I 
109TH CONGRESS 
2D SESSION 
H. R. 5835 
To amend title 38, United States Code, to improve information management 
within the Department of Veterans Affairs, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 19, 2006 
Mr. BUYER (for himself, Mr. FILNER, Mr. BILIRAKIS, Mr. EVANS, Mr. 
STEARNS, Mr. GUTIERREZ, Mr. BURTON of Indiana, Ms. CORRINE 
BROWN of Florida, Mr. BROWN of South Carolina, Mr. MICHAUD, Mr. 
MILLER of Florida, Ms. HERSETH, Mr. BOOZMAN, Mr. STRICKLAND, Mr. 
BRADLEY of New Hampshire, Mr. REYES, Ms. GINNY BROWN-WAITE of 
Florida, Ms. BERKLEY, Mr. BILBRAY, Mr. SALAZAR, Mr. TOM DAVIS of 
Virginia, Mr. WAXMAN, Mr. WALSH, Mr. EDWARDS, Mr. DINGELL, and 
Ms. SCHAKOWSKY) introduced the following bill; which was referred to 
the Committee on Veterans’ Affairs, and in addition to the Committee 
on Government Reform, for a period to be subsequently determined by 
the Speaker, in each case for consideration of such provisions as fall with-
in the jurisdiction of the committee concerned 
A BILL 
To amend title 38, United States Code, to improve informa-
tion management within the Department of Veterans 
Affairs, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Veterans Identity and 
Credit Security Act of 2006’’. 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
SEC. 2. FEDERAL AGENCY DATA BREACH NOTIFICATION 
REQUIREMENTS. 
(a) AUTHORITY OF DIRECTOR OF OFFICE OF MAN-
AGEMENT AND BUDGET TO ESTABLISH DATA BREACH 
POLICIES.—Section 3543(a) of title 44, United States 
Code, is amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
(3) by adding at the end the following new 
paragraph: 
‘‘(9) establishing policies, procedures, and 
standards for agencies to follow in the event of a 
breach of data security involving the disclosure of 
sensitive personal information in violation of section 
552a of title 5, including a requirement for timely 
notice to be given to those individuals whose sen-
sitive personal information could be compromised as 
a result of such breach, except no notice shall be re-
quired if the breach does not create a reasonable 
risk of identity theft, fraud, or other unlawful con-
duct regarding such individual.’’. 
(b) AUTHORITY OF CHIEF INFORMATION OFFICER 
TO
ENFORCE
DATA
BREACH
POLICIES.—Section 
3544(a)(3) of title 44, United States Code, is amended 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
by inserting after ‘‘authority to ensure compliance with’’ 
the following: ‘‘and, to the extent determined necessary 
and explicitly authorized by the head of the agency, to en-
force’’. 
(c) INCLUSION OF DATA BREACH NOTIFICATION IN 
AGENCY INFORMATION SECURITY PROGRAMS.—Section 
3544(b) of title 44, United States Code, is amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
(3) by adding at the end the following new 
paragraph: 
‘‘(9) procedures for notifying individuals whose 
sensitive personal information is compromised con-
sistent with policies, procedures, and standards es-
tablished under section 3543(a)(9) of this title.’’. 
(d) SENSITIVE PERSONAL INFORMATION DEFINI-
TION.—Section 3542(b) of title 44, United States Code, 
is amended by adding at the end the following new para-
graph: 
‘‘(4) The term ‘sensitive personal information’ 
means any information contained in a record, as de-
fined in section 552a(4) of title 5.’’. 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
SEC. 3. UNDER SECRETARY FOR INFORMATION SERVICES. 
(a) UNDER SECRETARY.—Chapter 3 of title 38, 
United States Code, is amended by inserting after section 
307 the following new section: 
‘‘§ 307A. Under Secretary for Information Services 
‘‘(a) UNDER SECRETARY.—There is in the Depart-
ment an Under Secretary for Information Services, who 
is appointed by the President, by and with the advice and 
consent of the Senate. The Under Secretary shall be the 
head of the Office of Information Services and shall per-
form such functions as the Secretary shall prescribe. 
‘‘(b) SERVICE AS CHIEF INFORMATION OFFICER.— 
Notwithstanding any other provision of law, the Under 
Secretary for Information Services shall serve as the Chief 
Information Officer of the Department under section 310 
of this title.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of such chapter is amended by inserting 
after the item relating to section 307 the following new 
item: 
‘‘307A. Under Secretary for Information Services.’’. 
(c) CONFORMING AMENDMENT.—Section 308(b) of 
such title is amended by striking paragraph (5) and redes-
ignating paragraphs (6) through (11) as paragraphs (5) 
through (10), respectively. 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
SEC. 4. DEPARTMENT OF VETERANS AFFAIRS INFORMA-
TION SECURITY. 
(a) INFORMATION SECURITY.—Chapter 57 of title 
38, United States Code, is amended by adding at the end 
the following new subchapter: 
‘‘SUBCHAPTER III—INFORMATION SECURITY 
‘‘§ 5721. Definitions 
‘‘For the purposes of this subchapter: 
‘‘(1) The term ‘sensitive personal information’ 
means the name, address, or telephone number of an 
individual, in combination with any of the following: 
‘‘(A) The Social Security number of the in-
dividual. 
‘‘(B) The date of birth of the individual. 
‘‘(C) Any information not available as part 
of the public record regarding the individual’s 
military service or health. 
‘‘(D) Any financial account or other finan-
cial information relating to the individual. 
‘‘(E) The driver’s license number of the in-
dividual. 
‘‘(2) The term ‘data breach’ means the loss, 
theft, or other unauthorized access to data con-
taining sensitive personal information, in electronic 
or printed form, that results in the potential com-
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
promise of the confidentiality or integrity of the 
data. 
‘‘(3) The term ‘data breach analysis’ means the 
identification of any misuse of sensitive personal in-
formation involved in a data breach. 
‘‘(4) The term ‘fraud resolution services’ means 
services to assist an individual in the process of re-
covering and rehabilitating the credit of the indi-
vidual after the individual experiences identity theft. 
‘‘(5) The term ‘identity theft’ has the meaning 
given such term under section 603 of the Fair Cred-
it Reporting Act (15 U.S.C. 1681a). 
‘‘(6) The term ‘identity theft insurance’ means 
any insurance policy that pays benefits for costs, in-
cluding travel costs, notary fees, and postage costs, 
lost wages, and legal fees and expenses associated 
with the identity theft of the insured individual. 
‘‘(7) The term ‘principal credit reporting agen-
cy’ means a consumer reporting agency as described 
in section 603(p) of the Fair Credit Reporting Act 
(15 U.S.C. 1681a(p)). 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
‘‘§ 5722. Office of the Under Secretary for Information 
Services 
‘‘(a) DEPUTY UNDER SECRETARIES.—The Office of 
the Under Secretary for Information Services shall consist 
of the following: 
‘‘(1) The Deputy Under Secretary for Informa-
tion Services for Security, who shall serve as the 
Senior Information Security Officer of the Depart-
ment. 
‘‘(2) The Deputy Under Secretary for Informa-
tion Services for Operations and Management. 
‘‘(3) The Deputy Under Secretary for Informa-
tion Services for Policy and Planning. 
‘‘(b) APPOINTMENTS.—Appointments under sub-
section (a) shall be made by the Secretary. 
‘‘§ 5723. Information security management 
‘‘(a) RESPONSIBILITIES OF CHIEF INFORMATION OF-
FICER.—To support the economical, efficient, and effec-
tive execution of subtitle III of chapter 35 of title 44, and 
policies and plans of the Department, the Secretary shall 
ensure that the Chief Information Officer of the Depart-
ment has the authority and control necessary to develop, 
approve, implement, integrate, and oversee the policies, 
procedures, processes, activities, and systems of the De-
partment relating to that subtitle, including the manage-
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
ment of all related mission applications, information re-
sources, personnel, and infrastructure. 
‘‘(b) ANNUAL COMPLIANCE REPORT.—Not later than 
March 1 of each year, the Secretary shall submit to the 
Committees on Veterans’ Affairs of the Senate and House 
of Representatives, the Committee on Government Reform 
of the House of Representatives, and the Committee on 
Homeland Security and Governmental Affairs of the Sen-
ate, a report on the Department’s compliance with subtitle 
III of chapter 35 of title 44. The information in such re-
port shall be displayed in the aggregate and separately for 
each Administration, office, and facility of the Depart-
ment. 
‘‘(c) REPORTS TO SECRETARY OF COMPLIANCE DE-
FICIENCIES.—(1) At least once every month, the Chief In-
formation Officer shall report to the Secretary any defi-
ciency in the compliance with subtitle III of chapter 35 
of title 44 of the Department or any Administration, of-
fice, or facility of the Department. 
‘‘(2) The Chief Information Officer shall immediately 
report to the Secretary any significant deficiency in such 
compliance. 
‘‘(d) DATA BREACHES.—(1) The Chief Information 
Officer shall immediately provide notice to the Secretary 
of any data breach. 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
‘‘(2) Immediately after receiving notice of a data 
breach under paragraph (1), the Secretary shall provide 
notice of such breach to the Director of the Office of Man-
agement and Budget, the Inspector General of the Depart-
ment, and, if appropriate, the Federal Trade Commission 
and the United States Secret Service. 
‘‘(e) BUDGETARY MATTERS.—When the budget for 
any fiscal year is submitted by the President to Congress 
under section 1105 of title 31, the Secretary shall submit 
to Congress a report that identifies amounts requested for 
Department implementation and remediation of and com-
pliance with this subchapter and subtitle III of chapter 
35 of title 44. The report shall set forth those amounts 
both for each Administration within the Department and 
for the Department in the aggregate and shall identify, 
for each such amount, how that amount is aligned with 
and supports such implementation and compliance. 
‘‘§ 5724. Congressional reporting and notification of 
data breaches 
‘‘(a) QUARTERLY REPORTS.—(1) Not later than 30 
days after the last day of a fiscal quarter, the Secretary 
shall submit to the Committees on Veterans’ Affairs of 
the Senate and House of Representatives a report on any 
data breach with respect to sensitive personal information 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
processed or maintained by the Department that occurred 
during that quarter. 
‘‘(2) Each report submitted under paragraph (1) 
shall identify, for each data breach covered by the report, 
the Administration and facility of the Department respon-
sible for processing or maintaining the sensitive personal 
information involved in the data breach. 
‘‘(b) 
NOTIFICATION
OF
SIGNIFICANT
DATA 
BREACHES.—(1) In the event of a data breach with re-
spect to sensitive personal information processed or main-
tained by the Secretary that the Secretary determines is 
significant, the Secretary shall provide notice of such 
breach to the Committees on Veterans’ Affairs of the Sen-
ate and House of Representatives. 
‘‘(2) Notice under paragraph (1) shall be provided 
promptly following the discovery of such a data breach and 
the implementation of any measures necessary to deter-
mine the scope of the breach, prevent any further breach 
or unauthorized disclosures, and reasonably restore the in-
tegrity of the data system. 
‘‘§ 5725. Data breaches 
‘‘(a) INDEPENDENT RISK ANALYSIS.—(1) In the 
event of a data breach with respect to sensitive personal 
information that is processed or maintained by the Sec-
retary, the Secretary shall ensure that, as soon as possible 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
after the data breach, a non-Department entity conducts 
an independent risk analysis of the data breach to deter-
mine the level of risk associated with the data breach for 
the potential misuse of any sensitive personal information 
involved in the data breach. 
‘‘(2) If the Secretary determines, based on the find-
ings of a risk analysis conducted under paragraph (1), 
that a reasonable risk exists for the potential misuse of 
sensitive information involved in a data breach, the Sec-
retary shall provide credit protection services in accord-
ance with section 5726 of this title. 
‘‘(b) NOTIFICATION.—(1) In the event of a data 
breach, the Secretary of Veterans Affairs shall provide to 
an individual whose sensitive personal information is in-
volved in that breach notice of the data breach— 
‘‘(A) in writing; or 
‘‘(B) by email, if— 
‘‘(i) the Department’s primary method of 
communication with the individual is by email; 
and 
‘‘(ii) the individual has consented to receive 
such notification. 
‘‘(2) Notice provided under paragraph (1) shall— 
‘‘(A) describe the circumstances of the data 
breach and the risk that the breach could lead to 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
misuse, including identity theft, involving the sen-
sitive personal information of the individual; 
‘‘(B) describe the specific types of sensitive per-
sonal information that was compromised as a part of 
the data breach; 
‘‘(C) describe the actions the Department is 
taking to remedy the data breach; 
‘‘(D) inform the individual that the individual 
may request a fraud alert and credit security freeze 
under this section; 
‘‘(E) clearly explain the advantages and dis-
advantages to the individual of receiving fraud alerts 
and credit security freezes under this section; and 
‘‘(F) includes such other information as the 
Secretary determines is appropriate. 
‘‘(3) The notice required under paragraph (1) shall 
be provided promptly following the discovery of a data 
breach and the implementation of any measures necessary 
to determine the scope of the breach, prevent any further 
breach or unauthorized disclosures, and reasonably restore 
the integrity of the data system. 
‘‘(c) REPORT.—For each data breach with respect to 
sensitive personal information processed or maintained by 
the Secretary, the Secretary shall promptly submit to the 
Committees on Veterans’ Affairs of the Senate and House 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
of Representatives a report containing the findings of any 
independent risk analysis conducted under subsection 
(a)(1), any determination of the Secretary under sub-
section (a)(2), and a description of any credit protection 
services provided under section 5726 of this title. 
‘‘(d) FINAL DETERMINATION.—Notwithstanding sec-
tions 511 and 7104(a) of this title, any determination of 
the Secretary under subsection (a)(2) with respect to the 
reasonable risk for the potential misuse of sensitive infor-
mation involved in a data breach is final and conclusive 
and may not be reviewed by any other official, administra-
tive body, or court, whether by an action in the nature 
of mandamus or otherwise. 
‘‘(e) FRAUD ALERTS.—(1) In the event of a data 
breach with respect to sensitive personal information that 
is processed or maintained by the Secretary, the Secretary 
shall arrange, upon the request of an individual whose sen-
sitive personal information is involved in the breach to a 
principal credit reporting agency with which the Secretary 
has entered into a contract under section 5726(d) and at 
no cost to the individual, for the principal credit reporting 
agency to provide fraud alert services for that individual 
for a period of not less than one year, beginning on the 
date of such request, unless the individual requests that 
such fraud alert be removed before the end of such period, 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
and the agency receives appropriate proof of the identity 
of the individual for such purpose. 
‘‘(2) The Secretary shall arrange for each principal 
credit reporting agency referred to in paragraph (1) to 
provide any alert requested under such subsection in the 
file of the individual along with any credit score generated 
in using that file, for a period of not less than one year, 
beginning on the date of such request, unless the indi-
vidual requests that such fraud alert be removed before 
the end of such period, and the agency receives appro-
priate proof of the identity of the individual for such pur-
pose. 
‘‘(f) CREDIT SECURITY FREEZE.— (1) In the event 
of a data breach with respect to sensitive personal infor-
mation that is processed or maintained by the Secretary, 
the Secretary shall arrange, upon the request of an indi-
vidual whose sensitive personal information is involved in 
the breach and at no cost to the individual, for each prin-
cipal credit reporting agency to apply a security freeze to 
the file of that individual for a period of not less than 
one year, beginning on the date of such request, unless 
the individual requests that such security freeze be re-
moved before the end of such period, and the agency re-
ceives appropriate proof of the identity of the individual 
for such purpose. 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
‘‘(2) The Secretary shall arrange for a principal cred-
it reporting agency applying a security freeze under para-
graph (1)— 
‘‘(A) to send a written confirmation of the secu-
rity freeze to the individual within five business days 
of applying the freeze; 
‘‘(B) to refer the information regarding the se-
curity freeze to other consumer reporting agencies; 
‘‘(C) to provide the individual with a unique 
personal identification number or password to be 
used by the individual when providing authorization 
for the release of the individual’s credit for a specific 
party or period of time; and 
‘‘(D) upon the request of the individual, to tem-
porarily lift the freeze for a period of time specified 
by the individual, beginning not later than three 
business days after the date on which the agency re-
ceives the request. 
‘‘§ 5726. Provision of credit protection services 
‘‘(a) COVERED INDIVIDUAL.—For purposes of this 
section, a covered individual is an individual whose sen-
sitive personal information that is processed or maintained 
by the Department (or any third-party entity acting on 
behalf of the Department) is involved, on or after August 
1, 2005, in a data breach for which the Secretary deter-
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
mines a reasonable risk exists for the potential misuse of 
sensitive personal information under section 5725(a)(2) of 
this title. 
‘‘(b) NOTIFICATION.—(1) In addition to any notice 
required under subsection 5725(b) of this title, the Sec-
retary shall provide to a covered individual notice in writ-
ing that— 
‘‘(A) the individual may request credit protec-
tion services under this section; 
‘‘(B) clearly explains the advantages and dis-
advantages to the individual of receiving credit pro-
tection services under this section; 
‘‘(C) includes a notice of which principal credit 
reporting agency the Secretary has entered into a 
contract with under subsection (d), and information 
about requesting services through that agency; 
‘‘(D) describes actions the individual can or 
should take to reduce the risk of identity theft; and 
‘‘(E) includes such other information as the 
Secretary determines is appropriate. 
‘‘(2) The notice required under paragraph (1) shall 
be made as promptly as possible and without unreasonable 
delay following the discovery of a data breach for which 
the Secretary determines a reasonable risk exists for the 
potential misuse of sensitive personal information under 
VerDate Aug 31 2005 
02:18 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
section 5725(a)(2) of this title and the implementation of 
any measures necessary to determine the scope of the 
breach, prevent any further breach or unauthorized disclo-
sures, and reasonably restore the integrity of the data sys-
tem. 
‘‘(3) The Secretary shall ensure that each notification 
under paragraph (1) includes a form or other means for 
readily requesting the credit protection services under this 
section. Such form or other means may include a tele-
phone number, email address, or Internet website address. 
‘‘(c) AVAILABILITY OF SERVICES THROUGH OTHER 
GOVERNMENT AGENCIES.—If a service required to be pro-
vided under this section is available to a covered individual 
through another department or agency of the Government, 
the Secretary and the head of that department or agency 
may enter into an agreement under which the head of that 
department or agency agrees to provide that service to the 
covered individual. 
‘‘(d) CONTRACT WITH CREDIT REPORTING AGEN-
CY.—Subject to the availability of appropriations and not-
withstanding any other provision of law, the Secretary 
shall enter into contracts or other agreements as necessary 
with one or more principal credit reporting agencies in 
order to ensure, in advance, the provision of credit protec-
tion services under this section and fraud alerts and secu-
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
rity freezes under section 5725 of this title. Any such con-
tract or agreement may include provisions for the Sec-
retary to pay the expenses of such a credit reporting agen-
cy for the provision of such services. 
‘‘(e) DATA BREACH ANALYSIS.—The Secretary shall 
arrange, upon the request of a covered individual and at 
no cost to the individual, to provide data breach analysis 
for the individual for a period of not less than one year, 
beginning on the date of such request. 
‘‘(f) PROVISION OF CREDIT MONITORING SERVICES 
AND IDENTITY THEFT INSURANCE.—During the one-year 
period beginning on the date on which the Secretary noti-
fies a covered individual that the individual’s sensitive per-
sonal information is involved in a data breach, the Sec-
retary shall arrange, upon the request of the individual 
and without charge to the individual, for the provision of 
credit monitoring services to the individual. Credit moni-
toring services under this subsection shall include each of 
the following: 
‘‘(1) One copy of the credit report of the indi-
vidual every three months. 
‘‘(2) Fraud resolution services for the indi-
vidual. 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS
‘‘(3) Identity theft insurance in a coverage 
amount that does not exceed $30,000 in aggregate 
liability for the insured. 
‘‘§ 5727. Contracts for data processing or mainte-
nance 
‘‘(a) CONTRACT REQUIREMENTS.—If the Secretary 
enters into a contract for the performance of any Depart-
ment function that requires access to sensitive personal 
information, the Secretary shall require as a condition of 
the contract that— 
‘‘(1) the contractor shall not, directly or 
through an affiliate of the contractor, disclose such 
information to any other person unless the disclo-
sure is lawful and is expressly permitted under the 
contract; 
‘‘(2) the contractor, or any subcontractor for a 
subcontract of the contract, shall promptly notify the 
Secretary of any data breach that occurs with re-
spect to such information. 
‘‘(b) LIQUIDATED DAMAGES.—Each contract subject 
to the requirements of subsection (a) shall provide for liq-
uidated damages to be paid by the contractor to the Sec-
retary in the event of a data breach with respect to any 
sensitive personal information processed or maintained by 
the contractor or any subcontractor under that contract. 
VerDate Aug 31 2005 
01:41 Jul 20, 2006
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.IH
H5835
ycherry on PROD1PC64 with BILLS