SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Federal Agency Data Protection Act’’. 
(b) TABLE OF CONTENTS.—The table of contents of 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Purpose. 
Sec. 3. Definitions. 
Sec. 4. Authority of Director of Office of Management and Budget to establish 
information security policies and procedures. 
Sec. 5. Responsibilities of Federal agencies for information security. 
Sec. 6. Federal agency data breach notification requirements. 
Sec. 7. Protection of government computers from risks of peer-to-peer file shar-
ing. 
Sec. 8. Annual independent audit. 
Sec. 9. Best practices for privacy impact assessments. 
Sec. 10. Implementation. 
SEC. 2. PURPOSE. 
The purpose of this Act is to protect personally iden-
tifiable information of individuals that is maintained in or 
transmitted by Federal agency information systems. 
SEC. 3. DEFINITIONS. 
(a) PERSONALLY IDENTIFIABLE INFORMATION AND 
MOBILE
DIGITAL
DEVICE
DEFINITIONS.—Section 
3542(b) of title 44, United States Code, is amended by 
adding at the end the following new paragraphs: 
‘‘(4) The term ‘personally identifiable informa-
tion’, with respect to an individual, means any infor-
mation about the individual maintained by an agen-
cy, including information—
‘‘(A) about the individual’s education, fi-
nances, or medical, criminal, or employment 
history; 
‘‘(B) that can be used to distinguish or 
trace the individual’s identity, including name, 
social security number, date and place of birth, 
mother’s maiden name, or biometric records; or 
‘‘(C) that is otherwise linked or linkable to 
the individual. 
‘‘(5) The term ‘mobile digital device’ includes 
any device that can store or process information 
electronically and is designed to be used in a manner 
not limited to a fixed location, including— 
‘‘(A) processing devices such as laptop 
computers, communication devices, and other 
hand-held computing devices; and 
‘‘(B) storage devices such as portable hard 
drives, CD–ROMs, DVDs, and other portable 
electronic media.’’. 
(b) CONFORMING AMENDMENTS.—Section 208 of the 
E-Government Act of 2002 (Public Law 107–347; 44 
U.S.C. 3501 note) is amended— 
(1) in subsection (b)(1)(A)—
(A) in clause (i), by striking ‘‘information 
that is in an identifiable form’’ and inserting 
‘‘personally identifiable information’’; and 
(B) in clause (ii)(II), by striking ‘‘informa-
tion in an identifiable form permitting the phys-
ical or online contacting of a specific indi-
vidual’’ and inserting ‘‘personally identifiable 
information’’; 
(2) in subsection (b)(2)(B)(i), by striking ‘‘in-
formation that is in an identifiable form’’ and insert-
ing ‘‘personally identifiable information’’; 
(3) in subsection (b)(3)(C), by striking ‘‘infor-
mation that is in an identifiable form’’ and inserting 
‘‘personally identifiable information’’; and 
(4) in subsection (d), by striking the text and 
inserting ‘‘In this section, the term ‘personally iden-
tifiable information’ has the meaning given that 
term in section 3542(b)(4) of title 44, United States 
Code.’’. 
SEC. 4. AUTHORITY OF DIRECTOR OF OFFICE OF MANAGE-
MENT AND BUDGET TO ESTABLISH INFORMA-
TION SECURITY POLICIES AND PROCEDURES. 
Section 3543(a) of title 44, United States Code, is 
amended—
(1) by inserting before the semicolon at the end 
of paragraph (5) the following: ‘‘, including plans 
and schedules, developed by the agency on the basis 
of priorities for addressing levels of identified risk, 
for conducting— 
‘‘(A) testing and evaluation, as required 
under section 3544(b)(5); and 
‘‘(B) remedial action, as required under 
section 3544(b)(6), to address deficiencies iden-
tified by such testing and evaluation’’; and 
(2) by adding at the end the following: 
‘‘(9) establishing minimum requirements re-
garding the protection of personally identifiable in-
formation maintained in or transmitted by mobile 
digital devices, including requirements for the use of 
technologies that efficiently and effectively render in-
formation unusable by unauthorized persons; 
‘‘(10) requiring agencies to comply with— 
‘‘(A) minimally acceptable system configu-
ration requirements consistent with best prac-
tices, including checklists developed under sec-
tion 8(c) of the Cyber Security Research and 
Development Act (Public Law 107–305; 116 
Stat. 2378) by the Director of the National In-
stitute of Standards and Technology; and
‘‘(B) minimally acceptable requirements 
for periodic testing and evaluation of the imple-
mentation of such configuration requirements; 
‘‘(11) ensuring that agency contracts for (or in-
volving or including) the provision of information 
technology products or services include requirements 
for contractors to meet minimally acceptable con-
figuration requirements, as required under para-
graph (10); 
‘‘(12) ensuring the establishment through regu-
lation and guidance of contract requirements to en-
sure compliance with this subchapter with regard to 
providing information security for information and 
information systems used or operated by a con-
tractor of an agency or other organization on behalf 
of the agency; and’’. 
SEC. 5. RESPONSIBILITIES OF FEDERAL AGENCIES FOR IN-
FORMATION SECURITY. 
Section 3544(b) of title 44, United States Code, is 
amended— 
(1) in paragraph (2)(D)(iii), by striking ‘‘as de-
termined by the agency’’ and inserting ‘‘as required 
by the Director under section 3543(a)(10)’’; 
(2) in paragraph (5)—