II 

112TH CONGRESS 

1ST SESSION S. 1732 

To amend section 552a of title 5, United States Code (commonly referred 

to as the Privacy Act), the E-Government Act of 2002 (Public Law 

107–347), and chapters 35 and 36 of title 44, United States Code, 

and other provisions of law to modernize and improve Federal privacy 

laws. 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 18, 2011 

Mr. AKAKA introduced the following bill; which was read twice and referred 

to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To amend section 552a of title 5, United States Code (commonly referred to as the Privacy Act), the E-Government 

Act of 2002 (Public Law 107–347), and chapters 35 

and 36 of title 44, United States Code, and other provisions of law to modernize and improve Federal privacy 

laws. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Privacy Act Mod5 ernization for the Information Age Act of 2011’’. 


smartinez on DSK6TPTVN1PROD with BILLS
2 

•S 1732 IS

1 SEC. 2. AMENDMENTS TO THE PRIVACY ACT. 

2 (a) DEFINITIONS.—Section 552a(a) of title 5, United 

3 States Code (commonly referred to as the Privacy Act), 

4 is amended— 

5 (1) in paragraph (4), by striking ‘‘that is main6 tained by an agency, including, but not limited to, 

7 his’’ and inserting ‘‘, including’’; 

8 (2) by striking paragraph (5) and inserting the 

9 following: 

10 ‘‘(5) the term ‘system of records’ means a 

11 group of any records maintained by, or otherwise 

12 under the control of any agency that is used for any 

13 authorized purpose by or on behalf of the agency;’’; 

14 (3) by striking paragraph (7) and inserting the 

15 following: 

16 ‘‘(7) the term ‘routine use’ means, with respect 

17 to the disclosure of a record, the use of such record 

18 for a purpose which, as determined by the agency, 

19 is compatible with the purpose for which it was col20 lected and is appropriate and reasonably necessary 

21 for the efficient and effective conduct of Govern22 ment;’’; and 

23 (4) in paragraph (8)(A)(i)— 

24 (A) by striking ‘‘two or more automated 

25 systems of records or a system of records with 


smartinez on DSK6TPTVN1PROD with BILLS
3 

•S 1732 IS

1 non-Federal records’’ and inserting ‘‘data from 

2 a system of records’’; 

3 (B) in subclause (I), by inserting ‘‘or 

4 State’’ after ‘‘Federal’’; and 

5 (C) in subclause (II), by inserting ‘‘or 

6 State’’ after ‘‘Federal’’. 

7 (b) CONDITIONS OF DISCLOSURE.—Section 552a(b) 

8 of title 5, United States Code, is amended— 

9 (1) in paragraph (1), by inserting ‘‘that is con10 sistent with, and related to, any purpose described 

11 under subsection (e)(2)(D) of this section’’ before 

12 the semicolon; 

13 (2) in paragraph (3), by striking ‘‘(e)(4)(D)’’ 

14 and inserting ‘‘(e)(2)(D)(iv) or subsection (v)’’; 

15 (3) in paragraph (6), by inserting ‘‘or for 

16 records management inspections authorized by stat17 ute’’ before the semicolon; 

18 (4) in paragraph (7), by inserting ‘‘, notwith19 standing any requirements of a routine use as de20 fined under subsection (a)(7),’’ before ‘‘to another 

21 agency’’; 

22 (5) in paragraph (8), by striking ‘‘upon such 

23 disclosure notification is transmitted to the last 

24 known address of such individual’’ and inserting ‘‘a 


smartinez on DSK6TPTVN1PROD with BILLS
4 

•S 1732 IS

1 reasonable attempt to notify the individual is made 

2 promptly after the disclosure’’; and 

3 (6) by striking paragraph (9) and inserting the 

4 following: 

5 ‘‘(9)(A) to either House of Congress; 

6 ‘‘(B) to the extent of matter within its jurisdic7 tion, any committee or subcommittee thereof, any 

8 joint committee of Congress or subcommittee of any 

9 such joint committee; or 

10 ‘‘(C) to the office of a Member of Congress 

11 when that office is requesting records about a spe12 cific individual on behalf of that individual in re13 sponse to a written request for assistance by that in14 dividual;’’. 

15 (c) ACCOUNTING OF CERTAIN DISCLOSURES.—Sec16 tion 552a(c) of title 5, United States Code, is amended 

17 by inserting ‘‘whether in an electronic or other format’’ 

18 after ‘‘system of records under its control’’. 

19 (d) AGENCY REQUIREMENTS.—Section 552a of title 

20 5, United States Code, is amended by striking subsection 

21 (e) and inserting the following: 

22 ‘‘(e) AGENCY REQUIREMENTS.— 

23 ‘‘(1) AUTHORIZED PURPOSE.—No agency shall 

24 use a record except for an authorized purpose and 


smartinez on DSK6TPTVN1PROD with BILLS
5 

•S 1732 IS

1 as maintained in a system of records under this sec2 tion. 

3 ‘‘(2) REQUIREMENTS.—Each agency shall— 

4 ‘‘(A) maintain in its records only such in5 formation about an individual as is relevant and 

6 necessary to accomplish any specified purpose 

7 of the agency required to be accomplished by 

8 statute or by executive order of the President, 

9 and only retain such information as long as is 

10 necessary to fulfill that purpose or as otherwise 

11 required by law; 

12 ‘‘(B) collect information to the greatest ex13 tent practicable directly from the subject indi14 vidual when the information may result in ad15 verse determinations about an individual’s 

16 rights, benefits, and privileges; 

17 ‘‘(C) inform each individual whom it asks 

18 to supply information creating a record, at the 

19 time the information is requested— 

20 ‘‘(i) the authority (whether granted by 

21 statute or by executive order of the Presi22 dent) which authorizes the solicitation of 

23 the information and whether disclosure of 

24 such information is voluntary or required 

25 to receive a right, benefit, or privilege; 


smartinez on DSK6TPTVN1PROD with BILLS
6 

•S 1732 IS

1 ‘‘(ii) the principal purpose or purposes 

2 for which the information is intended to be 

3 used; 

4 ‘‘(iii) the routine uses which may be 

5 made of the information, as published 

6 under subparagraph (D)(iv); 

7 ‘‘(iv) any effects on that individual of 

8 not providing all or any part of the re9 quested information; 

10 ‘‘(v) the procedures and contact infor11 mation for accessing or correcting such in12 formation; and 

13 ‘‘(vi) a reference to learning how such 

14 information will be used or disclosed, in15 cluding the simplest access to the current 

16 system of records notice; 

17 ‘‘(D) subject to the provisions of subpara18 graph (K), publish in the Federal Register, 

19 make broadly accessible to the public through a 

20 centralized website maintained by the Office of 

21 Management and Budget, and link to such cen22 tralized website from each agency’s website, 

23 upon establishment or revision a notice of the 

24 existence and character of the system of 

25 records, which notice shall include— 


smartinez on DSK6TPTVN1PROD with BILLS
7 

•S 1732 IS

1 ‘‘(i) the name and location of the sys2 tem; 

3 ‘‘(ii) the categories of individuals on 

4 whom records are maintained in the sys5 tem; 

6 ‘‘(iii) the categories of records main7 tained in the system; 

8 ‘‘(iv) any purpose for which the infor9 mation is intended to be used, including 

10 each routine use; 

11 ‘‘(v) the legal authority for any pur12 pose for which the information is utilized 

13 granted by statute, executive order, or 

14 other authorization; 

15 ‘‘(vi) the policies and practices of the 

16 agency regarding storage, retrievability, ac17 cess controls, retention, and disposal of the 

18 records; 

19 ‘‘(vii) the title and business address of 

20 the agency official who is responsible for 

21 the system of records; 

22 ‘‘(viii) the agency procedures whereby 

23 an individual can be notified at his request 

24 if the system of records contains a record 

25 pertaining to him, how he can gain access 


smartinez on DSK6TPTVN1PROD with BILLS
8 

•S 1732 IS

1 to such a record, or contest its content; 

2 and 

3 ‘‘(ix) the sources of records in the sys4 tem; 

5 ‘‘(E) to the greatest extent practicable, en6 sure that all records, including records from a 

7 third party source, which are used by the agen8 cy in making any determination about an indi9 vidual are of such accuracy, relevance, timeli10 ness, and completeness as is reasonably nec11 essary to assure fairness to the individual in the 

12 determination, and upon request of the indi13 vidual, provide documentation of the same; 

14 ‘‘(F) prior to disseminating any record 

15 about an individual to any person other than an 

16 agency, unless the dissemination is made pursu17 ant to subsection (b)(2) of this section, make 

18 reasonable efforts to assure that such records 

19 are accurate, complete, timely, and relevant for 

20 agency purposes; 

21 ‘‘(G) maintain no record describing how 

22 any individual exercises rights guaranteed by 

23 the First Amendment unless expressly author24 ized by statute or by the individual about whom 

25 the record is maintained or unless pertinent to, 


smartinez on DSK6TPTVN1PROD with BILLS
9 

•S 1732 IS

1 and within the scope of, an authorized law en2 forcement activity; 

3 ‘‘(H) make reasonable efforts to notify an 

4 individual as promptly as practicable after the 

5 agency receives compulsory legal process for 

6 any record on the individual, unless that notifi7 cation is prohibited by law or court order; 

8 ‘‘(I) establish rules of conduct for persons 

9 involved in the design, development, operation, 

10 or maintenance of any system of records, or in 

11 maintaining any record, and instruct each such 

12 person with respect to such rules and the re13 quirements of this section, including any other 

14 rules and procedures adopted pursuant to this 

15 section and the penalties for noncompliance; 

16 ‘‘(J) establish appropriate administrative, 

17 technical, and physical safeguards to insure the 

18 security and confidentiality of records and to 

19 protect against any anticipated threats or haz20 ards to their security or integrity which could 

21 result in substantial harm, embarrassment, in22 convenience, or unfairness to any individual on 

23 whom information is maintained; 


smartinez on DSK6TPTVN1PROD with BILLS
10 

•S 1732 IS

1 ‘‘(K) in regards to the establishment or re2 vision of a system of records under subpara3 graph (D)— 

4 ‘‘(i) at least 30 days prior to creation 

5 or modification of a system of records, 

6 publish the entire text of the proposed sys7 tem of records notice in the Federal Reg8 ister and on the centralized website estab9 lished under subparagraph (D); 

10 ‘‘(ii) provide an opportunity for inter11 ested persons to submit written or elec12 tronic data, views, or arguments to the 

13 agency regarding the proposed system of 

14 records notice; 

15 ‘‘(iii) within 180 days after publica16 tion of a proposed system of records no17 tice, publish on the centralized website es18 tablished under subparagraph (D), a re19 sponse to the comments received, along 

20 with notice of whether the system of 

21 records notice as published has taken ef22 fect; and 

23 ‘‘(iv) provide a link to the centralized 

24 website from the website of the agency, 


smartinez on DSK6TPTVN1PROD with BILLS
11 

•S 1732 IS

1 unless the Director of the Office of Manage2 ment and Budget, through the Federal Chief 

3 Privacy Officer grants an exception, and that 

4 exception is published promptly in the Federal 

5 Register and on the centralized website estab6 lished under subparagraph (D), including a link 

7 from the agency’s website; 

8 ‘‘(L) if such agency is a recipient agency 

9 or a source agency in a matching program with 

10 a non-Federal agency, with respect to any es11 tablishment or revision of a matching program, 

12 at least 30 days prior to conducting such pro13 gram, publish in the Federal Register notice of 

14 such establishment or revision; 

15 ‘‘(M) shall— 

16 ‘‘(i) maintain an inventory on the 

17 number and scope of the systems of 

18 records of that agency in a manner that 

19 clearly and fairly describes activities of the 

20 agency to individuals; and 

21 ‘‘(ii) ensure that the inventory— 

22 ‘‘(I) is annually updated and 

23 published in the Federal Register, on 

24 the website established under subVerDate Mar 15 2010 02:38 Oct 19, 2011 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732

smartinez on DSK6TPTVN1PROD with BILLS
12 

•S 1732 IS

1 paragraph (D), and on the agency’s 

2 website; and 

3 ‘‘(II) does not contain any infor4 mation that would be exempted from 

5 disclosure under this section or sec6 tion 522 of this title; and 

7 ‘‘(N) make reasonable efforts to limit dis8 closure from a system of records to minimum 

9 information necessary to accomplish the pur10 pose of the disclosure.’’. 

11 (e) AGENCY RULES.—Section 552a(f) of title 5, 

12 United States Code, is amended in the last sentence— 

13 (1) by striking ‘‘biennially’’ and inserting ‘‘an14 nually’’; 

15 (2) by striking ‘‘subsection (e)(4)’’ and insert16 ing ‘‘subsection (e)(2)(D)(iv)’’; and 

17 (3) by striking ‘‘at low cost’’ and inserting 

18 ‘‘electronically, or at low cost physically’’. 

19 (f) CIVIL REMEDIES.—Section 552a(g)(4) is amend20 ed— 

21 (1) by inserting ‘‘and in which the complainant 

22 has substantially prevailed’’ after ‘‘the agency acted 

23 in a manner which was intentional or willful’’; and 

24 (2) in subparagraph (A), by striking ‘‘, but in 

25 no case shall a person entitled to recovery receive 


smartinez on DSK6TPTVN1PROD with BILLS
13 

•S 1732 IS

1 less than the sum of $1,000’’ and inserting ‘‘or the 

2 sum of $1,000, whichever is greater, except that in 

3 a class action the minimum for each individual shall 

4 be reduced as necessary to ensure that the total re5 covery in any class action or series of class actions 

6 arising out of the same refusal or failure to comply 

7 by the same agency shall not be greater than 

8 $10,000,000’’. 

9 (g) CRIMINAL PENALTIES.—Section 552a(i) of title 

10 5, United States Code, is amended— 

11 (1) in paragraph (1)— 

12 (A) by inserting ‘‘(A)’’ before ‘‘Any officer 

13 or employee’’; and 

14 (B) by adding at the end the following: 

15 ‘‘(B) A person who commits the offense 

16 described under subparagraph (A) with the in17 tent to sell, transfer, or use an agency record 

18 for commercial advantage, personal gain, or 

19 malicious harm shall be fined not more than 

20 $250,000, imprisoned for not more than 10 

21 years, or both.’’; and 

22 (2) in paragraph (3), by striking ‘‘misdemeanor 

23 and fined not more than $5,000’’ and inserting ‘‘fel24 ony and fined not more than $100,000, imprisoned 

25 for not more than 5 years, or both’’. 


smartinez on DSK6TPTVN1PROD with BILLS
14 

•S 1732 IS

1 (h) GENERAL EXEMPTIONS.—Section 552a(j) of title 

2 5, United States Code, is amended by striking ‘‘The head 

3 of any agency’’ and inserting ‘‘Notwithstanding any re4 quirements of a routine use as defined under subsection 

5 (a)(7), the head of any agency’’. 

6 (i) SPECIFIC EXEMPTIONS.—Section 552a(k) of title 

7 5, United States Code, is amended by striking ‘‘The head 

8 of any agency’’ and inserting ‘‘Notwithstanding any re9 quirements of a routine use as defined under subsection 

10 (a)(7), the head of any agency’’. 

11 (j) ARCHIVAL RECORDS.—Section 552a(l) of title 5, 

12 United States Code, is amended in paragraphs (2) and 

13 (3) by striking ‘‘National Archives of the United States’’ 

14 each place that term appears and inserting ‘‘National Ar15 chives and Records Administration’’. 

16 (k) GOVERNMENT CONTRACTORS.—Section 

17 552(m)(1) of title 5, United States Code, is amended by 

18 striking ‘‘for the operation by or on behalf of the agency 

19 of a system of records to accomplish an agency function’’ 

20 and inserting ‘‘or other agreement, including with another 

21 agency, for the maintenance of a system of records to ac22 complish an agency function on behalf of the agency’’. 

23 (l) OFFICE OF MANAGEMENT AND BUDGET RESPON24 SIBILITIES.—Section 552a(v) of title 5, United States 

25 Code, is amended— 


smartinez on DSK6TPTVN1PROD with BILLS
15 

•S 1732 IS

1 (1) in paragraph (1), by striking ‘‘and’’ after 

2 the semicolon; 

3 (2) in paragraph (2), by striking the period and 

4 inserting ‘‘; and’’; and 

5 (3) by adding at the end the following: 

6 ‘‘(3) establish and update a list of rec7 ommended standard routine uses.’’. 

8 SEC. 3. AMENDMENTS TO THE E-GOVERNMENT ACT OF 

9 2002. 

10 Section 208 of the E-Government Act of 2002 (44 

11 U.S.C. 3501 note; Public Law 107–347) is amended— 

12 (1) in subsection (b)— 

13 (A) in paragraph (1)(A)— 

14 (i) by striking clause (i) and inserting 

15 the following: 

16 ‘‘(i) developing, procuring, or other17 wise making use of information technology 

18 that collects, maintains, or disseminates 

19 personally identifiable information; or’’; 

20 (ii) in clause (ii)(II)— 

21 (I) by striking ‘‘information in an 

22 identifiable form’’ and inserting ‘‘per23 sonally identifiable information’’; and 

24 (II) by striking ‘‘, other than 

25 agencies, instrumentalities, or employVerDate Mar 15 2010 02:38 Oct 19, 2011 Jkt 019200 PO 00000 Frm 00015 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732

smartinez on DSK6TPTVN1PROD with BILLS
16 

•S 1732 IS

1 ees of the Federal Government.’’ and 

2 inserting ‘‘; and’’; and 

3 (iii) by adding at the end the fol4 lowing: 

5 ‘‘(iii) using personally identifiable in6 formation purchased, or subscribed to for a 

7 fee, from a commercial data source.’’; and 

8 (B) in paragraph (2)(B)— 

9 (i) in clause (i), by striking ‘‘informa10 tion that is in an identifiable form’’ and in11 serting ‘‘personally identifiable informa12 tion’’; and 

13 (ii) in clause (ii)— 

14 (I) in subclause (VI), by striking 

15 ‘‘and’’ at the end; 

16 (II) in subclause (VII), by strik17 ing the period and inserting ‘‘; and’’; 

18 and 

19 (III) by adding at the end the 

20 following: 

21 ‘‘(VIII) to what extent risks to 

22 privacy protection are created by the 

23 use of the information and what steps 

24 have been taken to mitigate such 

25 risks.’’; and 


smartinez on DSK6TPTVN1PROD with BILLS
17 

•S 1732 IS

1 (2) by striking subsection (d) and inserting the 

2 following: 

3 ‘‘(d) DEFINITION.—In this section, the term ‘person4 ally identifiable information’ means any information about 

5 an individual maintained by an agency, including— 

6 ‘‘(1) any information that can be used to distin7 guish or trace an individual’s identity, such as name, 

8 social security number, date and place of birth, 

9 mother’s maiden name, or biometric records; or 

10 ‘‘(2) any other information that is linked or 

11 linkable to an individual, such as medical, edu12 cational, financial, and employment information.’’. 

13 SEC. 4. AMENDMENTS TO CHAPTERS 35 AND 36 OF TITLE 44, 

14 UNITED STATES CODE. 

15 (a) OFFICE OF MANAGEMENT AND BUDGET.—Sec16 tion 3504 of title 44, United States Code, is amended— 

17 (1) in subsection (a)(1)(A)— 

18 (A) in clause (iv), by inserting ‘‘and’’ after 

19 the semicolon; 

20 (B) by striking clause (v); and 

21 (C) by redesignating clause (vi) as clause 

22 (v); 

23 (2) by striking subsection (g); and 

24 (3) by redesignating subsection (h) as sub25 section (g). 


smartinez on DSK6TPTVN1PROD with BILLS
18 

•S 1732 IS

1 (b) FEDERAL INFORMATION PRIVACY POLICY.— 

2 (1) IN GENERAL.—Chapter 35 of title 44, 

3 United States Code, is amended by adding at the 

4 end the following: 

5 ‘‘SUBCHAPTER IV—FEDERAL INFORMATION 

6 PRIVACY POLICY 

7 ‘‘§ 3561. Purposes 

8 ‘‘The purposes of this subchapter are to— 

9 ‘‘(1) ensure the consistent application of privacy 

10 protections to personally identifiable information col11 lected, maintained, and used by all agencies; 

12 ‘‘(2) strengthen the responsibility and account13 ability of the Office of Management and Budget for 

14 overseeing privacy protection in agencies; 

15 ‘‘(3) improve agency responses to privacy 

16 breaches to better inform and protect the public 

17 from the misuse of personally identifiable informa18 tion; 

19 ‘‘(4) strengthen the responsibility and account20 ability of agency officials for ensuring effective im21 plementation of privacy protection requirements; and 

22 ‘‘(5) ensure that agency use of commercial 

23 sources of information and information system serv24 ices provides adequate information security and pri25 vacy protections. 


smartinez on DSK6TPTVN1PROD with BILLS
19 

•S 1732 IS

1 ‘‘§ 3562. Definitions 

2 ‘‘(a) IN GENERAL.—Except as provided under sub3 section (b), the definitions under section 3502 shall apply 

4 to this subchapter. 

5 ‘‘(b) ADDITIONAL DEFINITIONS.—In this sub6 chapter— 

7 ‘‘(1) the term ‘Council’ means the Chief Privacy 

8 Officers Council established under section 3567; 

9 ‘‘(2) the term ‘personally identifiable informa10 tion’ means any information about an individual 

11 maintained by an agency, including— 

12 ‘‘(A) any information that can be used to 

13 distinguish or trace an individual’s identity, 

14 such as name, social security number, date and 

15 place of birth, mother’s maiden name, or bio16 metric records; and 

17 ‘‘(B) any other information that is linked 

18 or linkable to an individual, such as medical, 

19 educational, financial, and employment informa20 tion; and 

21 ‘‘(3) the term ‘data broker’ means a person or 

22 entity that for a fee regularly engages in the practice 

23 of collecting, transmitting, or providing access to 

24 personally identifiable information concerning more 

25 than 5,000 individuals who are not the customers or 

26 employees of that person or entity (or an affiliated 


smartinez on DSK6TPTVN1PROD with BILLS
20 

•S 1732 IS

1 entity) primarily for the purposes of providing such 

2 information to non-affiliated third parties on an 

3 interstate basis. 

4 ‘‘§ 3563. Authority and functions of the Director 

5 ‘‘(a) In fulfilling the responsibility to administer the 

6 functions assigned under subchapter I, the Director of the 

7 Office of Management and Budget shall comply with this 

8 subchapter with respect to the specific matters covered by 

9 this subchapter. 

10 ‘‘(b) The Director shall oversee agency privacy pro11 tection policies and practices, including by— 

12 ‘‘(1) developing and overseeing the implementa13 tion of policies, principles, standards, and guidelines 

14 on privacy protection; 

15 ‘‘(2) providing direction and overseeing privacy, 

16 confidentiality, security, disclosure, and sharing of 

17 information; 

18 ‘‘(3) overseeing agency compliance with laws re19 lating to privacy protection, including the require20 ments of this subchapter, section 552a of title 5 

21 (commonly referred to as the Privacy Act), and sec22 tion 208 of the E-Government Act of 2002; 

23 ‘‘(4) coordinating privacy protection policies 

24 and procedures with related information resources 

25 management policies and procedures, including 


smartinez on DSK6TPTVN1PROD with BILLS
21 

•S 1732 IS

1 through ensuring that privacy protection consider2 ations are taken into account in managing the col3 lection of information and the control of paperwork 

4 as provided under subchapter I; and 

5 ‘‘(5) appointing a Federal Chief Privacy Officer 

6 under section 3564. 

7 ‘‘§ 3564. Specific responsibilities of the Federal Chief 

8 Privacy Officer 

9 ‘‘(a) FEDERAL CHIEF PRIVACY OFFICER.— 

10 ‘‘(1) DEFINITIONS.—In this section— 

11 ‘‘(A) the term ‘Senior Executive Service 

12 position’ has the meaning given under section 

13 3132(a)(2) of title 5; and 

14 ‘‘(B) the term ‘noncareer appointee’ has 

15 the meaning given under section 3132(a)(7) of 

16 title 5. 

17 ‘‘(2) ESTABLISHMENT.—There is established 

18 the position of the Federal Chief Privacy Officer 

19 within the Office of Management and Budget. The 

20 position shall be a Senior Executive Service position. 

21 The Director shall appoint a noncareer appointee to 

22 the position. The primary responsibilities of the posi23 tion shall be the responsibilities under subsection 

24 (b). 


smartinez on DSK6TPTVN1PROD with BILLS
22 

•S 1732 IS

1 ‘‘(3) QUALIFICATIONS.—The individual ap2 pointed to be the Federal Chief Privacy Officer shall 

3 possess demonstrated expertise in privacy protection 

4 policy and Government information. 

5 ‘‘(b) RESPONSIBILITIES.—The Federal Chief Privacy 

6 Officer shall— 

7 ‘‘(1) carry out the responsibilities of the Direc8 tor under this subchapter; 

9 ‘‘(2) provide overall direction, consistent with 

10 the Office of Management and Budget guidance, 

11 section 552a of title 5 (commonly referred to as the 

12 Privacy Act), and section 208 of the E-Government 

13 Act of 2002, of privacy policy governing the Federal 

14 Government’s collection, use, sharing, disclosure, 

15 transfer, storage, security, and disposition of person16 ally identifiable information; 

17 ‘‘(3) to the extent that the Federal Chief Pri18 vacy Officer considers appropriate, establish proce19 dures to review and approve privacy documentation 

20 before public dissemination; 

21 ‘‘(4) serve as the principal advisor for Federal 

22 privacy policy matters to the Executive Office of the 

23 President, including the President, the Director, the 

24 National Security Council, the Homeland Security 


smartinez on DSK6TPTVN1PROD with BILLS
23 

•S 1732 IS

1 Council, and the Office of Science and Technology 

2 Policy; 

3 ‘‘(5) coordinate with the Privacy and Civil Lib4 erties Oversight Board established under section 

5 1061 of the Intelligence Reform and Terrorism Pre6 vention Act of 2004 (5 U.S.C. 601 note); and 

7 ‘‘(6) every 2 years submit a report to Congress 

8 on the protection of privacy by the United States 

9 Government, including the status of implementation 

10 of requirements under this subchapter and other pri11 vacy related laws and policies. 

12 ‘‘§ 3565. Privacy breach requirements 

13 ‘‘The Director shall establish and oversee policies and 

14 procedures for agencies to follow in the event of a breach 

15 of information security involving the disclosure of person16 ally identifiable information and for which harm to an in17 dividual could reasonably be expected to result, includ18 ing— 

19 ‘‘(1) a requirement for timely notice to be pro20 vided to those individuals whose personally identifi21 able information could be compromised as a result of 

22 such breach, except no notice shall be required if the 

23 breach does not create a reasonable risk of identity 

24 theft, fraud, or other unlawful conduct regarding 

25 such individual; 


smartinez on DSK6TPTVN1PROD with BILLS
24 

•S 1732 IS

1 ‘‘(2) guidance on determining how timely notice 

2 is to be provided; 

3 ‘‘(3) guidance regarding whether additional ac4 tions are necessary and appropriate, including data 

5 breach analysis, fraud resolution services, identity 

6 theft insurance, and credit protection or monitoring 

7 services; and 

8 ‘‘(4) requirements for timely reporting by the 

9 agencies of such breaches to the director and the 

10 Federal information security incident center referred 

11 to in section 3546. 

12 ‘‘§ 3566. Agency responsibilities 

13 ‘‘(a) IN GENERAL.—In addition to requirements 

14 under section 1062 of the National Security Intelligence 

15 Reform Act of 2004, and in fulfilling the responsibilities 

16 under section 3506(g), the head of each agency shall en17 sure compliance with laws relating to privacy protection, 

18 including the requirements of this subchapter, section 

19 552a of title 5 (commonly referred to as the Privacy Act), 

20 and section 208 of the E-Government Act of 2002. 

21 ‘‘(b) CHIEF PRIVACY OFFICERS.—In the case of an 

22 agency that has not designated a Chief Privacy Officer 

23 under section 522 of the Transportation, Treasury, Inde24 pendent Agencies and General Government AppropriaVerDate Mar 15 2010 02:38 Oct 19, 2011 Jkt 019200 PO 00000 Frm 00024 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732

smartinez on DSK6TPTVN1PROD with BILLS
25 

•S 1732 IS

1 tions Act, 2005 (42 U.S.C. 2000ee–2), the head of each 

2 agency shall— 

3 ‘‘(1) designate a senior official to be the chief 

4 privacy officer of that agency; and 

5 ‘‘(2) provide to the chief privacy officer such in6 formation as the officer considers necessary. 

7 ‘‘(c) RESPONSIBILITIES OF AGENCY CHIEF PRIVACY

8 OFFICER.—Each chief privacy officer shall have primary 

9 responsibility for assuring the adequacy of privacy protec10 tions for personally identifiable information collected, 

11 used, or disclosed by the agency, including— 

12 ‘‘(1) ensuring that the use of technologies sus13 tain, and do not erode, privacy protections relating 

14 to the use, collection, and disclosure of personal in15 formation, including through the conduct of privacy 

16 impact assessments as provided by section 208 of 

17 the E-Government Act of 2002; 

18 ‘‘(2) ensuring that personal information is han19 dled in full compliance with fair information prac20 tices under section 552a of title 5 (commonly re21 ferred to as the Privacy Act) and other applicable 

22 laws and policies; 

23 ‘‘(3) evaluating legislative and regulatory pro24 posals involving collection, use, and disclosure of 

25 personally identifiable information; 


smartinez on DSK6TPTVN1PROD with BILLS
26 

•S 1732 IS

1 ‘‘(4) coordinating with the chief information of2 ficer to ensure that privacy is adequately addressed 

3 in the agency information security program, estab4 lished under section 3544; 

5 ‘‘(5) coordinating with other senior officials to 

6 ensure programs, policies, and procedures involving 

7 civil rights, civil liberties, and privacy considerations 

8 addressed in an integrated and comprehensive man9 ner; and 

10 ‘‘(6) reporting periodically to the head of the 

11 agency on agency privacy protection activities. 

12 ‘‘§ 3567. Chief Privacy Officers Council 

13 ‘‘(a) ESTABLISHMENT.—There is established in the 

14 executive branch a Chief Privacy Officers Council. 

15 ‘‘(b) MEMBERSHIP.— 

16 ‘‘(1) IN GENERAL.—The members of the Coun17 cil shall be as follows: 

18 ‘‘(A) The Federal Chief Privacy Officer, 

19 who shall serve as chairperson of the Council. 

20 ‘‘(B) Chief Privacy Officers established 

21 under section 522 of division H of the Consoli22 dated Appropriations Act, 2005 (42 U.S.C. 

23 2000ee–2; Public Law 108–447). 

24 ‘‘(C) The chairperson of the Privacy and 

25 Civil Liberties Oversight Board. 


smartinez on DSK6TPTVN1PROD with BILLS
27 

•S 1732 IS

1 ‘‘(D) As designated by the chairperson of 

2 the Council, any senior agency official des3 ignated to be a chief privacy officer under sec4 tion 3566. 

5 ‘‘(E) The Administrator of the Office of 

6 Electronic Government, as an ex-officio mem7 ber. 

8 ‘‘(F) The Administrator of the Office of 

9 Information and Regulatory Affairs, as an ex10 officio member. 

11 ‘‘(G) Any other officer or employee of the 

12 United States designated by the chairperson. 

13 ‘‘(2) EX-OFFICIO MEMBERS.—An ex-officio 

14 member may not vote in Council proceedings. 

15 ‘‘(c) ADMINISTRATIVE SUPPORT.—The Adminis16 trator of the General Services shall provide administrative 

17 and other support for the Council. 

18 ‘‘(d) FUNCTIONS.—The Council shall— 

19 ‘‘(1) be an interagency forum for establishing 

20 best practices for agency privacy policy; 

21 ‘‘(2) share, and promote the development of, 

22 best practices to assure that the use of technologies 

23 sustains, and does not erode, privacy protections re24 lating to the use, collection, and disclosure of per25 sonal information; assure that personal information 


smartinez on DSK6TPTVN1PROD with BILLS
28 

•S 1732 IS

1 contained in systems of records are handled in full 

2 compliance with fair information practices; and 

3 evaluate legislative and regulatory proposals involv4 ing collection, use, and disclosure of personal infor5 mation by the Federal Government; and 

6 ‘‘(3) submit proposed improvements to privacy 

7 practices to the Director.’’. 

8 (2) TECHNICAL AND CONFORMING AMEND9 MENT.—The table of sections for chapter 35 of title 

10 44, United States Code, is amended by adding at 

11 the end the following: 

‘‘SUBCHAPTER IV—FEDERAL INFORMATION PRIVACY POLICY

‘‘Sec. 

‘‘3561. Purposes. 

‘‘3562. Definitions. 

‘‘3563. Authority and functions of the Director. 

‘‘3564. Specific responsibilities of the Chief Privacy Officer. 

‘‘3565. Privacy breach requirements. 

‘‘3566. Agency responsibilities. 

‘‘3567. Chief Privacy Officers Council.’’. 

12 (c) ELECTRONIC GOVERNMENT.—Section 3602(d) of 

13 title 44, United States Code, is amended by inserting ‘‘and 

14 the Federal Chief Privacy Officer’’ after ‘‘Information and 

15 Regulatory Affairs’’. 

16 SEC. 5. AMENDMENTS TO SECTION 1062 OF THE NATIONAL 

17 INTELLIGENCE REFORM ACT OF 2004. 

18 Section 1062 of the National Intelligence Reform Act 

19 of 2004 (42 U.S.C. 2000ee–1) is amended— 

20 (1) by redesignating subsection (d) through (h) 

21 as subsections (e) through (i); and 


smartinez on DSK6TPTVN1PROD with BILLS
29 

•S 1732 IS

1 (2) by striking subsection (c) and inserting the 

2 following: 

3 ‘‘(c) AUTHORITY TO INVESTIGATE.— 

4 ‘‘(1) IN GENERAL.—Each privacy officer or civil 

5 liberties officer described under subsection (a) or (b) 

6 may— 

7 ‘‘(A) have access to all records, reports, 

8 audits, reviews, documents, papers, rec9 ommendations, and other materials available to 

10 the Department, agency, or element of the exec11 utive branch that relate to programs and oper12 ations with respect to the responsibilities of the 

13 senior official under this section; 

14 ‘‘(B) make such investigations and reports 

15 relating to the administration of the programs 

16 and operations of the Department, agency, or 

17 element of the executive branch as are, in the 

18 senior official’s judgment, necessary or desir19 able; 

20 ‘‘(C) subject to the approval of the Sec21 retary or head of the agency or element of the 

22 executive branch, require by subpoena the pro23 duction, by any person other than a Federal 

24 agency, of all information, documents, reports, 

25 answers, records, accounts, papers, and other 


smartinez on DSK6TPTVN1PROD with BILLS
30 

•S 1732 IS

1 data and documentary evidence necessary to 

2 performance of the responsibilities of the senior 

3 official under this section; and 

4 ‘‘(D) administer to or take from any per5 son an oath, affirmation, or affidavit, whenever 

6 necessary to performance of the responsibilities 

7 of the senior official under this section. 

8 ‘‘(2) ENFORCEMENT OF SUBPOENAS.—Any sub9 poena issued under paragraph (1)(C) shall, in the 

10 case of contumacy or refusal to obey, be enforceable 

11 by order of any appropriate United States district 

12 court. 

13 ‘‘(3) EFFECT OF OATHS.—Any oath, affirma14 tion, or affidavit administered or taken under para15 graph (1)(D) by or before an employee of the Pri16 vacy Office designated for that purpose by the senior 

17 official appointed under subsection (a) shall have the 

18 same force and effect as if administered or taken by 

19 or before an officer having a seal of office. 

20 ‘‘(d) SUPERVISION AND COORDINATION.— 

21 ‘‘(1) IN GENERAL.—Each privacy officer or civil 

22 liberties officer described under subsection (a) or (b) 

23 shall— 

24 ‘‘(A) report to, and be under the general 

25 supervision of, the Secretary; and 


smartinez on DSK6TPTVN1PROD with BILLS
31 

•S 1732 IS

1 ‘‘(B) coordinate activities with the Inspec2 tor General of the Department in order to avoid 

3 duplication of effort. 

4 ‘‘(2) COORDINATION WITH THE INSPECTOR

5 GENERAL.— 

6 ‘‘(A) IN GENERAL.—Except as provided in 

7 subparagraph (B), the senior official appointed 

8 under subsection (a) may investigate any mat9 ter relating to possible violations or abuse con10 cerning the administration of any program or 

11 operation of the Department, agency, or ele12 ment of the executive branch relevant to the 

13 purposes under this section. 

14 ‘‘(B) COORDINATION.— 

15 ‘‘(i) REFERRAL.—Before initiating 

16 any investigation described under subpara17 graph (A), the senior official shall refer the 

18 matter and all related complaints, allega19 tions, and information to the Inspector 

20 General of the Department, agency, or ele21 ment of the executive branch. 

22 ‘‘(ii) DETERMINATIONS AND NOTIFI23 CATIONS BY THE INSPECTOR GENERAL.— 

24 Not later than 30 days after the receipt of 


smartinez on DSK6TPTVN1PROD with BILLS
32 

•S 1732 IS

1 a matter referred under clause (i), the In2 spector General shall— 

3 ‘‘(I) make a determination re4 garding whether the Inspector Gen5 eral intends to initiate an audit or in6 vestigation of the matter referred 

7 under clause (i); and 

8 ‘‘(II) notify the senior official of 

9 that determination.’’. 

Æ 


smartinez on DSK6TPTVN1PROD with BILLS