H. R. 4818—461
of title 5, 11 United States Code, internal controls, and other
relevant matters;
(7) ensuring that the Department protects information in
an identifiable form and information systems from unauthor-
ized access, use, disclosure, disruption, modification, or destruc-
tion;
(8) training and educating employees on privacy and data
protection policies to promote awareness of and compliance
with established privacy and data protection policies; and
(9) ensuring compliance with the Departments established
privacy and data protection policies.
(b) ESTABLISHING PRIVACY AND DATA PROTECTION PROCEDURES
AND POLICIES.—
(1) IN GENERAL.—Within 12 months of enactment of this
Act, each agency shall establish and implement comprehensive
privacy and data protection procedures governing the agency’s
collection, use, sharing, disclosure, transfer, storage and secu-
rity of information in an identifiable form relating to the agency
employees and the public. Such procedures shall be consistent
with legal and regulatory guidance, including OMB regulations,
the Privacy Act of 1974, and section 208 of the E-Government
Act of 2002.
(c) RECORDING.—Each agency shall prepare a written report
of its use of information in an identifiable form, along with its
privacy and data protection policies and procedures and record
it with the Inspector General of the agency to serve as a benchmark
for the agency. Each report shall be signed by the agency privacy
officer to verify that the agency intends to comply with the proce-
dures in the report. By signing the report the privacy officer also
verifies that the agency is only using information in identifiable
form as detailed in the report.
(d) INDEPENDENT, THIRD-PARTY REVIEW.—
(1) IN GENERAL.—At least every 2 years, each agency shall
have performed an independent, third party review of the use
of information in identifiable form as the privacy and data
protection procedures of the agency to—
(A) determine the accuracy of the description of the
use of information in identifiable form;
(B) determine the effectiveness of the privacy and data
protection procedures;
(C) ensure compliance with the stated privacy and
data protection policies of the agency and applicable laws
and regulations; and
(D) ensure that all technologies used to collect, use,
store, and disclose information in identifiable form allow
for continuous auditing of compliance with stated privacy
policies and practices governing the collection, use and
distribution of information in the operation of the program.
(2) PURPOSES.—The purposes of reviews under this sub-
section are to—
(A) ensure the agency’s description of the use of
information in an identifiable form is accurate and accounts
for the agency’s current technology and its processing of
information in an identifiable form;
(B) measure actual privacy and data protection prac-
tices against the agency’s recorded privacy and data protec-
tion procedures;
H. R. 4818—462
(C) ensure compliance and consistency with both online
and offline stated privacy and data protection policies; and
(D) provide agencies with ongoing awareness and rec-
ommendations regarding privacy and data protection proce-
dures.
(3) REQUIREMENTS OF REVIEW.—The Inspector General of
each agency shall contract with an independent, third party
that is a recognized leader in privacy consulting, privacy tech-
nology, data collection and data use management, and global
privacy issues, to—
(A) evaluate the agency’s use of information in identifi-
able form;
(B) evaluate the privacy and data protection procedures
of the agency; and
(C) recommend strategies and specific steps to improve
privacy and data protection management.
(4) CONTENT.—Each review under this subsection shall
include—
(A) a review of the agency’s technology, practices and
procedures with regard to the collection, use, sharing,
disclosure, transfer and storage of information in identifi-
able form;
(B) a review of the agency’s stated privacy and data
protection procedures with regard to the collection, use,
sharing, disclosure, transfer, and security of personal
information in identifiable form relating to agency
employees and the public;
(C) a detailed analysis of agency intranet, network
and Websites for privacy vulnerabilities, including—
(i) noncompliance with stated practices, procedures
and policies; and
(ii) risks for inadvertent release of information
in an identifiable form from the website of the agency;
and
(D) a review of agency compliance with this Act.
(e) REPORT.—
(1) IN
GENERAL.—Upon completion of a review, the
Inspector General of an agency shall submit to the head of
that agency a detailed report on the review, including rec-
ommendations for improvements or enhancements to manage-
ment of information in identifiable form, and the privacy and
data protection procedures of the agency.
(2) INTERNET AVAILABILITY.—Each agency shall make each
independent third party review, and each report of the Inspector
General relating to that review available to the public.
(f) DEFINITION.—In this section, the definition of ‘‘identifiable
form’’ is consistent with Public Law 107–347, the E-Government
Act of 2002, and means any representation of information that
permits the identity of an individual to whom the information
applies to be reasonably inferred by either direct or indirect means.
SEC. 523. None of the funds made available under this Act
may be obligated or expended to establish or implement a pilot
program under which not more than 10 designated essential air
service communities located in proximity to hub airports are
required to assume 10 percent of their essential air subsidy costs
for a 4-year period commonly referred to as the EAS local participa-
tion program.
H. R. 4818—463
SEC. 524. None of the funds made available in this Act may
be used by the Council of Economic Advisers to produce an Economic
Report of the President regarding the inclusion of employment
at a retail fast food restaurant as part of the definition of manufac-
turing employment.
SEC. 525. Section 302(e)(3)(B) of the Federal Election Campaign
Act of 1971 (2 U.S.C. 432(e)(3)(B)) is amended by striking ‘‘$1,000’’
and inserting in its place ‘‘$2,000’’.
SEC. 526. The Former Presidents Act, 3 U.S.C. 102, note, is
amended to add the following at the end of section 1(b): ‘‘Amounts
provided for ‘Allowances and Office Staff for Former Presidents’
may be used to pay fees of an independent contractor who is
not a member of the staff of the office of a former President
for the review of Presidential records of a former President in
connection with the transfer of such records to the National
Archives and Records Administration or a Presidential Library
without regard to the limitation on staff compensation set forth
herein.’’.
SEC. 527. Of funds so made available in Items 18 and 19
of the table contained in section 3031 of Public Law 105–178,
$5,000,000 shall be available for the Buffalo, New York Inner
Harbor Redevelopment Project; of funds made available in Public
Law 104–50 for Crossroads Intermodal Station, New York,
$1,000,000 shall be available for the Buffalo Inner Harbor Redevel-
opment Project; of the funds made available in Public Law 104–
205 for Crossroads Intermodal Station, New York, $1,000,000 shall
be available for the Buffalo, New York Inner Harbor Redevelopment
Project; of funds made available in Public Law 106–346 for Buffalo,
New York Intermodal facility, $500,000 shall be available for the
Buffalo, New York Inner Harbor Redevelopment Project; of funds
made available in Public Law 108–7 for Buffalo Intermodal
Transportation Center, $5,000,000 shall be available for the Buffalo,
New York Inner Harbor Redevelopment Project.
SEC. 528. Funds in this Act that are apportioned to the
Charleston Area Regional Transportation Authority to carry out
section 5307 of title 49, United States Code, may be used to acquire
land, equipment, or facilities used in public transportation from
another governmental authority in the same geographic area: Pro-
vided, That the non-Federal share under section 5307 may include
revenues from the sale of advertising and concessions.
SEC. 529. To the extent that funds remain available within
the current budget for the project, the Secretary shall amend the
Full Funding Grant Agreement for the Tri-Met Interstate light
rail extension in Portland, Oregon, to allow acquisition of up to
a total of twenty-four light rail vehicles.
SEC. 530. Section 1023(h) of the Intermodal Surface Transpor-
tation Efficiency Act of 1991 (23 U.S.C. 127 note; Public Law
102–240 as amended by section 347 of Public Law 108–7) is
amended in paragraph (1) by striking ‘‘October 1, 2003’’ and
inserting ‘‘October 1, 2005’’.
SEC. 531. Unobligated funds in an amount not to exceed
$4,500,000 that were designated to the North Country County
Consortium, New York project in the conference report accom-
panying Public Law 108–99 under the Job Access and Reverse
Commute Account shall be transferred to and administered under
the bus category of the Capital Investment Grants Account and
available for North Country Bus and Bus Related Equipment.