b)(1) of rule X of the Rules of the House of Representatives, are incorporated in the descriptive portions of this report. 

PERFORMANCE GOALS AND OBJECTIVES

H.R. 4561 does not authorize funding. Therefore, clause 3(c) of 

rule XIII of the Rules of the House of Representatives is inapplicable. H.R. 4561 protects the privacy rights of all Americans by requiring that Federal agencies assess, consider, and inform the public about the privacy impact of rules noticed for public comment 

under the Administrative Procedure Act. 

NEW BUDGET AUTHORITY AND TAX EXPENDITURES

Clause 3(c)(2) of House rule XIII is inapplicable because this legislation does not provide new budgetary authority or increased tax 

expenditures. 

CONGRESSIONAL BUDGET OFFICE COST ESTIMATE

In compliance with clause 3(c)(3) of rule XIII of the Rules of the 

House of Representatives, the Committee sets forth, with respect to 

the bill, H.R. 4561, the following estimate and comparison prepared 

by the Director of the Congressional Budget Office under section 

402 of the Congressional Budget Act of 1974:

10

U.S. CONGRESS, CONGRESSIONAL BUDGET OFFICE, Washington, DC, September 10, 2002. 

Hon. F. JAMES SENSENBRENNER, Jr., Chairman, 

Committee on the Judiciary, 

House of Representatives, Washington, DC. 

DEAR MR. CHAIRMAN: The Congressional Budget Office has prepared the enclosed cost estimate for H.R. 4561, the Federal Agency 

Protection of Privacy Act. 

If you wish further details on this estimate, we will be pleased 

to provide them. The CBO staff contact is Matthew Pickford, who 

can be reached at 226–2860. 

Sincerely, 

DAN L. CRIPPEN, Director.

Enclosure

cc: Honorable John Conyers, Jr. 

Ranking Member 

H.R. 4561—Federal Agency Protection of Privacy Act. 

H.R. 4561 would require Federal agencies to analyze proposed 

regulations to determine their impact on the privacy of individuals. 

H.R. 4561 also would require agencies issuing rules with a potentially significant impact on individual privacy to ensure that individuals have been given ample opportunity to participate in such 

rulemakings. Finally, agencies would have to review existing rules 

to consider impacts on the privacy of individuals at least every 10 

years. 

CBO estimates that implementing H.R. 4561 would have no significant effect on Federal spending. Based on a review on the number and types of agency rules published in recent years, we expect 

the privacy of individuals is of concern for less than 2 percent of 

the rules published annually. H.R. 4561 would add to the existing 

regulatory procedures for considering impacts on the privacy of individuals that are already performed by agencies under the Privacy 

Act of 1974, the Paperwork Reduction Act, and current Office of 

Management and Budget requirements concerning information collected from the public. Based on information from some agencies 

that would be affected by the bill, we expect that implementing this 

bill would not require significant additional efforts by rulemaking 

agencies. Thus, its implementation would not have a significant 

cost. 

H.R. 4561 also could affect direct spending by increasing the administrative costs of rulemaking agencies that receive no annual 

appropriations; therefore, pay-as-you-go procedures would apply. 

CBO estimates, however, that any increase in direct spending 

would not be significant. The bill contains no intergovernmental or 

private-sector mandates as defined in the Unfunded Mandates Reform Act and would not affect the budgets of State, local, or tribal 

governments. 

The CBO staff contact for this estimate is Matthew Pickford, who 

can be reached at 226–2860. This estimate was approved by Peter 

H. Fontaine, Deputy Assistant Director for Budget Analysis. 

11

CONSTITUTIONAL AUTHORITY STATEMENT

Pursuant to clause 3(d)(1) of rule XIII of the Rules of the House 

of Representatives, the Committee finds the authority for this legislation in article I, section 8, clause 14 of the Constitution. 

SECTION-BY-SECTION ANALYSIS AND DISCUSSION

Section 1. Short Title 

The title of this bill is the ‘‘Federal Agency Protection of Privacy 

Act.’’

Section 2. Requirement that Agency Rulemaking Take Into Consideration Impacts on Individual Privacy 

This section amends the Administrative Procedure Act to require 

agencies to provide an initial privacy impact analysis when publishing rules requiring notice and comment under 5 U.SC. § 553 or 

other laws. The analysis must describe the impact of the proposed 

rule or IRS interpretive statement on individual privacy and be 

signed by the senior agency official with primary responsibility for 

privacy policy and be published in the Federal Register at the time 

the rule is published. 

The initial privacy impact analysis must contain: a description 

and assessment of the rule’s impact on personal privacy interests, 

including the extent to which the proposed rule provides notice of 

the collection of personally identifiable information; what information will be obtained, how it is to be collected, maintained, used 

and disclosed. The initial statement must also provide the person 

to whom the personal information pertains an opportunity to correct inaccuracies, prevent the information from being used for another purpose, provide security for such information, and contain a 

description of any significant alternatives to the proposed rule that 

would advance its goals while protecting private information. 

This section also requires an agency to issue a final privacy impact analysis to accompany rules published for notice and comment 

under 5 U.S.C. § 553 or issued by the IRS. The final statement 

must be signed by the senior agency official responsible for privacy 

policy, and contain an assessment of the extent to which the final 

rule will impact the privacy of individuals, including the degree to 

which the proposed rule: provides notice of the collection of private 

information, specifies what information is to be collected, maintained and disclosed, allows access and opportunity to correct inaccuracies to the person whose information is obtained, prevents this 

information from being used for another purpose, and provides security for this information. 

This statement must contain a summary of the significant issues 

raised by the public comments in response to the initial privacy 

analysis, a summary of the assessment of the agency, and a statement of any changes made in the proposed rule. This statement 

must also contain a description of the steps the agency has taken 

to minimize the significant privacy impact on individuals consistent 

with the objective of the rules and applicable statutes, including a 

Statement of the factual and legal basis for selection of the final 

rule as well as other alternatives that might have a less adverse 

impact on privacy. The final privacy impact analysis shall be made 

available to the public and published in the Federal Register. 

12

This section also provides heads of agencies authority to waive 

or delay the completion of the final privacy impact analysis in specified circumstances. It further provides for procedures designed to 

ensure that the public adequately participates in the rulemaking 

process by including in the advance notice of proposed rulemaking, 

a statement that the proposed rule may have a significant impact 

on personal privacy, or a privacy impact on a substantial number 

of individuals, the publication of a general notice of proposed rulemaking in national publications, direct notification of affected individuals, and the adoption of agency procedural rules to reduce the 

cost and complexity of participation in the rulemaking by individuals. 

In addition, this section requires that agencies conduct periodic 

reviews of rules having a significant privacy impact to determine 

whether the rule can be amended or rescinded in a manner that 

minimizes any such impact while remaining accordance with applicable statutes. In making this determination, the agency should examine the need for the rule, the nature of complaints or comments 

received from the public concerning the rule, the complexity of the 

rule, the extent to which the rule is duplicative, the length of time 

since the rule was last reviewed, and changing technology. Each 

agency is required to carry out its periodic reviews in accordance 

with a plan published in the Federal Register, and each rule shall 

be examined no later than 10 years after its finalization. The agency in question shall annually publish a list of all rules to be reviewed. 

Of critical importance, this section allows individuals adversely 

affected by a final agency action to seek judicial review of agency 

compliance with the requirements of this legislation. Jurisdiction is 

conferred upon all courts which currently have jurisdiction over 5 

U.S.C. § 553. There are limitations on this standing. For example, 

an individual is permitted to challenge the rule only after the rule 

has been in existence for 1 year, unless otherwise specified. In the 

case where an agency delays the issuance of a final privacy impact 

analysis, an action for judicial review under this section shall be 

filed not later than 1 year after the date the analysis is made public, unless otherwise specified. 

In granting relief under this section, a court may remand the 

rule to the agency, or defer the enforcement of the rule unless the 

court finds the rule is in the public interest. This section also contains a savings clause, which permits judicial review of other privacy-related claims if otherwise not prohibited. 

This section defines personally identifiable information as data 

that can be used to identify an individual, including the individual’s name, address, telephone number, photograph, Social Security 

number, other identifying information. This definition encompasses 

information related to medical or financial condition. Finally, this 

section amends the Congressional Review Act to permit Congress 

to strike agency rules inconsistent with the requirements of this 

legislation. 

CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

In compliance with clause 3(e) of rule XIII of the Rules of the 

House of Representatives, changes in existing law made by the bill, 

as reported, are shown as follows (existing law proposed to be omitVerDate Sep 04 2002 01:01 Oct 01, 2002 Jkt 099006 PO 00000 Frm 00012 Fmt 6659 Sfmt 6601 E:\HR\OC\HR701.XXX HR701
13

ted is enclosed in black brackets, new matter is printed in italics, 

existing law in which no change is proposed is shown in roman):

TITLE 5, UNITED STATES CODE

* * * * * * *

PART I—THE AGENCIES GENERALLY 

* * * * * * *

CHAPTER 5—ADMINISTRATIVE PROCEDURE

SUBCHAPTER I—GENERAL PROVISIONS 

Sec. 

500. Administrative practice; general provisions. 

* * * * * * *

SUBCHAPTER II—ADMINISTRATIVE PROCEDURE 

551. Definitions. 

* * * * * * *

553a. Privacy impact analysis in rulemaking.

* * * * * * *

SUBCHAPTER II—ADMINISTRATIVE PROCEDURE 

* * * * * * *

§ 553a. Privacy impact analysis in rulemaking 

(a) INITIAL PRIVACY IMPACT ANALYSIS.— (1) IN GENERAL.—Whenever an agency is required by section 553 of this title, or any other law, to publish a general notice of proposed rulemaking for any proposed rule, or publishes 

a notice of proposed rulemaking for an interpretative rule involving the internal revenue laws of the United States, the 

agency shall prepare and make available for public comment 

an initial privacy impact analysis. Such analysis shall describe 

the impact of the proposed rule on the privacy of individuals. 

The initial privacy impact analysis or a summary shall be 

signed by the senior agency official with primary responsibility 

for privacy policy and be published in the Federal Register at 

the time of the publication of a general notice of proposed rulemaking for the rule. 

(2) CONTENTS.—Each initial privacy impact analysis required under this subsection shall contain the following: 

(A) A description and assessment of the extent to which 

the proposed rule will impact the privacy interests of individuals, including the extent to which the proposed rule—

(i) provides notice of the collection of personally 

identifiable information, and specifies what personally 

identifiable information is to be collected and how it is 

to be collected, maintained, used, and disclosed; 

(ii) allows access to such information by the person 

to whom the personally identifiable information perVerDate Sep 04 2002 01:01 Oct 01, 2002 Jkt 099006 PO 00000 Frm 00013 Fmt 6659 Sfmt 6603 E:\HR\OC\HR701.XXX HR701
14

tains and provides an opportunity to correct inaccuracies; 

(iii) prevents such information, which is collected 

for one purpose, from being used for another purpose; 

and 

(iv) provides security for such information. 

(B) A description of any significant alternatives to the 

proposed rule which accomplish the stated objectives of applicable statutes and which minimize any significant privacy impact of the proposed rule on individuals. 

(b) FINAL PRIVACY IMPACT ANALYSIS.— (1) IN GENERAL.—Whenever an agency promulgates a final 

rule under section 553 of this title, after being required by that 

section or any other law to publish a general notice of proposed 

rulemaking, or promulgates a final interpretative rule involving 

the internal revenue laws of the United States, the agency shall 

prepare a final privacy impact analysis, signed by the senior 

agency official with primary responsibility for privacy policy. 

(2) CONTENTS.—Each final privacy impact analysis required under this subsection shall contain the following: 

(A) A description and assessment of the extent to which 

the final rule will impact the privacy interests of individuals, including the extent to which the proposed rule— (i) provides notice of the collection of personally 

identifiable information, and specifies what personally 

identifiable information is to be collected and how it is 

to be collected, maintained, used, and disclosed; 

(ii) allows access to such information by the person 

to whom the personally identifiable information pertains and provides an opportunity to correct inaccuracies; 

(iii) prevents such information, which is collected 

for one purpose, from being used for another purpose; 

and 

(iv) provides security for such information. 

(B) A summary of the significant issues raised by the 

public comments in response to the initial privacy impact 

analysis, a summary of the assessment of the agency of 

such issues, and a statement of any changes made in the 

proposed rule as a result of such issues. 

(C) A description of the steps the agency has taken to 

minimize the significant privacy impact on individuals consistent with the stated objectives of applicable statutes, including a statement of the factual, policy, and legal reasons 

for selecting the alternative adopted in the final rule and 

why each one of the other significant alternatives to the 

rule considered by the agency which affect the privacy interests of individuals was rejected. 

(3) AVAILABILITY TO PUBLIC.—The agency shall make copies 

of the final privacy impact analysis available to members of the 

public and shall publish in the Federal Register such analysis 

or a summary thereof. 

(c) PROCEDURE FOR WAIVER OR DELAY OF COMPLETION.—An 

agency head may waive or delay the completion of some or all of 

the requirements of subsections (a) and (b) to the same extent as the 

15

agency head may, under section 608, waive or delay the completion 

of some or all of the requirements of sections 603 and 604, respectively. 

(d) PROCEDURES FOR GATHERING COMMENTS.—When any rule 

is promulgated which may have a significant privacy impact on individuals, or a privacy impact on a substantial number of individuals, the head of the agency promulgating the rule or the official of 

the agency with statutory responsibility for the promulgation of the 

rule shall assure that individuals have been given an opportunity 

to participate in the rulemaking for the rule through techniques 

such as—

(1) the inclusion in an advance notice of proposed rulemaking, if issued, of a statement that the proposed rule may 

have a significant privacy impact on individuals, or a privacy 

impact on a substantial number of individuals; 

(2) the publication of a general notice of proposed rulemaking in publications of national circulation likely to be obtained by individuals; 

(3) the direct notification of interested individuals; 

(4) the conduct of open conferences or public hearings concerning the rule for individuals, including soliciting and receiving comments over computer networks; and 

(5) the adoption or modification of agency procedural rules 

to reduce the cost or complexity of participation in the rulemaking by individuals. 

(e) PERIODIC REVIEW OF RULES.— (1) IN GENERAL.—Each agency shall carry out a periodic review of the rules promulgated by the agency that have a significant privacy impact on individuals, or a privacy impact on a 

substantial number of individuals. Under such periodic review, 

the agency shall determine, for each such rule, whether the rule 

can be amended or rescinded in a manner that minimizes any 

such impact while remaining in accordance with applicable 

statutes. For each such determination, the agency shall consider 

the following factors: 

(A) The continued need for the rule. 

(B) The nature of complaints or comments received 

from the public concerning the rule. 

(C) The complexity of the rule. 

(D) The extent to which the rule overlaps, duplicates, 

or conflicts with other Federal rules, and, to the extent feasible, with State and local governmental rules. 

(E) The length of time since the rule was last reviewed 

under this subsection. 

(F) The degree to which technology, economic conditions, or other factors have changed in the area affected by 

the rule since the rule was last reviewed under this subsection. 

(2) PLAN REQUIRED.—Each agency shall carry out the periodic review required by paragraph (1) in accordance with a 

plan published by such agency in the Federal Register. Each 

such plan shall provide for the review under this subsection of 

each rule promulgated by the agency not later than 10 years 

after the date on which such rule was published as the final 

rule and, thereafter, not later than 10 years after the date on 

16

which such rule was last reviewed under this subsection. The 

agency may amend such plan at any time by publishing the revision in the Federal Register. 

(3) ANNUAL PUBLICATION.—Each year, each agency shall 

publish in the Federal Register a list of the rules to be reviewed 

by such agency under this subsection during the following year. 

The list shall include a brief description of each such rule and 

the need for and legal basis of such rule and shall invite public 

comment upon the determination to be made under this subsection with respect to such rule. 

(f) JUDICIAL REVIEW.— (1) IN GENERAL.—For any rule subject to this section, an individual who is adversely affected or aggrieved by final agency 

action is entitled to judicial review of agency compliance with 

the requirements of subsections (b) and (c) in accordance with 

chapter 7. Agency compliance with subsection (d) shall be judicially reviewable in connection with judicial review of subsection (b). 

(2) JURISDICTION.—Each court having jurisdiction to review such rule for compliance with section 553, or under any 

other provision of law, shall have jurisdiction to review any 

claims of noncompliance with subsections (b) and (c) in accordance with chapter 7. Agency compliance with subsection (d) 

shall be judicially reviewable in connection with judicial review 

of subsection (b). 

(3) LIMITATIONS.— (A) An individual may seek such review during the period beginning on the date of final agency action and ending 1 year later, except that where a provision of law requires that an action challenging a final agency action be 

commenced before the expiration of 1 year, such lesser period shall apply to an action for judicial review under this 

subsection. 

(B) In the case where an agency delays the issuance of 

a final privacy impact analysis pursuant to subsection (c), 

an action for judicial review under this section shall be 

filed not later than—

(i) 1 year after the date the analysis is made available to the public; or 

(ii) where a provision of law requires that an action challenging a final agency regulation be commenced before the expiration of the 1-year period, the 

number of days specified in such provision of law that 

is after the date the analysis is made available to the 

public. 

(4) RELIEF.—In granting any relief in an action under this 

subsection, the court shall order the agency to take corrective 

action consistent with this section and chapter 7, including, but 

not limited to— (A) remanding the rule to the agency; and 

(B) deferring the enforcement of the rule against individuals, unless the court finds that continued enforcement 

of the rule is in the public interest. 

(5) RULE OF CONSTRUCTION.—Nothing in this subsection 

shall be construed to limit the authority of any court to stay the 

17

effective date of any rule or provision thereof under any other 

provision of law or to grant any other relief in addition to the 

requirements of this subsection. 

(6) RECORD OF AGENCY ACTION.—In an action for the judicial review of a rule, the privacy impact analysis for such rule, 

including an analysis prepared or corrected pursuant to paragraph (4), shall constitute part of the entire record of agency action in connection with such review. 

(7) EXCLUSIVITY.—Compliance or noncompliance by an 

agency with the provisions of this section shall be subject to judicial review only in accordance with this subsection. 

(8) SAVINGS CLAUSE.—Nothing in this subsection bars judicial review of any other impact statement or similar analysis required by any other law if judicial review of such statement or 

analysis is otherwise permitted by law. 

(g) DEFINITION.—For purposes of this section, the term ‘‘personally identifiable information’’ means information that can be used 

to identify an individual, including such individual’s name, address, telephone number, photograph, social security number or 

other identifying information. It includes information about such individual’s medical or financial condition. 

* * * * * * *

CHAPTER 8—CONGRESSIONAL REVIEW OF AGENCY 

RULEMAKING 

* * * * * * *

§ 801. Congressional review 

(a)(1)(A)***

(B) On the date of the submission of the report under subparagraph (A), the Federal agency promulgating the rule shall submit 

to the Comptroller General and make available to each House of 

Congress—

(i) * * *

* * * * * * *

(iii) the agency’s actions relevant to section 553a;

ø(iii)¿ (iv) the agency’s actions relevant to sections 202, 

203, 204, and 205 of the Unfunded Mandates Reform Act of 

1995; and 

ø(iv)¿ (v) any other relevant information or requirements 

under any other Act and any relevant Executive orders. 

* * * * * * *

MARKUP TRANSCRIPT

BUSINESS MEETING 

TUESDAY, SEPTEMBER 10, 2002

HOUSE OF REPRESENTATIVES, COMMITTEE ON THE JUDICIARY, Washington, DC. 

The Committee met, pursuant to notice, at 10:00 a.m., in Room 

2141, Rayburn House Office Building, Hon. F. James Sensenbrenner, Jr. [chairman of the Committee] presiding. 

18

Chairman SENSENBRENNER. The Committee will be in order, and 

a working quorum is present. 

* * * * * * *

The next item on the agenda is the adoption of H.R.4561, the 

‘‘Federal Agency Protection of Privacy Act.’’ The chair recognizes 

the gentleman from Georgia, Mr. Barr, for a motion. 

Mr. BARR. Mr. Chairman, the Subcommittee on Commercial and 

Administrative Law reports favorably the bill H.R.4561 and moves 

its favorable recommendation to the full House. 

Chairman SENSENBRENNER. Without objection, H.R.4561 will be 

considered as read and open for amendment at any point. 

[The bill, H.R.4561, follows:]

19


I4561A.eps
20


I4561B.eps
21


I4561C.eps
22


I4561D.eps
23


I4561E.eps
24


I4561F.eps
25


I4561G.eps
26


I4561H.eps
27


I4561I.eps
28


I4561J.eps
29


I4561K.eps
30


I4561L.eps
31


I4561M.eps
32

Chairman SENSENBRENNER. The chair again makes the same admonition about opening statements. Without objection, all opening 

statements will appear in the record at this point. 

Chairman SENSENBRENNER. Are there amendments? If there are 

no amendments, the chair notes the presence of a reporting 

quorum. 

The question occurs on the motion to report the bill H.R. 4561 

favorably. All in favor say aye. 

Opposed, no. The ayes appear to have it. The ayes have it. The 

motion to report favorably is adopted. Without objection, the bill 

will be reported to the House favorably in the form of a single 

amendment in the nature of a substitute. 

Without objection, the Chairman is authorized to move to go to 

conference pursuant to House rules. 

Without objection, the staff is directed to make any technical and 

conforming changes and all Members will be given 2 days, pursuant to House rules, in which to submit additional dissenting, supplemental or minority views.

Æ