has resulted in improper access to sensitive person-
ally identifiable information; and 
‘‘(4) the term ‘improper access’ means access 
without authorization or in excess of authorization.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of chapter 47 of title 18, United States 
Code, is amended by adding at the end the following: 
‘‘1040. Concealment of security breaches involving personally identifiable infor-
mation.’’. 
(c) OBLIGATION TO REPORT.— 
(1) IN GENERAL.—A person who owns or pos-
sesses data in electronic form containing a means of 
identification and has knowledge of a major security 
breach of the system containing such data main-
tained by such person, must provide prompt notice 
of such breach to the United States Secret Service 
or Federal Bureau of Investigation. 
(2) PUBLICATION
OF
LIST
OF
NOTIFICA-
TIONS.—The Secret Service and the Federal Bureau 
of Investigation shall annually publish in the Federal 
Register a list of all notifications submitted the pre-
vious calendar year and the identity of each entity 
with respect to which the major security breach oc-
curred. 
(3) DEFINITION.—In this subsection— 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
(A) the term ‘‘major security breach’’ 
means any security breach involving— 
(i) means of identification pertaining 
to 10,000 or more individuals is, or is rea-
sonably believed to have been acquired; 
(ii) databases owned by the Federal 
Government; or 
(iii) means of identification of Federal 
Government employees or contractors in-
volved in national security matters or law 
enforcement; and 
(B) the term ‘‘means of identification’’ has 
the meaning given that term in section 1028 of 
title 18, United States Code. 
SEC. 103. USE OF FULL INTERSTATE AND FOREIGN COM-
MERCE POWER FOR CRIMINAL PENALTIES. 
(a) BROADENING OF SCOPE.—Section 1030(e)(2)(B) 
of title 18, United States Code, is amended by inserting 
‘‘or affecting’’ after ‘‘which is used in’’. 
(b) ELIMINATION OF REQUIREMENT OF AN INTER-
STATE OR FOREIGN COMMUNICATION FOR CERTAIN OF-
FENSES INVOLVING PROTECTED COMPUTERS.—Section 
1030(a)(2)(C) of title 18, United States Code, is amended 
by striking ‘‘if the conduct involved an interstate or for-
eign communication’’. 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
SEC. 104. CYBER-EXTORTION. 
Section 1030(a)(7) of title 18, United States Code, 
is amended by inserting ‘‘, or to access without authoriza-
tion or exceed authorized access to a protected computer’’ 
after ‘‘cause damage to a protected computer’’. 
SEC. 105. CONSPIRACY TO COMMIT CYBER-CRIMES. 
Section 1030(b) of title 18, United States Code, is 
amended by inserting ‘‘or conspires’’ after ‘‘attempts’’. 
SEC. 106. PENALTIES FOR SECTION 1030 VIOLATIONS. 
Subsection (c) of section 1030 of title 18, United 
States Code, is amended to read as follows: 
‘‘(c)(1) The punishment for an offense under sub-
section (a) or (b) is a fine under this title or imprisonment 
for not more than 20 years, or both, but if the offender 
in the course of a violation of subsection (a)(5)(A)(i) 
knowingly or recklessly causes or attempts to cause death, 
such offender shall be fined under this title or imprisoned 
for any term of years or for life, or both. 
‘‘(2) The court, in imposing sentence for an offense 
under subsection (a) or (b), may, in addition to any other 
sentence imposed and irrespective of any provision of 
State law, order that the person forfeit to the United 
States— 
‘‘(A) the person’s interest in any personal prop-
erty that was used or intended to be used to commit 
or to facilitate the commission of the offense; and 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
‘‘(B) any property, real or personal, consti-
tuting or derived from, any proceeds the person ob-
tained, directly or indirectly, as a result of the of-
fense.’’. 
SEC. 107. ADDITIONAL FUNDING FOR RESOURCES TO IN-
VESTIGATE AND PROSECUTE CRIMINAL AC-
TIVITY INVOLVING COMPUTERS. 
(a) ADDITIONAL FUNDING FOR RESOURCES.— 
(1) AUTHORIZATION.—In addition to amounts 
otherwise authorized for resources to investigate and 
prosecute criminal activity involving computers, 
there are authorized to be appropriated for each of 
the fiscal years 2008 through 2012— 
(A) $10,000,000 to the Director of the 
United States Secret Service; 
(B) $10,000,000 to the Attorney General 
for the Criminal Division of the Department of 
Justice; and 
(C) $10,000,000 to the Director of the 
Federal Bureau of Investigation. 
(2) AVAILABILITY.—Any amounts appropriated 
under paragraph (1) shall remain available until ex-
pended. 
(b) USE OF ADDITIONAL FUNDING.—Funds made 
available under subsection (a) shall be used by the Direc-
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
tor of the United States Secret Service, the Director of 
the Federal Bureau of Investigation, and the Attorney 
General, for the United States Secret Service, the Federal 
Bureau of Investigation, and the criminal division of the 
Department of Justice, respectively, to— 
(1) hire and train law enforcement officers to— 
(A) investigate crimes committed through 
the use of computers and other information 
technology, including through the use of the 
Internet; and 
(B) assist in the prosecution of such 
crimes; and 
(2) procure advanced tools of forensic science to 
investigate, prosecute, and study such crimes. 
SEC. 108. CRIMINAL RESTITUTION. 
Section 3663(b) of title 18, United States Code, is 
amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(4); 
(2) by striking the period at the end of para-
graph (5) and inserting ‘‘; and’’ and 
(3) by adding at the end the following: 
‘‘(6) in the case of an offense under section 
1028(a)(7), 1028A(a), or 1030(a)(2), pay an 
amount equal to the value of the victim’s time rea-
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
sonably spent to remediate actual harm resulting 
from the offense.’’. 
SEC. 109. REVIEW AND AMENDMENT OF FEDERAL SEN-
TENCING GUIDELINES RELATED TO FRAUDU-
LENT ACCESS TO OR MISUSE OF DIGITIZED 
OR ELECTRONIC PERSONALLY IDENTIFIABLE 
INFORMATION. 
The United States Sentencing Commission, pursuant 
to its authority under section 994 of title 28, United 
States Code, and in accordance with this section, shall re-
view and, if appropriate, amend the Federal sentencing 
guidelines (including its policy statements) applicable to 
persons convicted of using fraud to access, or misuse of, 
digitized or electronic personally identifiable information, 
including identity theft or any offense under— 
(1) sections 1028, 1028A, 1030, 1030A, 2511, 
and 2701 of title 18, United States Code; and 
(2) any other relevant provision. 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
TITLE 
II—NON-CRIMINAL 
PRI-
VACY 
ENFORCEMENT 
AND 
PRIVACY 
IMPACT 
STATE-
MENTS 
SEC. 201. ENFORCEMENT BY ATTORNEY GENERAL AND 
STATE AUTHORITIES. 
(a) DEFINITION
OF ‘‘AUTHORIZED ENTITY’’.—As 
used in this section, the term ‘‘authorized entity’’ means 
the Attorney General, with respect to any conduct consti-
tuting a violation of a Federal law enacted after the date 
of the enactment of this Act relating to data security and 
engaged in by a business entity, and a State Attorney 
General with respect to that conduct to the extent the con-
duct adversely affects an interest of the residents of a 
State. 
(b) CIVIL PENALTY.— 
(1) GENERALLY.—An authorized entity may in 
a civil action obtain a civil penalty of not more than 
$500,000 from any business entity that engages in 
conduct constituting a violation of a Federal law en-
acted after the date of the enactment of this Act re-
lating to data security. 
(2) SPECIAL RULE FOR INTENTIONAL VIOLA-
TION.—If the violation described in subsection (a) is 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
intentional, 
the 
maximum 
civil 
penalty 
is 
$1,000,000. 
(c) INJUNCTIVE RELIEF.—An authorized entity may, 
in a civil action against a business entity that has engaged, 
or is engaged, in any conduct constituting a violation of 
a Federal law enacted after the date of the enactment of 
this Act relating data security, obtain an order— 
(1) enjoining such act or practice; or 
(2) enforcing compliance with that law. 
(d) OTHER RIGHTS AND REMEDIES.—The rights and 
remedies available under this section do not affect any 
other rights and remedies available under Federal or State 
law. 
SEC. 202. COORDINATION OF STATE AND FEDERAL EF-
FORTS. 
(a) NOTICE.— 
(1) IN GENERAL.—A State consumer protection 
attorney may not bring an action under section 201, 
until the attorney general of the State involved pro-
vides to the Attorney General of the United States— 
(A) written notice of the action; and 
(B) a copy of the complaint for the action. 
(2) EXCEPTION.—Paragraph (1) does not apply 
with respect to the filing of an action by an attorney 
general of a State under this section if the State at-
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
torney general determines that it is not feasible to 
provide the notice described in such subparagraph 
before the filing of the action, in such a case the 
State attorney general shall provide notice and a 
copy of the complaint to the Attorney General at the 
time the State attorney general files the action. 
(b) FEDERAL PROCEEDINGS.—The Attorney General 
may— 
(1) move to stay any non Federal action under 
section 201, pending the final disposition of a pend-
ing Federal action under that section; 
(2) initiate an action in an appropriate United 
States district court and move to consolidate all 
pending actions under section 201, including State 
actions, in that court; and 
(3) intervene in a State action under section 
201. 
(c) PENDING PROCEEDINGS.—If the Attorney Gen-
eral institutes a proceeding or action for a violation of a 
Federal law enacted after the date of the enactment of 
this Act relating data security, no authority of a State 
may, during the pendency of such proceeding or action, 
bring an action under this section against any defendant 
named in such criminal proceeding or a civil action against 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
any defendant for any violation that is alleged in that pro-
ceeding or action. 
(d) DEFINITION.—As used in this section, the term 
‘‘State consumer protection attorney’’ means the attorney 
general of a State or any State or local law enforcement 
agency authorized by the State attorney general or by 
State statute to prosecute violations of consumer protec-
tion law. 
SEC. 203. REQUIREMENT THAT AGENCY RULEMAKING 
TAKE INTO CONSIDERATION IMPACTS ON IN-
DIVIDUAL PRIVACY. 
(a) IN GENERAL.—Title 5, United States Code, is 
amended by adding after section 553 the following new 
section: 
‘‘§ 553a. Privacy impact assessment in rulemaking 
‘‘(a) INITIAL PRIVACY IMPACT ASSESSMENT.— 
‘‘(1) IN GENERAL.—Whenever an agency is re-
quired by section 553 of this title, or any other law, 
to publish a general notice of proposed rulemaking 
for a proposed rule, or publishes a notice of pro-
posed rulemaking for an interpretative rule involving 
the internal revenue laws of the United States, and 
such rule or proposed rulemaking pertains to the 
collection, maintenance, use, or disclosure of person-
ally identifiable information from 10 or more indi-
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
viduals, other than agencies, instrumentalities, or 
employees of the Federal government, the agency 
shall prepare and make available for public comment 
an initial privacy impact assessment that describes 
the impact of the proposed rule on the privacy of in-
dividuals. Such assessment or a summary thereof 
shall be signed by the senior agency official with pri-
mary responsibility for privacy policy and be pub-
lished in the Federal Register at the time of the 
publication of a general notice of proposed rule-
making for the rule. 
‘‘(2) CONTENTS.—Each initial privacy impact 
assessment required under this subsection shall con-
tain the following: 
‘‘(A) A description and analysis of the ex-
tent to which the proposed rule will impact the 
privacy interests of individuals, including the 
extent to which the proposed rule— 
‘‘(i) provides notice of the collection of 
personally identifiable information, and 
specifies what personally identifiable infor-
mation is to be collected and how it is to 
be collected, maintained, used, and dis-
closed; 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
‘‘(ii) allows access to such information 
by the person to whom the personally iden-
tifiable information pertains and provides 
an opportunity to correct inaccuracies; 
‘‘(iii) 
prevents 
such 
information, 
which is collected for one purpose, from 
being used for another purpose; and 
‘‘(iv) provides security for such infor-
mation, including the provision of written 
notice to any individual, within 14 days of 
the date of compromise, whose privacy in-
terests are compromised by the unauthor-
ized release of personally identifiable infor-
mation as a result of a breach of security 
at or by the agency. 
‘‘(B) A description of any significant alter-
natives to the proposed rule which accomplish 
the stated objectives of applicable statutes and 
which minimize any significant privacy impact 
of the proposed rule on individuals. 
‘‘(b) FINAL PRIVACY IMPACT ASSESSMENT.— 
‘‘(1) IN GENERAL.—Whenever an agency pro-
mulgates a final rule under section 553 of this title, 
after being required by that section or any other law 
to publish a general notice of proposed rulemaking, 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
or promulgates a final interpretative rule involving 
the internal revenue laws of the United States, and 
such rule or proposed rulemaking pertains to the 
collection, maintenance, use, or disclosure of person-
ally identifiable information from 10 or more indi-
viduals, other than agencies, instrumentalities, or 
employees of the Federal government, the agency 
shall prepare a final privacy impact assessment, 
signed by the senior agency official with primary re-
sponsibility for privacy policy. 
‘‘(2) CONTENTS.—Each final privacy impact as-
sessment required under this subsection shall con-
tain the following: 
‘‘(A) A description and analysis of the ex-
tent to which the final rule will impact the pri-
vacy interests of individuals, including the ex-
tent to which such rule— 
‘‘(i) provides notice of the collection of 
personally identifiable information, and 
specifies what personally identifiable infor-
mation is to be collected and how it is to 
be collected, maintained, used, and dis-
closed; 
‘‘(ii) allows access to such information 
by the person to whom the personally iden-
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
tifiable information pertains and provides 
an opportunity to correct inaccuracies; 
‘‘(iii) 
prevents 
such 
information, 
which is collected for one purpose, from 
being used for another purpose; and 
‘‘(iv) provides security for such infor-
mation, including the provision of written 
notice to any individual, within 14 days of 
the date of compromise, whose privacy in-
terests are compromised by the unauthor-
ized release of personally identifiable infor-
mation as a result of a breach of security 
at or by the agency. 
‘‘(B) A summary of any significant issues 
raised by the public comments in response to 
the initial privacy impact assessment, a sum-
mary of the analysis of the agency of such 
issues, and a statement of any changes made in 
such rule as a result of such issues. 
‘‘(C) A description of the steps the agency 
has taken to minimize the significant privacy 
impact on individuals consistent with the stated 
objectives of applicable statutes, including a 
statement of the factual, policy, and legal rea-
sons for selecting the alternative adopted in the 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
final rule and why each one of the other signifi-
cant alternatives to the rule considered by the 
agency which affect the privacy interests of in-
dividuals was rejected. 
‘‘(3) AVAILABILITY
TO
PUBLIC.—The agency 
shall make copies of the final privacy impact assess-
ment available to members of the public and shall 
publish in the Federal Register such assessment or 
a summary thereof. 
‘‘(c) WAIVERS.— 
‘‘(1) EMERGENCIES.—An agency head may 
waive or delay the completion of some or all of the 
requirements of subsections (a) and (b) to the same 
extent as the agency head may, under section 608, 
waive or delay the completion of some or all of the 
requirements of sections 603 and 604, respectively. 
‘‘(2) NATIONAL
SECURITY.—An agency head 
may, for national security reasons, or to protect 
from disclosure classified information, confidential 
commercial information, or information the disclo-
sure of which may adversely affect a law enforce-
ment effort, waive or delay the completion of some 
or all of the following requirements: 
‘‘(A) The requirement of subsection (a)(1) 
to make an assessment available for public com-
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
ment, provided that such assessment is made 
available, in classified form, to the Committees 
on the Judiciary of the House of Representa-
tives and the Senate, in lieu of making such as-
sessment available to the public. 
‘‘(B) The requirement of subsection (a)(1) 
to have an assessment or summary thereof pub-
lished in the Federal Register, provided that 
such assessment or summary is made available, 
in classified form, to the Committees on the Ju-
diciary of the House of Representatives and the 
Senate, in lieu of publishing such assessment or 
summary in the Federal Register. 
‘‘(C) The requirements of subsection 
(b)(3), provided that the final privacy impact 
assessment is made available, in classified form, 
to the Committees on the Judiciary of the 
House of Representatives and the Senate, in 
lieu of making such assessment available to the 
public and publishing such assessment in the 
Federal Register. 
‘‘(d) PROCEDURES FOR GATHERING COMMENTS.— 
When any rule is promulgated which may have a signifi-
cant privacy impact on individuals, or a privacy impact 
on a substantial number of individuals, the head of the 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
agency promulgating the rule or the official of the agency 
with statutory responsibility for the promulgation of the 
rule shall assure that individuals have been given an op-
portunity to participate in the rulemaking for the rule 
through techniques such as— 
‘‘(1) the inclusion in an advance notice of pro-
posed rulemaking, if issued, of a statement that the 
proposed rule may have a significant privacy impact 
on individuals, or a privacy impact on a substantial 
number of individuals; 
‘‘(2) the publication of a general notice of pro-
posed rulemaking in publications of national circula-
tion likely to be obtained by individuals; 
‘‘(3) the direct notification of interested individ-
uals; 
‘‘(4) the conduct of open conferences or public 
hearings concerning the rule for individuals, includ-
ing soliciting and receiving comments over computer 
networks; and 
‘‘(5) the adoption or modification of agency 
procedural rules to reduce the cost or complexity of 
participation in the rulemaking by individuals. 
‘‘(e) PERIODIC REVIEW OF RULES.— 
‘‘(1) IN
GENERAL.—Each agency shall carry 
out a periodic review of the rules promulgated by the 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
agency that have a significant privacy impact on in-
dividuals, or a privacy impact on a substantial num-
ber of individuals. Under such periodic review, the 
agency shall determine, for each such rule, whether 
the rule can be amended or rescinded in a manner 
that minimizes any such impact while remaining in 
accordance with applicable statutes. For each such 
determination, the agency shall consider the fol-
lowing factors: 
‘‘(A) The continued need for the rule. 
‘‘(B) The nature of complaints or com-
ments received from the public concerning the 
rule. 
‘‘(C) The complexity of the rule. 
‘‘(D) The extent to which the rule over-
laps, duplicates, or conflicts with other Federal 
rules, and, to the extent feasible, with State and 
local governmental rules. 
‘‘(E) The length of time since the rule was 
last reviewed under this subsection. 
‘‘(F) The degree to which technology, eco-
nomic conditions, or other factors have changed 
in the area affected by the rule since the rule 
was last reviewed under this subsection. 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
other relief in addition to the requirements of this 
subsection. 
‘‘(6) RECORD OF AGENCY ACTION.—In an ac-
tion for the judicial review of a rule, the privacy im-
pact assessment for such rule, including an assess-
ment prepared or corrected pursuant to paragraph 
(4), shall constitute part of the entire record of 
agency action in connection with such review. 
‘‘(7) EXCLUSIVITY.—Compliance or noncompli-
ance by an agency with the provisions of this section 
shall be subject to judicial review only in accordance 
with this subsection. 
‘‘(8) SAVINGS CLAUSE.—Nothing in this sub-
section bars judicial review of any other impact 
statement or similar assessment required by any 
other law if judicial review of such statement or as-
sessment is otherwise permitted by law. 
‘‘(g) DEFINITION.—For purposes of this section, the 
term ‘personally identifiable information’ means informa-
tion that can be used to identify an individual, including 
such individual’s name, address, telephone number, photo-
graph, social security number or other identifying infor-
mation. It includes information about such individual’s 
medical or financial condition.’’. 
(b) PERIODIC REVIEW TRANSITION PROVISIONS.— 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
(1) INITIAL PLAN.—For each agency, the plan 
required by subsection (e) of section 553a of title 5, 
United States Code (as added by subsection (a)), 
shall be published not later than 180 days after the 
date of the enactment of this Act. 
(2) REVIEW PERIOD.—In the case of a rule pro-
mulgated by an agency before the date of the enact-
ment of this Act, such plan shall provide for the 
periodic review of such rule before the expiration of 
the 10-year period beginning on the date of the en-
actment of this Act. For any such rule, the head of 
the agency may provide for a 1-year extension of 
such period if the head of the agency, before the ex-
piration of the period, certifies in a statement pub-
lished in the Federal Register that reviewing such 
rule before the expiration of the period is not fea-
sible. The head of the agency may provide for addi-
tional 1-year extensions of the period pursuant to 
the preceding sentence, but in no event may the pe-
riod exceed 15 years. 
(c) CONGRESSIONAL REVIEW.—Section 801(a)(1)(B) 
of title 5, United States Code, is amended— 
(1) by redesignating clauses (iii) and (iv) as 
clauses (iv) and (v), respectively; and 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
(2) by inserting after clause (ii) the following 
new clause: 
‘‘(iii) the agency’s actions relevant to section 
553a;’’. 
(d) CLERICAL AMENDMENT.—The table of sections 
at the beginning of chapter 5 of title 5, United States 
Code, is amended by adding after the item relating to sec-
tion 553 the following new item: 
‘‘553a. Privacy impact assessment in rulemaking.’’. 
TITLE 
III—ASSISTANCE 
FOR 
STATE AND LOCAL LAW EN-
FORCEMENT 
TO 
COMBAT 
FRAUDULENT, 
UNAUTHOR-
IZED, OR OTHER CRIMINAL 
USE OF PERSONALLY IDENTI-
FIABLE INFORMATION 
SEC. 301. GRANTS FOR STATE AND LOCAL LAW ENFORCE-
MENT. 
(a) IN GENERAL.—Subject to the availability of 
amounts provided in advance in appropriations Acts, the 
Assistant Attorney General for the Office of Justice Pro-
grams of the Department of Justice may award grants 
to States to establish and develop programs to increase 
and enhance enforcement against crimes related to fraud-
ulent, unauthorized, or other criminal use of personally 
identifiable information. 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
(b) APPLICATION.—To be eligible for a grant under 
subsection (a), a State shall submit an application to the 
Assistant Attorney General for the Office of Justice Pro-
grams of the Department of Justice at such time, in such 
manner, and containing such information, including as de-
scribed in subsection (d), as the Assistant Attorney Gen-
eral may require. 
(c) USE OF GRANT AMOUNTS.—A grant awarded to 
a State under subsection (a) shall be used by a State, in 
conjunction with units of local government within that 
State, State and local courts, other States, or combina-
tions thereof, to establish and develop programs to— 
(1) assist State and local law enforcement agen-
cies in enforcing State and local criminal laws relat-
ing to crimes involving the fraudulent, unauthorized, 
or other criminal use of personally identifiable infor-
mation; 
(2) assist State and local law enforcement agen-
cies in educating the public to prevent and identify 
crimes involving the fraudulent, unauthorized, or 
other criminal use of personally identifiable informa-
tion; 
(3) educate and train State and local law en-
forcement officers and prosecutors to conduct inves-
tigations and forensic analyses of evidence and pros-
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
ecutions of crimes involving the fraudulent, unau-
thorized, or other criminal use of personally identifi-
able information; 
(4) assist State and local law enforcement offi-
cers and prosecutors in acquiring computer and 
other equipment to conduct investigations and foren-
sic analysis of evidence of crimes involving the 
fraudulent, unauthorized, or other criminal use of 
personally identifiable information; and 
(5) facilitate and promote the sharing of Fed-
eral law enforcement expertise and information 
about the investigation, analysis, and prosecution of 
crimes involving the fraudulent, unauthorized, or 
other criminal use of personally identifiable informa-
tion with State and local law enforcement officers 
and prosecutors, including the use of multi-jurisdic-
tional task forces. 
(d) ASSURANCES AND ELIGIBILITY.—To be eligible 
to receive a grant under subsection (a), a State shall pro-
vide assurances to the Attorney General that the State— 
(1) has in effect laws that penalize crimes in-
volving the fraudulent, unauthorized, or other crimi-
nal use of personally identifiable information, such 
as penal laws prohibiting— 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
(A) fraudulent schemes executed to obtain 
personally identifiable information; 
(B) schemes executed to sell or use fraudu-
lently obtained personally identifiable informa-
tion; and 
(C) online sales of personally identifiable 
information obtained fraudulently or by other 
illegal means; 
(2) will provide an assessment of the resource 
needs of the State and units of local government 
within that State, including criminal justice re-
sources being devoted to the investigation and en-
forcement of laws related to crimes involving the 
fraudulent, unauthorized, or other criminal use of 
personally identifiable information; 
(3) will develop a plan for coordinating the pro-
grams funded under this section with other federally 
funded technical assistant and training programs, 
including directly funded local programs such as the 
Local Law Enforcement Block Grant program (de-
scribed under the heading ‘‘Violent Crime Reduction 
Programs, State and Local Law Enforcement As-
sistance’’ of the Departments of Commerce, Justice, 
and State, the Judiciary, and Related Agencies Ap-
propriations Act, 1998 (Public Law 105–119)); and 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
(4) will submit to the Assistant Attorney Gen-
eral for the Office of Justice Programs of the De-
partment of Justice applicable reports in accordance 
with subsection (f). 
(e) MATCHING FUNDS.—The Federal share of a 
grant received under this section may not exceed 90 per-
cent of the total cost of a program or proposal funded 
under this section unless the Attorney General waives, 
wholly or in part, the requirements of this subsection. 
(f) REPORTS.—For each year that a State receives 
a grant under subsection (a) for a program, the State shall 
submit to the Assistant Attorney General for the Office 
of Justice Programs of the Department of Justice a report 
on the results, including the effectiveness, of such program 
during such year. 
SEC. 302. AUTHORIZATION OF APPROPRIATIONS. 
(a) IN GENERAL.—There is authorized to be appro-
priated to carry out this title $25,000,000 for each of fis-
cal years 2008 through 2010. 
(b) LIMITATIONS.—Of the amount made available to 
carry out this title in any fiscal year not more than 3 per-
cent may be used by the Attorney General for salaries and 
administrative expenses. 
(c) MINIMUM AMOUNT.—Unless all eligible applica-
tions submitted by a State or units of local government 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
within a State for a grant under this title have been fund-
ed, the State, together with grantees within the State 
(other than Indian tribes), shall be allocated in each fiscal 
year under this title not less than 0.75 percent of the total 
amount appropriated in the fiscal year for grants pursuant 
to this title, except that the United States Virgin Islands, 
American Samoa, Guam, and the Northern Mariana Is-
lands each shall be allocated 0.25 percent. 
(d) GRANTS TO INDIAN TRIBES.—Notwithstanding 
any other provision of this title, the Attorney General may 
use amounts made available under this title to make 
grants to Indian tribes for use in accordance with this 
title. 
TITLE 
IV—NATIONAL 
WHITE 
COLLAR 
CRIME 
CENTER 
GRANTS 
SEC. 401. AUTHORIZATION AND EXPANSION OF NATIONAL 
WHITE COLLAR CRIME CENTER. 
(a) IN GENERAL.—Title I of the Omnibus Crime 
Control and Safe Streets Act of 1968 (42 U.S.C. 3711 
et seq.) is amended— 
(1) by redesignating part X, as added by sec-
tion 623 of Public Law 109–248, as part JJ; and 
(2) by adding at the end the following new part: 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
‘‘PART KK—NATIONAL WHITE COLLAR CRIME 
CENTER GRANTS 
‘‘SEC. 3021. ESTABLISHMENT OF GRANTS PROGRAM. 
‘‘(a) AUTHORIZATION.—The Director of the Bureau 
of Justice Assistance is authorized to make grants and 
enter into contracts with State and local criminal justice 
agencies and nonprofit organizations for the purpose of 
improving the identification, investigation, and prosecu-
tion of certain criminal activities. 
‘‘(b) CERTAIN CRIMINAL ACTIVITIES DEFINED.— 
For purposes of this part, the term ‘certain criminal activ-
ity’ means a criminal conspiracy or activity or a terrorist 
conspiracy or activity that spans jurisdictional boundaries, 
including the following: 
‘‘(1) Terrorism. 
‘‘(2) Economic crime. 
‘‘(3) High-tech crime, also known as cyber 
crime or computer crime, including internet-based 
crime against children and child pornography. 
‘‘(c) CRIMINAL JUSTICE AGENCY DEFINED.—For 
purposes of this part, the term ‘criminal justice agency’, 
with respect to a State or a unit of local government with-
in such State, includes a law enforcement agency, a State 
regulatory body with criminal investigative authority, and 
a State or local prosecution office to the extent that such 
agency, body, or office, respectively, is involved in the pre-
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
vention, investigation, and prosecution of certain criminal 
activities. 
‘‘SEC. 3022. AUTHORIZED PROGRAMS. 
‘‘Grants and contracts awarded under this part may 
be made only for the following programs, with respect to 
the prevention, investigation, and prosecution of certain 
criminal activities: 
‘‘(1) Programs to provide a nationwide support 
system for State and local criminal justice agencies. 
‘‘(2) Programs to assist State and local crimi-
nal justice agencies to develop, establish, and main-
tain intelligence-focused policing strategies and re-
lated information sharing. 
‘‘(3) Programs to provide training and inves-
tigative support services to State and local criminal 
justice agencies to provide such agencies with skills 
and resources needed to investigate and prosecute 
such criminal activities and related criminal activi-
ties. 
‘‘(4) Programs to provide research support, to 
establish partnerships, and to provide other re-
sources to aid State and local criminal justice agen-
cies to prevent, investigate, and prosecute such 
criminal activities and related problems. 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS
‘‘(5) Programs to provide information and re-
search to the general public to facilitate the preven-
tion of such criminal activities. 
‘‘(6) Programs to establish National training 
and research centers regionally, including within Vir-
ginia, Texas, and Michigan, to provide training and 
research services for State and local criminal justice 
agencies. 
‘‘(7) Any other programs specified by the Attor-
ney General as furthering the purposes of this part. 
‘‘SEC. 3023. APPLICATION. 
‘‘To be eligible for an award of a grant or contract 
under this part, an entity shall submit to the Director of 
the Bureau of Justice Assistance an application in such 
form and manner, and containing such information, as re-
quired by the Director. 
‘‘SEC. 3024. RULES AND REGULATIONS. 
‘‘Not later than 180 days after the date of the enact-
ment of this part, the Director of the Bureau of Justice 
Assistance shall promulgate such rules and regulations as 
are necessary to carry out the this part, including rules 
and regulations for submitting and reviewing applications 
under section 3023.’’. 
VerDate Aug 31 2005 
03:38 Nov 17, 2007
Jkt 069200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H4175.IH
H4175
bajohnson on PROD1PC69 with BILLS