HR 1560 RFS
the Inspector General of the Department, and 
the senior privacy and civil liberties officer of 
each Federal agency that receives cyber threat 
indicators and defensive measures shared with 
the Center under this section, shall biennially 
submit to the appropriate congressional com-
mittees a report assessing the privacy and civil 
liberties impact of the activities under this 
paragraph. Each such report shall include any 
recommendations the Chief Privacy Officer and 
the Chief Civil Rights and Civil Liberties Offi-
cer of the Department consider appropriate to 
minimize or mitigate the privacy and civil lib-
erties impact of the sharing of cyber threat in-
dicators and defensive measures under this sec-
tion. 
‘‘(E) FORM.—Each report required under 
subparagraphs (C) and (D) shall be submitted 
in unclassified form, but may include a classi-
fied annex. 
‘‘(7) USES
AND
PROTECTION
OF
INFORMA-
TION.— 
‘‘(A) NON-FEDERAL
ENTITIES.—A non- 
Federal entity, not including a State, local, or 
tribal government, that shares cyber threat in-
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
dicators or defensive measures through the Cen-
ter or otherwise under this section— 
‘‘(i) may use, retain, or further dis-
close such cyber threat indicators or defen-
sive measures solely for cybersecurity pur-
poses; 
‘‘(ii) shall, prior to such sharing, take 
reasonable efforts to remove or exclude in-
formation that can be used to identify spe-
cific persons and is reasonably believed at 
the time of sharing to be unrelated to a cy-
bersecurity risk or incident, and to safe-
guard information that can be used to 
identify specific persons from unintended 
disclosure or unauthorized access or acqui-
sition; 
‘‘(iii) shall comply with appropriate 
restrictions that a Federal entity or non- 
Federal entity places on the subsequent 
disclosure or retention of cyber threat indi-
cators and defensive measures that it dis-
closes to other Federal entities or non-Fed-
eral entities; 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
‘‘(iv) shall be deemed to have volun-
tarily shared such cyber threat indicators 
or defensive measures; 
‘‘(v) shall implement and utilize a se-
curity control to protect against unauthor-
ized access to or acquisition of such cyber 
threat indicators or defensive measures; 
and 
‘‘(vi) may not use such information to 
gain an unfair competitive advantage to 
the detriment of any non-Federal entity. 
‘‘(B) FEDERAL ENTITIES.— 
‘‘(i) USES OF INFORMATION.—A Fed-
eral entity that receives cyber threat indi-
cators 
or 
defensive 
measures 
shared 
through the Center or otherwise under this 
section from another Federal entity or a 
non-Federal entity— 
‘‘(I) may use, retain, or further 
disclose such cyber threat indicators 
or defensive measures solely for cyber-
security purposes; 
‘‘(II) shall, prior to such sharing, 
take reasonable efforts to remove or 
exclude information that can be used 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
to identify specific persons and is rea-
sonably believed at the time of sharing 
to be unrelated to a cybersecurity risk 
or incident, and to safeguard informa-
tion that can be used to identify spe-
cific persons from unintended disclo-
sure or unauthorized access or acqui-
sition; 
‘‘(III) shall be deemed to have 
voluntarily shared such cyber threat 
indicators or defensive measures; 
‘‘(IV) shall implement and utilize 
a security control to protect against 
unauthorized access to or acquisition 
of such cyber threat indicators or de-
fensive measures; and 
‘‘(V) may not use such cyber 
threat indicators or defensive meas-
ures to engage in surveillance or other 
collection activities for the purpose of 
tracking an individual’s personally 
identifiable information, except for 
purposes authorized in this section. 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
‘‘(ii) PROTECTIONS
FOR
INFORMA-
TION.—The cyber threat indicators and de-
fensive measures referred to in clause (i)— 
‘‘(I) are exempt from disclosure 
under section 552 of title 5, United 
States Code, and withheld, without 
discretion, from the public under sub-
section (b)(3)(B) of such section; 
‘‘(II) may not be used by the 
Federal Government for regulatory 
purposes; 
‘‘(III) may not constitute a waiv-
er of any applicable privilege or pro-
tection provided by law, including 
trade secret protection; 
‘‘(IV) shall be considered the 
commercial, financial, and proprietary 
information of the non-Federal entity 
referred to in clause (i) when so des-
ignated by such non-Federal entity; 
and 
‘‘(V) may not be subject to a rule 
of any Federal entity or any judicial 
doctrine regarding ex parte commu-
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
nications with a decisionmaking offi-
cial. 
‘‘(C) STATE, LOCAL, OR TRIBAL GOVERN-
MENT.— 
‘‘(i) 
USES
OF
INFORMATION.—A 
State, local, or tribal government that re-
ceives cyber threat indicators or defensive 
measures from the Center from a Federal 
entity or a non-Federal entity— 
‘‘(I) may use, retain, or further 
disclose such cyber threat indicators 
or defensive measures solely for cyber-
security purposes; 
‘‘(II) shall, prior to such sharing, 
take reasonable efforts to remove or 
exclude information that can be used 
to identify specific persons and is rea-
sonably believed at the time of sharing 
to be unrelated to a cybersecurity risk 
or incident, and to safeguard informa-
tion that can be used to identify spe-
cific persons from unintended disclo-
sure or unauthorized access or acqui-
sition; 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS