Leahy Secures Privacy Protections In E-Government Reauthorization

 

WASHINGTON (Monday, September 29, 2008) – Senator Patrick Leahy (D-Vt.) has secured key privacy protections in proposed legislation to reauthorize the E-Government Act.  The E-Government Act became law in 2002 to streamline government information and promote inter-agency communication and communication between the government and citizens.

 

The E-Government Reauthorization Act was considered and reported by the Senate Homeland Security and Government Affairs Committee on September 16.  Leahy subsequently began to work with the bill’s sponsors, Sen. Joe Lieberman (ID-Conn.) and Susan Collins (R-Maine) to include personal privacy protections in the bill.  Leahy, who chairs the Senate Judiciary Committee, offered an amendment to improve and strengthen the reauthorization legislation by adding important privacy provisions to protect the personal information of Americans from data breaches, identity theft and other cyber crimes.  Leahy’s amendment, which was accepted by the bill’s sponsors and the Bush administration, will require federal agencies to conduct privacy impact assessments before using outside contractors to manage personal information.

 

“This amendment takes a small but important step towards addressing the growing problem of lax data security by government contractors, by making sure that Americans’ privacy rights are not compromised when they entrust their sensitive personal information to our government,” said Leahy.  “The E-Government Reauthorization Act is a good bill that will now be even better because of the privacy protections in this amendment.  I hope all Senators will support this important legislation.”

 

Leahy has been a longtime leader and advocate for privacy protections.  He is the author of the Personal Data Privacy and Security Act, S. 495, comprehensive data privacy legislation, and the Identity Theft Enforcement and Restitution Act, which is a part of legislation that the President signed into law last week to extend Secret Service protection for former Vice Presidents.

# # # # #

 

Statement of Sen. Patrick Leahy

 

Text of Privacy Amendment

 

Summary of Privacy Amendment

 

# # # # #

 

Statement of Senator Patrick Leahy

Chairman, Committee on the Judiciary

Privacy Amendment to the E-Government Reauthorization Act

September 29, 2008

 

MR. PRESIDENT.  I am pleased to announce that, today, after several discussions, the Bush administration and lead sponsors of the E-Government Reauthorization Act of 2008, S. 2321, have accepted an amendment I have drafted to ensure that Americans’ privacy comes first when the government purchases and uses their most sensitive personal information.  My amendment requires that Federal agencies must conduct privacy impact assessments before employing outside contractors that use and market Americans’ sensitive personal data.

 

The addition of privacy protections to the E-Government Reauthorization Act will help to better protect all Americans from the growing threats of data breaches, identity theft and other cyber crimes.  I am particularly pleased about the compromise reached today, because I am a proud supporter of this bill.  In 2002, I was an original cosponsor of E-Government Act, and in the intervening years, I have worked to promote and strengthen this law.

 

The E-Government Reauthorization Act is good bill that will now be even better because of the privacy protections added by my amendment.  Recently, the Government Accountability Office released a report on lessons learned about the government data breaches at the Veterans Administration and elsewhere.  That report found that government contractor responsibilities for preventing and responding to data breaches should be clearly defined.  My amendment takes a small, but important step towards addressing the growing problem of lax data security by government contractors, by making sure that Americans’ privacy rights are not compromised when they entrust their sensitive personal information to our government.

 

I thank the lead sponsors of this bill for working with me on compromise privacy language for this bill.  I also thank the many stakeholders who support this bill and my privacy amendment, including the Center for Democracy and Technology, Symantec and the Cyber Security Industry Alliance. 

 

I urge all Senators to support and pass this important legislation.

 

# # # # #

 

 

AMENDMENT NO.                                                                           Calendar No.

 

Purpose:  To provide for privacy impact assessment of Government use of commercial information services containing personally identifiable information.

 

IN THE SENATE OF THE UNITED STATES—110th Cong., 2d Sess.

 

S. 2321

 

To amend the E–Government Act of 2002 (Public Law 107– 347) to reauthorize appropriations, and for other purposes.

 

Referred to the Committee on                              and ordered to be printed

 

Ordered to lie on the table and to be printed

 

AMENDMENT intended to be proposed by Mr. LEAHY

 

Viz:

 

At the end of the bill add the following:

 

SEC. 5. PRIVACY IMPACT ASSESSMENT OF GOVERNMENT USE OF COMMERCIAL INFORMATION SERVICES CONTAINING PERSONALLY IDENTIFIABLE INFORMATION.

(a) IN GENERAL.—Section 208(b)(1)(A) of the E-Government Act of 2002 (44 U.S.C. 3501 note) is amended—

 

(1) in clause (i), by striking ‘‘or’’ after the semicolon;

(2) in clause (ii), by striking the period and inserting ‘‘; or’’; and

(3) by adding after clause (ii) the following:

‘‘(iii) systematically using personally identifiable information purchased from, or subscribed to, for a fee from a commercial data source.’’.

(b) DEFINITION OF PERSONALLY IDENTIFIABLE INFORMATION.--Section 208 of the E-Government Act of 2002 (44 U.S.C. 3501 note) is amended by striking subsection (d) and inserting the following:

‘‘(d) DEFINITIONS.—In this section—

 ‘‘(1) the term ‘identifiable form’ means any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means; and

‘‘(2) the term ‘personally identifiable information’ means any information, or compilation of information, in electronic or digital form comprising information in an identifiable form.’’.

 

# # # # #

 

SUMMARY OF LEAHY PRIVACY AMENDMENT TO S. 2321

 

The amendment updates the E-Government Act of 2002 to require that Federal departments and agencies that purchase, or subscribe to, personally identifiable information provided by a commercial data broker conduct a privacy impact assessment regarding the use of those services.

 

# # # # #