(6) Section 3543(a)(8)(A) of such title is 
amended by striking ‘‘evaluations’’ and inserting 
‘‘audits’’. 
(7) Section 3544(b)(5)(B) of such title is 
amended by striking ‘‘evaluation’’ and inserting 
‘‘audit’’. 
SEC. 8. PRIVACY IMPACT ASSESSMENT OF FEDERAL AGEN-
CY 
USE 
OF 
COMMERCIAL 
INFORMATION 
SERVICES CONTAINING PERSONAL INFORMA-
TION. 
(a) IN GENERAL.—Section 208(b)(1)(A) of the E- 
Government Act of 2002 (44 U.S.C. 3501 note) is amend-
ed— 
(1) by striking ‘‘or’’ at the end of clause (i); 
and 
(2) in clause (ii), by striking the period at the 
end of subclause (II) and inserting ‘‘; or’’; and 
(3) by inserting after clause (ii) the following: 
‘‘(iii) purchasing or subscribing for a 
fee to information in identifiable form from 
a data broker.’’. 
(b) DEFINITIONS.—Section 208(d) of such Act (44 
U.S.C. 3501 note) is amended to read as follows: 
‘‘(d) DEFINITIONS.—In this section: 
VerDate Aug 31 2005 
04:08 Dec 20, 2007
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.IH
H4791
bajohnson on PROD1PC69 with BILLS
‘‘(1) IDENTIFIABLE FORM.—The term ‘identifi-
able form’ means any representation of information 
that permits the identity of an individual to whom 
the information applies to be reasonably inferred by 
either direct or indirect means. 
‘‘(2) DATA BROKER.—The term ‘data broker’ 
means a business entity that, for monetary fees or 
dues, regularly engages in the practice of collecting, 
transmitting, or providing access to sensitive infor-
mation in identifiable form on more than 5,000 indi-
viduals who are not the customers or employees of 
that business entity or affiliate primarily for the 
purposes of providing such information to non-
affiliated third parties on an interstate basis.’’. 
(c) STUDY.—Not later than 2 years after the date 
of the enactment of this Act, the Comptroller General of 
the United States shall submit a report to the Congress 
regarding Federal agency compliance with the require-
ments established by the amendments made by this sec-
tion. 
SEC. 9. PROHIBITION ON CERTAIN CONTRACTS WITH DATA 
BROKERS. 
Section 208 of the E-Government Act of 2002 (44 
U.S.C. 3501 note) is amended— 
VerDate Aug 31 2005 
04:08 Dec 20, 2007
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.IH
H4791
bajohnson on PROD1PC69 with BILLS
(1) by redesignating subsection (d) as sub-
section (e); and 
(2) by inserting after subsection (c) the fol-
lowing: 
‘‘(d) PROHIBITION ON CERTAIN CONTRACTS WITH 
DATA BROKERS.— 
‘‘(1) PROHIBITION.—Notwithstanding any other 
provision of law, beginning 1 year after the date of 
the enactment of this subsection, no Federal agency 
may enter into a contract with a data broker, or 
issue a task or delivery order under a contract with 
a data broker, to access for a fee any database con-
sisting primarily of information in identifiable form 
concerning United States persons (other than a 
database consisting of news reporting or telephone 
directories) unless the head of such agency imple-
ments the requirements specified in paragraph (2). 
‘‘(2) REQUIREMENTS.—For purposes of para-
graph (1), the requirements specified in this para-
graph are the following: 
‘‘(A) COMPLETION OF PRIVACY IMPACT AS-
SESSMENT.—With respect to any database pro-
posed to be accessed, the head of the agency 
shall complete a privacy impact assessment 
under this section. The assessment shall, sub-
VerDate Aug 31 2005 
04:08 Dec 20, 2007
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.IH
H4791
bajohnson on PROD1PC69 with BILLS
ject to the provisions in this section pertaining 
to sensitive information, include a description 
of— 
‘‘(i) such database; 
‘‘(ii) the name of the data broker 
from which it is proposed to be obtained; 
and 
‘‘(iii) the amount of the contract or 
task or delivery order proposed to be en-
tered into or issued. 
‘‘(B) PROMULGATION OF REGULATIONS.— 
The head of the agency shall promulgate regu-
lations that specify— 
‘‘(i) the personnel permitted to access, 
analyze, or otherwise use databases of the 
type described in paragraph (1); 
‘‘(ii) standards governing the access, 
analysis, or use of such databases; 
‘‘(iii) any standards used to ensure 
that the information in identifiable form 
accessed, analyzed, or used is the minimum 
necessary to accomplish the intended legiti-
mate purpose of the Federal agency; 
VerDate Aug 31 2005 
04:08 Dec 20, 2007
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.IH
H4791
bajohnson on PROD1PC69 with BILLS
‘‘(iv) standards limiting the retention 
and redisclosure of information in identifi-
able form obtained from such databases; 
‘‘(v) procedures ensuring that such 
data meet standards of accuracy, rel-
evance, completeness, and timeliness; 
‘‘(vi) the auditing and security meas-
ures to protect against unauthorized ac-
cess, analysis, use, or modification of data 
in such databases; 
‘‘(vii) applicable mechanisms by which 
individuals may secure timely redress for 
any adverse consequences wrongly incurred 
due to the access, analysis, or use of such 
databases; 
‘‘(viii) mechanisms, if any, for the en-
forcement and independent oversight of ex-
isting or planned procedures, policies, or 
guidelines; and 
‘‘(ix) an outline of enforcement mech-
anisms for accountability to protect indi-
viduals and the public against unlawful or 
illegitimate access or use of databases. 
‘‘(C) INCLUSION
OF
PENALTIES
AND 
OTHER
REQUIREMENTS
IN
LARGER
CON-
VerDate Aug 31 2005 
04:08 Dec 20, 2007
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.IH
H4791
bajohnson on PROD1PC69 with BILLS
TRACTS.—With respect to any contract or task 
or delivery order proposed to be entered into or 
issued in an amount greater than $500,000, the 
head of the agency shall include in the contract 
or order the following provisions: 
‘‘(i) Provisions providing for pen-
alties— 
‘‘(I) for failure to implement a 
comprehensive personal data privacy 
and security program that includes 
administrative, technical, and physical 
safeguards appropriate to the size and 
complexity of the business entity and 
the nature and scope of its activities; 
or 
‘‘(II) for the provision to the 
Federal agency of inaccurate informa-
tion in identifiable form, if the entity 
knows or has reason to know that the 
information being provided is inac-
curate. 
‘‘(ii) Provisions requiring a data 
broker that retains service providers for re-
sponsibilities related to information in 
identifiable form to— 
VerDate Aug 31 2005 
04:08 Dec 20, 2007
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.IH
H4791
bajohnson on PROD1PC69 with BILLS
‘‘(I) exercise appropriate due dili-
gence in selecting those service pro-
viders for responsibilities related to 
such information; 
‘‘(II) take reasonable steps to se-
lect and retain service providers that 
are capable of maintaining appro-
priate safeguards for the security, pri-
vacy, and integrity of such informa-
tion; and 
‘‘(III) require such service pro-
viders, by contract, to implement a 
comprehensive personal data privacy 
and security program that includes 
administrative, technical, and physical 
safeguards appropriate to the size and 
complexity of the business entity and 
the nature and scope of its activities. 
‘‘(3) LIMITATION
ON
PENALTIES.—The pen-
alties under paragraph (2)(C)(i) shall not apply to 
a data broker providing information in identifiable 
form that is accurately and completely recorded 
from a public record source.’’. 
VerDate Aug 31 2005 
04:08 Dec 20, 2007
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.IH
H4791
bajohnson on PROD1PC69 with BILLS
SEC. 10. AUTHORIZATION OF APPROPRIATIONS. 
Section 3548 of title 44, United States Code, is 
amended by striking ‘‘2007’’ and inserting ‘‘2012’’. 
SEC. 11. IMPLEMENTATION. 
Except as otherwise specifically provided in this Act, 
implementation of this Act and the amendments made by 
this Act shall begin not later than 90 days after the date 
of the enactment of this Act. 
Æ 
VerDate Aug 31 2005 
04:08 Dec 20, 2007
Jkt 069200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6301
E:\BILLS\H4791.IH
H4791
bajohnson on PROD1PC69 with BILLS