(C) the currently available and widely ac-
cepted technological, administrative, and phys-
ical means to protect covered data under the 
control of the covered entity; 
(D) the cost associated with implementing, 
maintaining, and regularly reviewing the safe-
guards; and 
(E) the impact of these requirements on 
small- and medium-sized businesses. 
(2) LIMITATIONS.—In promulgating the regula-
tions required under this section, the Commission 
shall consider a covered entity who is in compliance 
with existing information security laws that the 
Commission determines are sufficiently rigorous to 
be in compliance with this section with respect to 
particular types of covered data to the extent those 
types of covered data are covered by such law, in-
cluding the following: 
(A) Title V of the Gramm-Leach-Bliley Act 
(15 U.S.C. 6801 et seq.). 
(B) The Health Information Technology 
for Economic and Clinical Health Act (42 
U.S.C. 17931). 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(C) The Health Insurance Portability and 
Accountability Act of 1996 Security Rule (45 
CFR 160.103 and part 164). 
(D) Any other existing law requiring a cov-
ered entity to implement and maintain informa-
tion security practices and procedures that the 
Commission determines to be sufficiently rig-
orous. 
SEC. 7. PRIVACY PROTECTION OFFICERS. 
(a) APPOINTMENT OF A PRIVACY PROTECTION OFFI-
CER.—Each covered entity with annual revenue in excess 
of $50,000,000 the prior year shall designate at least 1 
appropriately qualified employee as a privacy protection 
officer who shall— 
(1) educate employees about compliance re-
quirements; 
(2) train employees involved in data processing; 
(3) conduct regular, comprehensive audits to 
ensure compliance and make records of the audits 
available to enforcement authorities upon request; 
(4) maintain updated, clear, and understand-
able records of all data security practices undertaken 
by the covered entity; 
(5) serve as the point of contact between the 
covered entity and enforcement authorities; and 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(6) advocate for policies and practices within 
the covered entity that promote individual privacy. 
(b) PROTECTIONS.—The privacy protection officer 
shall not be dismissed or otherwise penalized by the cov-
ered entity for performing any of the tasks assigned to 
the person under this section. 
SEC. 8. RESEARCH INTO PRIVACY ENHANCING TECH-
NOLOGY. 
(a) NATIONAL SCIENCE FOUNDATION SUPPORT OF 
RESEARCH ON PRIVACY ENHANCING TECHNOLOGY.—The 
Director of the National Science Foundation, in consulta-
tion with other relevant Federal agencies (as determined 
by the Director), shall support merit-reviewed and com-
petitively awarded research on privacy enhancing tech-
nologies, which may include— 
(1) fundamental research on technologies for 
de-identification, pseudonymization, anonymization, 
or obfuscation of covered data in data sets while 
maintaining fairness, accuracy, and efficiency; 
(2) fundamental research on algorithms and 
other similar mathematical tools used to protect in-
dividual privacy when collecting, storing, sharing, or 
aggregating data; 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(3) fundamental research on technologies that 
promote data minimization principles in data collec-
tion, sharing, and analytics; and 
(4) research awards on privacy enhancing tech-
nologies coordinated with other relevant Federal 
agencies and programs. 
(b) INTEGRATION INTO THE COMPUTER AND NET-
WORK SECURITY PROGRAM.—Subparagraph (D) of sec-
tion 4(a)(1) of the Cyber Security Research and Develop-
ment Act (15 U.S.C. 7403(a)(1)(D)) is amended to read 
as follows: 
‘‘(D) privacy enhancing technologies and 
confidentiality;’’. 
(c) COORDINATION WITH THE NATIONAL INSTITUTE 
OF STANDARDS AND TECHNOLOGY AND OTHER STAKE-
HOLDERS.— 
(1) IN GENERAL.—The Director of the Office of 
Science and Technology Policy, acting through the 
Networking and Information Technology Research 
and Development Program, shall coordinate with the 
Director of the National Science Foundation, the Di-
rector of the National Institute of Standards and 
Technology, and the Commission to accelerate the 
development and use of privacy enhancing tech-
nologies. 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS
(2) OUTREACH.—The Director of the National 
Institute of Standards and Technology shall conduct 
outreach to— 
(A) receive input from private, public, and 
academic stakeholders, including the National 
Institutes of Health and the Centers for Dis-
ease Control and Prevention, for the purpose of 
facilitating public health research, on the devel-
opment of privacy enhancing technologies; and 
(B) develop ongoing public and private sec-
tor engagement to create and disseminate vol-
untary, consensus-based resources to increase 
the integration of privacy enhancing tech-
nologies in data collection, sharing, and ana-
lytics by the public and private sectors. 
(d) REPORT ON RESEARCH AND STANDARDS DEVEL-
OPMENT.—Not later than 2 years after the date of enact-
ment of this Act, the Director of the Office of Science and 
Technology Policy, acting through the Networking and In-
formation Technology Research and Development Pro-
gram, shall, in coordination with the Director of the Na-
tional Science Foundation and the Director of the Na-
tional Institute of Standards and Technology, submit to 
the Committee on Commerce, Science, and Transportation 
of the Senate, the Subcommittee on Commerce, Justice, 
VerDate Sep 11 2014 
22:34 Nov 04, 2021
Jkt 029200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H5807.IH
H5807
pamtmann on DSKBC07HB2PROD with BILLS