I
110th CONGRESS
1st Session
H. R. 2124
IN THE HOUSE OF REPRESENTATIVES
May 3, 2007
Mr. Tom Davis of Virginia introduced the following bill; which was referred to the Committee on Oversight and Government Reform
A BILL
To amend title 44, United States Code, to strengthen requirements related to security breaches of data involving the disclosure of sensitive personal information.
Short title
This Act may be cited as the
Federal Agency Data Breach Protection
Act
.
Federal agency data breach notification requirements
Authority of director of Office of Management and Budget To establish data breach policies
Section 3543(a) of title 44, United States Code, is amended—
by striking
and
at the end of paragraph (7);
by
striking the period and inserting ; and
at the end of paragraph
(8); and
by adding at the end the following:
establishing policies, procedures, and standards for agencies to follow in the event of a breach of data security involving the disclosure of sensitive personal information and for which harm to an individual could reasonably be expected to result, specifically including—
a requirement for timely notice to be provided to those individuals whose sensitive personal information could be compromised as a result of such breach, except no notice shall be required if the breach does not create a reasonable risk of identity theft, fraud, or other unlawful conduct regarding such individual;
guidance on determining how timely notice is to be provided; and
guidance regarding whether additional special actions are necessary and appropriate, including data breach analysis, fraud resolution services, identity theft insurance, and credit protection or monitoring services.
.
Authority of chief information officer To enforce data breach policies and develop and maintain inventories
Section 3544(a)(3) of title 44, United States Code, is amended—
by inserting after
authority to ensure compliance with
the following: and,
to the extent determined necessary and explicitly authorized by the head of the
agency, to enforce
;
by striking
and
at the end of subparagraph (D);
by inserting
and
at the end of subparagraph (E); and
by adding at the end the following:
developing and maintaining an inventory of all personal computers, laptops, or any other hardware containing sensitive personal information;
.
Inclusion of data breach notification in agency information security programs
Section 3544(b) of title 44, United States Code, is amended—
by striking
and
at the end of paragraph (7);
by striking the
period and inserting ; and
at the end of paragraph (8);
and
by adding at the end the following:
procedures for notifying individuals whose sensitive personal information is compromised consistent with policies, procedures, and standards established under section 3543(a)(9) of this title.
.
Authority of agency chief human capital officers To assess federal personal property
Section 1402(a) of title 5, United States Code, is amended—
by striking
, and
at the end of paragraph (5) and inserting a
semicolon;
by striking the
period and inserting ; and
at the end of paragraph (6);
and
by adding at the end the following:
prescribing policies and procedures for exit interviews of employees, including a full accounting of all Federal personal property that was assigned to the employee during the course of employment.
.
Sensitive personal information definition
Section 3542(b) of title 44, United States Code, is amended by adding at the end the following new paragraph:
The term
sensitive personal information
, with respect to an individual,
means any information about the individual maintained by an agency,
including—
education, financial transactions, medical history, and criminal or employment history;
information that can be used to distinguish or trace the individual’s identity, including name, social security number, date and place of birth, mother’s maiden name, or biometric records; or
any other personal information that is linked or linkable to the individual.
.