II 

110TH CONGRESS 

1ST SESSION S. 1558 

To amend title 44, United States Code, to strengthen requirements related 

to security breaches of data involving the disclosure of sensitive personal 

information. 

IN THE SENATE OF THE UNITED STATES 

JUNE 6, 2007 

Mr. COLEMAN introduced the following bill; which was read twice and referred 

to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To amend title 44, United States Code, to strengthen requirements related to security breaches of data involving 

the disclosure of sensitive personal information. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Agency Data 

5 Breach Protection Act’’. 

6 SEC. 2. FEDERAL AGENCY DATA BREACH NOTIFICATION 

7 REQUIREMENTS. 

8 (a) AUTHORITY OF DIRECTOR OF OFFICE OF MAN9 AGEMENT AND BUDGET TO ESTABLISH DATA BREACH


hmoore on PRODPC68 with HMBILLS
2 

•S 1558 IS

1 POLICIES.—Section 3543(a) of title 44, United States 

2 Code, is amended— 

3 (1) by striking ‘‘and’’ at the end of paragraph 

4 (7); 

5 (2) by striking the period and inserting ‘‘; and’’ 

6 at the end of paragraph (8); and 

7 (3) by adding at the end the following: 

8 ‘‘(9) establishing policies, procedures, and 

9 standards for agencies to follow in the event of a 

10 breach of data security involving the disclosure of 

11 sensitive personal information and for which harm to 

12 an individual could reasonably be expected to result, 

13 specifically including— 

14 ‘‘(A) a requirement for timely notice to be 

15 provided to those individuals whose sensitive 

16 personal information could be compromised as a 

17 result of such breach, except no notice shall be 

18 required if the breach does not create a reason19 able risk of identity theft, fraud, or other un20 lawful conduct regarding such individual; 

21 ‘‘(B) guidance on determining how timely 

22 notice is to be provided; and 

23 ‘‘(C) guidance regarding whether addi24 tional special actions are necessary and appro25 priate, including data breach analysis, fraud 


hmoore on PRODPC68 with HMBILLS
3 

•S 1558 IS

1 resolution services, identity theft insurance, and 

2 credit protection or monitoring services.’’. 

3 (b) AUTHORITY OF CHIEF INFORMATION OFFICER

4 TO ENFORCE DATA BREACH POLICIES AND DEVELOP

5 AND MAINTAIN INVENTORIES.—Section 3544(a)(3) of 

6 title 44, United States Code, is amended— 

7 (1) by inserting after ‘‘authority to ensure com8 pliance with’’ the following: ‘‘and, to the extent de9 termined necessary and explicitly authorized by the 

10 head of the agency, to enforce’’; 

11 (2) by striking ‘‘and’’ at the end of subpara12 graph (D); 

13 (3) by inserting ‘‘and’’ at the end of subpara14 graph (E); and 

15 (4) by adding at the end the following: 

16 ‘‘(F) developing and maintaining an inven17 tory of all personal computers, laptops, or any 

18 other hardware containing sensitive personal in19 formation;’’. 

20 (c) INCLUSION OF DATA BREACH NOTIFICATION IN

21 AGENCY INFORMATION SECURITY PROGRAMS.—Section 

22 3544(b) of title 44, United States Code, is amended— 

23 (1) by striking ‘‘and’’ at the end of paragraph 

24 (7); 


hmoore on PRODPC68 with HMBILLS
4 

•S 1558 IS

1 (2) by striking the period and inserting ‘‘; and’’ 

2 at the end of paragraph (8); and 

3 (3) by adding at the end the following: 

4 ‘‘(9) procedures for notifying individuals whose 

5 sensitive personal information is compromised con6 sistent with policies, procedures, and standards es7 tablished under section 3543(a)(9) of this title.’’. 

8 (d) AUTHORITY OF AGENCY CHIEF HUMAN CAPITAL

9 OFFICERS TO ASSESS FEDERAL PERSONAL PROPERTY.— 

10 Section 1402(a) of title 5, United States Code, is amend11 ed— 

12 (1) by striking ‘‘, and’’ at the end of paragraph 

13 (5) and inserting a semicolon; 

14 (2) by striking the period and inserting ‘‘; and’’ 

15 at the end of paragraph (6); and 

16 (3) by adding at the end the following: 

17 ‘‘(7) prescribing policies and procedures for exit 

18 interviews of employees, including a full accounting 

19 of all Federal personal property that was assigned to 

20 the employee during the course of employment.’’. 

21 (e) SENSITIVE PERSONAL INFORMATION DEFINI22 TION.—Section 3542(b) of title 44, United States Code, 

23 is amended by adding at the end the following: 

24 ‘‘(4) The term ‘sensitive personal information’, 

25 with respect to an individual, means any information 


hmoore on PRODPC68 with HMBILLS
5 

•S 1558 IS

1 about the individual maintained by an agency, in2 cluding— 

3 ‘‘(A) education, financial transactions, 

4 medical history, and criminal or employment 

5 history; 

6 ‘‘(B) information that can be used to dis7 tinguish or trace the individual’s identity, in8 cluding name, social security number, date and 

9 place of birth, mother’s maiden name, or bio10 metric records; or 

11 ‘‘(C) any other personal information that 

12 is linked or linkable to the individual.’’. 

Æ 


hmoore on PRODPC68 with HMBILLS