I 
109TH CONGRESS 
2D SESSION 
H. R. 5838 
To amend title 44, United States Code, to strengthen requirements related 
to security breaches of data involving the disclosure of sensitive personal 
information. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 19, 2006 
Mr. TOM DAVIS of Virginia (for himself, Ms. PRYCE of Ohio, Mr. BUYER, Mr. 
BRADLEY of New Hampshire, and Ms. CORRINE BROWN of Florida) in-
troduced the following bill; which was referred to the Committee on Gov-
ernment Reform 
A BILL 
To amend title 44, United States Code, to strengthen re-
quirements related to security breaches of data involving 
the disclosure of sensitive personal information. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Agency Data 
Breach Notification Act’’. 
VerDate Aug 31 2005 
00:38 Jul 21, 2006
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5838.IH
H5838
ycherry on PROD1PC64 with BILLS
SEC. 2. FEDERAL AGENCY DATA BREACH NOTIFICATION 
REQUIREMENTS. 
(a) AUTHORITY OF DIRECTOR OF OFFICE OF MAN-
AGEMENT AND BUDGET TO ESTABLISH DATA BREACH 
POLICIES.—Section 3543(a) of title 44, United States 
Code, is amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
(3) by adding at the end the following: 
‘‘(9) establishing policies, procedures, and 
standards for agencies to follow in the event of a 
breach of data security involving the disclosure of 
sensitive personal information in violation of section 
552a of title 5, including a requirement for timely 
notice to be given to those individuals whose sen-
sitive personal information could be compromised as 
a result of such breach, except no notice shall be re-
quired if the breach does not create a reasonable 
risk of identity theft, fraud, or other unlawful con-
duct regarding such individual.’’. 
(b) AUTHORITY OF CHIEF INFORMATION OFFICER 
TO
ENFORCE
DATA
BREACH
POLICIES.—Section 
3544(a)(3) of title 44, United States Code, is amended 
by inserting after ‘‘authority to ensure compliance with’’ 
VerDate Aug 31 2005 
00:38 Jul 21, 2006
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5838.IH
H5838
ycherry on PROD1PC64 with BILLS
the following: ‘‘and, to the extent determined necessary 
and explicitly authorized by the head of the agency, to en-
force’’. 
(c) INCLUSION OF DATA BREACH NOTIFICATION IN 
AGENCY INFORMATION SECURITY PROGRAMS.—Section 
3544(b) of title 44, United States Code, is amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
(3) by adding at the end the following: 
‘‘(9) procedures for notifying individuals whose 
sensitive personal information is compromised con-
sistent with policies, procedures, and standards es-
tablished under section 3543(a)(9) of this title.’’. 
(d) SENSITIVE PERSONAL INFORMATION DEFINI-
TION.—Section 3542(b) of title 44, United States Code, 
is amended by adding at the end the following new para-
graph: 
‘‘(4) The term ‘sensitive personal information’ 
means any information contained in a record, as de-
fined in section 552a(4) of title 5.’’. 
Æ 
VerDate Aug 31 2005 
00:38 Jul 21, 2006
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6301
E:\BILLS\H5838.IH
H5838
ycherry on PROD1PC64 with BILLS