Short title

This Act may be cited as the

Promoting Digital Privacy Technologies Act

Definition of privacy enhancing technology

In this Act, the term privacy enhancing technology— (1)means any software or hardware solution, technical process, or other technological means of mitigating individuals’ privacy risks arising from data processing by enhancing predictability, manageability, disassociability, and confidentiality; and (2)may include— (A)cryptographic techniques for facilitating computation or analysis on data while mitigating privacy risks; (B)techniques for publicly sharing data without enabling inferences to be made about specific individuals; (C)techniques for giving individuals’ control over the dissemination, sharing, and use of their data; (D)techniques for generating synthetic data; and (E)any other technology or approach that reduces the risk of re-identification, including when combined with other information.

National Science Foundation support of research on privacy enhancing technology

The Director of the National Science Foundation, in consultation with other relevant Federal agencies (as determined by the Director), shall support merit-reviewed and competitively awarded research on privacy enhancing technologies, which may include— (1)fundamental research on technologies for de-identification, pseudonymization, anonymization, or obfuscation to mitigate individuals’ privacy risks in data sets while maintaining fairness, accuracy, and efficiency; (2)fundamental research on algorithms and other similar mathematical tools used to protect individual privacy when collecting, storing, sharing, analyzing, or aggregating data; (3)fundamental research on technologies that promote data minimization in data collection, sharing, and analytics that takes into account the trade-offs between the data minimization goals and the informational goals of data collection; (4)research awards on privacy enhancing technologies coordinated with other relevant Federal agencies and programs; (5)supporting education and workforce training research and development activities, including re-training and upskilling of the existing workforce, to grow the number of privacy enhancing technology researchers and practitioners; (6)multidisciplinary socio-technical research that fosters broader understanding of privacy preferences, requirements, and human behavior to inform the design and adoption of effective privacy solutions; (7)development of freely available privacy enhancing technology software libraries, platforms, and applications; and (8)fundamental research on techniques that may undermine the protections provided by privacy enhancing technologies, the limitations of the protections provided by privacy enhancing technologies, and the trade-offs between privacy and utility required for their deployment.

Integration into the computer and network security program

Subparagraph (D) of section 4(a)(1) of the Cyber Security Research and Development Act (15 U.S.C. 7403(a)(1)(D)) is amended to read as follows:

(D)privacy and confidentiality, including privacy enhancing technologies;

Coordination with the National Institute of Standards and Technology and other stakeholders

(a)

In general

The Director of the Office of Science and Technology Policy, acting through the Networking and Information Technology Research and Development Program, shall coordinate with the Director of the National Science Foundation, the Director of the National Institute of Standards and Technology, the Federal Trade Commission, and the heads of other Federal agencies, as appropriate, to accelerate the development, deployment, and adoption of privacy enhancing technologies. (b)

Outreach

The Director of the National Institute of Standards and Technology shall conduct outreach to— (1)receive input from private, public, and academic stakeholders on the development of privacy enhancing technologies; and (2) facilitate and support ongoing public and private sector engagement to inform the development and dissemination of voluntary, consensus-based technical standards, guidelines, methodologies, procedures, and processes to cost-effectively increase the integration of privacy enhancing technologies in data collection, sharing, and analytics performed by the public and private sectors.

Report on privacy enhancing technology research

Not later than 3 years after the date of enactment of this Act, the Director of the Office of Science and Technology Policy, acting through the Networking and Information Technology Research and Development Program, shall, in coordination with the Director of the National Science Foundation, the Director of the National Institute of Standards and Technology, and the heads of other Federal agencies, as appropriate, submit to the Committee on Commerce, Science, and Transportation of the Senate, the Subcommittee on Commerce, Justice, Science, and Related Agencies of the Committee on Appropriations of the Senate, the Committee on Science, Space, and Technology of the House of Representatives, and the Subcommittee on Commerce, Justice, Science, and Related Agencies of the Committee on Appropriations of the House of Representatives, a report containing— (1)the progress of research on privacy enhancing technologies; (2)the progress of the development of voluntary resources described under section 5(b)(2); and (3)any policy recommendations that could facilitate and improve communication and coordination between the private sector and relevant Federal agencies for the implementation and adoption of privacy enhancing technologies.

Protecting personal identifying information

Any personal identifying information collected or stored through the activities authorized in this Act shall be done in accordance with section 690 of title 45, Code of Federal Regulations (relating to the protection of human subjects), or any successor regulation.