S.Amdt. 2618

SA 2618. Mr. AKAKA (for himself, Mr. Blumenthal, Mr. Coons, Mr. Franken, Mr. Sanders, Mr. Udall of New Mexico, and Mr. Wyden) submitted an amendment intended to be proposed by him to the bill S. 3414, to enhance the security and resiliency of the cyber and communications infrastructure of the United States; which was ordered to lie on the table; as follows:

On page 105, after the end of the matter between lines 11 and 12, insert the following:

SEC. 205. PRIVACY BREACH REQUIREMENTS.

(a) In General.--Subchapter II of chapter 35 of title 44, United States Code, as amended by section 201 of this Act, is amended by adding at the end the following:

“Sec. 3559. Privacy breach requirements

“(a) Policies and Procedures.--The Secretary shall establish and oversee policies and procedures for agencies to follow in the event of a breach of information security involving the disclosure of personally identifiable information, including requirements for--

“(1) timely notice to the individuals whose personally identifiable information could be compromised as a result of such breach;

“(2) timely reporting to a Federal cybersecurity center (as defined in section 708 of the Cybersecurity Act of 2012), as designated by the Secretary; and

“(3) additional actions as necessary and appropriate, including data breach analysis, fraud resolution services, identity theft insurance, and credit protection or monitoring services.

“(b) Required Agency Action.--The head of each agency shall ensure that actions taken in response to a breach of information security involving the disclosure of personally identifiable information under the authority or control of the agency comply with policies and procedures established by the Secretary under subsection (a).

“(c) Report.--Not later than March 1 of each year, the Secretary shall report to Congress on agency compliance with the policies and procedures established under subsection (a).”.

(b) Technical and Conforming Amendment.--The table of sections for subtitle II for chapter 35 of title 44, United States Code, as amended by section 201 of this Act, is amended by adding at the end the following:

“3559. Privacy breach requirements.”.

SEC. 206. AMENDMENTS TO THE E-GOVERNMENT ACT OF 2002.

Section 208(b)(1)(A) of the E-Government Act of 2002 (44 U.S.C. 3501 note; Public Law 107-347) is amended--

(1) in clause (i), by striking “or” at the end;

(2) in clause (ii), by striking the period at the end and inserting “; or”; and

(3) by adding at the end the following:

“(iii) using information in an identifiable form purchased, or subscribed to for a fee, from a commercial data source.”.

SEC. 207. AUTHORITY OF THE DIRECTOR OF THE OFFICE OF MANAGEMENT AND BUDGET WITH RESPECT TO FEDERAL INFORMATION POLICY.

Section 3504(g) of title 44, United States Code, is amended--

(1) paragraph (1), by striking “and” at the end;

(2) in paragraph (2), by striking the period at the end and inserting “; and”; and

(3) by adding at the end the following:

“(3) designate a Federal Chief Privacy Officer within the Office of Management and Budget who is a noncareer appointee in a Senior Executive Service position and who is a trained and experienced privacy professional to carry out the responsibilities of the Director with regard to privacy.”.

SEC. 208. CIVIL REMEDIES UNDER THE PRIVACY ACT.

Section 552a(g)(4)(A) of title 5, United States Code, is amended--

(1) by striking “actual damages” and inserting “provable damages, including damages that are not pecuniary damages,”; and

(2) by striking “, but in no case shall a person entitled to recovery receive less than the sum of $1,000” and inserting “or the sum of $1,000, whichever is greater.”.

On page 188, lines 5 through 7, strike “the Chief Privacy and Civil Liberties Officer of the Department of Justice and the Chief Privacy Officer of the Department” and insert “the Federal Chief Privacy Officer”.

On page 191, line 19, strike “actual damages” and insert “provable damages, including damages that are not pecuniary damages,”