S. 5522 – Protecting Biological Data as Critical Infrastructure Act

AI-Generated Summary

Updated October 2, 2026 at 5:22 AM UTC

The Protecting Biological Data as Critical Infrastructure Act amends the Homeland Security Act of 2002 to make the Cybersecurity and Infrastructure Security Agency (CISA) responsible for safeguarding genetic information and other sensitive biometric data. It treats these data systems as part of the nation’s critical infrastructure and requires CISA to develop, coordinate, and enforce security measures. The bill also calls for training federal staff and establishing communication channels with biotechnology industry stakeholders.

Key Provisions

CISA must oversee planning, management, and coordination of security for genetic and sensitive biometric data systems, ensuring it has sufficient staff.
CISA must provide training to federal personnel on protecting these data, addressing unique security challenges and ethical issues.
Genetic and biometric data systems are designated as critical infrastructure, prompting CISA to take necessary protective actions.
CISA must consult with U.S. biotechnology sector stakeholders to develop security protocols and maintain a secure line for reporting incidents and requesting assistance.
The list of critical infrastructure sectors in the Homeland Security Act is expanded to include "Genetic and biometric data security."

Legislative Activity

Stay on top of the latest movement without scrolling through every action

1 earlier action

SenateIntro Referral Latest Action

Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Homeland Security and Governmental Affairs Committee

September 24, 2026

View full timeline

SenateIntro Referral

Introduced in Senate

September 24, 2026

SenateIntro Referral

Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Homeland Security and Governmental Affairs Committee

September 24, 2026

Bill Text

Latest available legislative text

Reading Mode

Raw Text PDF XML

Introduced in SenateIssued September 24, 2026

II

119th CONGRESS

2d Session

S. 5522

IN THE SENATE OF THE UNITED STATES

September 24, 2026

Mr. Young (for himself and Ms. Hassan) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs

A BILL

To amend the Homeland Security Act of 2002 to require the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security to protect genetic and other sensitive biometric data, and for other purposes.

1.

Short title

This Act may be cited as the Protecting Biological Data as Critical Infrastructure Act.

2.

CISA protection of genetic and other sensitive biometric data

The Homeland Security Act of 2002 is amended—

(1)

in section 2202 (6 U.S.C. 652)—

(A)

in subsection (c)—

(i)

in paragraph (13), by striking and after the semicolon;

(ii)

by redesignating paragraph (14) as paragraph (17); and

(iii)

by inserting after paragraph (13) the following new paragraphs:

(14)

oversee the planning, management, and coordination of duties related to security management of, and responsibilities associated with, genetic data systems that involve genomic sequences and other sensitive biometric data, including by ensuring sufficient staff of the Agency to carry out such duties;

(15)

provide training for relevant Federal personnel regarding protecting genetic data systems that involve genomic sequences and other sensitive biometric data, including addressing unique security challenges and ethical considerations;

(16)

take such actions as may be necessary to ensure the protection of biological data and critical biotechnology infrastructure, including genetic data systems that involve genomic sequences and other sensitive biometric data; and

; and

(B)

in subsection (e)(1), by adding at the end the following new subparagraphs:

(S)

To treat as critical infrastructure genetic data systems that involve genomic sequences and other sensitive biometric data.

(T)

To consult with United States biotechnology sector stakeholders to gain input for the development of security protocols relating to the genetic data systems referred to in subparagraph (S), as well as relevant Federal agencies responsible for collecting and protecting such systems, such as the Office of Biometric Identity Management of the Department.

(U)

To collaborate with the United States biotechnology sector stakeholders referred to in subparagraph (T), as well as any additional United States stakeholders engaged in biosecurity policy development and enforcement, including by carrying out the following:

(i)

Facilitating engagements between the Agency and such biotechnology stakeholders and additional stakeholders to coordinate and synchronize regarding emerging security concerns, such as the digital-physical boundary between genetic sequence data and physical samples.

(ii)

Providing a secure line of communication to the Agency for such biotechnology stakeholders and additional stakeholders to raise concerns, report incidents, and request technical assistance.

; and

(2)

in section 2211(b)(2) (6 U.S.C. 661(b)(2)), by adding at the end the following new subparagraph:

(E)

Genetic and biometric data security.

.