SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Federal Agency Data Protection Act’’. 
(b) TABLE OF CONTENTS.—The table of contents of this 
Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Purpose. 
Sec. 3. Definitions. 
Sec. 4. Authority of Director of Office of Management and Budget to establish in-
formation security policies and procedures. 
Sec. 5. Responsibilities of Federal agencies for information security. 
Sec. 6. Federal agency data breach notification requirements. 
Sec. 7. Protection of government computers from risks of peer-to-peer file sharing. 
Sec. 8. Annual independent audit. 
Sec. 9. Best practices for privacy impact assessments. 
Sec. 10. Implementation. 
SEC. 2. PURPOSE. 
The purpose of this Act is to protect personally identi-
fiable information of individuals that is maintained in or 
transmitted by Federal agency information systems. 
SEC. 3. DEFINITIONS. 
(a) PERSONALLY IDENTIFIABLE INFORMATION
AND 
MOBILE DIGITAL DEVICE DEFINITIONS.—Section 3542(b) 
of title 44, United States Code, is amended by adding at 
the end the following new paragraphs: 
‘‘(4) The term ‘personally identifiable informa-
tion’, with respect to an individual, means any infor-
mation about the individual maintained by an agen-
cy, including information— 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
‘‘(A) about the individual’s education, fi-
nances, or medical, criminal, or employment his-
tory; 
‘‘(B) that can be used to distinguish or 
trace the individual’s identity, including name, 
social security number, date and place of birth, 
mother’s maiden name, or biometric records; or 
‘‘(C) that is otherwise linked or linkable to 
the individual. 
‘‘(5) The term ‘mobile digital device’ includes 
any device that can store or process information elec-
tronically and is designed to be used in a manner not 
limited to a fixed location, including— 
‘‘(A) processing devices such as laptop com-
puters, communication devices, and other hand- 
held computing devices; and 
‘‘(B) storage devices such as portable hard 
drives, CD–ROMs, DVDs, and other portable 
electronic media.’’. 
(b) CONFORMING AMENDMENTS.—Section 208 of the 
E-Government Act of 2002 (Public Law 107–347; 44 U.S.C. 
3501 note) is amended— 
(1) in subsection (b)(1)(A)— 
VerDate Aug 31 2005 
00:34 May 22, 2008
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
(A) in clause (i), by striking ‘‘information 
that is in an identifiable form’’ and inserting 
‘‘personally identifiable information’’; and 
(B) in clause (ii)(II), by striking ‘‘informa-
tion in an identifiable form permitting the phys-
ical or online contacting of a specific indi-
vidual’’ and inserting ‘‘personally identifiable 
information’’; 
(2) in subsection (b)(2)(B)(i), by striking ‘‘infor-
mation that is in an identifiable form’’ and inserting 
‘‘personally identifiable information’’; 
(3) in subsection (b)(3)(C), by striking ‘‘informa-
tion that is in an identifiable form’’ and inserting 
‘‘personally identifiable information’’; and 
(4) in subsection (d), by striking the text and in-
serting ‘‘In this section, the term ‘personally identifi-
able information’ has the meaning given that term in 
section 3542(b)(4) of title 44, United States Code.’’. 
SEC. 4. AUTHORITY OF DIRECTOR OF OFFICE OF MANAGE-
MENT AND BUDGET TO ESTABLISH INFORMA-
TION SECURITY POLICIES AND PROCEDURES. 
Section 3543(a) of title 44, United States Code, is 
amended— 
(1) by inserting before the semicolon at the end 
of paragraph (5) the following: ‘‘, including plans 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
and schedules, developed by the agency on the basis of 
priorities for addressing levels of identified risk, for 
conducting— 
‘‘(A) testing and evaluation, as required 
under section 3544(b)(5); and 
‘‘(B) remedial action, as required under sec-
tion 3544(b)(6), to address deficiencies identified 
by such testing and evaluation’’; and 
(2) by adding at the end the following: 
‘‘(9) establishing minimum requirements regard-
ing the protection of personally identifiable informa-
tion maintained in or transmitted by mobile digital 
devices, including requirements for the use of tech-
nologies that efficiently and effectively render infor-
mation unusable by unauthorized persons; 
‘‘(10) requiring agencies to comply with— 
‘‘(A) minimally acceptable system configu-
ration requirements consistent with best prac-
tices, including checklists developed under section 
8(c) of the Cyber Security Research and Develop-
ment Act (Public Law 107–305; 116 Stat. 2378) 
by the Director of the National Institute of 
Standards and Technology; and 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
‘‘(B) minimally acceptable requirements for 
periodic testing and evaluation of the implemen-
tation of such configuration requirements; 
‘‘(11) ensuring that agency contracts for (or in-
volving or including) the provision of information 
technology products or services include requirements 
for contractors to meet minimally acceptable configu-
ration requirements, as required under paragraph 
(10); 
‘‘(12) ensuring the establishment through regula-
tion and guidance of contract requirements to ensure 
compliance with this subchapter with regard to pro-
viding information security for information and in-
formation systems used or operated by a contractor of 
an agency or other organization on behalf of the agen-
cy; and’’. 
SEC. 5. RESPONSIBILITIES OF FEDERAL AGENCIES FOR IN-
FORMATION SECURITY. 
Section 3544(b) of title 44, United States Code, is 
amended— 
(1) in paragraph (2)(D)(iii), by striking ‘‘as de-
termined by the agency’’ and inserting ‘‘as required 
by the Director under section 3543(a)(10)’’; 
(2) in paragraph (5)— 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
(A) by inserting after ‘‘annually’’ the fol-
lowing: ‘‘and as approved by the Director’’; 
(B) by striking ‘‘and’’ at the end of sub-
paragraph (A); 
(C) by redesignating subparagraph (B) as 
subparagraph (D); and 
(D) by inserting after subparagraph (A) the 
following: 
‘‘(B) shall include testing and evaluation of 
system configuration requirements as required 
under section 3543(a)(10); 
‘‘(C) shall include testing of systems oper-
ated by a contractor of the agency or other orga-
nization on behalf of the agency, which testing 
requirement may be satisfied by independent 
testing, evaluation, or audit of such systems; 
and’’; 
(3) by striking ‘‘and’’ at the end of paragraph 
(7); 
(4) by striking the period at the end of para-
graph (8) and inserting a semicolon; and 
(5) by adding at the end the following: 
‘‘(9) plans and procedures for ensuring the ade-
quacy of information security protections for systems 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
maintaining or transmitting personally identifiable 
information, including requirements for— 
‘‘(A) maintaining a current inventory of 
systems maintaining or transmitting such infor-
mation; 
‘‘(B) implementing information security re-
quirements for mobile digital devices maintain-
ing or transmitting such information, as re-
quired by the Director (including the use of tech-
nologies rendering data unusable by unauthor-
ized persons); and 
‘‘(C) developing, implementing, and over-
seeing 
remediation 
plans 
to 
address 
vulnerabilities in information security protec-
tions for such information;’’. 
SEC. 6. FEDERAL AGENCY DATA BREACH NOTIFICATION RE-
QUIREMENTS. 
(a) AUTHORITY OF DIRECTOR OF OFFICE OF MANAGE-
MENT AND BUDGET TO ESTABLISH DATA BREACH POLI-
CIES.—Section 3543(a) of title 44, United States Code, as 
amended by section 4, is further amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) in paragraph (8)— 
VerDate Aug 31 2005 
00:34 May 22, 2008
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
(A) by striking ‘‘and’’ at the end of sub-
paragraph (D); 
(B) by striking the period and inserting ‘‘; 
and’’ at the end of subparagraph (E); and 
(C) by adding at the end the following new 
subparagraph: 
‘‘(F) a summary of the breaches of informa-
tion security reported by agencies to the Director 
and the Federal information security incident 
center pursuant to paragraph (13);’’; and 
(3) by adding at the end the following: 
‘‘(13) establishing policies, procedures, and 
standards for agencies to follow in the event of a 
breach of data security involving the disclosure of per-
sonally identifiable information, specifically includ-
ing— 
‘‘(A) a requirement for timely notice to be 
provided to those individuals whose personally 
identifiable information could be compromised as 
a result of such breach, except no notice shall be 
required if the breach does not create a reason-
able risk— 
‘‘(i) of identity theft, fraud, or other 
unlawful conduct regarding such indi-
vidual; or 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
‘‘(ii) of other harm to the individual; 
‘‘(B) guidance on determining how timely 
notice is to be provided; 
‘‘(C) guidance regarding whether additional 
special actions are necessary and appropriate, 
including data breach analysis, fraud resolution 
services, identify theft insurance, and credit pro-
tection or monitoring services; and 
‘‘(D) a requirement for timely reporting by 
the agencies of such breaches to the Director and 
Federal information security center.’’. 
(b) AUTHORITY OF CHIEF INFORMATION OFFICER TO 
DEVELOP
AND
MAINTAIN
INVENTORIES.—Section 
3544(a)(3) of title 44, United States Code, is amended— 
(1) by inserting after ‘‘authority to ensure com-
pliance with’’ the following: ‘‘and, to the extent deter-
mined necessary and explicitly authorized by the head 
of the agency, to enforce’’; 
(2) by striking ‘‘and’’ at the end of subpara-
graph (D); 
(3) by inserting ‘‘and’’ at the end of subpara-
graph (E); and 
(4) by adding at the end the following: 
‘‘(F) developing and maintaining an inven-
tory of all personal computers, laptops, or any 
VerDate Aug 31 2005 
00:34 May 22, 2008
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
other hardware containing personally identifi-
able information;’’. 
(c) INCLUSION OF DATA BREACH NOTIFICATION.— 
Section 3544(b) of title 44, United States Code, as amended 
by section 5, is further amended by adding at the end the 
following: 
‘‘(10) procedures for notifying individuals whose 
personally identifiable information may have been 
compromised or accessed following a breach of infor-
mation security; and 
‘‘(11) procedures for timely reporting of informa-
tion security breaches involving personally identifi-
able information to the Director and the Federal in-
formation security incident center.’’. 
(d) AUTHORITY OF AGENCY CHIEF HUMAN CAPITAL 
OFFICERS TO ASSESS FEDERAL PERSONAL PROPERTY.— 
Section 1402(a) of title 5, United States Code, is amend-
ed— 
(1) by striking ‘‘, and’’ at the end of paragraph 
(5) and inserting a semicolon; 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (6); and 
(3) by adding at the end the following: 
‘‘(7) prescribing policies and procedures for exit 
interviews of employees, including a full accounting 
VerDate Aug 31 2005 
00:34 May 22, 2008
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
of all Federal personal property that was assigned to 
the employee during the course of employment.’’. 
SEC. 7. PROTECTION OF GOVERNMENT COMPUTERS FROM 
RISKS OF PEER-TO-PEER FILE SHARING. 
(a) PLANS REQUIRED.—As part of the Federal agency 
responsibilities set forth in sections 3544 and 3545 of title 
44, United States Code, the head of each agency shall de-
velop and implement a plan to ensure the security and pri-
vacy of information collected or maintained by or on behalf 
of the agency from the risks posed by certain peer-to-peer 
file sharing programs. 
(b) CONTENTS OF PLANS.—Such plans shall set forth 
appropriate methods, including both technological (such as 
the use of software and hardware) and nontechnological 
methods (such as employee policies and user training), to 
achieve the goal of securing and protecting such information 
from the risks posed by peer-to-peer file sharing programs. 
(c) IMPLEMENTATION OF PLANS.—The head of each 
agency shall— 
(1) develop and implement the plan required 
under this section as expeditiously as possible, but in 
no event later than six months after the date of the 
enactment of this Act; and 
(2) review and revise the plan periodically as 
necessary. 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS