I 
109TH CONGRESS 
2D SESSION 
H. R. 5820 
To increase the security of sensitive data maintained by the Federal 
Government. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 17, 2006 
Mr. SWEENEY introduced the following bill; which was referred to the 
Committee on Government Reform 
A BILL 
To increase the security of sensitive data maintained by 
the Federal Government. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Agency Data 
Privacy Protection Act’’. 
SEC. 2. DEFINITION OF SENSITIVE DATA. 
In this Act— 
(1) SENSITIVE
DATA.—The term ‘‘sensitive 
data’’ includes the following: 
(A) Social security numbers. 
VerDate Aug 31 2005 
00:32 Jul 19, 2006
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5820.IH
H5820
ccoleman on PROD1PC71 with BILLS
(B) Financial records. 
(C) Previous or current health records, in-
cluding hospital or treatment records of any 
kind, including drug and alcohol rehabilitation 
records. 
(D) Criminal records. 
(E) Licenses. 
(F) License denials, suspensions, or rev-
ocations. 
(G) Tax returns. 
(H) Information that has been specifically 
authorized under criteria established by an Ex-
ecutive order or an Act of Congress to be kept 
classified in the interest of national defense or 
foreign policy. 
(I) Personally identifiable information. 
(2) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—The term ‘‘personally identifiable informa-
tion’’ means any information, in any form or me-
dium, that relates to the past, present, or future 
physical or mental health, predisposition, or condi-
tion of an individual or the provision of health care 
to an individual. 
(3) FEDERAL COMPUTER SYSTEM.—The term 
‘‘Federal computer system’’ has the meaning given 
VerDate Aug 31 2005 
00:32 Jul 19, 2006
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5820.IH
H5820
ccoleman on PROD1PC71 with BILLS
such term in section 20(d) of the National Institute 
of Standards and Technology Act (15 U.S.C. 278g– 
3(d)). 
(4) AGENCY.—The term ‘‘agency’’ has the 
meaning provided in section 3502(1) of title 44, 
United States Code. 
(5) RECORD.—The term ‘‘record’’ has the 
meaning provided in section 552a(a) of title 5, 
United States Code. 
SEC. 3. REQUIREMENT FOR USE OF ENCRYPTION FOR SEN-
SITIVE DATA. 
(a) REQUIREMENT FOR ENCRYPTION.— 
(1) IN
GENERAL.—All sensitive data main-
tained by the Federal Government, including such 
data maintained in Federal computer systems, shall 
be secured by the use of the most secure encryption 
standard recognized by the National Institute of 
Standards and Technology. 
(2) UPDATING REQUIRED EVERY 6 MONTHS.— 
Any sequence of characters (known as an encryption 
key) used to secure an encryption standard used on 
Federal computer systems shall be changed every 6 
months, at a minimum, to provide additional secu-
rity. 
VerDate Aug 31 2005 
00:32 Jul 19, 2006
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5820.IH
H5820
ccoleman on PROD1PC71 with BILLS
(3) IMPLEMENTATION.—The requirements of 
this subsection shall be implemented not later than 
6 months after the date of the enactment of this 
Act. 
(b) FEDERAL
AGENCY
RESPONSIBILITIES.—The 
head of each agency shall be responsible for complying 
with the requirements of subsection (a) within the agency. 
Such requirement shall be considered to be a requirement 
of subchapter III of chapter 35 of title 44, United States 
Code, for purposes of section 3544(a)(1)(B) of such title. 
SEC. 4. REQUIREMENTS RELATING TO ACCESS BY AGENCY 
PERSONNEL TO SENSITIVE DATA. 
(a) ON-SITE ACCESS.—No employee of the Federal 
government may have access to sensitive data on Govern-
ment property unless the employee has received a security 
clearance at the ‘‘secret’’ level or higher and has completed 
a financial disclosure form, in accordance with applicable 
provisions of law and regulation. 
(b) OFF-SITE ACCESS.— 
(1) PROHIBITION.—Sensitive data maintained 
by an agency may not be transported or accessed 
from a location off Government property unless a re-
quest for such transportation or access is submitted 
and approved by the Inspector General of the agency 
in accordance with paragraph (2). 
VerDate Aug 31 2005 
00:32 Jul 19, 2006
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5820.IH
H5820
ccoleman on PROD1PC71 with BILLS
(2) PROCEDURES.— 
(A) DEADLINE
FOR
APPROVAL
OR
DIS-
APPROVAL.—In the case of any request sub-
mitted under paragraph (1) to an Inspector 
General of an agency, the Inspector General 
shall approve or disapprove the request within 
2 business days after the date of submission of 
the request. 
(B) LIMITATION TO 10,000 RECORDS.—If a 
request is approved, the Inspector General shall 
limit the access to not more than 10,000 
records at a time. 
(3) ENCRYPTION.—Any technology used to 
store, transport, or access sensitive data during for 
purposes of off-site access approved under this sub-
section shall be secured by the use of the most se-
cure encryption standard recognized by the National 
Institute of Standards and Technology. 
(c) IMPLEMENTATION.—The requirements of this 
subsection shall be implemented not later than 6 months 
after the date of the enactment of this Act. 
SEC. 5. REQUIREMENTS RELATING TO GOVERNMENT CON-
TRACTORS INVOLVING SENSITIVE DATA. 
(a) APPLICABILITY
TO
GOVERNMENT
CONTRAC-
TORS.—In entering into any contract that may involve 
VerDate Aug 31 2005 
00:32 Jul 19, 2006
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5820.IH
H5820
ccoleman on PROD1PC71 with BILLS