I 

113TH CONGRESS 

2D SESSION H. R. 4215 

To strengthen privacy and data security, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 12, 2014 

Mr. CONNOLLY introduced the following bill; which was referred to the 

Committee on Oversight and Government Reform 

A BILL 

To strengthen privacy and data security, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Agency Data 

5 Breach Notification Act of 2014’’. 

6 SEC. 2. PRIVACY BREACH REQUIREMENTS. 

7 (a) INFORMATION SECURITY.— 

8 (1) AMENDMENT.—Subchapter III of chapter 

9 35 of title 44, United States Code, is amended by 

10 adding at the end the following: 


jbell on DSK7SPTVN1PROD with BILLS
2 

•HR 4215 IH

1 ‘‘§ 3550. Privacy breach requirements 

2 ‘‘(a) POLICIES AND PROCEDURES.—The Director of 

3 the Office of Management and Budget shall establish and 

4 oversee policies and procedures for agencies to follow in 

5 the event of a breach of information security involving the 

6 disclosure of personally identifiable information, including 

7 requirements for— 

8 ‘‘(1) not later than 72 hours after the agency 

9 discovers such a breach, or discovers evidence that 

10 reasonably indicates such a breach has occurred, no11 tice to the individuals whose personally identifiable 

12 information could be compromised as a result of 

13 such breach; 

14 ‘‘(2) timely reporting to a Federal cybersecurity 

15 center, as designated by the Director of the Office 

16 of Management and Budget; and 

17 ‘‘(3) any additional actions that the Director 

18 finds necessary and appropriate, including data 

19 breach analysis, fraud resolution services, identity 

20 theft insurance, and credit protection or monitoring 

21 services. 

22 ‘‘(b) REQUIRED AGENCY ACTION.—The head of each 

23 agency shall ensure that actions taken in response to a 

24 breach of information security involving the disclosure of 

25 personally identifiable information under the authority or 

26 control of the agency comply with policies and procedures 


jbell on DSK7SPTVN1PROD with BILLS
3 

•HR 4215 IH

1 established by the Director of the Office of Management 

2 and Budget under subsection (a). 

3 ‘‘(c) REPORT.—Not later than March 1 of each year, 

4 the Director of the Office of Management and Budget 

5 shall report to Congress on agency compliance with the 

6 policies and procedures established under subsection (a). 

7 ‘‘(d) FEDERAL CYBERSECURITY CENTER DE8 FINED.—The term ‘Federal cybersecurity center’ means 

9 any of the following: 

10 ‘‘(1) The Department of Defense Cyber Crime 

11 Center. 

12 ‘‘(2) The Intelligence Community Incident Re13 sponse Center. 

14 ‘‘(3) The United States Cyber Command Joint 

15 Operations Center. 

16 ‘‘(4) The National Cyber Investigative Joint 

17 Task Force. 

18 ‘‘(5) Central Security Service Threat Oper19 ations Center of the National Security Agency. 

20 ‘‘(6) The United States Computer Emergency 

21 Readiness Team. 

22 ‘‘(7) Any successor to a center, team, or task 

23 force described in paragraphs (1) through (6). 

24 ‘‘(8) Any center that the Director of the Office 

25 of Management and Budget determines is approVerDate Mar 15 2010 02:27 Mar 15, 2014 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H4215.IH H4215

jbell on DSK7SPTVN1PROD with BILLS
4 

•HR 4215 IH

1 priate to carry out the requirements of this sec2 tion.’’. 

3 (2) TECHNICAL AND CONFORMING AMEND4 MENT.—The table of sections for subchapter III of 

5 chapter 35 of title 44, United States Code, is 

6 amended by adding at the end the following: 

‘‘3550. Privacy breach requirements.’’. 

7 (b) AMENDMENTS TO THE E-GOVERNMENT ACT OF

8 2002.—Section 208(b)(1)(A) of the E-Government Act of 

9 2002 (44 U.S.C. 3501 note; Public Law 107–347) is 

10 amended— 

11 (1) in clause (i), by striking ‘‘or’’ at the end; 

12 (2) in clause (ii), by striking the period at the 

13 end and inserting ‘‘; or’’; and 

14 (3) by adding at the end the following new 

15 clause: 

16 ‘‘(iii) using information in an identifi17 able form purchased, or subscribed to for 

18 a fee, from a commercial data source.’’. 

19 (c) AUTHORITY OF THE DIRECTOR OF THE OFFICE

20 OF MANAGEMENT AND BUDGET WITH RESPECT TO FED21 ERAL INFORMATION POLICY.—Section 3504(g) of title 44, 

22 United States Code, is amended— 

23 (1) in paragraph (1), by striking ‘‘and’’ at the 

24 end; 


jbell on DSK7SPTVN1PROD with BILLS
5 

•HR 4215 IH

1 (2) in paragraph (2), by striking ‘‘. and’’ and 

2 inserting ‘‘; and’’; and 

3 (3) by adding at the end the following new 

4 paragraph: 

5 ‘‘(3) designate a Federal Chief Privacy Officer 

6 within the Office of Management and Budget who is 

7 a noncareer appointee in a Senior Executive Service 

8 position and who is a trained and experienced pri9 vacy professional to carry out the responsibilities of 

10 the Director with regard to privacy.’’. 

Æ 


jbell on DSK7SPTVN1PROD with BILLS