[House Report 117-305]
[From the U.S. Government Publishing Office]
117th Congress } { Report
HOUSE OF REPRESENTATIVES
2d Session } { 117-305
======================================================================
PROMOTING DIGITAL PRIVACY TECHNOLOGIES ACT
_______
May 3, 2022.--Committed to the Committee of the Whole House on the
State of the Union and ordered to be printed
_______
Ms. Johnson of Texas, from the Committee on Science, Space, and
Technology, submitted the following
R E P O R T
[To accompany H.R. 847]
[Including cost estimate of the Congressional Budget Office]
The Committee on Science, Space, and Technology, to whom
was referred the bill (H.R. 847) to support research on privacy
enhancing technologies and promote responsible data use, and
for other purposes, having considered the same, reports
favorably thereon with an amendment and recommends that the
bill as amended do pass.
CONTENTS
Page
I. Amendment.......................................................2
II. Purpose of the Bill.............................................3
III. Background and Need for the Legislation.........................3
IV. Committee Hearings..............................................4
V. Committee Consideration and Votes...............................5
VI. Summary of Major Provisions of the Bill.........................5
VII. Section-by-Section Analysis (by Title and Section)..............5
VIII. Committee Views.................................................6
IX. Cost Estimate...................................................6
X. Congressional Budget Office Cost Estimate.......................6
XI. Compliance with Public Law 104-4 (Unfunded Mandates)............7
XII. Committee Oversight Findings and Recommendations................7
XIII. Statement on General Performance Goals and Objectives...........7
XIV. Federal Advisory Committee Statement............................8
XV. Duplication of Federal Programs.................................8
XVI. Earmark Identification..........................................8
XVII. Applicability to the Legislative Branch.........................8
XVIII.Statement on Preemption of State, Local, or Tribal Law..........8
XIX. Changes in Existing Law Made by the Bill, as Reported...........8
XX. Proceedings of Committee Markup................................12
I. Amendment
The amendment is as follows:
Strike all after the enacting clause and insert the
following:
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Promoting Digital Privacy Technologies
Act''.
SEC. 2. DEFINITION OF PRIVACY ENHANCING TECHNOLOGY.
In this Act, the term ``privacy enhancing technology''--
(1) means any software or hardware solution, technical
process, or other technological means of mitigating
individuals' privacy risks arising from data processing by
enhancing predictability, manageability, disassociability, and
confidentiality; and
(2) may include--
(A) cryptographic techniques for facilitating
computation or analysis on data while mitigating
privacy risks;
(B) techniques for publicly sharing data without
enabling inferences to be made about specific
individuals;
(C) techniques for giving individuals' control over
the dissemination, sharing, and use of their data;
(D) techniques for generating synthetic data; and
(E) any other technology or approach that reduces the
risk of re-identification, including when combined with
other information.
SEC. 3. NATIONAL SCIENCE FOUNDATION SUPPORT OF RESEARCH ON PRIVACY
ENHANCING TECHNOLOGY.
The Director of the National Science Foundation, in consultation with
other relevant Federal agencies (as determined by the Director), shall
support merit-reviewed and competitively awarded research on privacy
enhancing technologies, which may include--
(1) fundamental research on technologies for de-
identification, pseudonymization, anonymization, or obfuscation
to mitigate individuals' privacy risks in data sets while
maintaining fairness, accuracy, and efficiency;
(2) fundamental research on algorithms and other similar
mathematical tools used to protect individual privacy when
collecting, storing, sharing, analyzing, or aggregating data;
(3) fundamental research on technologies that promote data
minimization in data collection, sharing, and analytics that
takes into account the trade-offs between the data minimization
goals and the informational goals of data collection;
(4) research awards on privacy enhancing technologies
coordinated with other relevant Federal agencies and programs;
(5) supporting education and workforce training research and
development activities, including re-training and upskilling of
the existing workforce, to grow the number of privacy enhancing
technology researchers and practitioners;
(6) multidisciplinary socio-technical research that fosters
broader understanding of privacy preferences, requirements, and
human behavior to inform the design and adoption of effective
privacy solutions;
(7) development of freely available privacy enhancing
technology software libraries, platforms, and applications; and
(8) fundamental research on techniques that may undermine the
protections provided by privacy enhancing technologies, the
limitations of the protections provided by privacy enhancing
technologies, and the trade-offs between privacy and utility
required for their deployment.
SEC. 4. INTEGRATION INTO THE COMPUTER AND NETWORK SECURITY PROGRAM.
Subparagraph (D) of section 4(a)(1) of the Cyber Security Research
and Development Act (15 U.S.C. 7403(a)(1)(D)) is amended to read as
follows:
``(D) privacy and confidentiality, including privacy
enhancing technologies;''.
SEC. 5. COORDINATION WITH THE NATIONAL INSTITUTE OF STANDARDS AND
TECHNOLOGY AND OTHER STAKEHOLDERS.
(a) In General.--The Director of the Office of Science and Technology
Policy, acting through the Networking and Information Technology
Research and Development Program, shall coordinate with the Director of
the National Science Foundation, the Director of the National Institute
of Standards and Technology, the Federal Trade Commission, and the
heads of other Federal agencies, as appropriate, to accelerate the
development, deployment, and adoption of privacy enhancing
technologies.
(b) Outreach.--The Director of the National Institute of Standards
and Technology shall conduct outreach to--
(1) receive input from private, public, and academic
stakeholders on the development of privacy enhancing
technologies; and
(2) facilitate and support ongoing public and private sector
engagement to inform the development and dissemination of
voluntary, consensus-based technical standards, guidelines,
methodologies, procedures, and processes to cost-effectively
increase the integration of privacy enhancing technologies in
data collection, sharing, and analytics performed by the public
and private sectors.
SEC. 6. REPORT ON PRIVACY ENHANCING TECHNOLOGY RESEARCH.
Not later than 3 years after the date of enactment of this Act, the
Director of the Office of Science and Technology Policy, acting through
the Networking and Information Technology Research and Development
Program, shall, in coordination with the Director of the National
Science Foundation, the Director of the National Institute of Standards
and Technology, and the heads of other Federal agencies, as
appropriate, submit to the Committee on Commerce, Science, and
Transportation of the Senate, the Subcommittee on Commerce, Justice,
Science, and Related Agencies of the Committee on Appropriations of the
Senate, the Committee on Science, Space, and Technology of the House of
Representatives, and the Subcommittee on Commerce, Justice, Science,
and Related Agencies of the Committee on Appropriations of the House of
Representatives, a report containing--
(1) the progress of research on privacy enhancing
technologies;
(2) the progress of the development of voluntary resources
described under section 5(b)(2); and
(3) any policy recommendations that could facilitate and
improve communication and coordination between the private
sector and relevant Federal agencies for the implementation and
adoption of privacy enhancing technologies.
SEC. 7. PROTECTING PERSONAL IDENTIFYING INFORMATION.
Any personal identifying information collected or stored through the
activities authorized in this Act shall be done in accordance with
section 690 of title 45, Code of Federal Regulations (relating to the
protection of human subjects), or any successor regulation.
II. Purpose of the Bill
The purpose of the H.R. 847, the Promoting Digital Privacy
Technologies Act, is to support research on privacy enhancing
technologies and promote responsible data use.
III. Background and Need for the Legislation
Data about individuals is being generated at an increasing
rate as more services rely on advertising to operate, and more
devices are connected to the Internet. While Congress has not
passed a general data protection law to promote the responsible
use of this data, a number of U.S. states and other countries
have started creating privacy laws that implicate organizations
of all types and sizes. As a result, organizations are
increasingly looking for low-cost and effective technologies
and techniques to help them preserve the privacy of their
consumers and employees. Privacy enhancing technologies (PETs),
such as differential privacy and secure multiparty computation,
have the potential to strengthen consumer privacy while still
enabling the use of consumer data. PETs may also help with the
implementation of other laws that encourage research activities
that use large amounts of data, such as the National Artificial
Intelligence Initiative Act (P.L. 116-283) and the Digital
Accountability and Transparency Act (P.L. 113-101). However,
the application of modern PETs is limited. Additional research
and standard setting activities are necessary to broaden the
applicability of the technology and encourage its further
development and adoption. In addition, barriers remain to the
successful coordination, development, and adoption of PETs by
Federal agencies, especially for public health research.
The National Science Foundation (NSF) and the National
Institute of Standards and Technology (NIST) are key agencies
for privacy research and standards development. NSF has a long
history of funding fundamental research and education
activities related to privacy technologies. Similarly, NIST has
long carried out research on privacy to inform the development
and standardization of technologies that access personal data.
For example, NIST created privacy standards for Federal systems
in response to the Privacy Act of 1974 (P.L. 93-579). In 2020,
NIST released the NIST Privacy Framework to help organizations
identify and manage their privacy risks.
IV. Committee Hearings
Pursuant to House rule XIII, clause 3(c)(6), the Committee
designates the following hearings as having been used to
develop or consider the legislation:
On March 11, 2020, the Subcommittee on Research and
Technology held a hearing entitled, ``Reauthorization of the
National Institute of Standards and Technology.'' The hearing
included discussion of major areas of research under the
National Institute of Standards and Technology laboratory
programs, the agency's role in working with industry to advance
U.S. competitiveness through standards development, and
specifically NIST's work on a Privacy Framework. The Honorable
Walter G. Copan, Undersecretary of Commerce for Standards and
Technology and Director for the National Institute of Standards
and Technology, testified before the committee.
On Wednesday, April 28, 2021, the Subcommittee on Research
and Technology held a hearing held a hearing entitled,
``National Science Foundation: Advancing Research for The
Future of U.S. Innovation.'' The hearing included discussion of
opportunities and challenges for leveraging and expanding the
National Science Foundation mission to continue to advance
excellent research; accelerating research to address major
societal challenges; and specifically a proposal for NSF to
create a secure national data service. The hearing witnesses
included Dr. Sethuraman Panchanathan, Director of the National
Science Foundation, and Dr. Ellen Ochoa, Chair of the National
Science Board.
On September 28, 2021, the Investigations and Oversight
Subcommittee held a hearing entitled, ``The Disinformation
Black Box: Researching Social Media Data.'' The hearing
included discussion of how researchers are able to access and
analyze data from social media companies. Researchers testified
about their work looking into the spread of misinformation and
disinformation on social media platforms and how platforms
drive traffic to advertisements and promoted posts. The hearing
also explored the limitations of current tools, techniques, and
datasets for researching social media platforms and how
researchers have utilized information available to advertisers
to flag privacy concerns to the platforms. The hearing examined
how the Federal government can contribute to the ethical study
of social media's impact on society while protecting the
privacy of users. The hearing witnesses included Dr. Alan
Mislove, Professor and Interim Dean of Khoury College of
Computer Sciences at Northeastern University; Ms. Laura
Edelson, Ph.D. Candidate and Co-Director of Cybersecurity for
Democracy at New York University; and Dr. Kevin Leicht,
Professor at the University of Illinois Urbana-Champaign
Department of Sociology.
V. Committee Consideration and Votes
On January 19, 2022, the Full Committee on Science, Space,
and Technology met to consider H.R. 847. Ms. Stevens offered an
amendment in the nature of a substitute to make technical
changes throughout the bill and update provisions in response
to stakeholder feedback and Committee Member priorities,
including expanding research provisions and ensuring OSTP
coordinates PET research activities broadly across the Federal
government. The amendment was agreed to on a voice vote. Ms.
Stevens offered an amendment to make technical changes to the
bill in response to agency technical assistance, including
updating the definitions in the bill. The amendment was agreed
to on a voice vote. Mr. Posey offered an amendment to ensure
any personally identifiable information collected or stored
through the activities in the Act would follow human subject
data protections. The amendment was agreed to on a voice vote.
VI. Summary of Major Provisions of the Bill
Directs NSF to support competitive research on PETs,
including through integration into research programs supported
by the Directorate for Computer and Information Science and
Engineering. Directs OSTP, in collaboration with other relevant
Federal agencies, to accelerate the development, deployment and
adoption of PETs. Directs NIST to conduct outreach to promote
development of PETs. Requires a report to Congress 2 years
after enactment.
VII. Section-by-Section Analysis (by Title and Section)
Sec. 1. Short title; Table of Contents
Sec. 2. Definitions
Sec. 3. National Science Foundation support of research on privacy
enhancing technology
Directs the NSF to support competitive, fundamental
research on privacy enhancing technologies.
Sec. 4. Integration into the computer and network security program
Adds privacy enhancing technologies to a list of research
areas supported by the NSF Directorate for Computer and
Information Science and Engineering.
Sec. 5. Coordination with the National Institute of Standards and
Technology and other stakeholders
Directs OSTP to coordinate activities related to privacy
enhancing technologies between NSF, NIST, and the FTC. Directs
NIST to conduct outreach and disseminate voluntary, consensus-
based resources to facilitate the development of privacy
enhancing technologies.
Sec. 6. Report on research and standards development
Directs OSTP to submit a report to Congress after 2 years
that tracks the progress of privacy enhancing technology
development and resources developed under Section 5, as well as
makes recommendations to improve the coordination between
Federal agencies and the private sector on privacy enhancing
technologies.
VIII. Committee Views
Interagency Coordination--The Committee encourages NIST to
coordinate its outreach activities with other Federal agencies
that conduct activities related to privacy enhancing
technologies, including the National Institutes of Health, the
Centers for Disease Control, and the intelligence community.
IX. Cost Estimate
Pursuant to clause 3(c)(2) of rule XIII of the Rules of the
House of Representatives, the Committee adopts as its own the
estimate of new budget authority, entitlement authority, or tax
expenditures or revenues contained in the cost estimate
prepared by the Director of the Congressional Budget Office
pursuant to section 402 of the Congressional Budget Act of
1974.
X. Congressional Budget Office Cost Estimate
U.S. Congress,
Congressional Budget Office,
Washington, DC, April 20, 2022.
Hon. Eddie Bernice Johnson,
Chairwoman, Committee on Science, Space, and Technology,
House of Representatives, Washington, DC.
Dear Madam Chairwoman: The Congressional Budget Office has
prepared the enclosed cost estimate for H.R. 847, the Promoting
Digital Privacy Technologies Act.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contact is Janani
Shankaran.
Sincerely,
Phillip L. Swagel,
Director.
Enclosure.
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
H.R. 847 would direct the National Institute of Standards
and Technology (NIST) to conduct outreach on privacy-enhancing
technologies and would require the National Science Foundation
(NSF) to support related research. The bill also would direct
the Office of Science and Technology Policy to report to the
Congress on research in privacy-enhancing technologies and
related policy recommendations.
Based on the costs of similar activities, CBO estimates
that NIST would need three employees at an average annual cost
of $175,000 annually to conduct the outreach. In recent years,
the NSF has awarded between $20 million and $40 million
annually in grants to support research on privacy-enhancing
technologies. On that basis, CBO estimates that any additional
costs incurred by the NSF under H.R. 847 would not be
significant. In addition, CBO estimates that cost of the
required report would be insignificant. In total, CBO estimates
that implementing H.R. 847 would cost $2 million over the 2022-
2026 period; such spending would be subject to the availability
of appropriated funds.
The CBO staff contacts for this estimate are Janani
Shankaran and David Hughes. The estimate was reviewed by H.
Samuel Papenfuss, Deputy Director of Budget Analysis.
XI. Federal Mandates Statement
H.R. 847 contains no unfunded mandates.
XII. Committee Oversight Findings and Recommendations
The Committee's oversight findings and recommendations are
reflected in the body of this report.
XIII. Statement on General Performance Goals and Objectives
The goals and objectives of H.R. 847 are to authorize
research and standards setting activities at the National
Science Foundation (NSF) and the National Institute of
Standards and Technology (NIST) for privacy enhancing
technologies. The bill also promotes interagency coordination
on privacy enhancing technologies.
XIV. Federal Advisory Committee Statement
H.R. 847 does not authorize an advisory committee.
XV. Duplication of Federal Programs
Pursuant to clause 3(c)(5) of rule XIII of the Rules of the
House of Representatives, the Committee finds that no provision
of H.R. 847 establishes or reauthorizes a program of the
federal government known to be duplicative of another federal
program, including any program that was included in a report to
Congress pursuant to section 21 of Public Law 111-139 or the
most recent Catalog of Federal Domestic Assistance.
XVI. Earmark Identification
Pursuant to clause 9(e), 9(f), and 9(g) of rule XXI, the
Committee finds that H.R. 847 contains no earmarks, limited tax
benefits, or limited tariff benefits.
XVII. Applicability to the Legislative Branch
The Committee finds that H.R. 847 does not relate to the
terms and conditions of employment or access to public services
or accommodations within the meaning of section 102(b)(3) of
the Congressional Accountability Act (Public Law 104-1).
XVIII. Statement on Preemption of State, Local, or Tribal Law
This bill is not intended to preempt any state, local, or
tribal law.
XIX. Changes in Existing Law Made by the Bill, as Reported
In compliance with clause 3(e) of rule XIII of the Rules of
the House of Representatives, changes in existing law made by
the bill, as reported, are shown as follows (existing law
proposed to be omitted is enclosed in black brackets, new
matter is printed in italics, and existing law in which no
change is proposed is shown in roman):
CYBER SECURITY RESEARCH AND DEVELOPMENT ACT
* * * * * * *
SEC. 4. NATIONAL SCIENCE FOUNDATION RESEARCH.
(a) Computer and Network Security Research Grants.--
(1) In general.--The Director shall award grants for
basic research on innovative approaches to the
structure of computer and network hardware and software
that are aimed at enhancing computer security. Research
areas may include--
(A) authentication, cryptography, and other
secure data communications technology;
(B) computer forensics and intrusion
detection;
(C) reliability of computer and network
applications, middleware, operating systems,
control systems, and communications
infrastructure;
[(D) privacy and confidentiality;]
(D) privacy and confidentiality, including
privacy enhancing technologies;
(E) network security architecture, including
tools for security administration and analysis;
(F) emerging threats;
(G) vulnerability assessments and techniques
for quantifying risk;
(H) remote access and wireless security;
(I) enhancement of law enforcement ability to
detect, investigate, and prosecute cyber-
crimes, including those that involve piracy of
intellectual property;
(J) secure fundamental protocols that are
integral to inter-network communications and
data exchange;
(K) secure software engineering and software
assurance, including--
(i) programming languages and systems
that include fundamental security
features;
(ii) portable or reusable code that
remains secure when deployed in various
environments;
(iii) verification and validation
technologies to ensure that
requirements and specifications have
been implemented; and
(iv) models for comparison and
metrics to assure that required
standards have been met;
(L) holistic system security that--
(i) addresses the building of secure
systems from trusted and untrusted
components;
(ii) proactively reduces
vulnerabilities;
(iii) addresses insider threats; and
(iv) supports privacy in conjunction
with improved security;
(M) monitoring and detection;
(N) mitigation and rapid recovery methods;
(O) security of wireless networks and mobile
devices;
(P) security of cloud infrastructure and
services;
(Q) security of election-dedicated voting
system software and hardware; and
(R) role of the human factor in cybersecurity
and the interplay of computers and humans and
the physical world.
(2) Merit review; competition.--Grants shall be
awarded under this section on a merit-reviewed
competitive basis.
(3) Authorization of appropriations.--There are
authorized to be appropriated to the National Science
Foundation to carry out this subsection--
(A) $35,000,000 for fiscal year 2003;
(B) $40,000,000 for fiscal year 2004;
(C) $46,000,000 for fiscal year 2005;
(D) $52,000,000 for fiscal year 2006; and
(E) $60,000,000 for fiscal year 2007.
(b) Computer and Network Security Research Centers.--
(1) In general.--The Director shall award multiyear
grants, subject to the availability of appropriations,
to institutions of higher education, nonprofit research
institutions, or consortia thereof to establish
multidisciplinary Centers for Computer and Network
Security Research. Institutions of higher education,
nonprofit research institutions, or consortia thereof
receiving such grants may partner with 1 or more
government laboratories or for-profit institutions, or
other institutions of higher education or nonprofit
research institutions.
(2) Merit review; competition.--Grants shall be
awarded under this subsection on a merit-reviewed
competitive basis.
(3) Purpose.--The purpose of the Centers shall be to
generate innovative approaches to computer and network
security by conducting cutting-edge, multidisciplinary
research in computer and network security, including
improving the security and resiliency of information
technology, reducing cyber vulnerabilities, and
anticipating and mitigating consequences of cyber
attacks on critical infrastructure, by conducting
research in the areas described in subsection (a)(1).
(4) Applications.--An institution of higher
education, nonprofit research institution, or consortia
thereof seeking funding under this subsection shall
submit an application to the Director at such time, in
such manner, and containing such information as the
Director may require. The application shall include, at
a minimum, a description of--
(A) the research projects that will be
undertaken by the Center and the contributions
of each of the participating entities;
(B) how the Center will promote active
collaboration among scientists and engineers
from different disciplines, such as computer
scientists, engineers, mathematicians, and
social science researchers;
(C) how the Center will contribute to
increasing the number and quality of computer
and network security researchers and other
professionals, including individuals from
groups historically underrepresented in these
fields; and
(D) how the Center will disseminate research
results quickly and widely to improve cyber
security in information technology networks,
products, and services.
(5) Criteria.--In evaluating the applications
submitted under paragraph (4), the Director shall
consider, at a minimum--
(A) the ability of the applicant to generate
innovative approaches to computer and network
security and effectively carry out the research
program;
(B) the experience of the applicant in
conducting research on computer and network
security and the capacity of the applicant to
foster new multidisciplinary collaborations;
(C) the capacity of the applicant to attract
and provide adequate support for a diverse
group of undergraduate and graduate students
and postdoctoral fellows to pursue computer and
network security research;
(D) the extent to which the applicant will
partner with government laboratories, for-
profit entities, other institutions of higher
education, or nonprofit research institutions,
and the role the partners will play in the
research undertaken by the Center;
(E) the demonstrated capability of the
applicant to conduct high performance
computation integral to complex computer and
network security research, through on-site or
off-site computing;
(F) the applicant's affiliation with private
sector entities involved with industrial
research described in subsection (a)(1);
(G) the capability of the applicant to
conduct research in a secure environment;
(H) the applicant's affiliation with existing
research programs of the Federal Government;
(I) the applicant's experience managing
public-private partnerships to transition new
technologies into a commercial setting or the
government user community;
(J) the capability of the applicant to
conduct interdisciplinary cybersecurity
research, basic and applied, such as in law,
economics, or behavioral sciences; and
(K) the capability of the applicant to
conduct research in areas such as systems
security, wireless security, networking and
protocols, formal methods and networking and
information technology, nanotechnology, or
industrial control systems.
(6) Annual meeting.--The Director shall convene an
annual meeting of the Centers in order to foster
collaboration and communication between Center
participants.
(7) Authorization of appropriations.--There are
authorized to be appropriated for the National Science
Foundation to carry out this subsection--
(A) $12,000,000 for fiscal year 2003;
(B) $24,000,000 for fiscal year 2004;
(C) $36,000,000 for fiscal year 2005;
(D) $36,000,000 for fiscal year 2006; and
(E) $36,000,000 for fiscal year 2007.
* * * * * * *
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
[all]