110 HR 4175 IH: Privacy and Cybercrime
U.S. House of Representatives
2007-11-14
text/xml
EN
Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
1.
(a)This Act may be cited
as the Privacy and Cybercrime
Enforcement Act of 2007
.
(b)The title of contents for this Act is as follows:
Sec. 1. Short title.
Title I—Enhancing punishment for identity theft and other
violations of data privacy and security
Sec. 101. Organized criminal activity.
Sec. 102. Failure to provide notice of security breaches
involving sensitive personally identifiable information.
Sec. 103. Use of full interstate and foreign commerce power for
criminal penalties.
Sec. 104. Cyber-extortion.
Sec. 105. Conspiracy to commit cyber-crimes.
Sec. 106. Penalties for section
1030 violations.
Sec. 107. Additional funding for resources to investigate and
prosecute criminal activity involving computers.
Sec. 108. Criminal restitution.
Sec. 109. Review and amendment of Federal sentencing guidelines
related to fraudulent access to or misuse of digitized or electronic personally
identifiable information.
Title II—Non-criminal privacy enforcement and privacy impact
statements
Sec. 201. Enforcement by Attorney General and State
authorities.
Sec. 202. Coordination of State and Federal
efforts.
Sec. 203. Requirement that agency rulemaking take into
consideration impacts on individual privacy.
Title III—Assistance for State and local law enforcement to
combat fraudulent, unauthorized, or other criminal use of personally
identifiable information
Sec. 301. Grants for State and local law
enforcement.
Sec. 302. Authorization of appropriations.
Title IV—National White Collar Crime Center grants
Sec. 401. Authorization and Expansion of National White Collar
Crime Center.
<enum>I</enum><header>Enhancing
punishment for identity theft and other violations of data privacy and
security</header>
<section id="H83FCB9E6296842BDB2977E2480276F04"><enum>101.</enum><header>Organized
criminal activity</header><text display-inline="no-display-inline">Section
1961(1) of title 18, United States Code, is amended by inserting <quote>section
1030 (relating to certain frauds and related activities in connection with
computers)</quote>.</text>
</section><section id="H4530AA2A09C045668C9B52981ED6447C"><enum>102.</enum><header>Failure to
provide notice of security breaches involving sensitive personally identifiable
information</header>
<subsection id="HC351C81A7C9348F9B4EAEA6F9759C88E"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Chapter 47 of title
18, United States Code, is amended by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="H5E7335D93BF94A38AAAE379381E0FDBE" style="USC">
<section id="H029C37BFF46943A880192501ACA73775"><enum>1040.</enum><header>Failure to
provide notice of security breaches involving sensitive personally identifiable
information</header>
<subsection id="H629A859125534CD3AD59361EFB74B351"><enum>(a)</enum><text display-inline="yes-display-inline">Whoever, having a covered obligation to
provide notice of a security breach involving sensitive personally identifiable
information, knowingly fails to do so, shall be fined under this title or
imprisoned not more than 5 years, or both.</text>
</subsection><subsection id="H2561701AE1CF4235A88206F07120582D"><enum>(b)</enum><text>As used in this
section—</text>
<paragraph id="H278D81D395174FDDA13E69858E99E2C8"><enum>(1)</enum><text>the term
<quote>covered obligation</quote>, with respect to providing notice of a
security breach, means an obligation under Federal law or, if the breach is in
or affects interstate or foreign commerce, under State law;</text>
</paragraph><paragraph id="H9C978E22C2454F1290BBB813D61C17C1"><enum>(2)</enum><text display-inline="yes-display-inline">the term <quote>sensitive personally
identifiable information</quote> means any electronic or digital information
that includes—</text>
<subparagraph id="H7CE2EB62ECAE4831A200CC097E8D38DF"><enum>(A)</enum><text>an individual’s
first and last name, or first initial and last name, or address or phone number
in combination with any 1 of the following data elements where the data
elements are not protected by a technology protection measure that renders the
data element indecipherable—</text>
<clause id="H911AC3CFB3634C3BB33D7E431E467F7B"><enum>(i)</enum><text>a
nontruncated social security number, driver’s license number, state resident
identification number, passport number, or alien registration number;</text>
</clause><clause id="H8C257E707FDB4BBBBF9748D6553F06F7"><enum>(ii)</enum><text>both of the
following—</text>
<subclause id="H42C7A24F624746B79084292C2C4098A3"><enum>(I)</enum><text>mother’s maiden
name, if identified as such; and</text>
</subclause><subclause id="HF44FFE3B0C06407700158497062C2FFB"><enum>(II)</enum><text>month, day, and
year of birth; and</text>
</subclause></clause><clause id="H56C080D421D44D31856584ABC3E27878"><enum>(iii)</enum><text>unique biometric
data such as a finger print, voice print, a retina or iris image; or</text>
</clause></subparagraph><subparagraph id="H9F304D6DCCBC43A0BCCF5E24FDFB0027"><enum>(B)</enum><text>a financial
account number or credit or debit card number in combination with any security
code, access code or password that is required for an individual to obtain
credit, withdraw funds, or engage in a financial transaction by means of such
number;</text>
</subparagraph></paragraph><paragraph id="H51D0176945F74904B500A207BF752DC8"><enum>(3)</enum><text display-inline="yes-display-inline">the term <quote>security breach</quote>
means a compromise of the security, confidentiality, or integrity of
computerized data that there is reason to believe has resulted in improper
access to sensitive personally identifiable information; and</text>
</paragraph><paragraph id="H454EF36AFE714E30882E2FB6F24BC0DA"><enum>(4)</enum><text>the term
<quote>improper access</quote> means access without authorization or in excess
of
authorization.</text>
</paragraph></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H64CCE6213662421499DD5C1124953100"><enum>(b)</enum><header>Clerical
amendment</header><text display-inline="yes-display-inline">The table of
sections at the beginning of <external-xref legal-doc="usc-chapter" parsable-cite="usc-chapter/18/47">chapter 47</external-xref> of title 18, United States Code, is
amended by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="H3621A54FE3904394B5B97CF8CC779B95" style="OLC">
<toc>
<toc-entry level="section">1040. Concealment of security breaches
involving personally identifiable
information.</toc-entry>
</toc>
<after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H64E0EFB59B5143A3BB82798C64AF36AB"><enum>(c)</enum><header>Obligation To
report</header>
<paragraph id="H75C9DBC38B6940F9BCBE65EF56002693"><enum>(1)</enum><header>In
general</header><text>A person who owns or possesses data in electronic form
containing a means of identification and has knowledge of a major security
breach of the system containing such data maintained by such person, must
provide prompt notice of such breach to the United States Secret Service or
Federal Bureau of Investigation.</text>
</paragraph><paragraph id="HEF84641B54554332B1A0AD68195011F1"><enum>(2)</enum><header>Publication of
list of notifications</header><text>The Secret Service and the Federal Bureau
of Investigation shall annually publish in the Federal Register a list of all
notifications submitted the previous calendar year and the identity of each
entity with respect to which the major security breach occurred.</text>
</paragraph><paragraph id="H4ED3A3218C4D42808FD4575C61DB7C63"><enum>(3)</enum><header>Definition</header><text>In
this subsection—</text>
<subparagraph id="HD817D91364864A088DB1106FC9EB3CC"><enum>(A)</enum><text>the term
<quote>major security breach</quote> means any security breach
involving—</text>
<clause id="HD49323F7150E4B8DAC6C631319079CC5"><enum>(i)</enum><text>means of
identification pertaining to 10,000 or more individuals is, or is reasonably
believed to have been acquired;</text>
</clause><clause id="H26ED8B4EA2834A4EB5B28251D23E500"><enum>(ii)</enum><text>databases owned by
the Federal Government; or</text>
</clause><clause id="H250C115815504D8BA6380022A0EB282E"><enum>(iii)</enum><text>means of
identification of Federal Government employees or contractors involved in
national security matters or law enforcement; and</text>
</clause></subparagraph><subparagraph id="H35199EC3529A47B4859601501D83508B"><enum>(B)</enum><text display-inline="yes-display-inline">the term <quote>means of
identification</quote> has the meaning given that term in section 1028 of title
18, United States Code.</text>
</subparagraph></paragraph></subsection></section><section id="H6DB1E114A8354CE0BC90315D10161500"><enum>103.</enum><header>Use of full
interstate and foreign commerce power for criminal penalties</header>
<subsection id="HB5857D31B4574616963003A9C68D8F14"><enum>(a)</enum><header>Broadening of
Scope</header><text><external-xref legal-doc="usc" parsable-cite="usc/18/1030">Section 1030(e)(2)(B)</external-xref> of title 18, United States Code, is
amended by inserting <quote>or affecting</quote> after <quote>which is used
in</quote>.</text>
</subsection><subsection id="H13E36DF470F04A58945FF22EF5517610"><enum>(b)</enum><header>Elimination of
Requirement of an Interstate or Foreign Communication for Certain Offenses
Involving Protected Computers</header><text><external-xref legal-doc="usc" parsable-cite="usc/18/1030">Section 1030(a)(2)(C)</external-xref> of title 18,
United States Code, is amended by striking <quote>if the conduct involved an
interstate or foreign communication</quote>.</text>
</subsection></section><section id="HAB062F74CCE04253848CBCCF564D7550"><enum>104.</enum><header>Cyber-extortion</header><text display-inline="no-display-inline"><external-xref legal-doc="usc" parsable-cite="usc/18/1030">Section 1030(a)(7)</external-xref> of title 18, United
States Code, is amended by inserting <quote>, or to access without
authorization or exceed authorized access to a protected computer</quote> after
<quote>cause damage to a protected computer</quote>.</text>
</section><section id="H5906B3350D8C4F35A9F56DD0B4DBA08C"><enum>105.</enum><header>Conspiracy to
commit cyber-crimes</header><text display-inline="no-display-inline">Section
1030(b) of title 18, United States Code, is amended by inserting <quote>or
conspires</quote> after <quote>attempts</quote>.</text>
</section><section id="HAB1B9E0EF51D46A9BDCFA2CEBFAEC6E6"><enum>106.</enum><header>Penalties for
section <enum-in-header>1030</enum-in-header> violations</header><text display-inline="no-display-inline">Subsection (c) of <external-xref legal-doc="usc" parsable-cite="usc/18/1030">section 1030</external-xref> of title 18,
United States Code, is amended to read as follows:</text>
<quoted-block id="H1A567859160B48C08C776C02AB9D48F" style="OLC">
<subsection id="HD617CFFF3C664598B54D4040D947B739"><enum>(c)</enum><paragraph commented="no" display-inline="yes-display-inline" id="H01D3C2E86FF042DA9D97EAD80C0056"><enum>(1)</enum><text>The punishment for an
offense under subsection (a) or (b) is a fine under this title or imprisonment
for not more than 20 years, or both, but if the offender in the course of a
violation of subsection (a)(5)(A)(i) knowingly or recklessly causes or attempts
to cause death, such offender shall be fined under this title or imprisoned for
any term of years or for life, or both.</text>
</paragraph><paragraph id="H2BA5EE7FE28F45D9B8DEBF5038F7CE00" indent="up1"><enum>(2)</enum><text>The court, in imposing sentence for
an offense under subsection (a) or (b), may, in addition to any other sentence
imposed and irrespective of any provision of State law, order that the person
forfeit to the United States—</text>
<subparagraph id="H4BBA96C79B52414F99B0E48B7490889"><enum>(A)</enum><text>the person’s interest in any personal
property that was used or intended to be used to commit or to facilitate the
commission of the offense; and</text>
</subparagraph><subparagraph id="H541C961FFA6A474F003E0664A912AEE"><enum>(B)</enum><text>any property, real or personal,
constituting or derived from, any proceeds the person obtained, directly or
indirectly, as a result of the
offense.</text>
</subparagraph></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</section><section id="H852BCEF625E2474F82EE8E2391E83200"><enum>107.</enum><header>Additional
funding for resources to investigate and prosecute criminal activity involving
computers</header>
<subsection id="H28ABA0E156CE4BC68918C36085F8909B"><enum>(a)</enum><header>Additional
Funding for Resources</header>
<paragraph id="H0BA376BA84B846B99346EF4F8427AB3E"><enum>(1)</enum><header>Authorization</header><text>In
addition to amounts otherwise authorized for resources to investigate and
prosecute criminal activity involving computers, there are authorized to be
appropriated for each of the fiscal years 2008 through 2012—</text>
<subparagraph id="HDD6BC7650F004E2A9CB090D9A00633ED"><enum>(A)</enum><text>$10,000,000 to the
Director of the United States Secret Service;</text>
</subparagraph><subparagraph id="HB9CC995F03384B77A646A0C2C937091D"><enum>(B)</enum><text>$10,000,000 to the
Attorney General for the Criminal Division of the Department of Justice;
and</text>
</subparagraph><subparagraph id="H278BD671962E40EAB08CFA6682A552E3"><enum>(C)</enum><text>$10,000,000 to the
Director of the Federal Bureau of Investigation.</text>
</subparagraph></paragraph><paragraph id="HEFA273A3D79A4FFB8C5C30CC773FAAE2"><enum>(2)</enum><header>Availability</header><text>Any
amounts appropriated under paragraph (1) shall remain available until
expended.</text>
</paragraph></subsection><subsection id="H32067F42671140DA813CDA32C959BCDF"><enum>(b)</enum><header>Use of
Additional Funding</header><text>Funds made available under subsection (a)
shall be used by the Director of the United States Secret Service, the Director
of the Federal Bureau of Investigation, and the Attorney General, for the
United States Secret Service, the Federal Bureau of Investigation, and the
criminal division of the Department of Justice, respectively, to—</text>
<paragraph id="HCBA808ADD3DC478A93680067BC5EC43"><enum>(1)</enum><text>hire and train law
enforcement officers to—</text>
<subparagraph id="H12040472B95C443FB1420774B24C4E56"><enum>(A)</enum><text>investigate crimes
committed through the use of computers and other information technology,
including through the use of the Internet; and</text>
</subparagraph><subparagraph id="H2E3F9FAB3F2D48030024ED15DDF8E18"><enum>(B)</enum><text>assist in the
prosecution of such crimes; and</text>
</subparagraph></paragraph><paragraph id="HE3BA766282E943F000A7C7C96507A500"><enum>(2)</enum><text>procure advanced
tools of forensic science to investigate, prosecute, and study such
crimes.</text>
</paragraph></subsection></section><section id="HDFEE6F4AB53045358897F6134E8913FF"><enum>108.</enum><header>Criminal
restitution</header><text display-inline="no-display-inline">Section 3663(b) of
title 18, United States Code, is amended—</text>
<paragraph id="H38AC53C410ED469D8EF4E20048C91572"><enum>(1)</enum><text>by striking
<quote>and</quote> at the end of paragraph (4);</text>
</paragraph><paragraph id="H35B423F99CF34C8C94FC7F29FADB8FF7"><enum>(2)</enum><text>by striking the
period at the end of paragraph (5) and inserting <quote>; and</quote>
and</text>
</paragraph><paragraph id="HACCF943DC9B34EE586CC55ABFDC7CE4E"><enum>(3)</enum><text>by adding at the
end the following:</text>
<quoted-block id="H01BEDE4F8CA14CA08E27C1FD4BF19762" style="OLC">
<paragraph id="HED70163F03284EEC83BFB88942C11C4"><enum>(6)</enum><text>in the case of an
offense under section 1028(a)(7), 1028A(a), or 1030(a)(2), pay an amount equal
to the value of the victim’s time reasonably spent to remediate actual harm
resulting from the
offense.</text>
</paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></section><section id="H63EBC32B8567468F8FB91644F2F6E241"><enum>109.</enum><header>Review and
amendment of Federal sentencing guidelines related to fraudulent access to or
misuse of digitized or electronic personally identifiable
information</header><text display-inline="no-display-inline">The United States
Sentencing Commission, pursuant to its authority under <external-xref legal-doc="usc" parsable-cite="usc/28/994">section 994</external-xref> of title 28,
United States Code, and in accordance with this section, shall review and, if
appropriate, amend the Federal sentencing guidelines (including its policy
statements) applicable to persons convicted of using fraud to access, or misuse
of, digitized or electronic personally identifiable information, including
identity theft or any offense under—</text>
<paragraph id="H992375B0D6CE49B28D848C1427D882EB"><enum>(1)</enum><text>sections 1028,
1028A, 1030, 1030A, 2511, and 2701 of title 18, United States Code; and</text>
</paragraph><paragraph id="H7697E62ACF004F2DBB35CC910675B01"><enum>(2)</enum><text>any other relevant
provision.</text>
</paragraph></section><enum>II</enum><header>Non-criminal
privacy enforcement and privacy impact statements</header>
<section id="H017FE825481F47B98955B75958D2BE"><enum>201.</enum><header>Enforcement by
Attorney General and State authorities</header>
<subsection id="HCAD0BAC45C9245E2919ED57339F1B54F"><enum>(a)</enum><header>Definition of
<quote>authorized entity</quote></header><text display-inline="yes-display-inline">As used in this section, the term
<quote>authorized entity</quote> means the Attorney General, with respect to
any conduct constituting a violation of a Federal law enacted after the date of
the enactment of this Act relating to data security and engaged in by a
business entity, and a State Attorney General with respect to that conduct to
the extent the conduct adversely affects an interest of the residents of a
State.</text>
</subsection><subsection id="H321518524FCA43ADB9333E1B001FEB14"><enum>(b)</enum><header>Civil
penalty</header>
<paragraph id="HCDD61ADA14D3451F82F544B542B281D8"><enum>(1)</enum><header>Generally</header><text>An
authorized entity may in a civil action obtain a civil penalty of not more than
$500,000 from any business entity that engages in conduct constituting a
violation of a Federal law enacted after the date of the enactment of this Act
relating to data security.</text>
</paragraph><paragraph id="H47BA7E2BF0AB4A09A52F00339FCFFD77"><enum>(2)</enum><header>Special rule for
intentional violation</header><text>If the violation described in subsection
(a) is intentional, the maximum civil penalty is $1,000,000.</text>
</paragraph></subsection><subsection id="HDA3A204B2B3C4B92AEF9D0A7FDD48B9D"><enum>(c)</enum><header>Injunctive
relief</header><text display-inline="yes-display-inline">An authorized entity
may, in a civil action against a business entity that has engaged, or is
engaged, in any conduct constituting a violation of a Federal law enacted after
the date of the enactment of this Act relating data security, obtain an
order—</text>
<paragraph id="H34D71E1E48DB4C8B0005E702421EB06F"><enum>(1)</enum><text>enjoining such act
or practice; or</text>
</paragraph><paragraph id="H2820517D28014448865F987C456CCCC2"><enum>(2)</enum><text>enforcing
compliance with that law.</text>
</paragraph></subsection><subsection id="H100823E58634428DAC7BD00BAA0936C"><enum>(d)</enum><header>Other rights and
remedies</header><text>The rights and remedies available under this section do
not affect any other rights and remedies available under Federal or State
law.</text>
</subsection></section><section display-inline="no-display-inline" id="HAF7EF1F3993E40E5849CF8AC69732BB" section-type="subsequent-section"><enum>202.</enum><header>Coordination of
State and Federal efforts</header>
<subsection id="H5EEB7A622E4D406D91DE89BF56B0FBE1"><enum>(a)</enum><header>Notice</header>
<paragraph id="H7C565A6E191545C68737CC2FCADF3C0"><enum>(1)</enum><header>In
general</header><text>A State consumer protection attorney may not bring an
action under section 201, until the attorney general of the State involved
provides to the Attorney General of the United States—</text>
<subparagraph id="HBB73917F9A694303873CF193E128D1ED"><enum>(A)</enum><text>written notice of
the action; and</text>
</subparagraph><subparagraph id="HD6EC93CE81BE40F1AAA24D3CD1CE7E1"><enum>(B)</enum><text>a copy of the
complaint for the action.</text>
</subparagraph></paragraph><paragraph id="H43A90A4BC62B409CAB9261FA59D49D6C"><enum>(2)</enum><header>Exception</header><text>Paragraph
(1) does not apply with respect to the filing of an action by an attorney
general of a State under this section if the State attorney general determines
that it is not feasible to provide the notice described in such subparagraph
before the filing of the action, in such a case the State attorney general
shall provide notice and a copy of the complaint to the Attorney General at the
time the State attorney general files the action.</text>
</paragraph></subsection><subsection id="H3601BF64255846CEB927AEACF3599F5F"><enum>(b)</enum><header>Federal
proceedings</header><text>The Attorney General may—</text>
<paragraph id="H8900C6F471EA472B9D9237B9E66F00E9"><enum>(1)</enum><text>move to stay any
non Federal action under section 201, pending the final disposition of a
pending Federal action under that section;</text>
</paragraph><paragraph id="H69BDFEBC1617474EA400C5FBB3006329"><enum>(2)</enum><text>initiate an action
in an appropriate United States district court and move to consolidate all
pending actions under section 201, including State actions, in that court;
and</text>
</paragraph><paragraph id="H1B1076EAA4F04FA39EB9691FE206E508"><enum>(3)</enum><text>intervene in a
State action under section 201.</text>
</paragraph></subsection><subsection id="H736FBBF9513641EDB23850CF24C769F5"><enum>(c)</enum><header>Pending
proceedings</header><text display-inline="yes-display-inline">If the Attorney
General institutes a proceeding or action for a violation of a Federal law
enacted after the date of the enactment of this Act relating data security, no
authority of a State may, during the pendency of such proceeding or action,
bring an action under this section against any defendant named in such criminal
proceeding or a civil action against any defendant for any violation that is
alleged in that proceeding or action.</text>
</subsection><subsection id="H739F5149B18A46C488BEFFD2C99F92C"><enum>(d)</enum><header>Definition</header><text display-inline="yes-display-inline">As used in this section, the term
<quote>State consumer protection attorney</quote> means the attorney general of
a State or any State or local law enforcement agency authorized by the State
attorney general or by State statute to prosecute violations of consumer
protection law.</text>
</subsection></section><section display-inline="no-display-inline" id="H2BCFD7D974014E3D80F7B71EC700B372" section-type="subsequent-section"><enum>203.</enum><header>Requirement that
agency rulemaking take into consideration impacts on individual
privacy</header>
<subsection id="H468E4E2788474BFD8F4105633C5CC49E"><enum>(a)</enum><header>In
general</header><text>Title 5, United States Code, is amended by adding after
section 553 the following new section:</text>
<quoted-block id="H90CBE3AE6EAD489291A6115822CA0000" style="USC">
<section id="H839AB9C714F74928B041448919BFA100"><enum>553a.</enum><header>Privacy impact
assessment in rulemaking</header>
<subsection id="H9BA5272A017040A5A49411A59975C24C"><enum>(a)</enum><header>Initial privacy
impact assessment</header>
<paragraph id="HC574C3DE1C654930A6AEB1E52C7216F"><enum>(1)</enum><header>In
general</header><text>Whenever an agency is required by section 553 of this
title, or any other law, to publish a general notice of proposed rulemaking for
a proposed rule, or publishes a notice of proposed rulemaking for an
interpretative rule involving the internal revenue laws of the United States,
and such rule or proposed rulemaking pertains to the collection, maintenance,
use, or disclosure of personally identifiable information from 10 or more
individuals, other than agencies, instrumentalities, or employees of the
Federal government, the agency shall prepare and make available for public
comment an initial privacy impact assessment that describes the impact of the
proposed rule on the privacy of individuals. Such assessment or a summary
thereof shall be signed by the senior agency official with primary
responsibility for privacy policy and be published in the Federal Register at
the time of the publication of a general notice of proposed rulemaking for the
rule.</text>
</paragraph><paragraph id="H355FADD0ADF941FDA6AD00761BF4A8A7"><enum>(2)</enum><header>Contents</header><text>Each
initial privacy impact assessment required under this subsection shall contain
the following:</text>
<subparagraph id="HEA02D19013A84CBCBA41004E000400F6"><enum>(A)</enum><text>A description and
analysis of the extent to which the proposed rule will impact the privacy
interests of individuals, including the extent to which the proposed
rule—</text>
<clause id="H87C099D7CE334E46B6E24F43F4DB6B54"><enum>(i)</enum><text>provides notice of
the collection of personally identifiable information, and specifies what
personally identifiable information is to be collected and how it is to be
collected, maintained, used, and disclosed;</text>
</clause><clause id="HC76C58A12B4E42A8B8F9DE3EF2504B03"><enum>(ii)</enum><text>allows access to
such information by the person to whom the personally identifiable information
pertains and provides an opportunity to correct inaccuracies;</text>
</clause><clause id="H0A52B8CAFF9A44B399A7ABDC3F110035"><enum>(iii)</enum><text>prevents such
information, which is collected for one purpose, from being used for another
purpose; and</text>
</clause><clause id="H0E0EE63C48754C330082C34EE657FD9E"><enum>(iv)</enum><text display-inline="yes-display-inline">provides security for such information,
including the provision of written notice to any individual, within 14 days of
the date of compromise, whose privacy interests are compromised by the
unauthorized release of personally identifiable information as a result of a
breach of security at or by the agency.</text>
</clause></subparagraph><subparagraph id="HD1A9C0A945F44F79A035F062775D763"><enum>(B)</enum><text>A description of
any significant alternatives to the proposed rule which accomplish the stated
objectives of applicable statutes and which minimize any significant privacy
impact of the proposed rule on individuals.</text>
</subparagraph></paragraph></subsection><subsection id="HA39D237510F94CC6A6377F7CC51503AE"><enum>(b)</enum><header>Final privacy
impact assessment</header>
<paragraph id="HD9E34F577A7148019770C7C8C0C40035"><enum>(1)</enum><header>In
general</header><text>Whenever an agency promulgates a final rule under section
553 of this title, after being required by that section or any other law to
publish a general notice of proposed rulemaking, or promulgates a final
interpretative rule involving the internal revenue laws of the United States,
and such rule or proposed rulemaking pertains to the collection, maintenance,
use, or disclosure of personally identifiable information from 10 or more
individuals, other than agencies, instrumentalities, or employees of the
Federal government, the agency shall prepare a final privacy impact assessment,
signed by the senior agency official with primary responsibility for privacy
policy.</text>
</paragraph><paragraph id="H98241819B6784EFD9F22CBB824D52DAC"><enum>(2)</enum><header>Contents</header><text>Each
final privacy impact assessment required under this subsection shall contain
the following:</text>
<subparagraph id="H08D0A39452454B978347C5A8DACC789B"><enum>(A)</enum><text>A description and
analysis of the extent to which the final rule will impact the privacy
interests of individuals, including the extent to which such rule—</text>
<clause id="H3505C503D7574A1CA80296438400C9AF"><enum>(i)</enum><text>provides notice of
the collection of personally identifiable information, and specifies what
personally identifiable information is to be collected and how it is to be
collected, maintained, used, and disclosed;</text>
</clause><clause id="HC346AD6677234F5D8927EABCD147F2F0"><enum>(ii)</enum><text>allows access to
such information by the person to whom the personally identifiable information
pertains and provides an opportunity to correct inaccuracies;</text>
</clause><clause id="H7C9BF31683424874A7B67F25159D1729"><enum>(iii)</enum><text>prevents such
information, which is collected for one purpose, from being used for another
purpose; and</text>
</clause><clause id="H92F4FF0C7C9D49A4A02693457E43A0AF"><enum>(iv)</enum><text display-inline="yes-display-inline">provides security for such information,
including the provision of written notice to any individual, within 14 days of
the date of compromise, whose privacy interests are compromised by the
unauthorized release of personally identifiable information as a result of a
breach of security at or by the agency.</text>
</clause></subparagraph><subparagraph id="H318790B42A2C487284690176B0DD13C1"><enum>(B)</enum><text>A summary of any
significant issues raised by the public comments in response to the initial
privacy impact assessment, a summary of the analysis of the agency of such
issues, and a statement of any changes made in such rule as a result of such
issues.</text>
</subparagraph><subparagraph id="HB8FF7657A0824FD18CA34130C81138CE"><enum>(C)</enum><text>A description of
the steps the agency has taken to minimize the significant privacy impact on
individuals consistent with the stated objectives of applicable statutes,
including a statement of the factual, policy, and legal reasons for selecting
the alternative adopted in the final rule and why each one of the other
significant alternatives to the rule considered by the agency which affect the
privacy interests of individuals was rejected.</text>
</subparagraph></paragraph><paragraph id="H3876A74DD264475F9EA51EFF69D97152"><enum>(3)</enum><header>Availability to
public</header><text>The agency shall make copies of the final privacy impact
assessment available to members of the public and shall publish in the Federal
Register such assessment or a summary thereof.</text>
</paragraph></subsection><subsection id="HDD8B3D0B9A9B41B2B571F9005500001F"><enum>(c)</enum><header>Waivers</header>
<paragraph id="H406C141285304621954C3E58E533AF4C"><enum>(1)</enum><header>Emergencies</header><text>An
agency head may waive or delay the completion of some or all of the
requirements of subsections (a) and (b) to the same extent as the agency head
may, under section 608, waive or delay the completion of some or all of the
requirements of sections 603 and 604, respectively.</text>
</paragraph><paragraph id="H0DEE48D5E6984B69A45FB1A599AF6DB2"><enum>(2)</enum><header>National
security</header><text>An agency head may, for national security reasons, or to
protect from disclosure classified information, confidential commercial
information, or information the disclosure of which may adversely affect a law
enforcement effort, waive or delay the completion of some or all of the
following requirements:</text>
<subparagraph id="H4EF848B61FC345FE9DF91EFC84C797E9"><enum>(A)</enum><text display-inline="yes-display-inline">The requirement of
<internal-xref idref="HC574C3DE1C654930A6AEB1E52C7216F" legis-path="553a.(a)(1)">subsection (a)(1)</internal-xref> to make an
assessment available for public comment, provided that such assessment is made
available, in classified form, to the Committees on the Judiciary of the House
of Representatives and the Senate, in lieu of making such assessment available
to the public.</text>
</subparagraph><subparagraph id="H03794358145948A885E3B15163D40835"><enum>(B)</enum><text display-inline="yes-display-inline">The requirement of
<internal-xref idref="HC574C3DE1C654930A6AEB1E52C7216F" legis-path="553a.(a)(1)">subsection (a)(1)</internal-xref> to have an
assessment or summary thereof published in the Federal Register, provided that
such assessment or summary is made available, in classified form, to the
Committees on the Judiciary of the House of Representatives and the Senate, in
lieu of publishing such assessment or summary in the Federal Register.</text>
</subparagraph><subparagraph id="H7C56B7C1C11E41839DF5EF16AB823E69"><enum>(C)</enum><text display-inline="yes-display-inline">The requirements of
<internal-xref idref="H3876A74DD264475F9EA51EFF69D97152" legis-path="553a.(b)(3)">subsection (b)(3)</internal-xref>, provided that the
final privacy impact assessment is made available, in classified form, to the
Committees on the Judiciary of the House of Representatives and the Senate, in
lieu of making such assessment available to the public and publishing such
assessment in the Federal Register.</text>
</subparagraph></paragraph></subsection><subsection id="HCC4B4B4680AF4FC5A86167EA249EB22B"><enum>(d)</enum><header>Procedures for
gathering comments</header><text>When any rule is promulgated which may have a
significant privacy impact on individuals, or a privacy impact on a substantial
number of individuals, the head of the agency promulgating the rule or the
official of the agency with statutory responsibility for the promulgation of
the rule shall assure that individuals have been given an opportunity to
participate in the rulemaking for the rule through techniques such as—</text>
<paragraph id="H853B3FA120104763B4CDAC8752AA5D30"><enum>(1)</enum><text>the inclusion in
an advance notice of proposed rulemaking, if issued, of a statement that the
proposed rule may have a significant privacy impact on individuals, or a
privacy impact on a substantial number of individuals;</text>
</paragraph><paragraph id="HDCE5A3E08E1249C191E74F547CBCD36D"><enum>(2)</enum><text>the publication of
a general notice of proposed rulemaking in publications of national circulation
likely to be obtained by individuals;</text>
</paragraph><paragraph id="HB483287C6B43429CA0EFFDBB77B6DC64"><enum>(3)</enum><text>the direct
notification of interested individuals;</text>
</paragraph><paragraph id="H8A104CAD41C64B47A09C257689293800"><enum>(4)</enum><text>the conduct of
open conferences or public hearings concerning the rule for individuals,
including soliciting and receiving comments over computer networks; and</text>
</paragraph><paragraph id="HECD744B9D86745BA98940071FB486F39"><enum>(5)</enum><text>the adoption or
modification of agency procedural rules to reduce the cost or complexity of
participation in the rulemaking by individuals.</text>
</paragraph></subsection><subsection id="H4158154F2FD248D4A39CA2C1124CEE29"><enum>(e)</enum><header>Periodic review
of rules</header>
<paragraph id="H8A4A17D0C850483989B1F848D7D8C3AA"><enum>(1)</enum><header>In
general</header><text>Each agency shall carry out a periodic review of the
rules promulgated by the agency that have a significant privacy impact on
individuals, or a privacy impact on a substantial number of individuals. Under
such periodic review, the agency shall determine, for each such rule, whether
the rule can be amended or rescinded in a manner that minimizes any such impact
while remaining in accordance with applicable statutes. For each such
determination, the agency shall consider the following factors:</text>
<subparagraph id="H7FD325D37EAA49E2A242CE83C2300AF"><enum>(A)</enum><text>The continued need
for the rule.</text>
</subparagraph><subparagraph id="H20B2F1EF23B5491D8F00AF3D982DC4C8"><enum>(B)</enum><text>The nature of
complaints or comments received from the public concerning the rule.</text>
</subparagraph><subparagraph id="H790D85ED079646AD96D07CB0E38E0197"><enum>(C)</enum><text>The complexity of
the rule.</text>
</subparagraph><subparagraph id="H157FDE0C208F4DAAB500DBF28EF9231B"><enum>(D)</enum><text>The extent to
which the rule overlaps, duplicates, or conflicts with other Federal rules,
and, to the extent feasible, with State and local governmental rules.</text>
</subparagraph><subparagraph id="H6E9AE87E3E7A473E9D7F0727D53DA1A2"><enum>(E)</enum><text>The length of time
since the rule was last reviewed under this subsection.</text>
</subparagraph><subparagraph id="H42A0DA3ED20B40A99C9306D300BE8874"><enum>(F)</enum><text>The degree to
which technology, economic conditions, or other factors have changed in the
area affected by the rule since the rule was last reviewed under this
subsection.</text>
</subparagraph></paragraph><paragraph id="H642B89A7CEA74384896F5CB3A185DAD1"><enum>(2)</enum><header>Plan
required</header><text>Each agency shall carry out the periodic review required
by
<internal-xref idref="H8A4A17D0C850483989B1F848D7D8C3AA" legis-path="553a.(e)(1)">paragraph (1)</internal-xref> in accordance with a
plan published by such agency in the Federal Register. Each such plan shall
provide for the review under this subsection of each rule promulgated by the
agency not later than 10 years after the date on which such rule was published
as the final rule and, thereafter, not later than 10 years after the date on
which such rule was last reviewed under this subsection. The agency may amend
such plan at any time by publishing the revision in the Federal
Register.</text>
</paragraph><paragraph id="H624689D2ABC249BAB61BD8B66B74EE9C"><enum>(3)</enum><header>Annual
publication</header><text>Each year, each agency shall publish in the Federal
Register a list of the rules to be reviewed by such agency under this
subsection during the following year. The list shall include a brief
description of each such rule and the need for and legal basis of such rule and
shall invite public comment upon the determination to be made under this
subsection with respect to such rule.</text>
</paragraph></subsection><subsection id="H9E1E781A7D1D4F6488FBB92833ED417E"><enum>(f)</enum><header>Judicial
review</header>
<paragraph id="HC24ABD54C80941AB849C1C72F4B35944"><enum>(1)</enum><header>In
general</header><text>For any rule subject to this section, an individual who
is adversely affected or aggrieved by final agency action is entitled to
judicial review of agency compliance with the requirements of subsections (b)
and (c) in accordance with chapter 7. Agency compliance with
<internal-xref idref="HCC4B4B4680AF4FC5A86167EA249EB22B" legis-path="553a.(d)">subsection (d)</internal-xref> shall be judicially
reviewable in connection with judicial review
<internal-xref idref="HA39D237510F94CC6A6377F7CC51503AE" legis-path="553a.(b)">of subsection (b)</internal-xref>.</text>
</paragraph><paragraph id="H9DC439D536F440C1A7D2A5257EF0DD82"><enum>(2)</enum><header>Jurisdiction</header><text>Each
court having jurisdiction to review such rule for compliance with section 553,
or under any other provision of law, shall have jurisdiction to review any
claims of noncompliance with subsections (b) and (c) in accordance with chapter
7. Agency compliance with
<internal-xref idref="HCC4B4B4680AF4FC5A86167EA249EB22B" legis-path="553a.(d)">subsection (d)</internal-xref> shall be judicially
reviewable in connection with judicial review<internal-xref idref="HA39D237510F94CC6A6377F7CC51503AE" legis-path="553a.(b)"> of subsection
(b)</internal-xref>.</text>
</paragraph><paragraph id="H88A1E83897D242988079B0F578BCF6C5"><enum>(3)</enum><header>Limitations</header>
<subparagraph id="H7A4E2F17F8CE4DA48D69AC1623A8D239"><enum>(A)</enum><text>An individual may
seek such review during the period beginning on the date of final agency action
and ending 1 year later, except that where a provision of law requires that an
action challenging a final agency action be commenced before the expiration of
1 year, such lesser period shall apply to an action for judicial review under
this subsection.</text>
</subparagraph><subparagraph id="H5A4822A2BCEE4EC0836D30F0DFE464C3"><enum>(B)</enum><text>In the case where
an agency delays the issuance of a final privacy impact assessment pursuant to
<internal-xref idref="HDD8B3D0B9A9B41B2B571F9005500001F" legis-path="553a.(c)">subsection (c)</internal-xref>, an action for judicial
review under this section shall be filed not later than—</text>
<clause id="H1DC573A2E9E1412D8E41082C5311F24F"><enum>(i)</enum><text>1
year after the date the assessment is made available to the public; or</text>
</clause><clause id="H12CDBD7809D94DE2AF00E0F1114EFEDA"><enum>(ii)</enum><text>where a provision
of law requires that an action challenging a final agency regulation be
commenced before the expiration of the 1-year period, the number of days
specified in such provision of law that is after the date the assessment is
made available to the public.</text>
</clause></subparagraph></paragraph><paragraph id="H1A9C862F18CE451B92009652E0B88038"><enum>(4)</enum><header>Relief</header><text>In
granting any relief in an action under this subsection, the court shall order
the agency to take corrective action consistent with this section and chapter
7, and may—</text>
<subparagraph id="HE202E8A7F9314AC396ABAA9DAE70234D"><enum>(A)</enum><text>remand the rule to
the agency; and</text>
</subparagraph><subparagraph id="H2C10E94DB77140928C68003D96910061"><enum>(B)</enum><text>defer the
enforcement of the rule against individuals, unless the court finds that
continued enforcement of the rule is in the public interest.</text>
</subparagraph></paragraph><paragraph id="HADE74D735301433183790798E1840189"><enum>(5)</enum><header>Rule of
construction</header><text>Nothing in this subsection limits the authority of
any court to stay the effective date of any rule or provision thereof under any
other provision of law or to grant any other relief in addition to the
requirements of this subsection.</text>
</paragraph><paragraph id="H9703D7BDE45548E78854F30676654EF"><enum>(6)</enum><header>Record of agency
action</header><text>In an action for the judicial review of a rule, the
privacy impact assessment for such rule, including an assessment prepared or
corrected pursuant to
<internal-xref idref="H1A9C862F18CE451B92009652E0B88038" legis-path="553a.(f)(4)">paragraph (4)</internal-xref>, shall constitute part
of the entire record of agency action in connection with such review.</text>
</paragraph><paragraph id="H469FA29C4B044BEB8CEAB9B33C432E23"><enum>(7)</enum><header>Exclusivity</header><text>Compliance
or noncompliance by an agency with the provisions of this section shall be
subject to judicial review only in accordance with this subsection.</text>
</paragraph><paragraph id="H7877846EBCC044A2B215F31F0900808C"><enum>(8)</enum><header>Savings
clause</header><text>Nothing in this subsection bars judicial review of any
other impact statement or similar assessment required by any other law if
judicial review of such statement or assessment is otherwise permitted by
law.</text>
</paragraph></subsection><subsection id="H5DA2F048AF0F49E9AC5C7CADFA4B90A"><enum>(g)</enum><header>Definition</header><text>For
purposes of this section, the term <term>personally identifiable
information</term> means information that can be used to identify an
individual, including such individual’s name, address, telephone number,
photograph, social security number or other identifying information. It
includes information about such individual’s medical or financial
condition.</text>
</subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H079AA6814D3A49A999A16A6C4D9200"><enum>(b)</enum><header>Periodic review
transition provisions</header>
<paragraph id="HEE84A7EA6C0940C19130976BDCF6B677"><enum>(1)</enum><header>Initial
plan</header><text>For each agency, the plan required by subsection (e) of
<external-xref legal-doc="usc" parsable-cite="usc/5/553a">section 553a</external-xref> of title 5, United States Code (as added by
<internal-xref idref="H468E4E2788474BFD8F4105633C5CC49E" legis-path="2.(a)">subsection (a)</internal-xref>), shall be published not
later than 180 days after the date of the enactment of this Act.</text>
</paragraph><paragraph id="H92692FB9D037463E9EC0EAA2F0F3D49C"><enum>(2)</enum><header>Review
period</header><text>In the case of a rule promulgated by an agency before the
date of the enactment of this Act, such plan shall provide for the periodic
review of such rule before the expiration of the 10-year period beginning on
the date of the enactment of this Act. For any such rule, the head of the
agency may provide for a 1-year extension of such period if the head of the
agency, before the expiration of the period, certifies in a statement published
in the Federal Register that reviewing such rule before the expiration of the
period is not feasible. The head of the agency may provide for additional
1-year extensions of the period pursuant to the preceding sentence, but in no
event may the period exceed 15 years.</text>
</paragraph></subsection><subsection id="H957ABE99D4264D5EA69ED9C07C62F963"><enum>(c)</enum><header>Congressional
review</header><text><external-xref legal-doc="usc" parsable-cite="usc/5/801">Section 801(a)(1)(B)</external-xref> of title 5, United States Code, is
amended—</text>
<paragraph id="H40B127BA85B14A8B8B5D00136DDBD04"><enum>(1)</enum><text>by
redesignating clauses (iii) and (iv) as clauses (iv) and (v), respectively;
and</text>
</paragraph><paragraph id="HDA67A540561A4101B191F46DED1FCD46"><enum>(2)</enum><text>by inserting after
clause (ii) the following new clause:</text>
<quoted-block id="H609F0ECB8BBF4A8092DAC3A06294CB2">
<clause id="HCD3B02ADF56E41D6B6CF3535884500E3" indent="up2"><enum>(iii)</enum><text>the agency’s actions relevant to
section
553a;</text>
</clause><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="H5ADDBB3F8C4B4C85BC719920A61D159E"><enum>(d)</enum><header>Clerical
amendment</header><text>The table of sections at the beginning of chapter 5 of
title 5, United States Code, is amended by adding after the item relating to
section 553 the following new item:</text>
<quoted-block id="HCF8609F3EA3C404A90A2012F94A1C5C1" style="USC">
<toc regeneration="no-regeneration">
<toc-entry level="section">553a. Privacy impact assessment in
rulemaking.</toc-entry>
</toc>
<after-quoted-block>.</after-quoted-block></quoted-block>
</subsection></section><enum>III</enum><header>Assistance for
State and local law enforcement to combat fraudulent, unauthorized, or other
criminal use of personally identifiable information</header>
<section id="HD6F60909DD4D4F78B54258F246B28FB1"><enum>301.</enum><header>Grants for
State and local law enforcement</header>
<subsection id="H5F3E51640C88462285E0298CBDBF1F8B"><enum>(a)</enum><header>In
general</header><text>Subject to the availability of amounts provided in
advance in appropriations Acts, the Assistant Attorney General for the Office
of Justice Programs of the Department of Justice may award grants to States to
establish and develop programs to increase and enhance enforcement against
crimes related to fraudulent, unauthorized, or other criminal use of personally
identifiable information.</text>
</subsection><subsection id="HA4DF33A2F9114060A3C73BE4C3F0A59C"><enum>(b)</enum><header>Application</header><text>To
be eligible for a grant under subsection (a), a State shall submit an
application to the Assistant Attorney General for the Office of Justice
Programs of the Department of Justice at such time, in such manner, and
containing such information, including as described in subsection (d), as the
Assistant Attorney General may require.</text>
</subsection><subsection id="H4B0DA7B747FE4586B7C27B68DED6DCC4"><enum>(c)</enum><header>Use of grant
amounts</header><text>A grant awarded to a State under subsection (a) shall be
used by a State, in conjunction with units of local government within that
State, State and local courts, other States, or combinations thereof, to
establish and develop programs to—</text>
<paragraph id="HC3F563C312A845FFB4A10400A58EB688"><enum>(1)</enum><text>assist State and
local law enforcement agencies in enforcing State and local criminal laws
relating to crimes involving the fraudulent, unauthorized, or other criminal
use of personally identifiable information;</text>
</paragraph><paragraph id="HB6DDE3EFC1F840B4AD3F31A5B2BECB0"><enum>(2)</enum><text>assist State and
local law enforcement agencies in educating the public to prevent and identify
crimes involving the fraudulent, unauthorized, or other criminal use of
personally identifiable information;</text>
</paragraph><paragraph id="H08B9E05E1EEC42418633447F886BEEDA"><enum>(3)</enum><text>educate and train
State and local law enforcement officers and prosecutors to conduct
investigations and forensic analyses of evidence and prosecutions of crimes
involving the fraudulent, unauthorized, or other criminal use of personally
identifiable information;</text>
</paragraph><paragraph id="HDB2596784EC5446D8E003FCAE38D73AE"><enum>(4)</enum><text>assist State and
local law enforcement officers and prosecutors in acquiring computer and other
equipment to conduct investigations and forensic analysis of evidence of crimes
involving the fraudulent, unauthorized, or other criminal use of personally
identifiable information; and</text>
</paragraph><paragraph id="HF9DCC967FF764423BF022CB0A4C21C77"><enum>(5)</enum><text>facilitate and
promote the sharing of Federal law enforcement expertise and information about
the investigation, analysis, and prosecution of crimes involving the
fraudulent, unauthorized, or other criminal use of personally identifiable
information with State and local law enforcement officers and prosecutors,
including the use of multi-jurisdictional task forces.</text>
</paragraph></subsection><subsection id="H297AB698026B4AAAA23700BE23A44CAF"><enum>(d)</enum><header>Assurances and
eligibility</header><text>To be eligible to receive a grant under subsection
(a), a State shall provide assurances to the Attorney General that the
State—</text>
<paragraph id="HE8B8B7AA022F4A0BA6643FBA1BDE49D2"><enum>(1)</enum><text>has in effect laws
that penalize crimes involving the fraudulent, unauthorized, or other criminal
use of personally identifiable information, such as penal laws
prohibiting—</text>
<subparagraph id="H7F8B3649F33C46C7AB988EC55596F0A7"><enum>(A)</enum><text>fraudulent schemes
executed to obtain personally identifiable information;</text>
</subparagraph><subparagraph id="H34D96066DF634C7AB49685B131CE4FFF"><enum>(B)</enum><text>schemes executed
to sell or use fraudulently obtained personally identifiable information;
and</text>
</subparagraph><subparagraph id="H661F0BFDCEF14E54AFC1C4AF96D6BD16"><enum>(C)</enum><text>online sales of
personally identifiable information obtained fraudulently or by other illegal
means;</text>
</subparagraph></paragraph><paragraph id="HD00C4CFEDFA74F718EE58B24E36FCB1"><enum>(2)</enum><text>will provide an
assessment of the resource needs of the State and units of local government
within that State, including criminal justice resources being devoted to the
investigation and enforcement of laws related to crimes involving the
fraudulent, unauthorized, or other criminal use of personally identifiable
information;</text>
</paragraph><paragraph id="HD5916525CC634E468026769250AD70BA"><enum>(3)</enum><text>will develop a
plan for coordinating the programs funded under this section with other
federally funded technical assistant and training programs, including directly
funded local programs such as the Local Law Enforcement Block Grant program
(described under the heading <quote>Violent Crime Reduction Programs, State and
Local Law Enforcement Assistance</quote> of the Departments of Commerce,
Justice, and State, the Judiciary, and Related Agencies Appropriations Act,
1998 (<external-xref legal-doc="public-law" parsable-cite="pl/105/119">Public Law 105–119</external-xref>)); and</text>
</paragraph><paragraph id="H8E0FEAAFCEFB4961A6E3CD29BDADD6EA"><enum>(4)</enum><text display-inline="yes-display-inline">will submit to the Assistant Attorney
General for the Office of Justice Programs of the Department of Justice
applicable reports in accordance with subsection (f).</text>
</paragraph></subsection><subsection id="H51448C90E9164A73880076F04F867960"><enum>(e)</enum><header>Matching
funds</header><text>The Federal share of a grant received under this section
may not exceed 90 percent of the total cost of a program or proposal funded
under this section unless the Attorney General waives, wholly or in part, the
requirements of this subsection.</text>
</subsection><subsection id="H3D83885DD30844418B38EA98BF7C67A9"><enum>(f)</enum><header>Reports</header><text display-inline="yes-display-inline">For each year that a State receives a grant
under subsection (a) for a program, the State shall submit to the Assistant
Attorney General for the Office of Justice Programs of the Department of
Justice a report on the results, including the effectiveness, of such program
during such year.</text>
</subsection></section><section id="H4986C1796B4C4131A5AA8201C46B4D6F"><enum>302.</enum><header>Authorization
of appropriations</header>
<subsection id="HC486D76773844D39A828F5CA012B796"><enum>(a)</enum><header>In
general</header><text>There is authorized to be appropriated to carry out this
title $25,000,000 for each of fiscal years 2008 through 2010.</text>
</subsection><subsection id="HFA20C52280704BE400E8FC64D4E056DA"><enum>(b)</enum><header>Limitations</header><text>Of
the amount made available to carry out this title in any fiscal year not more
than 3 percent may be used by the Attorney General for salaries and
administrative expenses.</text>
</subsection><subsection id="H9CFE16E806AF4FA4A75EF42700A5BF29"><enum>(c)</enum><header>Minimum
amount</header><text>Unless all eligible applications submitted by a State or
units of local government within a State for a grant under this title have been
funded, the State, together with grantees within the State (other than Indian
tribes), shall be allocated in each fiscal year under this title not less than
0.75 percent of the total amount appropriated in the fiscal year for grants
pursuant to this title, except that the United States Virgin Islands, American
Samoa, Guam, and the Northern Mariana Islands each shall be allocated 0.25
percent.</text>
</subsection><subsection id="HC115302FB02849EE887987BC9C7B4C00"><enum>(d)</enum><header>Grants to Indian
tribes</header><text>Notwithstanding any other provision of this title, the
Attorney General may use amounts made available under this title to make grants
to Indian tribes for use in accordance with this title.</text>
</subsection></section><enum>IV</enum><header>National White
Collar Crime Center grants</header>
<section id="H8D5BD5CED4F242DCB7C469E386F195F" section-type="subsequent-section"><enum>401.</enum><header>Authorization and
Expansion of National White Collar Crime Center</header>
<subsection id="HF83D18B3293045CD84993300A568F6ED"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Title I of the
Omnibus Crime Control and Safe Streets Act of 1968 (<external-xref legal-doc="usc" parsable-cite="usc/42/3711">42 U.S.C. 3711 et seq.</external-xref>) is
amended—</text>
<paragraph id="H0B729FAE0797456CA55174EE8166084F"><enum>(1)</enum><text>by redesignating
part X, as added by section 623 of <external-xref legal-doc="public-law" parsable-cite="pl/109/248">Public Law 109–248</external-xref>, as part JJ; and</text>
</paragraph><paragraph id="HCA8686EA6BA64A5DADF0432103CE385E"><enum>(2)</enum><text>by adding at the
end the following new part:</text>
<quoted-block display-inline="no-display-inline" id="H5735164210ED48128D7F9C853882C014" style="OLC">
<part id="H754958345CC348989281A6CE79022BCA"><enum>KK</enum><header>National White
Collar Crime Center grants</header>
<section id="H2B0AC7C57B644B6C9267D5A7E4C9CF00"><enum>3021.</enum><header>Establishment
of grants program</header>
<subsection id="H254E0354A78E465DA9C4DD00BBF9313B"><enum>(a)</enum><header>Authorization</header><text display-inline="yes-display-inline">The Director of the Bureau of Justice
Assistance is authorized to make grants and enter into contracts with State and
local criminal justice agencies and nonprofit organizations for the purpose of
improving the identification, investigation, and prosecution of certain
criminal activities.</text>
</subsection><subsection id="HC1E1689C93EF4FDEA3BE39C2EB601F05"><enum>(b)</enum><header>Certain criminal
activities defined</header><text>For purposes of this part, the term
<term>certain criminal activity</term> means a criminal conspiracy or activity
or a terrorist conspiracy or activity that spans jurisdictional boundaries,
including the following:</text>
<paragraph id="H99DE99A2B9F54DFFA5A2EFBFDCE61C55"><enum>(1)</enum><text>Terrorism.</text>
</paragraph><paragraph id="H720296CA5B694B7593C2601100AEEEF0"><enum>(2)</enum><text>Economic
crime.</text>
</paragraph><paragraph id="H50796D98440E467B8F64E655AC6ED33E"><enum>(3)</enum><text>High-tech crime,
also known as cyber crime or computer crime, including internet-based crime
against children and child pornography.</text>
</paragraph></subsection><subsection id="H17B43ABAB0F7468EAB8E0755F770FAA6"><enum>(c)</enum><header>Criminal justice
agency defined</header><text display-inline="yes-display-inline">For purposes
of this part, the term <term>criminal justice agency</term>, with respect to a
State or a unit of local government within such State, includes a law
enforcement agency, a State regulatory body with criminal investigative
authority, and a State or local prosecution office to the extent that such
agency, body, or office, respectively, is involved in the prevention,
investigation, and prosecution of certain criminal activities.</text>
</subsection></section><section commented="no" id="HD87063A5F0BD47CC8E31C14920AD3E00"><enum>3022.</enum><header>Authorized
programs</header><text display-inline="no-display-inline">Grants and contracts
awarded under this part may be made only for the following programs, with
respect to the prevention, investigation, and prosecution of certain criminal
activities:</text>
<paragraph commented="no" id="H99DEE1F50C2448B0AC9E387C174D81B0"><enum>(1)</enum><text>Programs to
provide a nationwide support system for State and local criminal justice
agencies.</text>
</paragraph><paragraph id="H3D5049459F584DC28EC167A0004F21CB"><enum>(2)</enum><text>Programs to assist
State and local criminal justice agencies to develop, establish, and maintain
intelligence-focused policing strategies and related information
sharing.</text>
</paragraph><paragraph commented="no" id="HF7B4C7889167441EBA1D76A5E1025C85"><enum>(3)</enum><text>Programs to
provide training and investigative support services to State and local criminal
justice agencies to provide such agencies with skills and resources needed to
investigate and prosecute such criminal activities and related criminal
activities.</text>
</paragraph><paragraph commented="no" id="HD0AF7E82B9754514BF8839CA81F7EABE"><enum>(4)</enum><text>Programs to
provide research support, to establish partnerships, and to provide other
resources to aid State and local criminal justice agencies to prevent,
investigate, and prosecute such criminal activities and related
problems.</text>
</paragraph><paragraph commented="no" id="H11519862AF2E4A5D84E422C71CBA6D67"><enum>(5)</enum><text>Programs to
provide information and research to the general public to facilitate the
prevention of such criminal activities.</text>
</paragraph><paragraph commented="no" id="H256D4C3DFEB34F6C0098B4E4939D4514"><enum>(6)</enum><text>Programs to
establish National training and research centers regionally, including within
Virginia, Texas, and Michigan, to provide training and research services for
State and local criminal justice agencies.</text>
</paragraph><paragraph commented="no" id="H7D9FB124B0F444C2AD61934FDAE1A981"><enum>(7)</enum><text>Any other programs
specified by the Attorney General as furthering the purposes of this
part.</text>
</paragraph></section><section id="HE22C71798C9F4E15B98D81D90027171C"><enum>3023.</enum><header>Application</header><text display-inline="no-display-inline">To be eligible for an award of a grant or
contract under this part, an entity shall submit to the Director of the Bureau
of Justice Assistance an application in such form and manner, and containing
such information, as required by the Director.</text>
</section><section id="H18487A69F1FA4DE485CC979D9C00B0D1"><enum>3024.</enum><header>Rules and
regulations</header><text display-inline="no-display-inline">Not later than 180
days after the date of the enactment of this part, the Director of the Bureau
of Justice Assistance shall promulgate such rules and regulations as are
necessary to carry out the this part, including rules and regulations for
submitting and reviewing applications under section
3023.</text>
</section></part><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="HE90EAF0D97EB4AC6B484515E863EAE89"><enum>(b)</enum><header>Authorization of
appropriation</header><text display-inline="yes-display-inline">Section 1001(a)
of such Act (<external-xref legal-doc="usc" parsable-cite="usc/42/3793">42 U.S.C. 3793</external-xref>) is amended by adding at the end the following new
paragraph:</text>
<quoted-block display-inline="no-display-inline" id="H9F44891A909D432DA81EF7ED2C30EA58" style="OLC">
<paragraph id="HA7A418D8C96348BA801FFD069935F3F9"><enum>(26)</enum><text>There is
authorized to be appropriated to carry out part KK—</text>
<subparagraph id="HDC047DAA59084CA8AC17304B2658D329"><enum>(A)</enum><text>$25,000,000 for
fiscal year 2008;</text>
</subparagraph><subparagraph id="HE00F420B4A68494F9F4BBCC1FD2EF40"><enum>(B)</enum><text>$28,000,000 for
fiscal year 2009;</text>
</subparagraph><subparagraph id="HC2F9C54F0FCB4919A1142914FB9B008C"><enum>(C)</enum><text>$31,000,000 for
fiscal year 2010;</text>
</subparagraph><subparagraph id="HE0774A663DFC4AF08242256B53CC2100"><enum>(D)</enum><text>$34,000,000 for
fiscal year 2011;</text>
</subparagraph><subparagraph id="H859E24B5A7BB490183578B0062FED8D6"><enum>(E)</enum><text>$37,000,000 for
fiscal year 2012; and</text>
</subparagraph><subparagraph id="H7FA139291D7843B5A16D56285138B895"><enum>(F)</enum><text>$40,000,000 for
fiscal year
2013.</text>
</subparagraph></paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection></section>