109TH CONGRESS 
2D SESSION 
H. R. 5835
AN ACT 
To amend title 38, United States Code, to improve informa-
tion management within the Department of Veterans 
Affairs, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Veterans Identity and 
Credit Security Act of 2006’’. 
SEC. 2. FEDERAL AGENCY DATA BREACH NOTIFICATION 
REQUIREMENTS. 
(a) AUTHORITY OF DIRECTOR OF OFFICE OF MAN-
AGEMENT AND BUDGET TO ESTABLISH DATA BREACH 
POLICIES.—Section 3543(a) of title 44, United States 
Code, is amended—
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
(3) by adding at the end the following: 
‘‘(9) establishing policies, procedures, and 
standards for agencies to follow in the event of a 
breach of data security involving the disclosure of 
sensitive personal information and for which harm to 
an individual could reasonably be expected to result, 
specifically including—
‘‘(A) a requirement for timely notice to be 
provided to those individuals whose sensitive 
personal information could be compromised as a 
result of such breach, except no notice shall be 
required if the breach does not create a reason-
able risk of identity theft, fraud, or other un-
lawful conduct regarding such individual; 
‘‘(B) guidance on determining how timely 
notice is to be provided; and 
‘‘(C) guidance regarding whether addi-
tional special actions are necessary and appro-
priate, including data breach analysis, fraud 
resolution services, identity theft insurance, and 
credit protection or monitoring services.’’. 
(b) AUTHORITY OF CHIEF INFORMATION OFFICER 
TO ENFORCE DATA BREACH POLICIES AND DEVELOP 
AND MAINTAIN INVENTORIES.—Section 3544(a)(3) of 
title 44, United States Code, is amended—
(1) by inserting after ‘‘authority to ensure com-
pliance with’’ the following: ‘‘and, to the extent de-
termined necessary and explicitly authorized by the 
head of the agency, to enforce’’; 
(2) by striking ‘‘and’’ at the end of subpara-
graph (D); 
(3) by inserting ‘‘and’’ at the end of subpara-
graph (E); and 
(4) by adding at the end the following: 
‘‘(F) developing and maintaining an inven-
tory of all personal computers, laptops, or any
other hardware containing sensitive personal in-
formation;’’. 
(c) INCLUSION OF DATA BREACH NOTIFICATION IN 
AGENCY INFORMATION SECURITY PROGRAMS.—Section 
3544(b) of title 44, United States Code, is amended—
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
(3) by adding at the end the following: 
‘‘(9) procedures for notifying individuals whose 
sensitive personal information is compromised con-
sistent with policies, procedures, and standards es-
tablished under section 3543(a)(9) of this title.’’. 
(d) AUTHORITY OF AGENCY CHIEF HUMAN CAPITAL 
OFFICERS TO ASSESS FEDERAL PERSONAL PROPERTY.—
Section 1402(a) of title 5, United States Code, is amend-
ed—
(1) by striking ‘‘, and’’ at the end of paragraph 
(5) and inserting a semicolon; 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (6); and 
(3) by adding at the end the following: 
‘‘(7) prescribing policies and procedures for exit 
interviews of employees, including a full accounting
of all Federal personal property that was assigned to 
the employee during the course of employment.’’. 
(e) SENSITIVE PERSONAL INFORMATION DEFINI-
TION.—Section 3542(b) of title 44, United States Code, 
is amended by adding at the end the following new para-
graph: 
‘‘(4) The term ‘sensitive personal information’, 
with respect to an individual, means any information 
about the individual maintained by an agency, in-
cluding—
‘‘(A) education, financial transactions, 
medical history, and criminal or employment 
history; 
‘‘(B) information that can be used to dis-
tinguish or trace the individual’s identity, in-
cluding name, social security number, date and 
place of birth, mother’s maiden name, or bio-
metric records; or 
‘‘(C) any other personal information that 
is linked or linkable to the individual.’’. 
SEC. 3. UNDER SECRETARY FOR INFORMATION SERVICES. 
(a) UNDER SECRETARY.—Chapter 3 of title 38, 
United States Code, is amended by inserting after section 
307 the following new section:
‘‘§ 307A. Under Secretary for Information Services 
‘‘(a) UNDER SECRETARY.—There is in the Depart-
ment an Under Secretary for Information Services, who 
is appointed by the President, by and with the advice and 
consent of the Senate. The Under Secretary shall be the 
head of the Office of Information Services and shall per-
form such functions as the Secretary shall prescribe. 
‘‘(b) SERVICE AS CHIEF INFORMATION OFFICER.—
Notwithstanding any other provision of law, the Under 
Secretary for Information Services shall serve as the Chief 
Information Officer of the Department under section 310 
of this title.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of such chapter is amended by inserting 
after the item relating to section 307 the following new 
item:
‘‘307A. Under Secretary for Information Services.’’.
(c) CONFORMING AMENDMENT.—Section 308(b) of 
such title is amended by striking paragraph (5) and redes-
ignating paragraphs (6) through (11) as paragraphs (5) 
through (10), respectively. 
SEC. 4. DEPARTMENT OF VETERANS AFFAIRS INFORMA-
TION SECURITY. 
(a) INFORMATION SECURITY.—Chapter 57 of title 
38, United States Code, is amended by adding at the end 
the following new subchapter:
‘‘SUBCHAPTER III—INFORMATION SECURITY 
‘‘§ 5721. Definitions 
‘‘For the purposes of this subchapter: 
‘‘(1) The term ‘sensitive personal information’, 
with respect to an individual, means any information 
about the individual maintained by an agency, in-
cluding—
‘‘(A) education, financial transactions, 
medical history, and criminal or employment 
history; 
‘‘(B) information that can be used to dis-
tinguish or trace the individual’s identity, in-
cluding name, social security number, date and 
place of birth, mother’s maiden name, or bio-
metric records; or 
‘‘(C) any other personal information that 
is linked or linkable to the individual. 
‘‘(2) The term ‘data breach’ means the loss, 
theft, or other unauthorized access to data con-
taining sensitive personal information, in electronic 
or printed form, that results in the potential com-
promise of the confidentiality or integrity of the 
data.
‘‘(3) The term ‘data breach analysis’ means the 
identification of any misuse of sensitive personal in-
formation involved in a data breach. 
‘‘(4) The term ‘fraud resolution services’ means 
services to assist an individual in the process of re-
covering and rehabilitating the credit of the indi-
vidual after the individual experiences identity theft. 
‘‘(5) The term ‘identity theft’ has the meaning 
given such term under section 603 of the Fair Cred-
it Reporting Act (15 U.S.C. 1681a). 
‘‘(6) The term ‘identity theft insurance’ means 
any insurance policy that pays benefits for costs, in-
cluding travel costs, notary fees, and postage costs, 
lost wages, and legal fees and expenses associated 
with the identity theft of the insured individual. 
‘‘(7) The term ‘principal credit reporting agen-
cy’ means a consumer reporting agency as described 
in section 603(p) of the Fair Credit Reporting Act 
(15 U.S.C. 1681a(p)). 
‘‘§ 5722. Office of the Under Secretary for Information 
Services 
‘‘(a) DEPUTY UNDER SECRETARIES.—The Office of 
the Under Secretary for Information Services shall consist 
of the following:
‘‘(1) The Deputy Under Secretary for Informa-
tion Services for Security, who shall serve as the 
Senior Information Security Officer of the Depart-
ment. 
‘‘(2) The Deputy Under Secretary for Informa-
tion Services for Operations and Management. 
‘‘(3) The Deputy Under Secretary for Informa-
tion Services for Policy and Planning. 
‘‘(b) APPOINTMENTS.—Appointments under sub-
section (a) shall be made by the Secretary, notwith-
standing the limitations of section 709 of this title. 
‘‘(c) QUALIFICATIONS.—At least one of positions es-
tablished and filled under subsection (a) shall be filled by 
an individual who has at least five years of continuous 
service in the Federal civil service in the executive branch 
immediately preceding the appointment of the individual 
as a Deputy Under Secretary. For purposes of deter-
mining such continuous service of an individual, there 
shall be excluded any service by such individual in a posi-
tion—
‘‘(1) of a confidential, policy-determining, pol-
icy-making, or policy-advocating character; 
‘‘(2) in which such individual served as a non-
career appointee in the Senior Executive Service, as
such term is defined in section 3132(a)(7) of title 5; 
or 
‘‘(3) to which such individual was appointed by 
the President. 
‘‘§ 5723. Information security management 
‘‘(a) RESPONSIBILITIES OF CHIEF INFORMATION OF-
FICER.—To support the economical, efficient, and effec-
tive execution of subtitle III of chapter 35 of title 44, and 
policies and plans of the Department, the Secretary shall 
ensure that the Chief Information Officer of the Depart-
ment has the authority and control necessary to develop, 
approve, implement, integrate, and oversee the policies, 
procedures, processes, activities, and systems of the De-
partment relating to that subtitle, including the manage-
ment of all related mission applications, information re-
sources, personnel, and infrastructure. 
‘‘(b) ANNUAL COMPLIANCE REPORT.—Not later than 
March 1 of each year, the Secretary shall submit to the 
Committees on Veterans’ Affairs of the Senate and House 
of Representatives, the Committee on Government Reform 
of the House of Representatives, and the Committee on 
Homeland Security and Governmental Affairs of the Sen-
ate, a report on the Department’s compliance with subtitle 
III of chapter 35 of title 44. The information in such re-
port shall be displayed in the aggregate and separately for
each Administration, office, and facility of the Depart-
ment. 
‘‘(c) REPORTS TO SECRETARY OF COMPLIANCE DE-
FICIENCIES.—(1) At least once every month, the Chief In-
formation Officer shall report to the Secretary any defi-
ciency in the compliance with subtitle III of chapter 35 
of title 44 of the Department or any Administration, of-
fice, or facility of the Department. 
‘‘(2) The Chief Information Officer shall immediately 
report to the Secretary any significant deficiency in such 
compliance. 
‘‘(d) DATA BREACHES.—(1) The Chief Information 
Officer shall immediately provide notice to the Secretary 
of any data breach. 
‘‘(2) Immediately after receiving notice of a data 
breach under paragraph (1), the Secretary shall provide 
notice of such breach to the Director of the Office of Man-
agement and Budget, the Inspector General of the Depart-
ment, and, if appropriate, the Federal Trade Commission 
and the United States Secret Service. 
‘‘(e) BUDGETARY MATTERS.—When the budget for 
any fiscal year is submitted by the President to Congress 
under section 1105 of title 31, the Secretary shall submit 
to Congress a report that identifies amounts requested for 
Department implementation and remediation of and com-
pliance with this subchapter and subtitle III of chapter 
35 of title 44. The report shall set forth those amounts 
both for each Administration within the Department and 
for the Department in the aggregate and shall identify, 
for each such amount, how that amount is aligned with 
and supports such implementation and compliance. 
‘‘§ 5724. Congressional reporting and notification of 
data breaches 
‘‘(a) QUARTERLY REPORTS.—(1) Not later than 30 
days after the last day of a fiscal quarter, the Secretary 
shall submit to the Committees on Veterans’ Affairs of 
the Senate and House of Representatives a report on any 
data breach with respect to sensitive personal information 
processed or maintained by the Department that occurred 
during that quarter. 
‘‘(2) Each report submitted under paragraph (1) 
shall identify, for each data breach covered by the report, 
the Administration and facility of the Department respon-
sible for processing or maintaining the sensitive personal 
information involved in the data breach. 
‘‘(b) 
NOTIFICATION
OF
SIGNIFICANT
DATA 
BREACHES.—(1) In the event of a data breach with re-
spect to sensitive personal information processed or main-
tained by the Secretary that the Secretary determines is 
significant, the Secretary shall provide notice of such
breach to the Committees on Veterans’ Affairs of the Sen-
ate and House of Representatives. 
‘‘(2) Notice under paragraph (1) shall be provided 
promptly following the discovery of such a data breach and 
the implementation of any measures necessary to deter-
mine the scope of the breach, prevent any further breach 
or unauthorized disclosures, and reasonably restore the in-
tegrity of the data system. 
‘‘§ 5725. Data breaches 
‘‘(a) INDEPENDENT RISK ANALYSIS.—(1) In the 
event of a data breach with respect to sensitive personal 
information that is processed or maintained by the Sec-
retary, the Secretary shall ensure that, as soon as possible 
after the data breach, a non-Department entity conducts 
an independent risk analysis of the data breach to deter-
mine the level of risk associated with the data breach for 
the potential misuse of any sensitive personal information 
involved in the data breach. 
‘‘(2) If the Secretary determines, based on the find-
ings of a risk analysis conducted under paragraph (1), 
that a reasonable risk exists for the potential misuse of 
sensitive information involved in a data breach, the Sec-
retary shall provide credit protection services in accord-
ance with section 5726 of this title.
‘‘(b) NOTIFICATION.—(1) In the event of a data 
breach with respect to sensitive personal information that 
is processed or maintained by the Secretary, the Secretary 
shall provide to an individual whose sensitive personal in-
formation is involved in that breach notice of the data 
breach—
‘‘(A) in writing; or 
‘‘(B) by email, if—
‘‘(i) the Department’s primary method of 
communication with the individual is by email; 
and 
‘‘(ii) the individual has consented to receive 
such notification. 
‘‘(2) Notice provided under paragraph (1) shall—
‘‘(A) describe the circumstances of the data 
breach and the risk that the breach could lead to 
misuse, including identity theft, involving the sen-
sitive personal information of the individual; 
‘‘(B) describe the specific types of sensitive per-
sonal information that was compromised as a part of 
the data breach; 
‘‘(C) describe the actions the Department is 
taking to remedy the data breach;
‘‘(D) inform the individual that the individual 
may request a fraud alert and credit security freeze 
under this section; 
‘‘(E) clearly explain the advantages and dis-
advantages to the individual of receiving fraud alerts 
and credit security freezes under this section; and 
‘‘(F) includes such other information as the 
Secretary determines is appropriate. 
‘‘(3) The notice required under paragraph (1) shall 
be provided promptly following the discovery of a data 
breach and the implementation of any measures necessary 
to determine the scope of the breach, prevent any further 
breach or unauthorized disclosures, and reasonably restore 
the integrity of the data system. 
‘‘(c) REPORT.—For each data breach with respect to 
sensitive personal information processed or maintained by 
the Secretary, the Secretary shall promptly submit to the 
Committees on Veterans’ Affairs of the Senate and House 
of Representatives a report containing the findings of any 
independent risk analysis conducted under subsection 
(a)(1), any determination of the Secretary under sub-
section (a)(2), and a description of any credit protection 
services provided under section 5726 of this title. 
‘‘(d) FINAL DETERMINATION.—Notwithstanding sec-
tions 511 and 7104(a) of this title, any determination of
the Secretary under subsection (a)(2) with respect to the 
reasonable risk for the potential misuse of sensitive infor-
mation involved in a data breach is final and conclusive 
and may not be reviewed by any other official, administra-
tive body, or court, whether by an action in the nature 
of mandamus or otherwise. 
‘‘(e) FRAUD ALERTS.—(1) In the event of a data 
breach with respect to sensitive personal information that 
is processed or maintained by the Secretary, the Secretary 
shall arrange, upon the request of an individual whose sen-
sitive personal information is involved in the breach to a 
principal credit reporting agency with which the Secretary 
has entered into a contract under section 5726(d) and at 
no cost to the individual, for the principal credit reporting 
agency to provide fraud alert services for that individual 
for a period of not less than one year, beginning on the 
date of such request, unless the individual requests that 
such fraud alert be removed before the end of such period, 
and the agency receives appropriate proof of the identity 
of the individual for such purpose. 
‘‘(2) The Secretary shall arrange for each principal 
credit reporting agency referred to in paragraph (1) to 
provide any alert requested under such subsection in the 
file of the individual along with any credit score generated 
in using that file, for a period of not less than one year,
beginning on the date of such request, unless the indi-
vidual requests that such fraud alert be removed before 
the end of such period, and the agency receives appro-
priate proof of the identity of the individual for such pur-
pose. 
‘‘(f) CREDIT SECURITY FREEZE.— (1) In the event 
of a data breach with respect to sensitive personal infor-
mation that is processed or maintained by the Secretary, 
the Secretary shall arrange, upon the request of an indi-
vidual whose sensitive personal information is involved in 
the breach and at no cost to the individual, for each prin-
cipal credit reporting agency to apply a security freeze to 
the file of that individual for a period of not less than 
one year, beginning on the date of such request, unless 
the individual requests that such security freeze be re-
moved before the end of such period, and the agency re-
ceives appropriate proof of the identity of the individual 
for such purpose. 
‘‘(2) The Secretary shall arrange for a principal cred-
it reporting agency applying a security freeze under para-
graph (1)—
‘‘(A) to send a written confirmation of the security 
freeze to the individual within five business days of apply-
ing the freeze;
‘‘(B) to refer the information regarding the security 
freeze to other consumer reporting agencies; 
‘‘(C) to provide the individual with a unique personal 
identification number or password to be used by the indi-
vidual when providing authorization for the release of the 
individual’s credit for a specific party or period of time; 
and 
‘‘(D) upon the request of the individual, to tempo-
rarily lift the freeze for a period of time specified by the 
individual, beginning not later than three business days 
after the date on which the agency receives the request. 
‘‘§ 5726. Provision of credit protection services 
‘‘(a) COVERED INDIVIDUAL.—For purposes of this 
section, a covered individual is an individual whose sen-
sitive personal information that is processed or maintained 
by the Department (or any third-party entity acting on 
behalf of the Department) is involved, on or after August 
1, 2005, in a data breach for which the Secretary deter-
mines a reasonable risk exists for the potential misuse of 
sensitive personal information under section 5725(a)(2) of 
this title. 
‘‘(b) NOTIFICATION.—(1) In addition to any notice 
required under subsection 5725(b) of this title, the Sec-
retary shall provide to a covered individual notice in writ-
ing that—
‘‘(A) the individual may request credit protec-
tion services under this section; 
‘‘(B) clearly explains the advantages and dis-
advantages to the individual of receiving credit pro-
tection services under this section; 
‘‘(E) includes a notice of which principal credit 
reporting agency the Secretary has entered into a 
contract with under subsection (d), and information 
about requesting services through that agency; 
‘‘(C) describes actions the individual can or 
should take to reduce the risk of identity theft; and 
‘‘(D) includes such other information as the 
Secretary determines is appropriate. 
‘‘(2) The notice required under paragraph (1) shall 
be made as promptly as possible and without unreasonable 
delay following the discovery of a data breach for which 
the Secretary determines a reasonable risk exists for the 
potential misuse of sensitive personal information under 
section 5725(a)(2) of this title and the implementation of 
any measures necessary to determine the scope of the 
breach, prevent any further breach or unauthorized disclo-
sures, and reasonably restore the integrity of the data sys-
tem. 
‘‘(3) The Secretary shall ensure that each notification 
under paragraph (1) includes a form or other means for