I 
109TH CONGRESS 
1ST SESSION H. R. 2840
To amend title 5, United States Code, to require that agencies, in promul-
gating rules, take into consideration the impact of such rules on the 
privacy of individuals, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 9, 2005
Mr. CHABOT (for himself, Mr. NADLER, Mr. CANNON, and Mr. DELAHUNT) 
introduced the following bill; which was referred to the Committee on the 
Judiciary 
A BILL 
To amend title 5, United States Code, to require that agen-
cies, in promulgating rules, take into consideration the 
impact of such rules on the privacy of individuals, and 
for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Agency Pro-
tection of Privacy Act of 2005’’.
SEC. 2. REQUIREMENT THAT AGENCY RULEMAKING TAKE 
INTO CONSIDERATION IMPACTS ON INDI-
VIDUAL PRIVACY. 
(a) IN GENERAL.—Title 5, United States Code, is 
amended by adding after section 553 the following new 
section: 
‘‘§ 553a. Privacy impact assessment in rulemaking 
‘‘(a) INITIAL PRIVACY IMPACT ASSESSMENT.—
‘‘(1) IN GENERAL.—Whenever an agency is re-
quired by section 553 of this title, or any other law, 
to publish a general notice of proposed rulemaking 
for a proposed rule, or publishes a notice of pro-
posed rulemaking for an interpretative rule involving 
the internal revenue laws of the United States, and 
such rule or proposed rulemaking pertains to the 
collection, maintenance, use, or disclosure of person-
ally identifiable information from 10 or more indi-
viduals, other than agencies, instrumentalities, or 
employees of the Federal Government, the agency 
shall prepare and make available for public comment 
an initial privacy impact assessment that describes 
the impact of the proposed rule on the privacy of in-
dividuals. Such assessment or a summary thereof 
shall be signed by the senior agency official with pri-
mary responsibility for privacy policy and be pub-
lished in the Federal Register at the time of the
publication of a general notice of proposed rule-
making for the rule. 
‘‘(2) CONTENTS.—Each initial privacy impact 
assessment required under this subsection shall con-
tain the following: 
‘‘(A) A description and analysis of the ex-
tent to which the proposed rule will impact the 
privacy interests of individuals, including the 
extent to which the proposed rule—
‘‘(i) provides notice of the collection of 
personally identifiable information, and 
specifies what personally identifiable infor-
mation is to be collected and how it is to 
be collected, maintained, used, and dis-
closed; 
‘‘(ii) allows access to such information 
by the person to whom the personally iden-
tifiable information pertains and provides 
an opportunity to correct inaccuracies; 
‘‘(iii) 
prevents 
such 
information, 
which is collected for one purpose, from 
being used for another purpose; and 
‘‘(iv) provides security for such infor-
mation.
‘‘(B) A description of any significant alter-
natives to the proposed rule which accomplish 
the stated objectives of applicable statutes and 
which minimize any significant privacy impact 
of the proposed rule on individuals. 
‘‘(b) FINAL PRIVACY IMPACT ASSESSMENT.—
‘‘(1) IN GENERAL.—Whenever an agency pro-
mulgates a final rule under section 553 of this title, 
after being required by that section or any other law 
to publish a general notice of proposed rulemaking, 
or promulgates a final interpretative rule involving 
the internal revenue laws of the United States, and 
such rule or proposed rulemaking pertains to the 
collection, maintenance, use, or disclosure of person-
ally identifiable information from 10 or more indi-
viduals, other than agencies, instrumentalities, or 
employees of the Federal Government, the agency 
shall prepare a final privacy impact assessment, 
signed by the senior agency official with primary re-
sponsibility for privacy policy. 
‘‘(2) CONTENTS.—Each final privacy impact as-
sessment required under this subsection shall con-
tain the following: 
‘‘(A) A description and analysis of the ex-
tent to which the final rule will impact the pri-
vacy interests of individuals, including the ex-
tent to which such rule—
‘‘(i) provides notice of the collection of 
personally identifiable information, and 
specifies what personally identifiable infor-
mation is to be collected and how it is to 
be collected, maintained, used, and dis-
closed; 
‘‘(ii) allows access to such information 
by the person to whom the personally iden-
tifiable information pertains and provides 
an opportunity to correct inaccuracies; 
‘‘(iii) 
prevents 
such 
information, 
which is collected for one purpose, from 
being used for another purpose; and 
‘‘(iv) provides security for such infor-
mation. 
‘‘(B) A summary of any significant issues 
raised by the public comments in response to 
the initial privacy impact assessment, a sum-
mary of the analysis of the agency of such 
issues, and a statement of any changes made in 
such rule as a result of such issues. 
‘‘(C) A description of the steps the agency 
has taken to minimize the significant privacy
impact on individuals consistent with the stated 
objectives of applicable statutes, including a 
statement of the factual, policy, and legal rea-
sons for selecting the alternative adopted in the 
final rule and why each one of the other signifi-
cant alternatives to the rule considered by the 
agency which affect the privacy interests of in-
dividuals was rejected. 
‘‘(3) AVAILABILITY
TO
PUBLIC.—The agency 
shall make copies of the final privacy impact assess-
ment available to members of the public and shall 
publish in the Federal Register such assessment or 
a summary thereof. 
‘‘(c) WAIVERS.—
‘‘(1) EMERGENCIES.—An agency head may 
waive or delay the completion of some or all of the 
requirements of subsections (a) and (b) to the same 
extent as the agency head may, under section 608, 
waive or delay the completion of some or all of the 
requirements of sections 603 and 604, respectively. 
‘‘(2) NATIONAL
SECURITY.—An agency head 
may, for national security reasons, or to protect 
from disclosure classified information, confidential 
commercial information, or information the disclo-
sure of which may adversely affect a law enforce-
ment effort, waive or delay the completion of some 
or all of the following requirements: 
‘‘(A) The requirement of subsection (a)(1) 
to make an assessment available for public com-
ment. 
‘‘(B) The requirement of subsection (a)(1) 
to have an assessment or summary thereof pub-
lished in the Federal Register. 
‘‘(C) The requirements of subsection 
(b)(3). 
‘‘(d) PROCEDURES FOR GATHERING COMMENTS.—
When any rule is promulgated which may have a signifi-
cant privacy impact on individuals, or a privacy impact 
on a substantial number of individuals, the head of the 
agency promulgating the rule or the official of the agency 
with statutory responsibility for the promulgation of the 
rule shall assure that individuals have been given an op-
portunity to participate in the rulemaking for the rule 
through techniques such as—
‘‘(1) the inclusion in an advance notice of pro-
posed rulemaking, if issued, of a statement that the 
proposed rule may have a significant privacy impact 
on individuals, or a privacy impact on a substantial 
number of individuals;
‘‘(2) the publication of a general notice of pro-
posed rulemaking in publications of national circula-
tion likely to be obtained by individuals; 
‘‘(3) the direct notification of interested individ-
uals; 
‘‘(4) the conduct of open conferences or public 
hearings concerning the rule for individuals, includ-
ing soliciting and receiving comments over computer 
networks; and 
‘‘(5) the adoption or modification of agency 
procedural rules to reduce the cost or complexity of 
participation in the rulemaking by individuals. 
‘‘(e) PERIODIC REVIEW OF RULES.—
‘‘(1) IN
GENERAL.—Each agency shall carry 
out a periodic review of the rules promulgated by the 
agency that have a significant privacy impact on in-
dividuals, or a privacy impact on a substantial num-
ber of individuals. Under such periodic review, the 
agency shall determine, for each such rule, whether 
the rule can be amended or rescinded in a manner 
that minimizes any such impact while remaining in 
accordance with applicable statutes. For each such 
determination, the agency shall consider the fol-
lowing factors: 
‘‘(A) The continued need for the rule.
‘‘(B) The nature of complaints or com-
ments received from the public concerning the 
rule. 
‘‘(C) The complexity of the rule. 
‘‘(D) The extent to which the rule over-
laps, duplicates, or conflicts with other Federal 
rules, and, to the extent feasible, with State and 
local governmental rules. 
‘‘(E) The length of time since the rule was 
last reviewed under this subsection. 
‘‘(F) The degree to which technology, eco-
nomic conditions, or other factors have changed 
in the area affected by the rule since the rule 
was last reviewed under this subsection. 
‘‘(2) PLAN
REQUIRED.—Each agency shall 
carry out the periodic review required by paragraph 
(1) in accordance with a plan published by such 
agency in the Federal Register. Each such plan shall 
provide for the review under this subsection of each 
rule promulgated by the agency not later than 10 
years after the date on which such rule was pub-
lished as the final rule and, thereafter, not later 
than 10 years after the date on which such rule was 
last reviewed under this subsection. The agency may
amend such plan at any time by publishing the revi-
sion in the Federal Register. 
‘‘(3) ANNUAL PUBLICATION.—Each year, each 
agency shall publish in the Federal Register a list of 
the rules to be reviewed by such agency under this 
subsection during the following year. The list shall 
include a brief description of each such rule and the 
need for and legal basis of such rule and shall invite 
public comment upon the determination to be made 
under this subsection with respect to such rule. 
‘‘(f) JUDICIAL REVIEW.—
‘‘(1) IN GENERAL.—For any rule subject to this 
section, an individual who is adversely affected or 
aggrieved by final agency action is entitled to judi-
cial review of agency compliance with the require-
ments of subsections (b) and (c) in accordance with 
chapter 7. Agency compliance with subsection (d) 
shall be judicially reviewable in connection with judi-
cial review of subsection (b). 
‘‘(2) JURISDICTION.—Each court having juris-
diction to review such rule for compliance with sec-
tion 553, or under any other provision of law, shall 
have jurisdiction to review any claims of noncompli-
ance with subsections (b) and (c) in accordance with 
chapter 7. Agency compliance with subsection (d)
shall be judicially reviewable in connection with judi-
cial review of subsection (b). 
‘‘(3) LIMITATIONS.—
‘‘(A) An individual may seek such review 
during the period beginning on the date of final 
agency action and ending 1 year later, except 
that where a provision of law requires that an 
action challenging a final agency action be com-
menced before the expiration of 1 year, such 
lesser period shall apply to an action for judicial 
review under this subsection. 
‘‘(B) In the case where an agency delays 
the issuance of a final privacy impact assess-
ment pursuant to subsection (c), an action for 
judicial review under this section shall be filed 
not later than—
‘‘(i) 1 year after the date the assess-
ment is made available to the public; or 
‘‘(ii) where a provision of law requires 
that an action challenging a final agency 
regulation be commenced before the expi-
ration of the 1-year period, the number of 
days specified in such provision of law that 
is after the date the assessment is made 
available to the public.
‘‘(4) RELIEF.—In granting any relief in an ac-
tion under this subsection, the court shall order the 
agency to take corrective action consistent with this 
section and chapter 7, including, but not limited 
to—
‘‘(A) remanding the rule to the agency; 
and 
‘‘(B) deferring the enforcement of the rule 
against individuals, unless the court finds that 
continued enforcement of the rule is in the pub-
lic interest. 
‘‘(5) RULE
OF
CONSTRUCTION.—Nothing in 
this subsection shall be construed to limit the au-
thority of any court to stay the effective date of any 
rule or provision thereof under any other provision 
of law or to grant any other relief in addition to the 
requirements of this subsection. 
‘‘(6) RECORD OF AGENCY ACTION.—In an ac-
tion for the judicial review of a rule, the privacy im-
pact assessment for such rule, including an assess-
ment prepared or corrected pursuant to paragraph 
(4), shall constitute part of the entire record of 
agency action in connection with such review. 
‘‘(7) EXCLUSIVITY.—Compliance or noncompli-
ance by an agency with the provisions of this section
shall be subject to judicial review only in accordance 
with this subsection. 
‘‘(8) SAVINGS CLAUSE.—Nothing in this sub-
section bars judicial review of any other impact 
statement or similar assessment required by any 
other law if judicial review of such statement or as-
sessment is otherwise permitted by law. 
‘‘(g) DEFINITION.—For purposes of this section, the 
term ‘personally identifiable information’ means informa-
tion that can be used to identify an individual, including 
such individual’s name, address, telephone number, photo-
graph, social security number or other identifying infor-
mation. It includes information about such individual’s 
medical or financial condition.’’. 
(b) PERIODIC REVIEW TRANSITION PROVISIONS.—
(1) INITIAL PLAN.—For each agency, the plan 
required by subsection (e) of section 553a of title 5, 
United States Code (as added by subsection (a)), 
shall be published not later than 180 days after the 
date of the enactment of this Act. 
(2) In the case of a rule promulgated by an 
agency before the date of the enactment of this Act, 
such plan shall provide for the periodic review of 
such rule before the expiration of the 10-year period 
beginning on the date of the enactment of this Act.
For any such rule, the head of the agency may pro-
vide for a 1-year extension of such period if the head 
of the agency, before the expiration of the period, 
certifies in a statement published in the Federal 
Register that reviewing such rule before the expira-
tion of the period is not feasible. The head of the 
agency may provide for additional 1-year extensions 
of the period pursuant to the preceding sentence, 
but in no event may the period exceed 15 years. 
(c) CONGRESSIONAL REVIEW.—Section 801(a)(1)(B) 
of title 5, United States Code, is amended—
(1) by redesignating clauses (iii) and (iv) as 
clauses (iv) and (v), respectively; and 
(2) by inserting after clause (ii) the following 
new clause: 
‘‘(iii) the agency’s actions relevant to section 
553a;’’. 
(d) CLERICAL AMENDMENT.—The table of sections 
at the beginning of chapter 5 of title 5, United States 
Code, is amended by adding after the item relating to sec-
tion 553 the following new item:
‘‘553a. Privacy impact assessment in rulemaking.’’.
Æ