[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 2292 Introduced in Senate (IS)]

<DOC>






118th CONGRESS
  1st Session
                                S. 2292

 To improve the transparency of purchases by the Federal Government of 
data or information that can be used to identify an individual, and for 
                            other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             July 13, 2023

  Mr. Peters introduced the following bill; which was read twice and 
referred to the Committee on Homeland Security and Governmental Affairs

_______________________________________________________________________

                                 A BILL


 
 To improve the transparency of purchases by the Federal Government of 
data or information that can be used to identify an individual, and for 
                            other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Purchased Data Inventory Act''.

SEC. 2. DEFINITIONS.

    Section 3502 of title 44, United States Code, is amended--
            (1) in paragraph (22), by striking ``; and'';
            (2) in paragraph (23), by striking the period and inserting 
        a semicolon; and
            (3) by adding at the end the following:
            ``(24) the term `covered data purchase'--
                    ``(A) means data or information, including data or 
                information accessed through a database, that is--
                            ``(i) obtained by an agency in exchange for 
                        anything of value; and
                            ``(ii) reasonably can be used, alone or in 
                        combination with other data or information, to 
                        identify an individual;
                    ``(B) does not include bulk data obtained by an 
                agency to be used for statistical purposes; and
                    ``(C) does not include data obtained in exchange 
                for anything of value from another agency; and
            ``(25) the term `obtain in exchange for anything of value' 
        means to purchase, receive in connection with services provided 
        for consideration, or otherwise obtain in exchange for 
        considerations, including an access fee, service fee, 
        maintenance fee, or licensing fee.''.

SEC. 3. CHIEF DATA OFFICERS.

    Section 3520 of title 44, United States Code, is amended--
            (1) in subsection (c)--
                    (A) in paragraph (13), by striking ``and'';
                    (B) in paragraph (14), by striking the period and 
                inserting ``; and''; and
                    (C) by adding at the end the following:
            ``(15) compile the covered data purchases of the agency.'';
            (2) by striking subsection (e) and inserting the following:
    ``(e) Reports.--The Chief Data Officer of an agency shall submit to 
the Committee on Homeland Security and Governmental Affairs of the 
Senate and the Committee on Oversight and Accountability of the House 
of Representatives--
            ``(1) an annual report on the compliance of the agency with 
        the requirements of this subchapter, including information on 
        each requirement that the agency could not carry out and, if 
        applicable, what the agency needs to carry out such 
        requirement; and
            ``(2) an annual report on the covered data purchases of the 
        agency described in subsection (f), which may include an annex 
        of any material that is properly classified pursuant to an 
        Executive order.''; and
            (3) by adding at the end the following:
    ``(f) Covered Data Purchases.--
            ``(1) Report.--Not later than 180 days after the date of 
        enactment of this subsection, and annually thereafter the Chief 
        Data Officer of each agency shall compile a report on the 
        covered data purchases of each agency.
            ``(2) Consistency.--The Chief Data Officer Council, in 
        consultation with the Federal Privacy Council, or any successor 
        thereto, and the Chief Acquisition Officer Council, shall 
        provide direction to the Chief Data Officers of each agency for 
        consistent interpretation of this section.
            ``(3) Contents of report.--The report described in 
        paragraph (1) shall include, with respect to each covered data 
        purchase made by the agency during the 3-year period before the 
        date on which the report is submitted--
                    ``(A) a plain language description of the purpose 
                of the covered data purchase, including, if applicable, 
                a justification for obtaining the data in exchange for 
                anything of value rather than acquiring the data 
                through other means, including through the use of 
                interagency data sharing, subpoena, or other process;
                    ``(B) if applicable, the procurement instrument 
                identifier for the covered data purchase;
                    ``(C) the identity of the vendor that provided the 
                covered data purchase;
                    ``(D) if applicable, links to the relevant privacy 
                documents, including systems of records notices and 
                privacy impact assessments;
                    ``(E) a plain language description of the contents 
                of the data contained in the covered data purchase;
                    ``(F) the number of distinct individuals who are 
                reasonably linkable in the covered data purchase;
                    ``(G) an indication of whether data contained in 
                the covered data purchase is reflected in the data 
                inventory of the agency, as required under section 3511 
                of title 44, United States Code; and
                    ``(H) an indication of whether the covered data 
                purchase includes data, metadata, or information 
                relating to--
                            ``(i) location;
                            ``(ii) electronic device usage;
                            ``(iii) the contents of communications of 
                        an individual with other individuals;
                            ``(iv) communications metadata;
                            ``(v) network system traffic;
                            ``(vi) web browsing history;
                            ``(vii) social media history;
                            ``(viii) media consumption;
                            ``(ix) health;
                            ``(x) purchase history;
                            ``(xi) personal finances or credit;
                            ``(xii) education;
                            ``(xiii) work history;
                            ``(xiv) interests;
                            ``(xv) biometrics;
                            ``(xvi) identifiable characteristics of 
                        protected classes;
                            ``(xvii) criminal history;
                            ``(xviii) court records, including civil 
                        cases; and
                            ``(xix) the family members or friends of an 
                        individual.
            ``(4) Report publication.--
                    ``(A) In general.--Each agency shall make the 
                report submitted under paragraph (1) available to the 
                public on the website of the agency in a machine-
                readable, open format and without restrictions on 
                reuse, except for an annex described in subparagraph 
                (B).
                    ``(B) Annex.--A report under subparagraph (A) shall 
                include in an annex any necessary information that is 
                properly classified pursuant to an Executive order.''.

SEC. 4. CHIEF DATA OFFICER COUNCIL.

    Section 3520A of title 44 is amended--
            (1) in subsection (b)--
                    (A) in paragraph (4), by striking ``and'' at the 
                end;
                    (B) in paragraph (5), by striking the period and 
                inserting ``; and''; and
                    (C) by adding at the end the following:
            ``(6) study agency data purchasing habits.''; and
            (2) in subsection (d)--
                    (A) by inserting ``, in consultation with the 
                Federal Privacy Council, or any successor thereto, and 
                the Chief Acquisition Officer Council,'' after ``The 
                Council'';
                    (B) by striking ``the Committee on Oversight and 
                Government Reform of the House of Representatives'' and 
                inserting ``the Committee on Oversight and 
                Accountability of the House of Representatives''; and
                    (C) by inserting ``, including recommendations 
                specified in section 3(e) of the Purchased Data 
                Inventory Act'' after ``the work of the Council''.
                                 <all>