II

103D CONGRESS

1ST SESSION S. 1735

To establish a Privacy Protection Commission, and for other purposes.

IN THE SENATE OF THE UNITED STATES

NOVEMBER 20 (legislative day, NOVEMBER 2), 1993

Mr. SIMON introduced the following bill; which was read twice and referred

to the Committee on the Judiciary

NOVEMBER 24 (legislative day, NOVEMBER 23), 1993

Committee discharged; ordered referred to the Committee on Governmental

Affairs

A BILL

To establish a Privacy Protection Commission, and for other

purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Privacy Protection Act

5 of 1993’’.

6 SEC. 2. FINDINGS AND PURPOSE.

7 The Congress finds that—
2

•S 1735 RCS

1 (1) we live in an age of ever-increasing depend2 ence on electronic data storage, communications,

3 and usage;

4 (2) vast quantities of data are stored electroni5 cally and may be instantly transferred electronically

6 from one party to another for business or for other

7 purposes;

8 (3) the nature of such data allows for the in9 creasing possibility that an individual’s privacy

10 rights may be violated;

11 (4) the technology is growing so rapidly that

12 broader societal consequences may not have been re13 viewed or studied nor is it clear how the use of such

14 technology will affect existing data systems and their

15 use; and

16 (5) a United States Privacy Protection Com17 mission should be established to—

18 (A) ensure that privacy rights of United

19 States citizens in regard to electronic data and

20 fair information practices and principles are not

21 abused or violated;

22 (B) provide advisory guidance to the public

23 and private sector on matters related to elec24 tronic data storage, communication, and usage;
3

•S 1735 RCS

1 (C) provide the public with a central agen2 cy for information and guidance on privacy pro3 tections and fair information practices and

4 principles;

5 (D) oversee Federal agencies’ implementa6 tion of section 552a of title 5, United States

7 Code; and

8 (E) promote and encourage the adoption of

9 fair information practices and principles in the

10 public and private sector, which should in11 clude—

12 (i) the principle of openness, which

13 provides that the existence of record14 keeping systems and databanks containing

15 information about individuals be publicly

16 known, along with a description of main

17 purpose and uses of the data;

18 (ii) the principle of individual partici19 pation, which provides that each individual

20 should have the right to see any data

21 about him or herself and to correct any

22 data that is not timely, accurate, or com23 plete;

24 (iii) the principle of data quality,

25 which provides that personal data should
4

•S 1735 RCS

1 be relevant to the purposes for which they

2 are to be used, and data should be timely,

3 accurate, and complete;

4 (iv) the principle of collection limita5 tion, which provides that there should be

6 limits to the collection of personal data,

7 that data should be collected by lawful and

8 fair means, and that data should be col9 lected, where appropriate, with the knowl10 edge and consent of the subject;

11 (v) the principle of use limitation,

12 which provides that there are limits to the

13 use of personal data and that data should

14 be used only for purposes specified at the

15 time of collection;

16 (vi) the principle of disclosure limita17 tion, which provides that personal data

18 should not be communicated externally

19 without the consent of the data subject or

20 other legal authority;

21 (vii) the principle of security, which

22 provides that personal data should be pro23 tected by reasonable security safeguards

24 against such risks as loss, unauthorized ac-
5

•S 1735 RCS

1 cess, destruction, use, modification or dis2 closure; and

3 (viii) the principle of accountability,

4 which provides that recordkeepers should

5 be accountable for complying with fair in6 formation practices and principles.

7 SEC. 3. ESTABLISHMENT OF A PRIVACY PROTECTION COM8 MISSION.

9 There is established the Privacy Protection Commis10 sion (hereinafter referred to as the ‘‘Commission’’).

11 SEC. 4. PRIVACY PROTECTION COMMISSION.

12 (a) MEMBERSHIP.—(1) The Commission shall be

13 composed of 5 members who shall be appointed by the

14 President, by and with the consent of the Senate, from

15 among members of the public at large who are well quali16 fied for service on the Commission by their knowledge and

17 expertise in—

18 (A) civil rights and liberties;

19 (B) law;

20 (C) social sciences;

21 (D) computer technology;

22 (E) business; or

23 (F) State and local government.

24 (2) No more than 3 members of the Commission shall

25 be members of the same political party.
6

•S 1735 RCS

1 (3) One of the members shall be designated Chair2 person of the Commission by the President.

3 (b) MEETINGS.—The Chairperson shall preside at all

4 meetings of the Commission, but the Chairperson may

5 designate another member as an acting Chairperson who

6 may preside in the absence of the Chairperson. A quorum

7 for the transaction of business shall consist of at least 3

8 members present, except that 1 member may conduct

9 hearings and take testimony if authorized by the Commis10 sion. Each member of the Commission, including the

11 Chairperson, shall have equal responsibility and authority

12 in all decisions and actions of the Commission, shall have

13 full access to all information relating to performance of

14 the duties or responsibilities of the Commission, and shall

15 have 1 vote. Action of the Commission shall be determined

16 by a majority vote of the members. The Chairperson or

17 acting Chairperson shall see to the faithful execution of

18 the policies and decisions of the Commission and shall re19 port thereon to the Commission from time to time or as

20 the Commission may direct.

21 (c) TERMS.—(1) A member of the Commission shall

22 serve for a term of 7 years, except of members first ap23 pointed to the Commission—
7

•S 1735 RCS

1 (A) the member designated as Chairperson by

2 the President shall be appointed for a term of 7

3 years;

4 (B) 2 members shall be appointed for a term of

5 5 years;

6 (C) 2 members shall be appointed for a term of

7 3 years; and

8 (D) all such terms shall begin on—

9 (i) January 1 next following the date of

10 the enactment of this Act; or

11 (ii) such date as designated by the Presi12 dent.

13 (2) A member may continue to serve until a successor

14 is confirmed.

15 (3) Members shall be eligible for reappointment for

16 a single additional term.

17 (d) VACANCIES.—(1) Vacancies in the membership of

18 the Commission shall be filled in the same manner in

19 which the original appointment was made.

20 (2) If there are 2 or more Commission members in

21 office, vacancies in the membership of the Commission

22 shall not impair the power of the Commission to execute

23 functions and powers of the Commission.

24 (e) COMPENSATION AND RESTRICTION ON OTHER

25 EMPLOYMENT.—(1) The members of the Commission may
8

•S 1735 RCS

1 not engage in any other employment during their tenure

2 as members of the Commission.

3 (2) Section 5315 of title 5, United States Code, is

4 amended by adding at the end thereof the following new

5 item:

6 ‘‘Members of Privacy Protection Commission

7 (5).’’.

8 (f) REQUESTS AND RECOMMENDATIONS.—(1) When9 ever the Commission submits any budget estimate or re10 quest to the President or the Office of Management and

11 Budget, it shall concurrently transmit a copy of that re12 quest to Congress.

13 (2) Whenever the Commission submits any legislative

14 recommendations, or testimony, or comments on legisla15 tion to the President or Office of Management and Budg16 et, it shall concurrently transmit a copy thereof to the

17 Congress. No officer or agency of the United States shall

18 have any authority to require the Commission to submit

19 its legislative recommendations, or testimony, or com20 ments on legislation, to any officer or agency of the United

21 States for approval, comments, or review, prior to the sub22 mission of such recommendations, testimony, or comments

23 to the Congress.

24 (g) SEAL.—The Commission shall have an official

25 seal which shall be judicially noted.
9

•S 1735 RCS

1 SEC. 5. PERSONNEL OF THE COMMISSION.

2 (a) EXECUTIVE DIRECTOR AND GENERAL COUN3 SEL.—The Commission shall appoint an Executive Direc4 tor and a General Counsel who shall perform such duties

5 as the Commission may determine. Such appointment may

6 be made without regard to the provisions of title 5, United

7 States Code. The Executive Director and the General

8 Counsel shall be compensated at a rate not in excess of

9 the rate payable for a position under level V of the Execu10 tive Schedule under section 5316 of title 5, United States

11 Code.

12 (b) LIMITATION ON EMPLOYEES.—The Commission

13 is authorized to appoint and fix the compensation of not

14 more than 50 officers and employees (or the full-time

15 equivalent thereof), and to prescribe their functions and

16 duties.

17 (c) CONSULTANTS.—The Commission may obtain the

18 services of experts and consultants in accordance with the

19 provisions of section 3109 of title 5, United States Code.

20 (d) DETAIL OF GOVERNMENT EMPLOYEES.—Any

21 Federal Government employee may be detailed to the

22 Commission without reimbursement, and such detail shall

23 be without interruption or loss of civil service status or

24 privilege.

25 SEC. 6. FUNCTIONS OF THE COMMISSION.

26 (a) IN GENERAL.—The Commission shall—
10

•S 1735 RCS

1 (1) provide leadership and coordination to the

2 efforts of all Federal departments and agencies to

3 enforce all Federal statutes, Executive orders, regu4 lations and policies which involve privacy or data

5 protection;

6 (2) maximize effort, promote efficiency, and

7 eliminate conflict, competition, duplication, and in8 consistency among the operations, functions, and ju9 risdictions of Federal departments and agencies re10 sponsible for privacy or data protection, data protec11 tion rights and standards, and fair information prac12 tices and principles;

13 (3) develop model standards, guidelines, regula14 tions, policies, and routine uses for and by Federal,

15 State, and local agencies in implementing the provi16 sions of section 552a of title 5, United States Code;

17 (4) publish on a regular basis a guide to sec18 tions 552 and 552a of title 5, United States Code,

19 and other laws relating to data protection, for use

20 by record subjects;

21 (5) publish a compilation of agency system of

22 records notices, including an index and other finding

23 aids;

24 (6) no later than December 1, 1996, make rec25 ommendations to Congress to amend section 552a of
11

•S 1735 RCS

1 title 5, United States Code, and for improving the

2 coordination between such section and section 552 of

3 such title;

4 (7) provide active leadership, guidance, edu5 cation, and appropriate assistance to private sector

6 businesses, and organizations, groups, institutions,

7 and individuals regarding privacy, data protection

8 rights and standards, and fair information practices

9 and principles;

10 (8) develop model privacy, data protection, and

11 fair information practices, principles, standards,

12 guidelines, policies, and routine uses for use by the

13 private sector; and

14 (9) upon written request, provide appropriate

15 assistance to the private sector in implementing pri16 vacy, data protection, and fair information practices,

17 principles, standards, guidelines, policies, or routine

18 uses of privacy and data protection, and fair infor19 mation.

20 (b) DISCRETIONARY FUNCTIONS.—The Commission

21 may—

22 (1) issue advisory opinions relating to section

23 552a of title 5, United States Code, or privacy and

24 data protection practices, principles, standards,

25 guidelines, policies, or routine uses of data at the re-
12

•S 1735 RCS

1 quest of a Federal agency, a data integrity Commis2 sion of an agency or business, a court, the Congress,

3 a business or any person;

4 (2) investigate compliance with section 552a of

5 title 5, United States Code, and report on any viola6 tion of any provision thereof or any regulation pro7 mulgated under such section to an agency, the

8 President, the Attorney General, and the Congress;

9 (3) file comments with the Office of Manage10 ment and Budget and with any agency on any pro11 posal to—

12 (A) amend section 552a of title 5, United

13 States Code, or any regulation promulgated

14 under such section;

15 (B) create or modify a system of records;

16 or

17 (C) establish or alter routine uses of such

18 a system;

19 (4) request an agency to stay—

20 (A) the establishment or revision of a sys21 tem of records;

22 (B) a routine use;

23 (C) an exemption; or
13

•S 1735 RCS

1 (D) any other regulation promulgated

2 under section 552a of title 5, United States

3 Code;

4 (5) review Federal, State, and local laws, Exec5 utive orders, regulations, directives, and judicial de6 cisions and report on the extent to which they are

7 consistent with privacy and data protection rights,

8 and fair information practices and principles;

9 (6) at the request of a Federal, State, or local

10 government agency, a private business, or any per11 son, provide assistance on matters relating to pri12 vacy or data protection;

13 (7) comment on the implications for privacy or

14 data protection of proposed Federal, State, or local

15 statutes, regulations, or procedures;

16 (8) propose legislation on privacy or data pro17 tection;

18 (9) accept and investigate complaints about vio19 lation of privacy or data protection rights, and fair

20 information practices and principles;

21 (10) participate in any formal or informal Fed22 eral administrative proceeding or process where, in

23 the judgment of the Commission, the action being

24 considered would have a material effect on privacy

25 or data protection, either as a result of direct Gov-
14

•S 1735 RCS

1 ernment action or as the result of direct Government

2 regulation of others;

3 (11) petition a Federal agency to take action on

4 a matter affecting privacy or data protection;

5 (12) conduct, assist, or support research, stud6 ies, and investigations on the collection, mainte7 nance, use or dissemination of personal information;

8 the implications for privacy or data protection of

9 computer, communications, and other technologies,

10 and any other matter relating to privacy or data

11 protection;

12 (13) assist in the development or implementa13 tion of policies designed to provide for the protection

14 of personal information maintained by private sector

15 recordkeepers;

16 (14) assist United States companies doing busi17 ness abroad to respond to foreign privacy or data

18 protection laws and agencies;

19 (15) assist in the coordination of the United

20 States privacy and data protection policies with the

21 privacy and data protection policies of foreign coun22 tries; and

23 (16) cooperate and consult with privacy or data

24 protection commissions, boards, or agencies of for25 eign governments.
15

•S 1735 RCS

1 SEC. 7. CONFIDENTIALITY OF INFORMATION.

2 (a) IN GENERAL.—Each department, agency, and in3 strumentality of the executive branch of the Government,

4 including each independent agency, shall furnish to the

5 Commission upon request made by the Chairperson, such

6 data, reports, and other information as the Commission

7 determines necessary to carry out its functions under this

8 Act.

9 (b) CONFIDENTIALITY.—In carrying out its functions

10 and exercising its powers under this Act, the Commission

11 may accept from any Federal agency or other person, any

12 identifiable personal data if such data is necessary to carry

13 out such powers and functions. In any case in which the

14 Commission accepts any such information, it shall provide

15 all appropriate safeguards to ensure that the confidential16 ity of such information is maintained and that under com17 pletion of the specific purpose for which such information

18 is required, the information is destroyed or returned to

19 the agency or person from which it was obtained.

20 SEC. 8. POWERS OF THE COMMISSION.

21 (a) IN GENERAL.—The Commission may, in carrying

22 out its functions under this Act—

23 (1) conduct inspections;

24 (2) sit and act at such times and places;

25 (3) hold hearings;

26 (4) take testimony;
16

•S 1735 RCS

1 (5) require by subpoena the attendance of such

2 witnesses and the production of books, records, pa3 pers, correspondence, documents, film, and elec4 tronic information;

5 (6) administer such oaths; and

6 (7) make appropriate and necessary expendi7 tures.

8 (b) SUBPOENAS.—(1) Subpoenas shall be issued only

9 upon an affirmative vote of a majority of all members of

10 the Commission. Subpoenas shall be issued under the sig11 nature of the Chairperson or any member of the Commis12 sion designated by the Chairperson. Any member of the

13 Commission may administer oaths or affirmations to wit14 nesses appearing before the Commission.

15 (2) In the case of a disobedience to a subpoena issued

16 under this Act, the Commission may invoke the aid of any

17 district court of the United States in requiring compliance

18 with such subpoena. Any district court of the United

19 States within the jurisdiction where such person is found

20 or transacts business may, in the case of contumacy or

21 refusal to obey a subpoena issued by the Commission,

22 issue an order requiring such person to appear and testify,

23 to produce such books, records, papers, correspondence,

24 documents, films, and electronic information any failure
17

•S 1735 RCS

1 to obey the order of the court shall be punished by the

2 court as a contempt thereof.

3 (c) APPEARANCES.—Appearances by the Commission

4 in judicial and administrative proceedings shall be in its

5 own name.

6 (d) DELEGATION.—The Commission may delegate

7 any of its functions to such officers and employees of the

8 Commission as the Commission may designate and may

9 authorize such successive redelegations of such functions

10 as it may determine desirable.

11 (e) ADMINISTRATIVE POWERS.—In order to carry out

12 provisions of this Act, the Commission may—

13 (1) enter into contracts or other arrangements

14 with any State or local government, any agency or

15 department of the United States, or with any per16 son, firm, association, or corporation; and

17 (2) establish advisory committees in accordance

18 with the Federal Advisory Committee Act (5 U.S.C.

19 App.).

20 SEC. 9. REPORTS AND INFORMATION.

21 In an annual report to the President and Congress,

22 the Commission shall report on its activities in carrying

23 out the provisions of this Act. The Commission shall un24 dertake whatever efforts it may determine to be necessary

25 or appropriate to inform and educate the public of data
18

•S 1735 RCS

1 protection, privacy, and fair information rights and re2 sponsibilities.

3 SEC. 10. AUTHORIZATION OF APPROPRIATIONS.

4 There are authorized to be appropriated such sums

5 as may be necessary to carry out this Act.

Æ

S 1735 RCS——2