I 
109TH CONGRESS 
2D SESSION 
H. R. 6163 
To amend title 44, United States Code, to strengthen requirements related 
to security breaches of data involving the disclosure of sensitive personal 
information. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 25, 2006 
Mr. TOM DAVIS of Virginia (for himself, Ms. PRYCE of Ohio, and Mr. 
SWEENEY) introduced the following bill; which was referred to the Com-
mittee on Government Reform 
A BILL 
To amend title 44, United States Code, to strengthen re-
quirements related to security breaches of data involving 
the disclosure of sensitive personal information. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Agency Data 
Breach Protection Act’’. 
SEC. 2. FEDERAL AGENCY DATA BREACH NOTIFICATION 
REQUIREMENTS. 
(a) AUTHORITY OF DIRECTOR OF OFFICE OF MAN-
AGEMENT AND BUDGET TO ESTABLISH DATA BREACH 
VerDate Aug 31 2005 
23:03 Sep 27, 2006
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6163.IH
H6163
pwalker on PRODPC60 with BILLS
POLICIES.—Section 3543(a) of title 44, United States 
Code, is amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
(3) by adding at the end the following: 
‘‘(9) establishing policies, procedures, and 
standards for agencies to follow in the event of a 
breach of data security involving the disclosure of 
sensitive personal information and for which harm to 
an individual could reasonably be expected to result, 
specifically including— 
‘‘(A) a requirement for timely notice to be 
provided to those individuals whose sensitive 
personal information could be compromised as a 
result of such breach, except no notice shall be 
required if the breach does not create a reason-
able risk of identity theft, fraud, or other un-
lawful conduct regarding such individual; 
‘‘(B) guidance on determining how timely 
notice is to be provided; and 
‘‘(C) guidance regarding whether addi-
tional special actions are necessary and appro-
priate, including data breach analysis, fraud 
VerDate Aug 31 2005 
23:03 Sep 27, 2006
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6163.IH
H6163
pwalker on PRODPC60 with BILLS
resolution services, identity theft insurance, and 
credit protection or monitoring services.’’. 
(b) AUTHORITY OF CHIEF INFORMATION OFFICER 
TO ENFORCE DATA BREACH POLICIES AND DEVELOP 
AND MAINTAIN INVENTORIES.—Section 3544(a)(3) of 
title 44, United States Code, is amended— 
(1) by inserting after ‘‘authority to ensure com-
pliance with’’ the following: ‘‘and, to the extent de-
termined necessary and explicitly authorized by the 
head of the agency, to enforce’’; 
(2) by striking ‘‘and’’ at the end of subpara-
graph (D); 
(3) by inserting ‘‘and’’ at the end of subpara-
graph (E); and 
(4) by adding at the end the following: 
‘‘(F) developing and maintaining an inven-
tory of all personal computers, laptops, or any 
other hardware containing sensitive personal in-
formation;’’. 
(c) INCLUSION OF DATA BREACH NOTIFICATION IN 
AGENCY INFORMATION SECURITY PROGRAMS.—Section 
3544(b) of title 44, United States Code, is amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
VerDate Aug 31 2005 
23:03 Sep 27, 2006
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6163.IH
H6163
pwalker on PRODPC60 with BILLS
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
(3) by adding at the end the following: 
‘‘(9) procedures for notifying individuals whose 
sensitive personal information is compromised con-
sistent with policies, procedures, and standards es-
tablished under section 3543(a)(9) of this title.’’. 
(d) AUTHORITY OF AGENCY CHIEF HUMAN CAPITAL 
OFFICERS TO ASSESS FEDERAL PERSONAL PROPERTY.— 
Section 1402(a) of title 5, United States Code, is amend-
ed— 
(1) by striking ‘‘, and’’ at the end of paragraph 
(5) and inserting a semicolon; 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (6); and 
(3) by adding at the end the following: 
‘‘(7) prescribing policies and procedures for exit 
interviews of employees, including a full accounting 
of all Federal personal property that was assigned to 
the employee during the course of employment.’’. 
(e) SENSITIVE PERSONAL INFORMATION DEFINI-
TION.—Section 3542(b) of title 44, United States Code, 
is amended by adding at the end the following new para-
graph: 
VerDate Aug 31 2005 
23:03 Sep 27, 2006
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6163.IH
H6163
pwalker on PRODPC60 with BILLS
‘‘(4) The term ‘sensitive personal information’, 
with respect to an individual, means any information 
about the individual maintained by an agency, in-
cluding— 
‘‘(A) education, financial transactions, 
medical history, and criminal or employment 
history; 
‘‘(B) information that can be used to dis-
tinguish or trace the individual’s identity, in-
cluding name, social security number, date and 
place of birth, mother’s maiden name, or bio-
metric records; or 
‘‘(C) any other personal information that 
is linked or linkable to the individual.’’. 
Æ 
VerDate Aug 31 2005 
23:03 Sep 27, 2006
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H6163.IH
H6163
pwalker on PRODPC60 with BILLS