Military Data Privacy Act
Bill: H.R.8662 | Sponsor: Rep. Jacobs, Sara (D-CA)
Policy area: Armed Forces and National Security

Summary:
Military Data Privacy Act
This bill requires the Department of Defense (DOD) to submit an unclassified report identifying certain defense entities that were, or are currently, obtaining in exchange for anything of value specified personal records of individuals (e.g., location data generated by phones likely to be located in the United States) and retaining or using such records without a court order. The report must be made available to the public on a DOD website.

To require a report on the purchase and use by the Department of 
 Defense of certain location data and internet metadata data, and for 
                            other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Military Data Privacy Act''.

SEC. 2. REPORT ON PURCHASE AND USE BY DEPARTMENT OF DEFENSE OF LOCATION 
              DATA GENERATED BY AMERICANS' PHONES AND THEIR INTERNET 
              METADATA.

    (a) Report Required.--Not later than 90 days after the date of the 
enactment of this Act, the Secretary of Defense shall submit to the 
congressional defense committees and make available to the public on an 
internet website of the Department of Defense a report that--
            (1) identifies each covered entity that is currently, or 
        during the five-year period ending on the date of the enactment 
        of this Act was, without a court order--
                    (A) obtaining in exchange for anything of value any 
                covered records; and
                    (B) intentionally retaining or intentionally using 
                such covered records; and
            (2) for each covered entity identified pursuant to 
        paragraph (1), identifies--
                    (A) each category of covered record the covered 
                entity, without a court order, is obtaining or 
                obtained, in exchange for anything of value;
                    (B) whether the covered entity intentionally 
                retained or is intentionally retaining each category of 
                covered records pursuant to subparagraph (A);
                    (C) whether the covered entity intentionally uses 
                or used each category of covered records identified 
                pursuant to subparagraph (A); and
                    (D) whether such obtaining, retention, and use 
                ceased before the date of the enactment of this Act or 
                is ongoing.
    (b) Form.--The report submitted under subsection (a) shall be 
submitted in unclassified form.
    (c) Determination of Parties to a Communication.--In determining 
under this section whether a party to a communication is likely to be 
located inside or outside the United States, the Secretary shall 
consider the Internet Protocol (IP) address used by the party to the 
communication, but may also consider other information known to the 
Secretary.
    (d) Definitions.--In this section:
            (1) The term ``congressional defense committees'' has the 
        meaning given that term in section 101(a) of title 10, United 
        States Code.
            (2) The term ``covered entities'' means the Defense 
        Agencies, Department of Defense activities, and components of 
        the Department that--
                    (A) are under the authority, direction, and control 
                of the Under Secretary of Defense for Intelligence and 
                Security; or
                    (B) over which the Under Secretary exercises 
                planning, policy, funding, or strategic oversight 
                authority.
            (3) The term ``covered records'' includes the following:
                    (A) Location data generated by phones that are 
                likely to be located in the United States.
                    (B) Domestic phone call records.
                    (C) International phone call records.
                    (D) Domestic text message records.
                    (E) International text message records.
                    (F) Domestic netflow records.
                    (G) International netflow records.
                    (H) Domestic Domain Name System records.
                    (I) International Domain Name System records.
                    (J) Other types of domestic internet metadata.
                    (K) Other types of international internet metadata.
            (4) The term ``domestic'' means a telephone or an internet 
        communication in which all parties to the communication are 
        likely to be located in the United States.
            (5)(A) The term ``international'' means a telephone or an 
        internet communication in which one or more parties to the 
        communication are likely to be located in the United States and 
        one or more parties to the communication are likely to be 
        located outside the United States.
            (B) The term ``international'' does not include a telephone 
        or an internet communication in which all parties to the 
        communication are likely to be located outside the United 
        States.
            (6) The term ``obtain in exchange for anything of value'' 
        means to obtain by purchasing, to receive in connection with 
        services being provided for consideration, or to otherwise 
        obtain in exchange for consideration, including an access fee, 
        service fee, maintenance fee, or licensing fee.
            (7)(A) Except as provided in subparagraph (B), the term 
        ``retain'' means the storage of a covered record.
            (B) The term ``retain'' does not include the temporary 
        storage of a covered record that will be, but has not yet been, 
        subjected to a process in which the covered record, which is 
        part of a larger compilation containing records that are not 
        covered records, are identified and deleted.
            (8)(A) Except as provided in subparagraph (B), the term 
        ``use'', with respect to a covered record, includes analyzing, 
        processing, or sharing the covered record.
            (B) The term ``use'' does not include subjecting the 
        covered record to a process in which the covered record, which 
        is part of a larger compilation containing records that are not 
        covered records, are identified and deleted.
                                 <all>