[Congressional Record Volume 170, Number 73 (Monday, April 29, 2024)]
[House]
[Pages H2652-H2654]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]




               PRIVACY ENHANCING TECHNOLOGY RESEARCH ACT

  Mr. LUCAS. Mr. Speaker, I move to suspend the rules and pass the bill 
(H.R. 4755) to support research on privacy enhancing technologies and 
promote responsible data use, and for other purposes, as amended.
  The Clerk read the title of the bill.
  The text of the bill is as follows:

                               H.R. 4755

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     SECTION 1. SHORT TITLE.

       This Act may be cited as the ``Privacy Enhancing Technology 
     Research Act''.

     SEC. 2. PRIVACY ENHANCING TECHNOLOGY.

       (a) National Science Foundation Support of Research on 
     Privacy Enhancing Technology.--The Director of the National 
     Science Foundation, in consultation with the heads of other 
     relevant Federal agencies (as determined by the Director), 
     shall support merit-reviewed and competitively awarded 
     research on privacy enhancing technologies, which may include 
     the following:
       (1) Fundamental research on technologies for de-
     identification, pseudonymization, anonymization, or 
     obfuscation to mitigate individuals' privacy risks in data 
     sets while maintaining fairness, accuracy, and efficiency.
       (2) Fundamental research on algorithms and other similar 
     mathematical tools used to protect individual privacy when 
     collecting, storing, sharing, analyzing, or aggregating data.
       (3) Fundamental research on technologies that promote data 
     minimization in data collection, sharing, and analytics that 
     takes into account the trade-offs between the data 
     minimization goals and the informational goals of data 
     collection.
       (4) Research awards on privacy enhancing technologies 
     coordinated with other relevant Federal agencies and 
     programs.
       (5) Supporting education and workforce training research 
     and development activities, including re-training and 
     upskilling of the existing workforce, to increase the number 
     of privacy enhancing technology researchers and 
     practitioners.
       (6) Multidisciplinary socio-technical research that fosters 
     broader understanding of privacy preferences, requirements, 
     and human behavior to inform the design and adoption of 
     effective privacy solutions.
       (7) Development of freely available privacy enhancing 
     technology software libraries, platforms, and applications.
       (8) Fundamental research on techniques that may undermine 
     the protections provided by privacy enhancing technologies, 
     the limitations of such protections, and the trade-offs 
     between privacy and utility required for the deployment of 
     such technologies.
       (9) Fundamental research on technologies and techniques to 
     preserve the privacy and confidentiality of individuals from 
     unconsented, unwanted, or unauthorized location tracking, 
     including through GPS.
       (b) Integration Into the Computer and Network Security 
     Program.--Subparagraph (D) of section 4(a)(1) of the Cyber 
     Security Research and Development Act (15 U.S.C. 
     7403(a)(1)(D)) is amended by inserting ``, including privacy 
     enhancing technologies'' before the semicolon.
       (c) Coordination With the National Institute of Standards 
     and Technology and Other Stakeholders.--
       (1) In general.--The Director of the Office of Science and 
     Technology Policy, acting through the Networking and 
     Information Technology Research and Development Program, 
     shall coordinate with the Director of the National Science 
     Foundation, the Director of the National Institute of 
     Standards and Technology, the Federal Trade Commission, and 
     the heads of other Federal agencies, as appropriate, to 
     accelerate the development, deployment, and adoption of 
     privacy enhancing technologies.
       (2) Outreach.--The Director of the National Institute of 
     Standards and Technology shall conduct outreach to--
       (A) receive input from private, public, and academic 
     stakeholders on the development of privacy enhancing 
     technologies; and
       (B) facilitate and support ongoing public and private 
     sector engagement to inform the development and dissemination 
     of voluntary, consensus-based technical standards, 
     guidelines, methodologies, procedures, and processes to cost-
     effectively increase the integration of privacy enhancing 
     technologies in

[[Page H2653]]

     data collection, sharing, and analytics performed by the 
     public and private sectors.
       (d) Report on Privacy Enhancing Technology Research.--Not 
     later than three years after the date of the enactment of 
     this Act, the Director of the Office of Science and 
     Technology Policy, acting through the Networking and 
     Information Technology Research and Development Program, 
     shall, in coordination with the Director of the National 
     Science Foundation, the Director of the National Institute of 
     Standards and Technology, and the heads of other Federal 
     agencies, as appropriate, submit to the Committee on 
     Commerce, Science, and Transportation of the Senate, the 
     Subcommittee on Commerce, Justice, Science, and Related 
     Agencies of the Committee on Appropriations of the Senate, 
     the Committee on Science, Space, and Technology of the House 
     of Representatives, and the Subcommittee on Commerce, 
     Justice, Science, and Related Agencies of the Committee on 
     Appropriations of the House of Representatives, a report 
     containing information relating to the following:
       (1) The progress of research on privacy enhancing 
     technologies.
       (2) The progress of the development of voluntary resources 
     described under subsection (c)(2)(B).
       (3) Any policy recommendations that could facilitate and 
     improve communication and coordination between the private 
     sector and relevant Federal agencies for the implementation 
     and adoption of privacy enhancing technologies.
       (e) Protecting Personal Identifying Information.--Any 
     personal identifying information collected or stored through 
     the activities authorized under this section shall be done in 
     accordance with part 690 of title 45, Code of Federal 
     Regulations (relating to the protection of human subjects), 
     or any successor regulation.
       (f) Definition.--In this section, the term ``privacy 
     enhancing technology''--
       (1) means any software or hardware solution, technical 
     process, or other technological means of mitigating 
     individuals' privacy risks arising from data processing by 
     enhancing predictability, manageability, disassociability, 
     and confidentiality; and
       (2) may include--
       (A) cryptographic techniques for facilitating computation 
     or analysis on data while mitigating privacy risks;
       (B) techniques for--
       (i) publicly sharing data without enabling inferences to be 
     made about specific individuals;
       (ii) giving individuals' control over the dissemination, 
     sharing, and use of their data; and
       (iii) generating synthetic data; and
       (C) any other technology or approach that reduces the risk 
     of re-identification, including when combined with other 
     information.

  The SPEAKER pro tempore. Pursuant to the rule, the gentleman from 
Oklahoma (Mr. Lucas) and the gentlewoman from Michigan (Ms. Stevens) 
each will control 20 minutes.
  The Chair recognizes the gentleman from Oklahoma.


                             General Leave

  Mr. LUCAS. Mr. Speaker, I ask unanimous consent that all Members have 
5 legislative days to revise and extend their remarks and include 
extraneous material on H.R. 4755, the bill now under consideration.
  The SPEAKER pro tempore. Is there objection to the request of the 
gentleman from Oklahoma?
  There was no objection.
  Mr. LUCAS. Mr. Speaker, I yield myself such time as I may consume.
  Mr. Speaker, I rise in support of H.R. 4755, the Privacy Enhancing 
Technology Research Act, offered by the gentlewoman from Michigan (Ms. 
Stevens) and the gentleman from New Jersey (Mr. Kean). The bill 
supports research activities to advance innovative technologies to 
safeguard individuals' privacy.
  As Americans have moved more and more of their lives online, it has 
resulted in a greater amount of digital consumer data and personal 
information being generated than ever before. This personal information 
has long been a target of cybercriminals, and the threat has only 
worsened over time. In 2023, the Federal Trade Commission received more 
than 1 million reports of identity theft. This problem is exacerbated 
by the failure of some companies to properly safeguard consumer data.
  This data is a valuable asset. When safely utilized, it can do a 
great deal to spur our economy and support innovations like artificial 
intelligence and quantum computing. Our task is to ensure this resource 
doesn't fall into the hands of bad actors, putting Americans' private 
information at risk.
  Privacy enhancing technologies, PETs, may be part of the solution. 
PETs utilize cryptography and statistics to minimize the amount of 
personally identifiable information while ensuring the datasets are 
still usable. However, more research is needed to understand PETs' 
applicability and to encourage further development and adoption.
  This bill requires the National Science Foundation to support 
fundamental research into PETs, the mathematics that underlie them, and 
the additional technologies that promote data minimization standards.
  The legislation also directs NIST to work with stakeholders to 
develop voluntary consensus standards for incorporating these 
technologies into Federal and commercial applications. Similar 
legislation passed the House last Congress, which is a testament to the 
value of this bill.
  Mr. Speaker, again, I thank Representatives Stevens and Kean for 
their leadership on this issue. I encourage my colleagues to support 
the bill, and I reserve the balance of my time.
  Ms. STEVENS. Mr. Speaker, I yield myself such time as I may consume.
  Mr. Speaker, H.R. 4755, the Privacy Enhancing Technology Research 
Act, is another very important bipartisan piece of legislation that we 
bring to the House floor this evening on the heels of the pronouncement 
of the Speaker and minority leader to form an AI task force that is led 
by Mr. Obernolte of California on the Republican side and Mr. Lieu, 
also of California, on the Democratic side.
  What the Privacy Enhancing Technology Research Act gets us is an 
opportunity to further strengthen and utilize Federal agencies to 
regulate our artificial intelligence.
  This legislation has been met with the endorsement of the Federation 
of American Scientists, the Carnegie Mellon University, the University 
of California system, the U.S. Chamber of Commerce, and the Future of 
Privacy Forum.
  I thank my colleague, Congressman Kean, for joining me in this 
legislation. I also recognize Senator Catherine Cortez Masto of Nevada 
and Senator Deb Fischer of Nebraska for working in the other Chamber 
and for their contributions to the legislation.
  We have a path not only to see this pass here in the House but to see 
it pass in the Senate and become Federal law.
  We are living, as we all know, in the time of the modern digital 
economy, probably a hyper-digital economy, that is fueled by an 
astronomical amount of personal data compounded over decades at this 
point in time. In this AI-powered world, personal data protection is 
absolutely imperative. There is certainly a struggle with the processes 
that can protect and enable the protection of the productive use of 
personal data and secure the confidentiality of information it 
includes.
  In 2023, a survey by the Pew Research Center found that 81 percent of 
American adults are concerned about how companies use their personal 
data.
  We are liking, clicking, purchasing, and browsing. What is going on 
with all of that?
  It is certainly in conversations regarding AI in Congress, with 
friends of mine, and with my constituents back home in Oakland County, 
Michigan.
  There remain lots of opportunities to capture the benefits of data, 
including for safer roads, improved public health, better educational 
outcomes, and tackling inequities and other disparities. However, in 
any use of personal data, we must ensure privacy and confidentiality. A 
critical way to achieve that is through the development of privacy 
enhancing technologies, or PETs.
  PETs are a broad range of technologies that allow organizations to 
collect, share, and use data while mitigating the privacy risks that 
arise from those activities.
  The goal is to make systems that use personal information private by 
default, opening up those data to a wide range of researchers who would 
otherwise not have access. These technologies even have the potential 
to enable broader use of Federal datasets, as privacy risks are often 
the greatest barrier to open government data efforts. Unfortunately, 
the technology itself is still really immature, and it is not ready for 
widespread use.

  What we are looking to do with H.R. 4755 is to support the research, 
workforce development, standard setting, and government coordination 
for PETs. We are going to direct the National Science Foundation to 
conduct fundamental privacy research that can improve these 
technologies, assess their

[[Page H2654]]

limitations, and broaden their applicability.
  The National Science Foundation will also support workforce 
development activities in order to help address some of the 
exacerbating shortage of privacy professionals across the United States 
and also springboard from cybersecurity workforce developments that 
have taken place from years prior.
  H.R. 4755 also supports activities at the National Institute of 
Standards and Technology to facilitate the development of those 
standards and best practices for integration of PETs in public and 
private sectors.
  Mr. Speaker, these two groups, the public sector and private sector, 
are encouraging of this legislation. They are asking for us to act in 
this way.
  Finally, H.R. 4755 directs the White House Office of Science and 
Technology Policy to coordinate Federal activities to accelerate the 
development of PETs across government.
  Congress, we all know, has been debating proposals on privacy 
legislation for a long time. Sometimes we are even wondering if we have 
legislation, but we have H.R. 4755, which takes an amazing and 
necessary step for ownership of this new technology that we want to own 
and manage here in this country.
  So, yes, let us be encouraged by bipartisan activity. Let us continue 
to come together and ensure that we have the necessary tools to fully 
implement privacy legislation without stifling innovation.
  Mr. Speaker, I thank, again, my colleague, Congressman Kean of New 
Jersey, for his bipartisan efforts.
  Mr. Speaker, I reserve the balance of my time.

                              {time}  1700

  Mr. LUCAS. Mr. Speaker, I yield such time as he may consume to the 
gentleman from New Jersey (Mr. Kean).
  Mr. KEAN of New Jersey. Mr. Speaker, I am proud to be the co-lead on 
H.R. 4755, the Privacy Enhancing Technology Research Act of 2023, with 
my colleague, Congresswoman Stevens.
  Mr. Speaker, I have had many conversations about data privacy 
concerns with parents and constituents in the Seventh District in New 
Jersey. Ensuring their specific needs and concerns are met for 
safeguarding their privacy rights online is a top priority. I am 
pleased that the House is considering this critical piece of 
legislation to improve personal data protections for all Americans and 
to commit to enhancing individuals' privacy and security online.
  In an increasingly interconnected world where digital technologies 
touch every aspect of our lives, safeguarding personal privacy has 
become a critical concern for all Americans, especially during a time 
when vast amounts of personal data is collected online.
  As we navigate through a landscape of evolving cyber threats, data 
breaches, and the development of artificial intelligence, the need for 
cutting-edge, privacy enhancing technologies has never been more 
pressing.
  Recognizing the significance of these challenges and the threats we 
face online, this legislation directs the National Science Foundation 
to support competitive, fundamental research on privacy enhancing 
technologies. Our goal is to enhance user safety and provide safety 
measures for how our data is collected and used.
  This legislation also directs the National Institute of Standards and 
Technology to facilitate the development of voluntary consensus 
standards to better integrate privacy enhancing technologies into 
public and private sectors. This is a key step toward mitigating risks 
and promoting trustworthiness.
  The Privacy Enhancing Technology Research Act represents a promising 
opportunity to prioritize protecting an individual's data privacy in 
our ever-growing interconnected world.
  Additionally, the bill will not only facilitate crucial research 
efforts but also contribute to the development of a skilled workforce 
and foster effective government coordination to ensure an impactful 
implementation of these technologies.
  Advancing our legislation will support the development of robust 
safeguards for how people interact online and how their data is 
collected. This legislation seeks to empower individuals with greater 
control over their personal information, mitigating the risks of 
unauthorized access and misuse and maintaining trust in our digital 
ecosystem.
  Through cutting-edge research and technologies, we will develop 
innovative solutions to not only shield sensitive data from malicious 
actors but also establish robust standards for data collection and 
sharing practices, fostering a more transparent and secure online 
environment.
  Mr. Speaker, again, I thank Congresswoman Stevens for her 
extraordinary leadership in this regard and the chairman and the 
ranking member for helping advance this legislation. I encourage my 
colleagues to support this legislation.
  Ms. STEVENS. Mr. Speaker, I have no further speakers. I yield myself 
the balance of my time to close.
  Mr. Speaker, I continue to call on my colleagues to join me, 
Congressman Kean, the chairman of the Science Committee, and the 
ranking member of the Science Committee in passing H.R. 4755. This 
certainly will mark a very important moment in time when the United 
States chooses to lead on privacy enhancing technologies for the 
betterment of all.
  Mr. Speaker, I yield back the balance of my time.
  Mr. LUCAS. Mr. Speaker, I yield myself the balance of my time to 
close.
  Mr. Speaker, I congratulate my colleagues from Michigan and New 
Jersey on an outstanding piece of legislation, and I urge the body to 
adopt it.
  Mr. Speaker, I yield back the balance of my time.
  The SPEAKER pro tempore. The question is on the motion offered by the 
gentleman from Oklahoma (Mr. Lucas) that the House suspend the rules 
and pass the bill, H.R. 4755, as amended.
  The question was taken.
  The SPEAKER pro tempore. In the opinion of the Chair, two-thirds 
being in the affirmative, the ayes have it.
  Mr. LUCAS. Mr. Speaker, on that I demand the yeas and nays.
  The yeas and nays were ordered.
  The SPEAKER pro tempore. Pursuant to clause 8 of rule XX, further 
proceedings on this motion will be postponed.

                          ____________________