‘‘(iii) prevents such information, which 
is collected for one purpose, from being used 
for another purpose; and 
‘‘(iv) provides security for such infor-
mation. 
‘‘(B) A description of any significant alter-
natives to the proposed rule which accomplish 
the stated objectives of applicable statutes and 
which minimize any significant privacy impact 
of the proposed rule on individuals. 
‘‘(b) FINAL PRIVACY IMPACT ASSESSMENT.—
‘‘(1) IN GENERAL.—Whenever an agency promul-
gates a final rule under section 553 of this title, after 
being required by that section or any other law to 
publish a general notice of proposed rulemaking, or 
promulgates a final interpretative rule involving the 
internal revenue laws of the United States, and such 
rule or proposed rulemaking pertains to the collection, 
maintenance, use, or disclosure of personally identifi-
able information from 10 or more individuals, other 
than agencies, instrumentalities, or employees of the 
Federal government, the agency shall prepare a final 
privacy impact assessment, signed by the senior agen-
cy official with primary responsibility for privacy 
policy.
‘‘(2) CONTENTS.—Each final privacy impact as-
sessment required under this subsection shall contain 
the following: 
‘‘(A) A description and analysis of the ex-
tent to which the final rule will impact the pri-
vacy interests of individuals, including the ex-
tent to which such rule—
‘‘(i) provides notice of the collection of 
personally identifiable information, and 
specifies what personally identifiable infor-
mation is to be collected and how it is to be 
collected, maintained, used, and disclosed; 
‘‘(ii) allows access to such information 
by the person to whom the personally iden-
tifiable information pertains and provides 
an opportunity to correct inaccuracies; 
‘‘(iii) prevents such information, which 
is collected for one purpose, from being used 
for another purpose; and 
‘‘(iv) provides security for such infor-
mation. 
‘‘(B) A summary of any significant issues 
raised by the public comments in response to the 
initial privacy impact assessment, a summary of 
the analysis of the agency of such issues, and a
statement of any changes made in such rule as 
a result of such issues. 
‘‘(C) A description of the steps the agency 
has taken to minimize the significant privacy 
impact on individuals consistent with the stated
objectives of applicable statutes, including a 
statement of the factual, policy, and legal reasons 
for selecting the alternative adopted in the final 
rule and why each one of the other significant 
alternatives to the rule considered by the agency 
which affect the privacy interests of individuals 
was rejected. 
‘‘(3) AVAILABILITY
TO
PUBLIC.—The agency 
shall make copies of the final privacy impact assess-
ment available to members of the public and shall 
publish in the Federal Register such assessment or a 
summary thereof. 
‘‘(c) WAIVERS.—
‘‘(1) EMERGENCIES.—An agency head may 
waive or delay the completion of some or all of the 
requirements of subsections (a) and (b) to the same 
extent as the agency head may, under section 608, 
waive or delay the completion of some or all of the 
requirements of sections 603 and 604, respectively.
‘‘(2) NATIONAL
SECURITY.—An agency head 
may, for national security reasons, or to protect from 
disclosure classified information, confidential com-
mercial information, or information the disclosure of 
which may adversely affect a law enforcement effort, 
waive or delay the completion of some or all of the 
following requirements: 
‘‘(A) The requirement of subsection (a)(1) to 
make an assessment available for public com-
ment. 
‘‘(B) The requirement of subsection (a)(1) to 
have an assessment or summary thereof pub-
lished in the Federal Register. 
‘‘(C) The requirements of subsection (b)(3). 
‘‘(d) PROCEDURES
FOR GATHERING COMMENTS.—
When any rule is promulgated which may have a signifi-
cant privacy impact on individuals, or a privacy impact 
on a substantial number of individuals, the head of the 
agency promulgating the rule or the official of the agency 
with statutory responsibility for the promulgation of the 
rule shall assure that individuals have been given an oppor-
tunity to participate in the rulemaking for the rule through 
techniques such as—
‘‘(1) the inclusion in an advance notice of pro-
posed rulemaking, if issued, of a statement that the
proposed rule may have a significant privacy impact 
on individuals, or a privacy impact on a substantial 
number of individuals; 
‘‘(2) the publication of a general notice of pro-
posed rulemaking in publications of national circula-
tion likely to be obtained by individuals; 
‘‘(3) the direct notification of interested individ-
uals; 
‘‘(4) the conduct of open conferences or public 
hearings concerning the rule for individuals, includ-
ing soliciting and receiving comments over computer 
networks; and 
‘‘(5) the adoption or modification of agency pro-
cedural rules to reduce the cost or complexity of par-
ticipation in the rulemaking by individuals. 
‘‘(e) PERIODIC REVIEW OF RULES.—
‘‘(1) IN GENERAL.—Each agency shall carry out 
a periodic review of the rules promulgated by the 
agency that have a significant privacy impact on in-
dividuals, or a privacy impact on a substantial num-
ber of individuals. Under such periodic review, the 
agency shall determine, for each such rule, whether 
the rule can be amended or rescinded in a manner 
that minimizes any such impact while remaining in 
accordance with applicable statutes. For each such de-
termination, the agency shall consider the following 
factors: 
‘‘(A) The continued need for the rule. 
‘‘(B) The nature of complaints or comments 
received from the public concerning the rule. 
‘‘(C) The complexity of the rule. 
‘‘(D) The extent to which the rule overlaps, 
duplicates, or conflicts with other Federal rules, 
and, to the extent feasible, with State and local 
governmental rules. 
‘‘(E) The length of time since the rule was 
last reviewed under this subsection. 
‘‘(F) The degree to which technology, eco-
nomic conditions, or other factors have changed 
in the area affected by the rule since the rule was 
last reviewed under this subsection. 
‘‘(2) PLAN REQUIRED.—Each agency shall carry 
out the periodic review required by paragraph (1) in 
accordance with a plan published by such agency in 
the Federal Register. Each such plan shall provide for 
the review under this subsection of each rule promul-
gated by the agency not later than 10 years after the 
date on which such rule was published as the final 
rule and, thereafter, not later than 10 years after the 
date on which such rule was last reviewed under this
subsection. The agency may amend such plan at any 
time by publishing the revision in the Federal Reg-
ister. 
‘‘(3) ANNUAL
PUBLICATION.—Each year, each 
agency shall publish in the Federal Register a list of 
the rules to be reviewed by such agency under this 
subsection during the following year. The list shall in-
clude a brief description of each such rule and the 
need for and legal basis of such rule and shall invite 
public comment upon the determination to be made 
under this subsection with respect to such rule. 
‘‘(f) JUDICIAL REVIEW.—
‘‘(1) IN GENERAL.—For any rule subject to this 
section, an individual who is adversely affected or ag-
grieved by final agency action is entitled to judicial 
review of agency compliance with the requirements of 
subsections (b) and (c) in accordance with chapter 7. 
Agency compliance with subsection (d) shall be judi-
cially reviewable in connection with judicial review of 
subsection (b). 
‘‘(2) JURISDICTION.—Each court having juris-
diction to review such rule for compliance with sec-
tion 553, or under any other provision of law, shall 
have jurisdiction to review any claims of noncompli-
ance with subsections (b) and (c) in accordance with