To protect the privacy of personal information provided by United States travelers who participated in the Registered Traveler program.

SA 1464. Mr. GREGG submitted an amendment intended to be proposed to
amendment SA 1373 proposed by Mr. Reid (for Mr. Byrd (for himself, Mr.
Inouye, and Mrs. Murray)) to the bill H.R. 2892, making appropriations
for the Department of Homeland Security for the fiscal year ending
September 30, 2010, and for other purposes; as follows:

At the appropriate place, insert the following:

SEC. __. PROPER DISPOSAL OF PERSONAL INFORMATION COLLECTED
THROUGH THE REGISTERED TRAVELER PROGRAM.

(a) In General.--Any company that collects or retains
personal information from individuals who participated in the
Registered Traveler program shall safeguard and dispose of
such information in accordance with the requirements in--
(1) the National Institute for Standards and Technology
Special Publication 800-30, entitled ``Risk Management Guide
for Information Technology Systems''; and
(2) the National Institute for Standards and Technology
Special Publication 800-53, Revision 3, entitled
``Recommended Security Controls for Federal Information
Systems and Organizations,'';
(3) any supplemental standards established by the Assistant
Secretary, Transportation Security Administration (referred
to in this section as the ``Assistant Secretary'').
(b) Certification.--The Assistant Secretary shall--
(1) review the procedures used to safeguard and dispose of
such information; and
(2) require any company described in subsection (a) to
provide, not later than 30 days after the date of the
enactment of this Act, written certification to the
sponsoring aircraft operator or airport operator that such
procedures are consistent with the minimum standards
established under paragraph (1).
(c) Report.--Not later than 90 days after the date of the
enactment of this Act, the Assistant Secretary shall submit a
report to Congress that--
(1) describes the procedures that have been used to
safeguard and dispose of personal information collected
through the Registered Traveler program; and
(2) provides the status of the certification by any company
described in subsection (a) that such procedures are
consistent with the minimum standards established by the
Assistant Secretary.
______