Federal Agency Data Protection Act

Bill: 110-hr-4791
Sponsor: Rep. Clay, Wm. Lacy [D-MO-1]
Introduced: 2007-12-18 in the House
Policy area: Government Operations and Politics
Subjects: Administrative procedure
Authorization
Civil Rights and Liberties, Minority Issues
Computer networks
Computer security measures
Computers
Credit insurance
Crime and Law Enforcement
Criminal justice information
Data banks
Economics and Public Finance
Education
Elementary and secondary education
Encryption
Finance and Financial Sector
Financial statements
Fraud
Government contractors
Government paperwork
Government procurement
Government property
Government publicity
Health
Higher education
Identification devices
Identity theft
Information services
Labor and Employment
Law
Medical records
Office of Management and Budget
Personnel records
Public records
Right of privacy
Science, Technology, Communications
Security measures
Student records

Summary:
action_date: 2007-12-18
text: 
Federal Agency Data Protection Act - Defines &quot;personally identifiable information&quot; as any information about an individual maintained by a federal agency, including information about the individual's education, finances, medical, criminal, or employment history, that can be used to distinguish or trace such individual's identity or that is linked or linkable to the individual. 

Includes within the information security duties of the Director of the Office of Management and Budget (OMB): (1) the establishment of minimum requirements for the protection of information maintained in or transmitted by mobile digital devices, including requirements for the encryption of such information or the use of technologies that render information unusable by unauthorized persons; (2) the establishment of minimum requirements for agency actions following a breach of information security; (3) notification of individuals whose personally identifiable information may have been compromised or accessed during a security breach; and (4) requiring agencies to comply with minimally acceptable system configuration requirements consistent with best practices.

Requires federal agencies to: (1) adopt plans and procedures for ensuring the adequacy of information security protections for systems maintaining or transmitting personally identifiable information; (2) develop and implement a plan to protect the security and privacy of federal government computers and networks from the risks posed by peer-to-peer file sharing; and (3) undergo audits (currently, evaluations are required) of their information programs and practices.

Amends the E-Government Act of 2002 to prohibit agencies from contracting with data brokers to access information on U.S. persons unless agency head completes a privacy impact assessment and implements other safeguards.

Extends the authorization of appropriations for information security programs through FY 2012.

action_date: 2008-06-03
text: 
Federal Agency Data Protection Act - (Sec. 3) Defines &quot;personally identifiable information&quot; as any information about an individual maintained by a federal agency, including information about the individual's education, finances, medical, criminal, or employment history, that can be used to distinguish or trace such individual's identity or that is otherwise linked or linkable to the individual. 

(Sec. 4) Includes within the information security duties of the Director of the Office of Management and Budget (OMB): (1) reviewing agency information security programs, including plans and schedules, developed on the basis of priorities for addressing levels of identified risk, for conducting testing and evaluation and remedial action to address deficiencies; (2) establishing minimum requirements for the protection of personally identifiable information maintained in or transmitted by mobile digital devices, including requirements for the use of technologies that efficiently and effectively render information unusable by unauthorized persons; (3) requiring agencies to comply with minimally acceptable system configuration requirements consistent with best practices, including checklists developed under the Cyber Security Research and Development Act by the Director of the National Institute of Standards and Technology, and minimally acceptable requirements for periodic testing and evaluation of the implementation of such configuration requirements; (4) ensuring that agency contracts for the provision of information technology products or services include requirements for contractors to meet such configuration requirements; and (5) ensuring the establishment of contract requirements to ensure compliance with this Act with regard to providing security for information and information systems used or operated by an agency contractor or other organization on the agency's behalf.

(Sec. 5) Requires agencies to include in their information security programs: (1) policies and procedures that ensure compliance with minimally acceptable system configuration requirements as required by the Director (currently, the agency); (2) periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices as approved by the Director that include testing of systems operated by an agency contractor; and (3) plans and procedures for ensuring the adequacy of information security protections for systems maintaining or transmitting personally identifiable information, including requirements for maintaining a current inventory of such systems, implementing information security requirements for mobile digital devices maintaining or transmitting such information, and developing, implementing, and overseeing remediation plans to address vulnerabilities in information security protections. Allows testing requirements to be satisfied by independent testing, evaluation, or audits.

(Sec. 6) Requires the Director to report to Congress on a summary of information security breaches reported by agencies to the Director and the federal information security incident center.

Requires the Director to oversee the establishment of policies, procedures, and standards for agencies to follow in the event of a breach involving the disclosure of personally identifiable information, specifically including: (1) a requirement for timely notice to those individuals whose information could be compromised, except when the breach does not create a reasonable risk of identity theft, fraud, or other unlawful conduct or of other harm to the individual; (2) guidance regarding whether additional special actions are necessary and appropriate, including data breach analysis, fraud resolution services, identify theft insurance, and credit protection or monitoring services; and (3) a requirement for the timely reporting of such breaches to the Director and federal information security center.

Requires agency heads to delegate to their Chief Information Officer the authority to ensure compliance and to enforce information security requirements, including developing and maintaining an inventory of personal computers laptops or hardware containing personally identifiable information.

Requires agencies to include in their information security programs: (1) procedures for notifying individuals whose personally identifiable information may have been compromised or accessed following a breach; and (2) procedures for the timely reporting of breaches involving personally identifiable information.

Includes among functions of Chief Human Capital Officers the prescription of policies and procedures for exit interviews of employees, including a full accounting of all federal personal property assigned.
 
(Sec. 7) Requires agency heads to implement expeditiously and revise as necessary a plan to ensure the security and privacy of information collected or maintained by or on behalf of agencies from the risks posed by certain peer-to-peer file sharing programs. Requires the Comptroller General to review and report to specified congressional committees on the adequacy of such plans.
 
(Sec. 8) Requires audits (currently, evaluations are required) of agency information programs and practices to determine whether information security controls are effective.

(Sec. 9) Amends the E-Government Act of 2002 to require the Director to develop best practices for agencies to follow in conducting privacy impact assessments.


Legislative actions:
action_date: 2008-06-04
text: Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
action_date: 2008-06-03
text: Motion to reconsider laid on the table Agreed to without objection.
action_date: 2008-06-03
text: On motion to suspend the rules and pass the bill, as amended Agreed to by voice vote. (text: CR H4853-4854)
action_date: 2008-06-03
text: Passed/agreed to in House: On motion to suspend the rules and pass the bill, as amended Agreed to by voice vote.(text: CR H4853-4854)
action_date: 2008-06-03
text: DEBATE - The House proceeded with forty minutes of debate on H.R. 4791.
action_date: 2008-06-03
text: Considered under suspension of the rules. (consideration: CR H4853-4856)
action_date: 2008-06-03
text: Mr. Clay moved to suspend the rules and pass the bill, as amended.
action_date: 2008-05-21
text: Placed on the Union Calendar, Calendar No. 417.
action_date: 2008-05-21
text: Reported (Amended) by the Committee on Oversight and Government. H. Rept. 110-664.
action_date: 2008-05-21
text: Reported (Amended) by the Committee on Oversight and Government. H. Rept. 110-664.
action_date: 2008-04-16
text: Ordered to be Reported (Amended) by Voice Vote.
action_date: 2008-04-16
text: Subcommittee on Information Policy, Census, and National Archives Discharged.
action_date: 2008-02-14
text: Subcommittee Hearings Held.
action_date: 2008-01-16
text: Referred to the Subcommittee on Information Policy, Census, and National Archives.
action_date: 2007-12-18
text: Referred to the House Committee on Oversight and Government Reform.
action_date: 2007-12-18
text: Introduced in House
action_date: 2007-12-18
text: Introduced in House