1.This Act may be cited as the
Cyber Privacy Fortification Act of
2012
.
<enum>I</enum><header>Data
Breach Notification</header>
<section id="H44D8761EAEDB4294A52F68C5995EFFC4"><enum>101.</enum><header>Failure to
provide notice of security breaches involving sensitive personally identifiable
information</header>
<subsection id="H2E6172D068124D15A0F7DBCF2FAB1276"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Chapter 47 of title
18, United States Code, is amended by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="H10BC3B93684644B3825941FDD51A75A5" style="USC">
<section id="H34A0EB3DF89F4799B8C18180C67F4104"><enum>1040.</enum><header>Failure to
provide notice of security breaches involving sensitive personally identifiable
information</header>
<subsection id="H21B25C95153D4210B8442F3D68CC6A94"><enum>(a)</enum><text display-inline="yes-display-inline">Whoever, having a covered obligation to
provide notice of a security breach involving sensitive personally identifiable
information, knowingly fails to do so, shall be fined under this title or
imprisoned not more than 5 years, or both.</text>
</subsection><subsection id="HBE3D9BDD0C38481CBE5F2469046A517B"><enum>(b)</enum><text>As used in this
section—</text>
<paragraph id="HDFD0BA06DE1141BA92610E8090FC5B0A"><enum>(1)</enum><text>the term
<term>covered obligation</term>, with respect to providing notice of a security
breach, means an obligation under Federal law or, if the breach is in or
affects interstate or foreign commerce, under State law;</text>
</paragraph><paragraph id="H2B80C44D9BDC47F4A6499D9695B4A36E"><enum>(2)</enum><text display-inline="yes-display-inline">the term <term>sensitive personally
identifiable information</term> means any electronic or digital information
that includes—</text>
<subparagraph id="H9BD86F1FE82D4065ACBF6FBC825BB85E"><enum>(A)</enum><text>an individual’s
first and last name, or first initial and last name, or address or phone number
in combination with any 1 of the following data elements where the data
elements are not protected by a technology protection measure that renders the
data element indecipherable—</text>
<clause id="H5EB730D08D7A465B80F87D6DF3AFEB8D"><enum>(i)</enum><text>a
nontruncated social security number, driver’s license number, state resident
identification number, passport number, or alien registration number;</text>
</clause><clause id="H27D6FFE6401B4CA08E835891FA007ABE"><enum>(ii)</enum><text>both—</text>
<subclause id="HE6041BF880DA46AF9F679514C881B35C"><enum>(I)</enum><text>mother’s maiden
name, if identified as such; and</text>
</subclause><subclause id="H50837038665C465A9E4ECC1934887FEC"><enum>(II)</enum><text>month, day, and
year of birth; and</text>
</subclause></clause><clause id="HD7C845EE893D426798F237C605A44D80"><enum>(iii)</enum><text>unique biometric
data such as a fingerprint, voice print, a retina or iris image; or</text>
</clause></subparagraph><subparagraph id="H9AA81DFC6BD74882B314328107C92404"><enum>(B)</enum><text>a financial
account number or credit or debit card number in combination with any security
code, access code or password that is required for an individual to obtain
credit, withdraw funds, or engage in a financial transaction by means of such
number;</text>
</subparagraph></paragraph><paragraph id="H5707127ECB6947F5BB9A7BC72C94B74A"><enum>(3)</enum><text display-inline="yes-display-inline">the term <term>security breach</term> means
a compromise of the security, confidentiality, or integrity of computerized
data that there is reason to believe has resulted in improper access to
sensitive personally identifiable information; and</text>
</paragraph><paragraph id="H2D55D65449624ABF9FBBA3B6046A1640"><enum>(4)</enum><text>the term
<term>improper access</term> means access without authorization or in excess of
authorization.</text>
</paragraph></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H592D0D62198D4A78B3A7CC807997AF3A"><enum>(b)</enum><header>Clerical
amendment</header><text display-inline="yes-display-inline">The table of
sections at the beginning of chapter 47 of title 18, United States Code, is
amended by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="H4982A4436F144CDF880C08BBFB73E727" style="USC">
<toc>
<toc-entry level="section">1040. Concealment of security breaches
involving personally identifiable
information.</toc-entry>
</toc>
<after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H1DD80CC51B2F48FF83AD076E63FB6D93"><enum>(c)</enum><header>Obligation To
report</header>
<paragraph id="HF50545F5ACAF40FFAAF2170E38DA9F2D"><enum>(1)</enum><header>In
general</header><text>A person who owns or possesses data in electronic form
containing a means of identification and has knowledge of a major security
breach of the system containing such data maintained by such person, must
provide prompt notice of such breach to the United States Secret Service or
Federal Bureau of Investigation.</text>
</paragraph><paragraph id="H2EDA3FD6DEAD4791BCD5F32B92819F36"><enum>(2)</enum><header>Publication of
list of notifications</header><text>The Secret Service and the Federal Bureau
of Investigation shall annually publish in the Federal Register a list of all
notifications submitted the previous calendar year and the identity of each
entity with respect to which the major security breach occurred.</text>
</paragraph><paragraph id="HB7CD534E131F4D928D6E89E6D676FF3B"><enum>(3)</enum><header>Definition</header><text>In
this subsection—</text>
<subparagraph id="H251B43835F434B0B80B4CBB804B398E0"><enum>(A)</enum><text>the term
<term>major security breach</term> means any security breach involving—</text>
<clause id="HC7E816682E514AE3A4F1C88576E27BD2"><enum>(i)</enum><text>means of
identification pertaining to 10,000 or more individuals is, or is reasonably
believed to have been acquired;</text>
</clause><clause id="H5FDBAD37F3AE4B4DB8F97A8B39E50BF0"><enum>(ii)</enum><text>databases owned
by the Federal Government; or</text>
</clause><clause id="HFB4A834B304545D1881993AA365B76D8"><enum>(iii)</enum><text>means of
identification of Federal Government employees or contractors involved in
national security matters or law enforcement; and</text>
</clause></subparagraph><subparagraph id="HF7CD8CAA292E4D0AB2E3A29D144A2D86"><enum>(B)</enum><text display-inline="yes-display-inline">the term <term>means of
identification</term> has the meaning given that term in section 1028 of title
18, United States Code.</text>
</subparagraph></paragraph></subsection></section><enum>II</enum><header>Non-criminal
privacy enforcement and privacy impact statements</header>
<section id="H19187D917A4E4995A2E2D33A3303D472"><enum>201.</enum><header>Enforcement by
Attorney General and State authorities</header>
<subsection id="HD87ABAE93521460CB57B708E3555AC3C"><enum>(a)</enum><header>Definition of
<term>authorized entity</term></header><text display-inline="yes-display-inline">As used in this section, the term
<term>authorized entity</term> means the Attorney General, with respect to any
conduct constituting a violation of a Federal law enacted after the date of the
enactment of this Act relating to data security and engaged in by a business
entity, and a State Attorney General with respect to that conduct to the extent
the conduct adversely affects an interest of the residents of a State.</text>
</subsection><subsection id="H661D5DD527E54C1D937A76F4AEE9EA5C"><enum>(b)</enum><header>Civil
penalty</header>
<paragraph id="H213040F2AEA54DCD97BA2B5B5E1A8D6C"><enum>(1)</enum><header>Generally</header><text>An
authorized entity may in a civil action obtain a civil penalty of not more than
$500,000 from any business entity that engages in conduct constituting a
violation of a Federal law enacted after the date of the enactment of this Act
relating to data security.</text>
</paragraph><paragraph id="HE6705CCB82214A028C402BA3AB87C291"><enum>(2)</enum><header>Special rule for
intentional violation</header><text>If the violation described in subsection
(a) is intentional, the maximum civil penalty is $1,000,000.</text>
</paragraph></subsection><subsection id="H47FB9B4D91C447ED949A8862B173AE1D"><enum>(c)</enum><header>Injunctive
relief</header><text display-inline="yes-display-inline">An authorized entity
may, in a civil action against a business entity that has engaged, or is
engaged, in any conduct constituting a violation of a Federal law enacted after
the date of the enactment of this Act relating to data security, obtain an
order—</text>
<paragraph id="HEDF0F33C08B44098BAF0949DB8FE0347"><enum>(1)</enum><text>enjoining such act
or practice; or</text>
</paragraph><paragraph id="HA9AACCE5709D4B719F9DE46D8705A4AF"><enum>(2)</enum><text>enforcing
compliance with that law.</text>
</paragraph></subsection><subsection id="H10DEB10F7F1849F991DAA929D8F8EE80"><enum>(d)</enum><header>Other rights and
remedies</header><text>The rights and remedies available under this section do
not affect any other rights and remedies available under Federal or State
law.</text>
</subsection></section><section display-inline="no-display-inline" id="H1880C6FB23AF45419FE8AC8C78C1EA71" section-type="subsequent-section"><enum>202.</enum><header>Coordination of
State and Federal efforts</header>
<subsection id="H251FA011C1784BE695AEDE9B1F6FAD06"><enum>(a)</enum><header>Notice</header>
<paragraph id="HFE8BEA8978FB45F8AF68CB019BB39258"><enum>(1)</enum><header>In
general</header><text>A State consumer protection attorney may not bring an
action under section 201, until the attorney general of the State involved
provides to the Attorney General of the United States—</text>
<subparagraph id="HC9B57631036F4205846E5C39626FEB0F"><enum>(A)</enum><text>written notice of
the action; and</text>
</subparagraph><subparagraph id="HEA9173D71237465787C42EF877CE51E5"><enum>(B)</enum><text>a copy of the
complaint for the action.</text>
</subparagraph></paragraph><paragraph id="H539A360343AF4780A7F4EA74F3486DEA"><enum>(2)</enum><header>Exception</header><text>Paragraph
(1) does not apply with respect to the filing of an action by an attorney
general of a State under this section if the State attorney general determines
that it is not feasible to provide the notice described in such subparagraph
before the filing of the action, in such a case the State attorney general
shall provide notice and a copy of the complaint to the Attorney General at the
time the State attorney general files the action.</text>
</paragraph></subsection><subsection id="HE71278BC6D404D1E94E8CED24B06C386"><enum>(b)</enum><header>Federal
proceedings</header><text>The Attorney General may—</text>
<paragraph id="H0612D2555E324C45B7E3D35F5BFCD2EE"><enum>(1)</enum><text>move to stay any
non-Federal action under section 201, pending the final disposition of a
pending Federal action under that section;</text>
</paragraph><paragraph id="H1E7106BC7E74421BACC1C2194D8CEB2A"><enum>(2)</enum><text>initiate an action
in an appropriate United States district court and move to consolidate all
pending actions under section 201, including State actions, in that court;
and</text>
</paragraph><paragraph id="H871DA47655ED40A694427B8E349F2988"><enum>(3)</enum><text>intervene in a
State action under section 201.</text>
</paragraph></subsection><subsection id="H44FB636E958C4A8A9FF6E54321719236"><enum>(c)</enum><header>Pending
proceedings</header><text display-inline="yes-display-inline">If the Attorney
General institutes a proceeding or action for a violation of a Federal law
enacted after the date of the enactment of this Act relating to data security,
no authority of a State may, during the pendency of such proceeding or action,
bring an action under this section against any defendant named in such criminal
proceeding or a civil action against any defendant for any violation that is
alleged in that proceeding or action.</text>
</subsection><subsection id="H979FBD2EE1004E98ABF0AF0FD7CF1211"><enum>(d)</enum><header>Definition</header><text display-inline="yes-display-inline">As used in this section, the term
<term>State consumer protection attorney</term> means the attorney general of a
State or any State or local law enforcement agency authorized by the State
attorney general or by State statute to prosecute violations of consumer
protection law.</text>
</subsection></section><section display-inline="no-display-inline" id="HBB0EE181EBD04D7A889F20A3DC71BC99" section-type="subsequent-section"><enum>203.</enum><header>Requirement that
agency rulemaking take into consideration impacts on individual
privacy</header>
<subsection id="H359001F0EBB34274B1E03AB8468388AF"><enum>(a)</enum><header>In
general</header><text>Title 5, United States Code, is amended by adding after
section 553 the following new section:</text>
<quoted-block id="HF16D422D04EA4A29AFB8D5C042C24F26" style="USC">
<section id="H6D5B729CF2B34931A0597AA875F4C176"><enum>553a.</enum><header>Privacy impact
assessment in rulemaking</header>
<subsection id="H290D5E7E029B461880FC6F6D083FC4A9"><enum>(a)</enum><header>Initial privacy
impact assessment</header>
<paragraph id="H9B9FFBC318C843938553D9231CEA7C9E"><enum>(1)</enum><header>In
general</header><text>Whenever an agency is required by section 553 of this
title, or any other law, to publish a general notice of proposed rulemaking for
a proposed rule, or publishes a notice of proposed rulemaking for an
interpretative rule involving the internal revenue laws of the United States,
and such rule or proposed rulemaking pertains to the collection, maintenance,
use, or disclosure of personally identifiable information from 10 or more
individuals, other than agencies, instrumentalities, or employees of the
Federal Government, the agency shall prepare and make available for public
comment an initial privacy impact assessment that describes the impact of the
proposed rule on the privacy of individuals. Such assessment or a summary
thereof shall be signed by the senior agency official with primary
responsibility for privacy policy and be published in the Federal Register at
the time of the publication of a general notice of proposed rulemaking for the
rule.</text>
</paragraph><paragraph id="HABF00B575D4C4155AFCB385F7DB28764"><enum>(2)</enum><header>Contents</header><text>Each
initial privacy impact assessment required under this subsection shall contain
the following:</text>
<subparagraph id="H343603163D2B42FD8D43009FEF54A171"><enum>(A)</enum><text>A description and
analysis of the extent to which the proposed rule will impact the privacy
interests of individuals, including the extent to which the proposed
rule—</text>
<clause id="H41B7B8CE756F48D8BEC57EA0C6238F9B"><enum>(i)</enum><text>provides notice of
the collection of personally identifiable information, and specifies what
personally identifiable information is to be collected and how it is to be
collected, maintained, used, and disclosed;</text>
</clause><clause id="H3C1CCEBD60DA4B62A2A80FB6AC117EEC"><enum>(ii)</enum><text>allows access to
such information by the person to whom the personally identifiable information
pertains and provides an opportunity to correct inaccuracies;</text>
</clause><clause id="HFB820714D1D24FD69C7696821F58CD50"><enum>(iii)</enum><text>prevents such
information, which is collected for one purpose, from being used for another
purpose; and</text>
</clause><clause id="H5124CBF136D74B2AB4DC4C41757072B4"><enum>(iv)</enum><text display-inline="yes-display-inline">provides security for such information,
including the provision of written notice to any individual, within 14 days of
the date of compromise, whose privacy interests are compromised by the
unauthorized release of personally identifiable information as a result of a
breach of security at or by the agency.</text>
</clause></subparagraph><subparagraph id="HCA7853F2CB5D47D3AB3A910ADC934CEC"><enum>(B)</enum><text>A description of
any significant alternatives to the proposed rule which accomplish the stated
objectives of applicable statutes and which minimize any significant privacy
impact of the proposed rule on individuals.</text>
</subparagraph></paragraph></subsection><subsection id="HBF6BDCD4093746EABECF9122F08A393E"><enum>(b)</enum><header>Final privacy
impact assessment</header>
<paragraph id="HB65BCE793EA64467B0F8206ED4508CBC"><enum>(1)</enum><header>In
general</header><text>Whenever an agency promulgates a final rule under section
553 of this title, after being required by that section or any other law to
publish a general notice of proposed rulemaking, or promulgates a final
interpretative rule involving the internal revenue laws of the United States,
and such rule or proposed rulemaking pertains to the collection, maintenance,
use, or disclosure of personally identifiable information from 10 or more
individuals, other than agencies, instrumentalities, or employees of the
Federal Government, the agency shall prepare a final privacy impact assessment,
signed by the senior agency official with primary responsibility for privacy
policy.</text>
</paragraph><paragraph id="H2BEA65F32B2D46B8B0775730600467A7"><enum>(2)</enum><header>Contents</header><text>Each
final privacy impact assessment required under this subsection shall contain
the following:</text>
<subparagraph id="HC03B717477DD4A95B2EA8DBCF31112FA"><enum>(A)</enum><text>A description and
analysis of the extent to which the final rule will impact the privacy
interests of individuals, including the extent to which such rule—</text>
<clause id="HEEB835B099B14D53B759215B3AFBE72B"><enum>(i)</enum><text>provides notice of
the collection of personally identifiable information, and specifies what
personally identifiable information is to be collected and how it is to be
collected, maintained, used, and disclosed;</text>
</clause><clause id="HE1B61DF12E0845E2A9BAB75946C68BEC"><enum>(ii)</enum><text>allows access to
such information by the person to whom the personally identifiable information
pertains and provides an opportunity to correct inaccuracies;</text>
</clause><clause id="H469D3B2B833D45A4BEBE76DD459F1C8C"><enum>(iii)</enum><text>prevents such
information, which is collected for one purpose, from being used for another
purpose; and</text>
</clause><clause id="HA1658180EE5D4447BCE1D84BADDB81FC"><enum>(iv)</enum><text display-inline="yes-display-inline">provides security for such information,
including the provision of written notice to any individual, within 14 days of
the date of compromise, whose privacy interests are compromised by the
unauthorized release of personally identifiable information as a result of a
breach of security at or by the agency.</text>
</clause></subparagraph><subparagraph id="H0C4B74E58576409A9E1CD22D94424365"><enum>(B)</enum><text>A summary of any
significant issues raised by the public comments in response to the initial
privacy impact assessment, a summary of the analysis of the agency of such
issues, and a statement of any changes made in such rule as a result of such
issues.</text>
</subparagraph><subparagraph id="H9BB123845DCF4E9394F5D2C9648E49AF"><enum>(C)</enum><text>A description of
the steps the agency has taken to minimize the significant privacy impact on
individuals consistent with the stated objectives of applicable statutes,
including a statement of the factual, policy, and legal reasons for selecting
the alternative adopted in the final rule and why each one of the other
significant alternatives to the rule considered by the agency which affect the
privacy interests of individuals was rejected.</text>
</subparagraph></paragraph><paragraph id="H09A87E48785B475E8421982C633E1E93"><enum>(3)</enum><header>Availability to
public</header><text>The agency shall make copies of the final privacy impact
assessment available to members of the public and shall publish in the Federal
Register such assessment or a summary thereof.</text>
</paragraph></subsection><subsection id="H5BA9B17CCFE7458CBCACD12361B974B1"><enum>(c)</enum><header>Waivers</header>
<paragraph id="H1B39450189774496BEE153CF5296D8DB"><enum>(1)</enum><header>Emergencies</header><text>An
agency head may waive or delay the completion of some or all of the
requirements of subsections (a) and (b) to the same extent as the agency head
may, under section 608, waive or delay the completion of some or all of the
requirements of sections 603 and 604, respectively.</text>
</paragraph><paragraph id="HDB841998C7E74D8CB28A8AF16069A41F"><enum>(2)</enum><header>National
security</header><text>An agency head may, for national security reasons, or to
protect from disclosure classified information, confidential commercial
information, or information the disclosure of which may adversely affect a law
enforcement effort, waive or delay the completion of some or all of the
following requirements:</text>
<subparagraph id="H93C5825557814E7C8DE2C2F41AAAAEB4"><enum>(A)</enum><text display-inline="yes-display-inline">The requirement of
<internal-xref idref="H9B9FFBC318C843938553D9231CEA7C9E" legis-path="553a.(a)(1)">subsection (a)(1)</internal-xref> to make an
assessment available for public comment, provided that such assessment is made
available, in classified form, to the Committees on the Judiciary of the House
of Representatives and the Senate, in lieu of making such assessment available
to the public.</text>
</subparagraph><subparagraph id="H135027E146724BE686D2B3D4DB68F481"><enum>(B)</enum><text display-inline="yes-display-inline">The requirement of
<internal-xref idref="H9B9FFBC318C843938553D9231CEA7C9E" legis-path="553a.(a)(1)">subsection (a)(1)</internal-xref> to have an
assessment or summary thereof published in the Federal Register, provided that
such assessment or summary is made available, in classified form, to the
Committees on the Judiciary of the House of Representatives and the Senate, in
lieu of publishing such assessment or summary in the Federal Register.</text>
</subparagraph><subparagraph id="H9FBD29D8E0234E3EADCDB90AE59D8F46"><enum>(C)</enum><text display-inline="yes-display-inline">The requirements of
<internal-xref idref="H09A87E48785B475E8421982C633E1E93" legis-path="553a.(b)(3)">subsection (b)(3)</internal-xref>, provided that the
final privacy impact assessment is made available, in classified form, to the
Committees on the Judiciary of the House of Representatives and the Senate, in
lieu of making such assessment available to the public and publishing such
assessment in the Federal Register.</text>
</subparagraph></paragraph></subsection><subsection id="H0ADA97D273F241BB83F83B6E6238BEE4"><enum>(d)</enum><header>Procedures for
gathering comments</header><text>When any rule is promulgated which may have a
significant privacy impact on individuals, or a privacy impact on a substantial
number of individuals, the head of the agency promulgating the rule or the
official of the agency with statutory responsibility for the promulgation of
the rule shall assure that individuals have been given an opportunity to
participate in the rulemaking for the rule through techniques such as—</text>
<paragraph id="HB56C13EF2B0E46EC882419FCE6A70757"><enum>(1)</enum><text>the inclusion in
an advance notice of proposed rulemaking, if issued, of a statement that the
proposed rule may have a significant privacy impact on individuals, or a
privacy impact on a substantial number of individuals;</text>
</paragraph><paragraph id="H945E91859194478CBEDDD458DDA29C13"><enum>(2)</enum><text>the publication of
a general notice of proposed rulemaking in publications of national circulation
likely to be obtained by individuals;</text>
</paragraph><paragraph id="H4B6DCC820D374776868425D5EA4D05A8"><enum>(3)</enum><text>the direct
notification of interested individuals;</text>
</paragraph><paragraph id="H641E97CFF00048E481455B69B1DF753F"><enum>(4)</enum><text>the conduct of
open conferences or public hearings concerning the rule for individuals,
including soliciting and receiving comments over computer networks; and</text>
</paragraph><paragraph id="HB2F68FFA26A0484BB6D5CE9388282846"><enum>(5)</enum><text>the adoption or
modification of agency procedural rules to reduce the cost or complexity of
participation in the rulemaking by individuals.</text>
</paragraph></subsection><subsection id="H3E116854A9B84AA6A31D98F053E41586"><enum>(e)</enum><header>Periodic review
of rules</header>
<paragraph id="H04114CD0C0A94832A996B580DF1B082D"><enum>(1)</enum><header>In
general</header><text>Each agency shall carry out a periodic review of the
rules promulgated by the agency that have a significant privacy impact on
individuals, or a privacy impact on a substantial number of individuals. Under
such periodic review, the agency shall determine, for each such rule, whether
the rule can be amended or rescinded in a manner that minimizes any such impact
while remaining in accordance with applicable statutes. For each such
determination, the agency shall consider the following factors:</text>
<subparagraph id="HE083324FACA04BC5BCAA0EFEBD99A0FE"><enum>(A)</enum><text>The continued need
for the rule.</text>
</subparagraph><subparagraph id="HD36E97657ECB456EA4DE748EB53ABE99"><enum>(B)</enum><text>The nature of
complaints or comments received from the public concerning the rule.</text>
</subparagraph><subparagraph id="HE9FA1DE04E2043ADAD335FADAB974784"><enum>(C)</enum><text>The complexity of
the rule.</text>
</subparagraph><subparagraph id="H0B7CE30C89724CE3B7DF7FA35ECB34BF"><enum>(D)</enum><text>The extent to
which the rule overlaps, duplicates, or conflicts with other Federal rules,
and, to the extent feasible, with State and local governmental rules.</text>
</subparagraph><subparagraph id="H3FF2860E4F3649EEB52116C3EAAC15BC"><enum>(E)</enum><text>The length of time
since the rule was last reviewed under this subsection.</text>
</subparagraph><subparagraph id="H1109E14ADEF64142911F2EB91E189EC7"><enum>(F)</enum><text>The degree to
which technology, economic conditions, or other factors have changed in the
area affected by the rule since the rule was last reviewed under this
subsection.</text>
</subparagraph></paragraph><paragraph id="HFCF28CD5018148B8A03BCEDA33852FD7"><enum>(2)</enum><header>Plan
required</header><text>Each agency shall carry out the periodic review required
by
<internal-xref idref="H04114CD0C0A94832A996B580DF1B082D" legis-path="553a.(e)(1)">paragraph (1)</internal-xref> in accordance with a
plan published by such agency in the Federal Register. Each such plan shall
provide for the review under this subsection of each rule promulgated by the
agency not later than 10 years after the date on which such rule was published
as the final rule and, thereafter, not later than 10 years after the date on
which such rule was last reviewed under this subsection. The agency may amend
such plan at any time by publishing the revision in the Federal
Register.</text>
</paragraph><paragraph id="H61B29C2A6CAD401B8415D29B33C4C1E5"><enum>(3)</enum><header>Annual
publication</header><text>Each year, each agency shall publish in the Federal
Register a list of the rules to be reviewed by such agency under this
subsection during the following year. The list shall include a brief
description of each such rule and the need for and legal basis of such rule and
shall invite public comment upon the determination to be made under this
subsection with respect to such rule.</text>
</paragraph></subsection><subsection id="HA306D8502F094DA691363226226FEC1F"><enum>(f)</enum><header>Judicial
review</header>
<paragraph id="H2CF83C2B5D464AB084F5B85D9D72C803"><enum>(1)</enum><header>In
general</header><text>For any rule subject to this section, an individual who
is adversely affected or aggrieved by final agency action is entitled to
judicial review of agency compliance with the requirements of subsections (b)
and (c) in accordance with chapter 7. Agency compliance with
<internal-xref idref="H0ADA97D273F241BB83F83B6E6238BEE4" legis-path="553a.(d)">subsection (d)</internal-xref> shall be judicially
reviewable in connection with judicial review
<internal-xref idref="HBF6BDCD4093746EABECF9122F08A393E" legis-path="553a.(b)">of subsection (b)</internal-xref>.</text>
</paragraph><paragraph id="HB4D18472F2AA4ED89E19DD37177635D6"><enum>(2)</enum><header>Jurisdiction</header><text>Each
court having jurisdiction to review such rule for compliance with section 553,
or under any other provision of law, shall have jurisdiction to review any
claims of noncompliance with subsections (b) and (c) in accordance with chapter
7. Agency compliance with
<internal-xref idref="H0ADA97D273F241BB83F83B6E6238BEE4" legis-path="553a.(d)">subsection (d)</internal-xref> shall be judicially
reviewable in connection with judicial review<internal-xref idref="HBF6BDCD4093746EABECF9122F08A393E" legis-path="553a.(b)"> of subsection
(b)</internal-xref>.</text>
</paragraph><paragraph id="H2F7ED667B43346C5AC5BF043354F76D8"><enum>(3)</enum><header>Limitations</header>
<subparagraph id="HA805787786AC473A8BDCF7B90D2317AC"><enum>(A)</enum><text>An individual may
seek such review during the period beginning on the date of final agency action
and ending 1 year later, except that where a provision of law requires that an
action challenging a final agency action be commenced before the expiration of
1 year, such lesser period shall apply to an action for judicial review under
this subsection.</text>
</subparagraph><subparagraph id="H43ED8FFEEE7B45F08BCB1E73809835EE"><enum>(B)</enum><text>In the case where
an agency delays the issuance of a final privacy impact assessment pursuant to
<internal-xref idref="H5BA9B17CCFE7458CBCACD12361B974B1" legis-path="553a.(c)">subsection (c)</internal-xref>, an action for judicial
review under this section shall be filed not later than—</text>
<clause id="H3EA336E81EC3445685A184B1EE70D2C6"><enum>(i)</enum><text>1
year after the date the assessment is made available to the public; or</text>
</clause><clause id="HE508BA3920864D599F62B58FB8AD1FA0"><enum>(ii)</enum><text>where a provision
of law requires that an action challenging a final agency regulation be
commenced before the expiration of the 1-year period, the number of days
specified in such provision of law that is after the date the assessment is
made available to the public.</text>
</clause></subparagraph></paragraph><paragraph id="H1607C4CDC8DE44EBB2C864650587766C"><enum>(4)</enum><header>Relief</header><text>In
granting any relief in an action under this subsection, the court shall order
the agency to take corrective action consistent with this section and chapter
7, and may—</text>
<subparagraph id="H059DC95FC5B145D49106EF7458E111BC"><enum>(A)</enum><text>remand the rule to
the agency; and</text>
</subparagraph><subparagraph id="H41689B55DE2A4CC29E35B737AC67141D"><enum>(B)</enum><text>defer the
enforcement of the rule against individuals, unless the court finds that
continued enforcement of the rule is in the public interest.</text>
</subparagraph></paragraph><paragraph id="H027FACFB29AC42EB8EE1DD5FD1842319"><enum>(5)</enum><header>Rule of
construction</header><text>Nothing in this subsection limits the authority of
any court to stay the effective date of any rule or provision thereof under any
other provision of law or to grant any other relief in addition to the
requirements of this subsection.</text>
</paragraph><paragraph id="H2D330B243C1349F6AA402FA810C2B35A"><enum>(6)</enum><header>Record of agency
action</header><text>In an action for the judicial review of a rule, the
privacy impact assessment for such rule, including an assessment prepared or
corrected pursuant to
<internal-xref idref="H1607C4CDC8DE44EBB2C864650587766C" legis-path="553a.(f)(4)">paragraph (4)</internal-xref>, shall constitute part
of the entire record of agency action in connection with such review.</text>
</paragraph><paragraph id="H14312AD9F47049B7B733B95EDD4CB742"><enum>(7)</enum><header>Exclusivity</header><text>Compliance
or noncompliance by an agency with the provisions of this section shall be
subject to judicial review only in accordance with this subsection.</text>
</paragraph><paragraph id="H206E4EF0F1C440D0A2334C38A26460F0"><enum>(8)</enum><header>Savings
clause</header><text>Nothing in this subsection bars judicial review of any
other impact statement or similar assessment required by any other law if
judicial review of such statement or assessment is otherwise permitted by
law.</text>
</paragraph></subsection><subsection id="H2862C2442AC94C44BC1F6FD6CAED6DCB"><enum>(g)</enum><header>Definition</header><text>For
purposes of this section, the term <term>personally identifiable
information</term> means information that can be used to identify an
individual, including such individual’s name, address, telephone number,
photograph, social security number or other identifying information. It
includes information about such individual’s medical or financial
condition.</text>
</subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H2D48DE5046D048F4B724C56537D7441F"><enum>(b)</enum><header>Periodic review
transition provisions</header>
<paragraph id="H7102F34BD09C47BA97435053381A020A"><enum>(1)</enum><header>Initial
plan</header><text>For each agency, the plan required by subsection (e) of
section 553a of title 5, United States Code (as added by
<internal-xref idref="H359001F0EBB34274B1E03AB8468388AF" legis-path="2.(a)">subsection (a)</internal-xref>), shall be published not
later than 180 days after the date of the enactment of this Act.</text>
</paragraph><paragraph id="HB92E0797EA374200B470289C69AA2168"><enum>(2)</enum><header>Review
period</header><text>In the case of a rule promulgated by an agency before the
date of the enactment of this Act, such plan shall provide for the periodic
review of such rule before the expiration of the 10-year period beginning on
the date of the enactment of this Act. For any such rule, the head of the
agency may provide for a 1-year extension of such period if the head of the
agency, before the expiration of the period, certifies in a statement published
in the Federal Register that reviewing such rule before the expiration of the
period is not feasible. The head of the agency may provide for additional
1-year extensions of the period pursuant to the preceding sentence, but in no
event may the period exceed 15 years.</text>
</paragraph></subsection><subsection id="HCBF17583AAFE4F4ABA14AE1D1475AAB1"><enum>(c)</enum><header>Congressional
review</header><text>Section 801(a)(1)(B) of title 5, United States Code, is
amended—</text>
<paragraph id="H4F59B5CA045244EBAFC0FD9C7AAABA0B"><enum>(1)</enum><text>by redesignating
clauses (iii) and (iv) as clauses (iv) and (v), respectively; and</text>
</paragraph><paragraph id="H6A72810E775A49DD9D743584B9431663"><enum>(2)</enum><text>by inserting after
clause (ii) the following new clause:</text>
<quoted-block id="HF7B1693B58D743C88425671A15E254D1">
<clause id="HBCF15CDF57874D0882BC67B1125F3377" indent="up2"><enum>(iii)</enum><text>the agency’s actions relevant to
section
553a;</text>
</clause><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="H3DFB22901BDE44D0919F7B73F3DFBD45"><enum>(d)</enum><header>Clerical
amendment</header><text>The table of sections at the beginning of chapter 5 of
title 5, United States Code, is amended by adding after the item relating to
section 553 the following new item:</text>
<quoted-block id="HC806027EC8A944F092852B45654A625F" style="USC">
<toc regeneration="no-regeneration">
<toc-entry level="section">553a. Privacy impact assessment in
rulemaking.</toc-entry>
</toc>
<after-quoted-block>.</after-quoted-block></quoted-block>
</subsection></section>