Section 1 Short title
This Act may be cited as the “Federal Agency Data Breach Notification Act of 2014”.
Federal Agency Data Breach Notification Act of 2014
A BILL
To strengthen privacy and data security, and for other purposes.
Sec. 2 Privacy breach requirements
Information security—
Amendment— Subchapter III of chapter 35 of title 44, United States Code, is amended by adding at the end the following:
“3550. Privacy breach requirements
“(a) Policies and Procedures—The Director of the Office of Management and Budget shall establish and oversee policies and procedures for agencies to follow in the event of a breach of information security involving the disclosure of personally identifiable information, including requirements for—
“(1) not later than 72 hours after the agency discovers such a breach, or discovers evidence that reasonably indicates such a breach has occurred, notice to the individuals whose personally identifiable information could be compromised as a result of such breach;
“(2) timely reporting to a Federal cybersecurity center, as designated by the Director of the Office of Management and Budget; and
“(3) any additional actions that the Director finds necessary and appropriate, including data breach analysis, fraud resolution services, identity theft insurance, and credit protection or monitoring services.
“(b) Required Agency Action—The head of each agency shall ensure that actions taken in response to a breach of information security involving the disclosure of personally identifiable information under the authority or control of the agency comply with policies and procedures established by the Director of the Office of Management and Budget under subsection (a).
“(c) Report—Not later than March 1 of each year, the Director of the Office of Management and Budget shall report to Congress on agency compliance with the policies and procedures established under subsection (a).
“(d) Federal cybersecurity center defined—The term Federal cybersecurity center means any of the following:
“(1) The Department of Defense Cyber Crime Center.
“(2) The Intelligence Community Incident Response Center.
“(3) The United States Cyber Command Joint Operations Center.
“(4) The National Cyber Investigative Joint Task Force.
“(5) Central Security Service Threat Operations Center of the National Security Agency.
“(6) The United States Computer Emergency Readiness Team.
“(7) Any successor to a center, team, or task force described in paragraphs (1) through (6).
“(8) Any center that the Director of the Office of Management and Budget determines is appropriate to carry out the requirements of this section.”
Technical and Conforming Amendment— The table of sections for subchapter III of chapter 35 of title 44, United States Code, is amended by adding at the end the following:
Amendments to the E-Government Act of 2002— Section 208(b)(1)(A) of the E-Government Act of 2002 (44 U.S.C. 3501 note; Public Law 107–347) is amended—
in clause (i), by striking “or” at the end;
in clause (ii), by striking the period at the end and inserting “; or”; and
by adding at the end the following new clause:
“(iii) using information in an identifiable form purchased, or subscribed to for a fee, from a commercial data source.”
Authority of the Director of the Office of Management and Budget with respect to federal information policy— Section 3504(g) of title 44, United States Code, is amended—
in paragraph (1), by striking “and” at the end;
in paragraph (2), by striking “. and” and inserting “; and”; and
by adding at the end the following new paragraph:
“(3) designate a Federal Chief Privacy Officer within the Office of Management and Budget who is a noncareer appointee in a Senior Executive Service position and who is a trained and experienced privacy professional to carry out the responsibilities of the Director with regard to privacy.”