II 

117TH CONGRESS 

2D SESSION S. 3620 

To establish the Commission for the Comprehensive Study of Health Data 

Use and Privacy Protection. 

IN THE SENATE OF THE UNITED STATES 

FEBRUARY 9, 2022 

Mr. CASSIDY (for himself and Ms. BALDWIN) introduced the following bill; 

which was read twice and referred to the Committee on Health, Education, Labor, and Pensions 

A BILL 

To establish the Commission for the Comprehensive Study 

of Health Data Use and Privacy Protection. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Health Data Use and 

5 Privacy Commission Act’’. 

6 SEC. 2. FINDINGS; RULE OF CONSTRUCTION; SENSE OF 

7 CONGRESS. 

8 (a) FINDINGS.—Congress finds the following: 

9 (1) The people of the United States are increas10 ingly concerned about their civil liberties and the 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 3620 IS

1 confidentiality, security, and use of their personal 

2 health information. 

3 (2) Commercial entities are increasingly aware 

4 that consumers expect them to adopt privacy policies 

5 and take appropriate steps to protect consumers’ 

6 personal health information. 

7 (3) Due to a lack of Federal guidelines and a 

8 range of different State and local rules regarding 

9 privacy protection for individually identifiable health 

10 information, there is a growing concern about the 

11 confidentiality of personal health information col12 lected outside the context of health care delivery, 

13 payment, and the practice of medicine generally. 

14 (4) There is a need to ensure that accurate and 

15 timely health information flows to meet the needs of 

16 patients, reduce costs in the health care system, co17 ordinate care, and improve health care outcomes. 

18 (5) Access to accurate and complete health in19 formation is critical to ensure the equitable, safe, 

20 and effective delivery of care, the development of 

21 novel treatments and cures, the promotion of public 

22 health, and the refinement of health care delivery. 

23 (6) During the public health emergency with re24 spect to COVID–19 declared by the Secretary of 

25 Health and Human Services under section 319 of 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 3620 IS

1 the Public Health Service Act (42 U.S.C. 247d), 

2 some Federal and State privacy rules have been 

3 waived, modified, or not enforced to help contain the 

4 pandemic. As a result, the COVID–19 contagion has 

5 uncovered areas where current State and Federal 

6 privacy rules may impede patient care, public health 

7 management, and efforts to control the pandemic. 

8 Moreover, the pandemic has spurred innovation in9 cluding the development of new technologies and 

10 technology platforms that may not be covered by 

11 current regulatory constructs. 

12 (7) Privacy regulations promulgated under the 

13 Health Insurance Portability and Accountability Act 

14 of 1996 (Public Law 104–191) have provided clearly 

15 defined responsibilities and enforcement for entities 

16 and business associates covered by such regulations, 

17 however, the regulations should be assessed to ac18 count for the evolution of emerging technologies, 

19 data and data management tools, and the mod20 ernization of health care delivery. 

21 (8) New rules and policies from the Federal 

22 Government encouraging the flow of health informa23 tion to improve care and patient access to their own 

24 health information, including the rules promulgated 

25 under the 21st Century Cures Act (Public Law 114– 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 3620 IS

1 255), raise the issue of protected health information 

2 flowing to entities that are not subject to standard3 ized privacy protections, including the privacy regu4 lations promulgated under the Health Information 

5 Portability and Accountability Act of 1996 (Public 

6 Law 104–191), the Health Information Technology 

7 for Economic and Clinical Health Act (Public Law 

8 111–5) (including the amendments made by such 

9 Act), and section 444 of the General Education Pro10 visions Act (20 U.S.C. 1232g; commonly known as 

11 the ‘‘Family Educational Rights and Privacy Act of 

12 1974’’). 

13 (9) Given the extensive proliferation of laws and 

14 proposals concerning the privacy of health informa15 tion in light of recent changes in technology, applica16 tions, social media, and other platforms, and the in17 creasing generation, collection, use, sharing, and 

18 selling of personal health information, a coordinated 

19 and comprehensive review is necessary to evaluate 

20 the effectiveness of existing protections of personal 

21 health information compiled by the health care, in22 surance, financial services, consumer electronics, ad23 vertising, technology, and other industries. 

24 (10) Use of the internet as a medium for com25 mercial, social, and health related activities will conVerDate Sep 11 2014 02:55 Feb 11, 2022 Jkt 029200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S3620.IS S3620

kjohnson on DSK79L0C42PROD with BILLS
5 

•S 3620 IS

1 tinue to grow, and more data, including personal 

2 health information, will be generated, exchanged, 

3 and used by an increasing number of entities en4 gaged in the digital marketplace. 

5 (11) An increasing number of people of the 

6 United States are using consumer health tech7 nologies, including wearable technology, with about 

8 20 percent of people of the United States reporting 

9 using such technology in 2020, and generating data 

10 about their personal health and well-being. 

11 (12) The United States is the leading economic 

12 and social force in the global information economy, 

13 and it is important for the United States to continue 

14 that leadership. As countries and governing bodies 

15 around the world continue to establish privacy 

16 standards, these standards will directly affect the 

17 United States. 

18 (13) The shift from an industry-focused econ19 omy to an information-focused economy calls for a 

20 swift reassessment of the most effective ways to bal21 ance personal privacy against information use for le22 gitimate purposes, keeping in mind the potential for 

23 unintended effects on technology and product devel24 opment, innovation, and medical research. 


kjohnson on DSK79L0C42PROD with BILLS
6 

•S 3620 IS

1 (b) RULE OF CONSTRUCTION.—This Act shall not be 

2 construed to prohibit the enactment of privacy legislation 

3 by Congress during the existence of the Commission on 

4 Health Data Use and Privacy Protection established 

5 under section 3. 

6 (c) SENSE OF CONGRESS.—It is the sense of Con7 gress that— 

8 (1) it is the responsibility of Congress to act to 

9 protect the privacy of individuals, including individ10 uals’ medical information, and to foster the improve11 ment our Nation’s health care system; and 

12 (2) further study by the Commission estab13 lished under section 3 should not be considered a 

14 prerequisite for further consideration or enactment 

15 of health privacy or other related privacy legislation 

16 by Congress. 

17 SEC. 3. ESTABLISHMENT. 

18 There is established a commission to be known as the 

19 ‘‘Commission on Health Data Use and Privacy Protec20 tion’’ (referred to in this Act as the ‘‘Commission’’). 

21 SEC. 4. DUTIES OF COMMISSION. 

22 (a) STUDY.—The Commission shall conduct a study 

23 of issues relating to protection of individual privacy and 

24 the appropriate balance to be achieved between protecting 

25 individual privacy and allowing and advancing appropriate 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 3620 IS

1 uses of personal health information, including the fol2 lowing issues: 

3 (1) The monitoring, collection, and distribution 

4 of personal health information by Federal, State, 

5 and local governments, such as the collection of in6 formation to combat the spread of infectious dis7 eases such as COVID–19, the threat of substance 

8 use disorders involving opioids and other substances, 

9 and other public health threats and benefits. 

10 (2) Current efforts to address the access, ex11 change, and use of personal health information by 

12 Federal and State governments, individuals, or enti13 ties, including— 

14 (A) existing statutes and regulations relat15 ing to the protection of individual privacy, such 

16 as section 552a of title 5, United States Code 

17 (commonly known as the ‘‘Privacy Act of 

18 1974’’), section 552 of title 5, United States 

19 Code (commonly known as the ‘‘Freedom of In20 formation Act’’), the Federal Trade Commis21 sion Act (15 U.S.C. 42 et seq.), the Common 

22 Rule and other applicable regulations promul23 gated under the Health Information Portability 

24 and Accountability Act of 1996 (Public Law 

25 104–191), the Health Information Technology 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 3620 IS

1 for Economic and Clinical Health Act (Public 

2 Law 111–5) (including the amendments made 

3 by such Act), the 21st Century Cures Act (Pub4 lic Law 114–255) (including the amendments 

5 made by such Act), and section 444 of the Gen6 eral Education Provisions Act (20 U.S.C. 

7 1232g; commonly known as the ‘‘Family Edu8 cational Rights and Privacy Act of 1974’’); 

9 (B) relevant legislation pending before 

10 Congress and State legislatures; 

11 (C) privacy protection efforts undertaken 

12 by— 

13 (i) the Federal Government; 

14 (ii) State governments; or 

15 (iii) foreign governments and inter16 national governing bodies; 

17 (D) privacy protection efforts undertaken 

18 by the private sector, including any relevant 

19 recommendations, frameworks, or proposals; 

20 and 

21 (E) self-regulatory efforts initiated or pro22 posed by the private sector to respond to pri23 vacy issues. 

24 (3) The differences and similarities between 

25 Federal, State, and international rules for protecting 


kjohnson on DSK79L0C42PROD with BILLS
9 

•S 3620 IS

1 the privacy of health information and the degree to 

2 which such similarities or differences create or ad3 dress problems related to collecting, sharing, and 

4 using health information to improve care and lower 

5 costs, and any trade-offs related to patient privacy 

6 and patient control over health information. 

7 (4) The need for consistency in deidentification 

8 standards for health data to avoid conflicting re9 quirements that could impede the improvement of 

10 health care through clinical trials, technology devel11 opment, public health surveillance, monitoring of 

12 general health trends, and medical research. 

13 (5) Technologies and data currently used for 

14 treatment, payment, and health care operations, 

15 compared with technologies used when the privacy 

16 regulations promulgated under section 264 of the 

17 Health Insurance Portability and Accountability Act 

18 of 1996 (42 U.S.C. 1320d–2 note) were first issued, 

19 including an assessment of any gaps in the privacy 

20 protections under such regulations resulting from 

21 data collection and use by non-covered entities, tak22 ing into account recommendations of the National 

23 Committee on Vital and Health Statistics and the 

24 Office for the National Coordinator for Health In25 formation Technology. 


kjohnson on DSK79L0C42PROD with BILLS
10 

•S 3620 IS

1 (6) The monitoring, collection, and distribution 

2 of personal information by individuals or entities, in3 cluding access to, and use of, personal health infor4 mation and medical records, and the ability to access 

5 and restrict the information. 

6 (7) Employer practices and policies with respect 

7 to the health information of employees, including— 

8 (A) the extent to which employers collect, 

9 use, or disclose employee health information for 

10 marketing, employment, or insurance under11 writing purposes; 

12 (B) what restrictions employers place on 

13 disclosure or use of employee health informa14 tion; and 

15 (C) practices of employer medical depart16 ments with respect to disclosing employee 

17 health information to administrative or other 

18 personnel of the employer. 

19 (8) Current enforcement of privacy laws and 

20 rules through the Federal Trade Commission, the 

21 Office for Civil Rights of the Department of Health 

22 and Human Services, the Civil Rights Division of 

23 the Department of Justice, State agencies (including 

24 State attorneys general), and private rights of ac25 tion. Such evaluation shall include an examination of 


kjohnson on DSK79L0C42PROD with BILLS
11 

•S 3620 IS

1 efficacy, recommendations, and advantages and dis2 advantages of different enforcement mechanisms, 

3 and the potential for consolidation of enforcement. 

4 (9) Varying notices of privacy practices and 

5 whether such practices are effective in informing 

6 consumers of their rights and responsibilities, includ7 ing, as appropriate, an assessment of best practices. 

8 (10) Varying statutory and regulatory employee 

9 training requirements, including, as appropriate, an 

10 assessment of best practices and whether har11 monized training requirements may be more effective 

12 in encouraging efficient and effective training of em13 ployees in sound practices concerning personal 

14 health data. 

15 (11) Challenges and potential solutions to con16 sent requirements and processes, particularly related 

17 to medical research. 

18 (12) The degree to which personal health infor19 mation is sold with or without consent, and the uses 

20 of such information. 

21 (b) FIELD HEARINGS.—The Commission may con22 duct field hearings in the United States. 

23 (c) REPORT.— 


kjohnson on DSK79L0C42PROD with BILLS
12 

•S 3620 IS

1 (1) IN GENERAL.—Not later than 6 months 

2 after the appointment of all members of the Com3 mission— 

4 (A) a majority of the members of the Com5 mission shall approve a report described in 

6 paragraph (2); and 

7 (B) the Commission shall submit the ap8 proved report to the Committee on Health, 

9 Education, Labor, and Pensions of the Senate, 

10 the Committee on Energy and Commerce of the 

11 House of Representatives, the Secretary of 

12 Health and Human Services, and the President. 

13 (2) CONTENTS.—The report required under 

14 paragraph (1) shall include a detailed statement of 

15 findings, conclusions, and recommendations, includ16 ing the following: 

17 (A) Findings from the study conducted by 

18 the Commission pursuant to section 4(a), in19 cluding potential threats posed to individual 

20 health privacy and to legitimate business and 

21 policy interests. 

22 (B) Analysis of purposes for which sharing 

23 of health information is appropriate and bene24 ficial to consumers and the threat to health outVerDate Sep 11 2014 02:55 Feb 11, 2022 Jkt 029200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S3620.IS S3620

kjohnson on DSK79L0C42PROD with BILLS
13 

•S 3620 IS

1 comes and costs if privacy rules are too strin2 gent. 

3 (C) Analysis of the effectiveness of existing 

4 statutes, regulations, private sector self-regu5 latory efforts, technology advances, and market 

6 forces in protecting individual health privacy. 

7 (D) Recommendations on whether Federal 

8 legislation is necessary, and if so, specific sug9 gestions on proposals to reform, streamline, 

10 harmonize, unify, or augment current laws and 

11 regulations relating to individual health privacy, 

12 including reforms or additions to existing law 

13 related to enforcement, preemption, consent, 

14 penalties for misuse, transparency, and notice 

15 of privacy practices. 

16 (E) Analysis of whether additional regula17 tions may impose costs or burdens, or cause un18 intended consequences in other policy areas, 

19 such as security, law enforcement, medical re20 search, health care cost containment, improved 

21 patient outcomes, public health, or critical in22 frastructure protection, and whether such costs 

23 or burdens are justified by the additional regu24 lations or benefits to privacy, including whether 


kjohnson on DSK79L0C42PROD with BILLS
14 

•S 3620 IS

1 such benefits may be achieved through less on2 erous means. 

3 (F) Cost analysis of legislative or regu4 latory changes proposed in the report. 

5 (G) Recommendations on non-legislative 

6 solutions to individual health privacy concerns, 

7 including education, market-based measures, in8 dustry best practices, and new technologies. 

9 (H) Review of the effectiveness and utility 

10 of third-party statements of privacy principles 

11 and private sector self-regulatory efforts, as 

12 well as third-party certification or accreditation 

13 programs meant to ensure compliance with pri14 vacy requirements. 

15 (d) ADDITIONAL REPORT.—Together with the report 

16 under subsection (c), the Commission shall submit to Con17 gress and the President any additional report of dissenting 

18 opinions or minority views by a member or members of 

19 the Commission. 

20 (e) INTERIM REPORT.—The Commission may submit 

21 to Congress and the President an interim report approved 

22 by a majority of the members of the Commission. 

23 SEC. 5. MEMBERSHIP. 

24 (a) NUMBER AND APPOINTMENT.—The Commission 

25 shall— 


kjohnson on DSK79L0C42PROD with BILLS
15 

•S 3620 IS

1 (1) be composed of 17 members to be appointed 

2 by the Comptroller General; and 

3 (2) reflect the views of health providers, ancil4 lary health care workers, health care purchasers, 

5 health plans, health technology developers, research6 ers, consumers, public health experts, civil liberties 

7 experts, genomics experts, educators, the consumer 

8 electronics industry, and relevant Federal agencies, 

9 and other entities as the Secretary of Health and 

10 Human Services determines appropriate. 

11 (b) TERMS.—Each member of the Commission shall 

12 be appointed for the life of the Commission. 

13 (c) VACANCIES.—A vacancy in the Commission shall 

14 be filled in the same manner in which the original appoint15 ment was made. 

16 (d) COMPENSATION; TRAVEL EXPENSES.—Members 

17 of the Commission shall serve without pay, but shall re18 ceive travel expenses, including per diem in lieu of subsist19 ence, in accordance with sections 5702 and 5703 of title 

20 5, United States Code. 

21 (e) QUORUM.—A majority of the members of the 

22 Commission shall constitute a quorum, but a lesser num23 ber may hold hearings. 

24 (f) MEETINGS.— 


kjohnson on DSK79L0C42PROD with BILLS
16 

•S 3620 IS

1 (1) IN GENERAL.—The Commission shall meet 

2 at the call of the Chair or a majority of its members. 

3 (2) INITIAL MEETING.—Not later than 60 days 

4 after the date of the enactment of this Act, the 

5 Commission shall hold its initial meeting. 

6 (3) VIRTUAL OR IN-PERSON MEETINGS.—Meet7 ings may be held in person or virtually. 

8 (g) ETHICAL DISCLOSURE.—The Comptroller Gen9 eral shall establish a system for public disclosure by mem10 bers of the Commission of financial and other potential 

11 conflicts of interest relating to such members. Members 

12 of the Commission shall be treated as employees of Con13 gress for purposes of applying title I of the Ethics in Gov14 ernment Act of 1978 (5 U.S.C. App.). 

15 SEC. 6. DIRECTOR; STAFF; EXPERTS AND CONSULTANTS. 

16 (a) DIRECTOR.— 

17 (1) IN GENERAL.—Not earlier than 45 days 

18 after the date of enactment of this Act, the Commis19 sion shall appoint a Director of the Commissioner 

20 (referred to in this Act as the ‘‘Director’’) without 

21 regard to the provisions of title 5, United States 

22 Code, governing appointments to the competitive 

23 service. 

24 (2) PAY.—The Director shall be paid at the 

25 rate payable for level III of the Executive Schedule 


kjohnson on DSK79L0C42PROD with BILLS
17 

•S 3620 IS

1 established under section 5314 of title 5, United 

2 States Code. 

3 (b) STAFF.—The Director may appoint staff as the 

4 Director determines appropriate. 

5 (c) APPLICABILITY OF CERTAIN CIVIL SERVICE

6 LAWS.— 

7 (1) IN GENERAL.—The staff of the Commission 

8 shall be appointed without regard to the provisions 

9 of title 5, United States Code, governing appoint10 ments in the competitive service. 

11 (2) PAY.—The staff of the Commission shall be 

12 paid in accordance with the provisions of chapter 51 

13 and subchapter III of chapter 53 of that title relat14 ing to classification and General Schedule pay rates, 

15 but at rates not in excess of the maximum rate for 

16 grade GS–15 of the General Schedule under section 

17 5332 of that title. 

18 (d) EXPERTS AND CONSULTANTS.—The Director 

19 may procure temporary and intermittent services under 

20 section 3109(b) of title 5, United States Code. 

21 (e) STAFF OF FEDERAL AGENCIES.— 

22 (1) IN GENERAL.—Upon request of the Direc23 tor, the head of any Federal department or agency 

24 may detail, on a reimbursable basis, any of the perVerDate Sep 11 2014 02:55 Feb 11, 2022 Jkt 029200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S3620.IS S3620

kjohnson on DSK79L0C42PROD with BILLS
18 

•S 3620 IS

1 sonnel of that department or agency to the Commis2 sion to assist it in carrying out this Act. 

3 (2) NOTIFICATION.—Before making a request 

4 under this subsection, the Director shall give notice 

5 of the request to each member of the Commission. 

6 SEC. 7. POWERS OF COMMISSION. 

7 (a) HEARINGS AND SESSIONS.—The Commission 

8 may, for the purpose of carrying out this Act, hold hear9 ings, sit and act at times and places, take testimony, and 

10 receive evidence as the Commission considers appropriate. 

11 The Commission may administer oaths or affirmations to 

12 witnesses appearing before it. 

13 (b) POWERS OF MEMBERS AND AGENTS.—Any mem14 ber or agent of the Commission may, if authorized by the 

15 Commission, take any action which the Commission is au16 thorized to take by this section. 

17 (c) OBTAINING OFFICIAL INFORMATION.— 

18 (1) IN GENERAL.—Except as provided in para19 graph (2), if the Chair of the Commission submits 

20 a request to a Federal department or agency for in21 formation necessary to enable the Commission to 

22 carry out this Act, the head of that department or 

23 agency shall furnish that information to the Com24 mission. 


kjohnson on DSK79L0C42PROD with BILLS
19 

•S 3620 IS

1 (2) EXCEPTION FOR NATIONAL SECURITY.—If 

2 the head of the department or agency determines 

3 that it is necessary to guard such information from 

4 disclosure to protect the national security interests 

5 of the United States, the head shall not furnish that 

6 information to the Commission. 

7 (d) MAILS.—The Commission may use the United 

8 States mails in the same manner and under the same con9 ditions as other departments and agencies of the United 

10 States. 

11 (e) ADMINISTRATIVE SUPPORT SERVICES.—Upon 

12 the request of the Director, the Administrator of General 

13 Services shall provide to the Commission, on a reimburs14 able basis, the administrative support services necessary 

15 for the Commission to carry out this Act. 

16 (f) GIFTS AND DONATIONS.—The Commission may 

17 accept, use, and dispose of gifts or donations of services 

18 or property to carry out this Act, but only to the extent 

19 or in the amounts provided in advance in appropriation 

20 Acts. 

21 (g) CONTRACTS.—The Commission may contract 

22 with and compensate persons and government agencies for 

23 supplies and services, without regard to section 3709 of 

24 the Revised Statutes (41 U.S.C. 5). 

25 (h) SUBPOENA POWER.— 


kjohnson on DSK79L0C42PROD with BILLS
20 

•S 3620 IS

1 (1) IN GENERAL.—The Commission may issue 

2 subpoenas requiring the attendance and testimony of 

3 witnesses and the production of any evidence relat4 ing to any matter that the Commission is empow5 ered to investigate by section 4. The attendance of 

6 witnesses and the production of evidence may be re7 quired by such subpoena from any place within the 

8 United States and at any specified place of hearing 

9 within the United States. 

10 (2) FAILURE TO OBEY A SUBPOENA.—If a per11 son refuses to obey a subpoena issued under para12 graph (1), the Commission may apply to a United 

13 States district court for an order requiring that per14 son to appear before the Commission to give testi15 mony, produce evidence, or both, relating to the 

16 matter under investigation. The application may be 

17 made within the judicial district where the hearing 

18 is conducted or where that person is found, resides, 

19 or transacts business. Any failure to obey the order 

20 of the court may be punished by the court as civil 

21 contempt. 

22 (3) SERVICE OF SUBPOENAS.—The subpoenas 

23 of the Commission shall be served in the manner 

24 provided for subpoenas issued by a United States 


kjohnson on DSK79L0C42PROD with BILLS
21 

•S 3620 IS

1 district court under the Federal Rules of Civil Pro2 cedure for the United States district courts. 

3 (4) SERVICE OF PROCESS.—All process of any 

4 court to which application is made under paragraph 

5 (2) may be served in the judicial district in which 

6 the person required to be served resides or may be 

7 found. 

8 SEC. 8. TERMINATION. 

9 The Commission shall terminate 30 days after sub10 mitting a report under section 4(c). 

11 SEC. 9. AUTHORIZATION OF APPROPRIATIONS. 

12 (a) IN GENERAL.—There are authorized to be appro13 priated to the Commission such sums as may be necessary 

14 to carry out this Act. 

15 (b) AVAILABILITY.—Any sums appropriated pursu16 ant to the authorization in subsection (a) shall remain 

17 available until expended. 

18 SEC. 10. BUDGET ACT COMPLIANCE. 

19 Any new contract authority authorized by this Act 

20 shall be effective only to the extent or in the amounts pro21 vided in advance in appropriation Acts. 

22 SEC. 11. PRIVACY PROTECTIONS. 

23 (a) DESTRUCTION OR RETURN OF INFORMATION RE24 QUIRED.—Upon the conclusion of the matter or need for 

25 which individually identifiable information was disclosed 


kjohnson on DSK79L0C42PROD with BILLS
22 

•S 3620 IS

1 to the Commission, the Commission shall either destroy 

2 the individually identifiable information or return it to the 

3 person or entity from which it was obtained, unless the 

4 individual that is the subject of the individually identifi5 able information has authorized its disclosure. 

6 (b) DISCLOSURE OF INFORMATION PROHIBITED.— 

7 The Commission— 

8 (1) shall protect individually identifiable infor9 mation from improper use; and 

10 (2) may not disclose such information to any 

11 person, including Congress or the President, unless 

12 the individual that is the subject of the information 

13 has authorized such a disclosure. 

14 (c) PROPRIETARY BUSINESS INFORMATION AND FI15 NANCIAL INFORMATION.—The Commission shall protect 

16 from improper use, and may not disclose to any person, 

17 proprietary business information and proprietary financial 

18 information that may be viewed or obtained by the Com19 mission in the course of carrying out its duties under this 

20 Act. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS