SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Federal Agency Pro-
tection of Privacy Act’’.
SEC. 2. REQUIREMENT THAT AGENCY RULEMAKING TAKE
INTO CONSIDERATION IMPACTS ON INDI-
VIDUAL PRIVACY.
(a) IN GENERAL.—Title 5, United States Code, is
amended by adding after section 553 the following new
section:
‘‘§ 553a. Privacy impact analysis in rulemaking
‘‘(a) INITIAL PRIVACY IMPACT ANALYSIS.—
‘‘(1) IN GENERAL.—Whenever an agency is re-
quired by section 553 of this title, or any other law,
to publish a general notice of proposed rulemaking
for any proposed rule, or publishes a notice of pro-
posed rulemaking for an interpretative rule involving
the internal revenue laws of the United States, the
agency shall prepare and make available for public
comment an initial privacy impact analysis. Such
analysis shall describe the impact of the proposed
rule on the privacy of individuals. The initial privacy
impact analysis or a summary shall be signed by the
senior agency official with primary responsibility for
privacy policy and be published in the Federal Reg-
ister at the time of the publication of a general no-
tice of proposed rulemaking for the rule.
‘‘(2) CONTENTS.—Each initial privacy impact
analysis required under this subsection shall contain
the following:
‘‘(A) A description and assessment of the
extent to which the proposed rule will impact
the privacy interests of individuals, including
the extent to which the proposed rule—
‘‘(i) provides notice of the collection of
personally identifiable information, and
specifies what personally identifiable infor-
mation is to be collected and how it is to
be collected, maintained, used, and dis-
closed;
‘‘(ii) allows access to such information
by the person to whom the personally iden-
tifiable information pertains and provides
an opportunity to correct inaccuracies;
‘‘(iii) 
prevents 
such 
information,
which is collected for one purpose, from
being used for another purpose; and
‘‘(iv) provides security for such infor-
mation.
‘‘(B) A description of any significant alter-
natives to the proposed rule which accomplish
the stated objectives of applicable statutes and
which minimize any significant privacy impact
of the proposed rule on individuals.
‘‘(b) FINAL PRIVACY IMPACT ANALYSIS.—
‘‘(1) IN GENERAL.—Whenever an agency pro-
mulgates a final rule under section 553 of this title,
after being required by that section or any other law
to publish a general notice of proposed rulemaking,
or promulgates a final interpretative rule involving
the internal revenue laws of the United States, the
agency shall prepare a final privacy impact analysis,
signed by the senior agency official with primary re-
sponsibility for privacy policy.
‘‘(2) CONTENTS.—Each final privacy impact
analysis required under this subsection shall contain
the following:
‘‘(A) A description and assessment of the
extent to which the final rule will impact the
privacy interests of individuals, including the
extent to which the proposed rule—
‘‘(i) provides notice of the collection of
personally identifiable information, and
specifies what personally identifiable infor-
mation is to be collected and how it is to
be collected, maintained, used, and dis-
closed;
‘‘(ii) allows access to such information
by the person to whom the personally iden-
tifiable information pertains and provides
an opportunity to correct inaccuracies;
‘‘(iii) 
prevents 
such 
information,
which is collected for one purpose, from
being used for another purpose; and
‘‘(iv) provides security for such infor-
mation.
‘‘(B) A summary of the significant issues
raised by the public comments in response to
the initial privacy impact analysis, a summary
of the assessment of the agency of such issues,
and a statement of any changes made in the
proposed rule as a result of such issues.
‘‘(C) A description of the steps the agency
has taken to minimize the significant privacy
impact on individuals consistent with the stated
objectives of applicable statutes, including a
statement of the factual, policy, and legal rea-
sons for selecting the alternative adopted in the
final rule and why each one of the other signifi-
cant alternatives to the rule considered by the
agency which affect the privacy interests of in-
dividuals was rejected.
‘‘(3) AVAILABILITY
TO
PUBLIC.—The agency
shall make copies of the final privacy impact anal-
ysis available to members of the public and shall
publish in the Federal Register such analysis or a
summary thereof.
‘‘(c) PROCEDURE FOR WAIVER OR DELAY OF COM-
PLETION.—An agency head may waive or delay the com-
pletion of some or all of the requirements of subsections
(a) and (b) to the same extent as the agency head may,
under section 608, waive or delay the completion of some
or all of the requirements of sections 603 and 604, respec-
tively.
‘‘(d) PROCEDURES FOR GATHERING COMMENTS.—
When any rule is promulgated which may have a signifi-
cant privacy impact on individuals, or a privacy impact
on a substantial number of individuals, the head of the
agency promulgating the rule or the official of the agency
with statutory responsibility for the promulgation of the
rule shall assure that individuals have been given an op-
portunity to participate in the rulemaking for the rule
through techniques such as—
‘‘(1) the inclusion in an advance notice of pro-
posed rulemaking, if issued, of a statement that the
proposed rule may have a significant privacy impact
on individuals, or a privacy impact on a substantial
number of individuals;
‘‘(2) the publication of a general notice of pro-
posed rulemaking in publications of national circula-
tion likely to be obtained by individuals;
‘‘(3) the direct notification of interested individ-
uals;
‘‘(4) the conduct of open conferences or public
hearings concerning the rule for individuals, includ-
ing soliciting and receiving comments over computer
networks; and
‘‘(5) the adoption or modification of agency
procedural rules to reduce the cost or complexity of
participation in the rulemaking by individuals.
‘‘(e) PERIODIC REVIEW OF RULES.—
‘‘(1) IN
GENERAL.—Each agency shall carry
out a periodic review of the rules promulgated by the
agency that have a significant privacy impact on in-
dividuals, or a privacy impact on a substantial num-
ber of individuals. Under such periodic review, the
agency shall determine, for each such rule, whether
the rule can be amended or rescinded in a manner
that minimizes any such impact while remaining in
accordance with applicable statutes. For each such
ance with subsections (b) and (c) in accordance with
chapter 7. Agency compliance with subsection (d)
shall be judicially reviewable in connection with judi-
cial review of subsection (b).
‘‘(3) LIMITATIONS.—
‘‘(A) An individual may seek such review
during the period beginning on the date of final
agency action and ending 1 year later, except
that where a provision of law requires that an
action challenging a final agency action be com-
menced before the expiration of 1 year, such
lesser period shall apply to an action for judicial
review under this subsection.
‘‘(B) In the case where an agency delays
the issuance of a final privacy impact analysis
pursuant to subsection (c), an action for judi-
cial review under this section shall be filed not
later than—
‘‘(i) 1 year after the date the analysis
is made available to the public; or
‘‘(ii) where a provision of law requires
that an action challenging a final agency
regulation be commenced before the expi-
ration of the 1-year period, the number of
days specified in such provision of law that
is after the date the analysis is made avail-
able to the public.
‘‘(4) RELIEF.—In granting any relief in an ac-
tion under this subsection, the court shall order the
agency to take corrective action consistent with this
section and chapter 7, including, but not limited
to—
‘‘(A) remanding the rule to the agency;
and
‘‘(B) deferring the enforcement of the rule
against individuals, unless the court finds that
continued enforcement of the rule is in the pub-
lic interest.
‘‘(5) RULE
OF
CONSTRUCTION.—Nothing in
this subsection shall be construed to limit the au-
thority of any court to stay the effective date of any
rule or provision thereof under any other provision
of law or to grant any other relief in addition to the
requirements of this subsection.
‘‘(6) RECORD OF AGENCY ACTION.—In an ac-
tion for the judicial review of a rule, the privacy im-
pact analysis for such rule, including an analysis
prepared or corrected pursuant to paragraph (4),
shall constitute part of the entire record of agency
action in connection with such review.
‘‘(7) EXCLUSIVITY.—Compliance or noncompli-
ance by an agency with the provisions of this section
shall be subject to judicial review only in accordance
with this subsection.
‘‘(8) SAVINGS CLAUSE.—Nothing in this sub-
section bars judicial review of any other impact
statement or similar analysis required by any other
law if judicial review of such statement or analysis
is otherwise permitted by law.
‘‘(g) DEFINITION.—For purposes of this section, the
term ‘personally identifiable information’ means informa-
tion that can be used to identify an individual, including
such individual’s name, address, telephone number, photo-
graph, social security number or other identifying infor-
mation. It includes information about such individual’s
medical or financial condition.’’.
(b) PERIODIC REVIEW TRANSITION PROVISIONS.—
(1) INITIAL PLAN.—For each agency, the plan
required by subsection (e) of section 553a of title 5,
United States Code (as added by subsection (a)),
shall be published not later than 180 days after the
date of the enactment of this Act.
(2) In the case of a rule promulgated by an
agency before the date of the enactment of this Act,
such plan shall provide for the periodic review of
such rule before the expiration of the 10-year period
beginning on the date of the enactment of this Act.
For any such rule, the head of the agency may pro-
vide for a 1-year extension of such period if the head
of the agency, before the expiration of the period,
certifies in a statement published in the Federal
Register that reviewing such rule before the expira-
tion of the period is not feasible. The head of the
agency may provide for additional 1-year extensions
of the period pursuant to the preceding sentence,
but in no event may the period exceed 15 years.
(c) CONGRESSIONAL REVIEW.—Section 801(a)(1)(B)
of title 5, United States Code, is amended—
(1) by redesignating clauses (iii) and (iv) as
clauses (iv) and (v), respectively; and
(2) by inserting after clause (ii) the following
new clause:
‘‘(iii) the agency’s actions relevant to section
553a;’’.
(d) CLERICAL AMENDMENT.—The table of sections
at the beginning of chapter 5 of title 5, United States
Code, is amended by adding after the item relating to sec-
tion 553 the following new item:
‘‘553a. Privacy impact analysis in rulemaking.’’.
Passed the House of Representatives October 7,
2002.
Attest:
Clerk.