Military Data Privacy Act

To require a report on the purchase and use by the Department of Defense of certain location data and internet metadata data, and for other purposes. 1. Short title This Act may be cited as the Military Data Privacy Act 2. Report on purchase and use by Department of Defense of location data generated by Americans’ phones and their internet metadata (a) Report required Not later than 90 days after the date of the enactment of this Act, the Secretary of Defense shall submit to the congressional defense committees and make available to the public on an internet website of the Department of Defense a report that— (1) identifies each covered entity that is currently, or during the five-year period ending on the date of the enactment of this Act was, without a court order— (A) obtaining in exchange for anything of value any covered records; and (B) intentionally retaining or intentionally using such covered records; and (2) for each covered entity identified pursuant to paragraph (1), identifies— (A) each category of covered record the covered entity, without a court order, is obtaining or obtained, in exchange for anything of value; (B) whether the covered entity intentionally retained or is intentionally retaining each category of covered records pursuant to subparagraph (A); (C) whether the covered entity intentionally uses or used each category of covered records identified pursuant to subparagraph (A); and (D) whether such obtaining, retention, and use ceased before the date of the enactment of this Act or is ongoing. (b) Form The report submitted under subsection (a) shall be submitted in unclassified form. (c) Determination of parties to a communication In determining under this section whether a party to a communication is likely to be located inside or outside the United States, the Secretary shall consider the Internet Protocol (IP) address used by the party to the communication, but may also consider other information known to the Secretary. (d) Definitions In this section: (1) The term congressional defense committees (2) The term covered entities (A) are under the authority, direction, and control of the Under Secretary of Defense for Intelligence and Security; or (B) over which the Under Secretary exercises planning, policy, funding, or strategic oversight authority. (3) The term covered records (A) Location data generated by phones that are likely to be located in the United States. (B) Domestic phone call records. (C) International phone call records. (D) Domestic text message records. (E) International text message records. (F) Domestic netflow records. (G) International netflow records. (H) Domestic Domain Name System records. (I) International Domain Name System records. (J) Other types of domestic internet metadata. (K) Other types of international internet metadata. (4) The term domestic (5) (A) The term international (B) The term international (6) The term obtain in exchange for anything of value (7) (A) Except as provided in subparagraph (B), the term retain (B) The term retain (8) (A) Except as provided in subparagraph (B), the term use (B) The term use

Summary: Military Data Privacy Act This bill requires the Department of Defense (DOD) to submit an unclassified report identifying certain defense entities that were, or are currently, obtaining in exchange for anything of value specified personal records of individuals (e.g., location data generated by phones likely to be located in the United States) and retaining or using such records without a court order. The report must be made available to the public on a DOD website.