S. 2472Senate108th Congress (2003-2005)In Committee

Increasing Notice of Foreign Outsourcing Act

Introduced May 20, 2004

Legislative Activity

Stay on top of the latest movement without scrolling through every action

2 earlier actions
SenateIntro Referral Latest Action

Read twice and referred to the Committee on the Judiciary. (text of measure as introduced: CR S6007-6009)

May 20, 2004

View full timeline
SenateIntro Referral

Introduced in Senate

May 20, 2004

SenateIntro Referral

Sponsor introductory remarks on measure. (CR S6006-6007)

May 20, 2004

SenateIntro Referral

Read twice and referred to the Committee on the Judiciary. (text of measure as introduced: CR S6007-6009)

May 20, 2004

Floor Debate

22 members

What members said about S. 2472 on the floor

12 Republicans10 Democrats
Dianne Feinstein
Sen. Dianne FeinsteinD-CA · May 20, 2004

Mr. President, I rise today along with my colleague Senator Coleman to introduce the Internet Pharmacy Consumer Protection Act also called the ``Ryan Haight Act'', a bill which is vital to protect…

Mike DeWine
Sen. Mike DeWineR-OH · May 20, 2004

Mr. President, I ask unanimous consent that the Peace Corps Volunteers Health, Safety, and Security Act of 2004 be printed in the Record. Mr. President, today I join our colleague from Massachusetts,…

Susan M. Collins
Sen. Susan M. CollinsR-ME · May 20, 2004

Mr. President, I rise today with my friend and colleague, Senator Carper, to introduce the Postal Accountability and Enhancement Act of 2004, a bill designed to help the 225-year-old Postal Service…

John Warner
Sen. John WarnerR-VA · May 20, 2004

Mr. President, I rise today to introduce an important bill related to education and our national, homeland, and economic security. I am pleased to be joined in this bipartisan effort with Senators…

Norm Coleman
Sen. Norm ColemanR-MN · May 20, 2004

Mr. President, I rise to introduce two bills that expand Federal authority to prevent controlled substances from flooding into the U.S., authorizing states to shut down illegitimate virtual…

Show 8 more
John D. Rockefeller IV
Sen. John D. Rockefeller IVD-WV · May 20, 2004

Mr. President, I am proud today to introduce the Community Security Act of 2004. This bill is intended to help prepare our Nation to cope with future disasters, as well as help the daily work of our…

Edward M. Kennedy
Sen. Edward M. KennedyD-MA · May 20, 2004

Mr. President, today, Senator DeWine and I are introducing legislation to give the Food and Drug Administration broad authority to regulate tobacco products for the protection of the public health.…

Dianne Feinstein
Sen. Dianne FeinsteinD-CA · May 20, 2004

Mr. President, I rise to introduce, along with my colleague, Senator Bill Nelson, the Increasing Notice of Foreign Outsourcing Act, or the INFO Act. This legislation will help safeguard Americans'…

Christopher S. Bond
Sen. Christopher S. BondR-MO · May 20, 2004

Mr. President, today, I join my colleagues, Senators Harkin, Durbin, Talent, Grassley, Coleman, Fitzgerald and Pryor to introduce bipartisan legislation to provide transportation efficiency and…

Bill Nelson
Sen. Bill NelsonD-FL · May 20, 2004

Mr. President, I rise today to express my deep concern about an issue that illustrates the continuing erosion of Americans' privacy rights. My concern is related to the practice of outsourcing. When…

Bill Nelson
Sen. Bill NelsonD-FL · May 20, 2004

Mr. President, I rise today to express my deep concern about an issue that illustrates the continuing erosion of Americans' privacy rights. My concern is related to the practice of outsourcing. When…

Joseph I. Lieberman
Sen. Joseph I. LiebermanD-CT · May 20, 2004

Mr. President, I rise today to join my esteemed colleague from the State of Virginia, Senator Warner, in introducing The 21st Century Pell Grant Plus Act. This bill is intended to provide an…

Russell D. Feingold
Sen. Russell D. FeingoldD-WI · May 20, 2004

Mr. President, I would like to discuss legislation I am introducing that would protect ginseng farmers and consumers by ensuring that ginseng sold at retail discloses where the root was harvested.…

Show 11 more
Tom Harkin
Sen. Tom HarkinD-IA · May 20, 2004

Mr. President, I rise to discuss a bipartisan measure on which I have worked closely with my colleague from Missouri, Senator Bond. The purpose of this bill is to expand the transportation…

Sam Brownback
Sen. Sam BrownbackR-KS · May 20, 2004

Mr. President, I rise today to introduce the bipartisan Unborn Child Pain Awareness Act, and I am joined by 22 original cosponsors. Unborn children can experience pain, and they can certainly respond…

Harry Reid
Sen. Harry ReidD-NV · May 20, 2004

Mr. President, I rise today on behalf of myself and Senator Ensign to introduce the Nevada Mining Townsite Conveyance Act, which will address an important public land issue in rural Nevada. As you…

Jim Talent
Sen. Jim TalentR-MO · May 20, 2004

Mr. President, I rise today to as a cosponsor of legislation to modernize our aging waterways infrastructure on the Upper Mississippi River and the Illinois River. I am glad to join my colleague from…

Thomas A. Daschle
Sen. Thomas A. DaschleD-SD · May 20, 2004

Mr. President, today the Washington Post reported that the United States Department of Agriculture secretly allowed American meatpackers to resume imports of ground and processed beef from Canada…

Peter Fitzgerald
Sen. Peter FitzgeraldR-IL · May 20, 2004

Mr. President, I rise today with Senator Bond in support of a bill to put into place recommendations by the Army Corps of Engineers for navigation capacity improvements and ecosystem restoration for…

Chuck Grassley
Sen. Chuck GrassleyR-IA · May 20, 2004

Mr. President, I am pleased to be an original cosponsor of bipartisan legislation to authorize the modernization of the lock and dam infrastructure and enhanced environmental restoration on the Upper…

Pete V. Domenici
Sen. Pete V. DomeniciR-NM · May 20, 2004

Mr. President, water is the life's blood for New Mexico. When the water dries up in New Mexico, so will many of its communities. As such, the scarcity of water in New Mexico is a dire situation.…

Daniel K. Akaka
Sen. Daniel K. AkakaD-HI · May 20, 2004

Mr. President, I am pleased to join with Senator Collins and Senator Carper, who today have introduced the Postal Accountability and Enhancement Act. I commend both of my Governmental Affairs…

Ted Stevens
Sen. Ted StevensR-AK · May 20, 2004

Mr. President, I am pleased to join Chairman Collins and Senator Carper as an original cosponsor of S. 2468, the Postal Accountability and Enhancement Act. In 2002, the President formed a Commission…

Kay Bailey Hutchison
Sen. Kay Bailey HutchisonR-TX · May 20, 2004

Mr. President, I ask unanimous consent that the text of the bill be printed in the Record.

Bill Text

Latest available legislative text

Reading Mode
Latest
Introduced in SenateIssued May 20, 2004
        [Congressional Bills 108th Congress]
[From the U.S. Government Publishing Office]
[S. 2472 Introduced in Senate (IS)]

2d Session
S. 2472

To require that notices to consumers of health and financial services
include information on the outsourcing of sensitive personal
information abroad, to require relevant Federal agencies to prescribe
regulations to ensure the privacy and security of sensitive personal
information outsourced abroad, to establish requirements for foreign
call centers, and for other purposes.

_______________________________________________________________________

IN THE SENATE OF THE UNITED STATES

May 20, 2004

Mr. Nelson of Florida introduced the following bill; which was read
twice and referred to the Committee on the Judiciary

_______________________________________________________________________

A BILL

To require that notices to consumers of health and financial services
include information on the outsourcing of sensitive personal
information abroad, to require relevant Federal agencies to prescribe
regulations to ensure the privacy and security of sensitive personal
information outsourced abroad, to establish requirements for foreign
call centers, and for other purposes.

Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the ``Increasing Notice of Foreign
Outsourcing Act''.

SEC. 2. HEALTH PRIVACY.

(a) Foreign-Based Business Associate.--In this section, the term
``foreign-based business associate'' means a business associate, as
defined under the regulations promulgated pursuant to section 264(c) of
the Health Insurance Portability and Accountability Act of 1996 (42
U.S.C. 1320d-2 note), whose operation is based outside the United
States and that receives protected health information and processes
such information outside the United States.
(b) Notices.--
(1) In general.--The Secretary of Health and Human Services
(referred to in this section as the ``Secretary'') shall revise
the regulations prescribed pursuant to section 264(c) of the
Health Insurance Portability and Accountability Act of 1996 (42
U.S.C. 1320d-2 note) to require a covered entity (as defined
under such regulations and referred to in this section as a
``covered entity''), that outsources protected health
information (as defined under such regulations and referred to
in this section as ``protected health information''), outside
the United States to include in such entity's notice of privacy
protections the following:
(A) The following information in simple language:
(i) Notification that the covered entity
outsources protected health information to
foreign-based business associates.
(ii) Any risks and consequences to the
privacy and security of protected health
information that arise as a result of the
processing of such information outside the
United States.
(iii) Additional measures the covered
entity is taking to protect the protected
health information outsourced for processing
outside the United States.
(B) A certification that the covered entity has
taken reasonable steps to ensure that the handling of
protected health information will be done in compliance
with applicable laws in all instances where protected
health information is processed outside the United
States, including the reasons for the certification.
(2) Effective date.--A covered entity shall be required to
include in such entity's notice of privacy protections the
information and certification described in paragraph (1) for
notices issued on or after the date on which the Secretary
prescribes regulations pursuant to this section or the date
that is 365 days after the date of enactment of this Act,
whichever date is earlier. Nothing in this subsection shall be
construed to require a covered entity to reissue notices issued
before the date on which the Secretary prescribes regulations
pursuant to this section or the date that is 365 days after the
date of enactment of this Act, whichever date is earlier, to
include in such notices the information and certification
described in paragraph (1).
(c) Rulemaking.--
(1) In general.--
(A) Regulatory authority.--The Secretary shall--
(i) prescribe such regulations consistent
with paragraph (2) as may be necessary to carry
out this section with respect to foreign
outsourcing; and
(ii) determine the appropriate penalties to
impose upon a covered entity for a violation of
a provision of this subsection or subsection
(b).
(B) Procedures and deadlines.--The regulations
described in subparagraph (A) shall be prescribed in
accordance with all applicable legal requirements and
shall be issued in final form not later than 365 days
after the date of enactment of this Act.
(2) Necessary regulations.--The Secretary shall prescribe
regulations--
(A) requiring that a contract between a covered
entity and such entity's foreign-based business
associate contain a provision that provides such entity
with the right to audit such associate, as needed, to
monitor performance under the contract; and
(B) requiring that foreign-based business
associates and subcontractors of covered entities be
contractually bound by Federal privacy standards and
security safeguards.
(d) Breach of Security.--
(1) Breach of security of the system.--In this subsection,
the term ``breach of security of the system''--
(A) means the compromise of the security,
confidentiality, or integrity of computerized data that
results in, or there is a reasonable basis to conclude
has resulted in, the unauthorized acquisition of and
access to protected health information maintained by
the covered entity, foreign-based business associate,
or subcontractor; and
(B) does not include good faith acquisition of
protected health information by an employee or agent of
the covered entity, foreign-based business associate,
or subcontractor for the purposes of the entity,
associate, or subcontractor, if the protected health
information is not used or subject to further
unauthorized disclosure.
(2) Database security.--
(A) Covered entity.--A covered entity--
(i) that owns or licenses electronic data
containing protected health information shall,
following the discovery of a breach of security
of the system containing such data, notify the
Secretary of such breach; or
(ii) that receives a notification under
subparagraph (B) of a breach, shall notify the
Secretary of such breach.
(B) Other parties.--
(i) Third party.--The Secretary shall
require that a contract between a covered
entity and such entity's foreign-based business
associate contain a provision that if the
foreign-based business associate (or any
subcontractor of such associate) owns or
licenses electronic data containing protected
health information that was provided to the
associate through the covered entity, the
associate (or subcontractor) shall, following
the discovery of a breach of security of the
system containing such data--
(I) notify the entity from which it
received the protected health
information of such breach; and
(II) provide a description to the
entity from which it received the
protected health information of any
corrective actions taken to guard
against future security breaches.
(ii) Notification process.--Each entity
that receives a notification under clause (i)
shall notify the entity from which it received
the protected health information of such breach
until the notification reaches the foreign-
based business associate who shall, in turn,
notify the covered entity of such breach.
(C) Timeliness of notification.--All notifications
required under subparagraphs (A) and (B) shall be made
as expediently as possible and without unreasonable
delay following--
(i) the discovery of a breach of security
of the system; and
(ii) any measures necessary to determine
the scope of the breach, prevent further
disclosures, and restore the reasonable
integrity of the data system.
(3) Effective date.--This subsection shall take effect on
the expiration of the date that is 365 days after the date of
enactment of this subsection.

SEC. 3. FINANCIAL PRIVACY.

(a) Foreign-Based Business.--Section 509 of the Gramm-Leach-Bliley
Act (15 U.S.C. 6809) is amended by adding at the end the following:
``(12) Foreign-based business.--The term `foreign-based
business' means a nonaffiliated third party whose operation is
based outside the United States and that receives nonpublic
personal information and processes such information outside the
United States.''.
(b) Financial Notices.--
(1) In general.--Section 503(b) of the Gramm-Leach-Bliley
Act (15 U.S.C. 6803(b)) is amended--
(A) in paragraph (3), by striking ``and'' after the
semicolon;
(B) in paragraph (4), by striking the period at the
end and inserting ``; and''; and
(C) by adding at the end the following:
``(5) if the financial institution outsources nonpublic
personal information outside the United States--
``(A) information informing the consumer in simple
language--
``(i) that the financial institution
outsources nonpublic personal information to
foreign-based businesses;
``(ii) of any risks and consequences to the
privacy and security of an individual's
nonpublic personal information that arise as a
result of the processing of such information
outside the United States; and
``(iii) of the additional measures the
financial institution is taking to protect the
nonpublic personal information outsourced for
processing outside the United States; and
``(B) a certification that the financial
institution has taken reasonable steps to ensure that
the handling of nonpublic personal information will be
done in compliance with applicable laws in all
instances where nonpublic personal information is
processed outside the United States, including the
reasons for the certification.''.
(2) Effective date.--A financial institution shall include
in such institution's disclosure the information and
certification described in the amendment made by paragraph
(1)(C) for disclosures provided on or after the date on which
the regulatory agency that has jurisdiction over such
institution pursuant to section 505 of the Gramm-Leach-Bliley
Act (15 U.S.C. 6805) prescribes regulations pursuant to the
amendments made by this section or the date that is 365 days
after the date of enactment of this Act, whichever date is
earlier. Nothing in this subsection, or the amendments made by
this subsection, shall be construed to require a financial
institution to reissue disclosures provided before the date on
which the regulatory agency that has jurisdiction over such
institution pursuant to section 505 of the Gramm-Leach-Bliley
Act (15 U.S.C. 6805) prescribes regulations pursuant to the
amendments made by this section or the date that is 365 days
after the date of enactment of this Act, whichever date is
earlier, to include in such disclosures the information and
certification described in the amendment made by paragraph
(1)(C).
(c) Rulemaking.--Section 504 of the Gramm-Leach-Bliley Act (15
U.S.C. 6804) is amended by adding at the end the following:
``(c) Rulemaking on Foreign Outsourcing.--
``(1) In general.--
``(A) Regulatory authority.--The Federal banking
agencies, the National Credit Union Administration, the
Secretary of the Treasury, the Securities and Exchange
Commission, and the Federal Trade Commission (referred
to in this subsection as the `regulatory agencies')
shall--
``(i) prescribe such regulations consistent
with paragraph (2) as may be necessary to carry
out this subtitle with respect to foreign
outsourcing, with respect to the financial
institutions subject to their jurisdiction
under section 505; and
``(ii) determine the appropriate penalties
to impose upon financial institutions for a
violation of a provision of this subsection.
``(B) Coordination, consistency, and
comparability.--The regulatory agencies shall consult
and coordinate with each other for the purposes of
assuring, to the extent possible, that the regulations
prescribed by each such agency are consistent and
comparable with the regulations prescribed by the other
such agencies.
``(C) Procedures and deadlines.--The regulations
described in subparagraph (A) shall be prescribed in
accordance with all applicable legal requirements and
shall be issued in final form not later than 365 days
after the date of enactment of this subsection.
``(2) Necessary regulations.--The regulatory agencies shall
prescribe regulations--
``(A) requiring that a contract between a financial
institution and such institution's foreign-based
business contain a provision that provides such
institution with the right to audit such business, as
needed, to monitor performance under the contract; and
``(B) requiring that foreign-based businesses and
subcontractors of financial institutions be
contractually bound by Federal privacy standards and
security safeguards.''.
(d) Breach of Security.--Section 502 of the Gramm-Leach-Bliley Act
(15 U.S.C. 6802) is amended by adding at the end the following:
``(f) Breach of Security.--
``(1) Breach of security of the system.--In this
subsection, the term `breach of security of the system'--
``(A) means the compromise of the security,
confidentiality, or integrity of computerized data that
results in, or there is a reasonable basis to conclude
has resulted in, the unauthorized acquisition of and
access to nonpublic personal information maintained by
the financial institution, foreign-based business, or
subcontractor; and
``(B) does not include good faith acquisition of
nonpublic personal information by an employee or agent
of the financial institution, foreign-based business,
or subcontractor for the purposes of the institution,
business, or subcontractor, if the nonpublic personal
information is not used or subject to further
unauthorized disclosure.
``(2) Database security.--
``(A) Financial institution.--A financial
institution--
``(i) that owns or licenses electronic data
containing nonpublic personal information
shall, following the discovery of a breach of
security of the system containing such data,
notify the entity under which the institution
is subject to jurisdiction under section 505 of
such breach; or
``(ii) that receives a notification under
subparagraph (B) of a breach, shall notify the
entity under which the institution is subject
to jurisdiction under section 505 of such
breach.
``(B) Other parties.--
``(i) In general.--The Federal banking
agencies, the National Credit Union
Administration, the Secretary of the Treasury,
the Securities and Exchange Commission, and the
Federal Trade Commission shall require, with
respect to the financial institutions subject
to their jurisdiction under section 505, that a
contract between a financial institution and
such institution's foreign-based business
contain a provision that if the foreign-based
business (or any subcontractor of such
business) owns or licenses electronic data
containing nonpublic personal information that
was provided to the business through the
financial institution, the business (or
subcontractor) shall, following the discovery
of a breach of security of the system
containing such data--
``(I) notify the entity from which
it received the nonpublic personal
information of such breach; and
``(II) provide a description to the
entity from which it received the
nonpublic personal information of any
corrective actions taken to guard
against future security breaches.
``(ii) Notification process.--Each entity
that receives a notification under clause (i)
shall notify the entity from which it received
the nonpublic personal information of such
breach until the notification reaches the
foreign-based business who shall, in turn,
notify the financial institution of such
breach.
``(C) Timeliness of notification.--All
notifications required under subparagraphs (A) and (B)
shall be made as expediently as possible and without
unreasonable delay following--
``(i) the discovery of a breach of security
of the system; and
``(ii) any measures necessary to determine
the scope of the breach, prevent further
disclosures, and restore the reasonable
integrity of the data system.
``(3) Effective date.--This subsection shall take effect on
the expiration of the date that is 365 days after the date of
enactment of this subsection.''.

SEC. 4. FOREIGN CALL CENTERS.

(a) Foreign Call Center Defined.--In this section, the term
``foreign call center'' means a foreign-based service provider or a
foreign-based subcontractor of such provider that--
(1) is unaffiliated with the entity that utilizes such
provider or subcontractor; and
(2) provides customer-based service and sales or technical
assistance and expertise to individuals located in the United
States via the telephone, the Internet, or other
telecommunications and information technology.
(b) Requirement.--A contract between a foreign call center and an
entity that utilizes such foreign call center to initiate telephone
calls to, or receive telephone calls from, individuals shall include a
requirement that each employee of the foreign call center disclose the
physical location of such employee upon the request of such individual.
(c) Certification Requirement.--An entity described in subsection
(b) shall submit an annual certification to the Federal Trade
Commission on whether or not the entity and its subsidiaries, and the
foreign call center employees and its subsidiaries, have complied with
subsection (b). Such annual certifications shall be made available to
the public.
(d) Noncompliance.--An entity described in subsection (b) or its
subsidiaries that violates subsection (b) shall be subject to such
civil penalties as the Federal Trade Commission prescribes under
subsection (e).
(e) Regulations.--Not later than 365 days after the date of
enactment of this Act, the Federal Trade Commission shall prescribe
such regulations as are necessary for effective monitoring and
compliance with this section. Such regulations shall include
appropriate civil penalties for noncompliance with this section.
<all>