H.R. 451 — what changed

In general— Except as otherwise provided under this subsection, an agency may not deploy or make available to the public a new Federal PII website until the date on which the chief information officer of the agency submits a certification to Congress that the website is fully functional and secure.

Transition— In the case of a new Federal PII website that is operational on the date of the enactment of this Act, paragraph (1) shall not apply until the end of the 90-day period beginning on such date of enactment. If the certification required under paragraph (1) for such website has not been submitted to Congress before the end of such period, the head of the responsible agency shall render the website inaccessible to the public until such certification is submitted to Congress.

Exception for beta website with explicit permission— Paragraph (1) shall not apply to a website (or portion thereof) that is in a development or testing phase, if the following conditions are met:

A member of the public may access PII-related portions of the website only after executing an agreement that acknowledges the risks involved.

No agency compelled, enjoined, or otherwise provided incentives for such a member to access the website for such purposes.

Construction— Nothing in this section shall be construed as applying to a website that is operated entirely by an entity (such as a State or locality) that is independent of the Federal Government, regardless of the receipt of funding in support of such website from the Federal Government.

Definitions— In this section:

Agency— The term agency has the meaning given that term under section 551 of title 5, United States Code.

Fully functional— The term fully functional means, with respect to a new Federal PII website, that the website can fully support the activities for which it is designed or intended with regard to the eliciting, collection, storage, or maintenance of personally identifiable information, including handling a volume of queries relating to such information commensurate with the purpose for which the website is designed.

New Federal personally identifiable information website (New Federal PII website)— The terms new Federal personally identifiable information website and new Federal PII website mean a website that—

is operated by (or under a contract with) an agency;

elicits, collects, stores, or maintains personally identifiable information of individuals and is accessible to the public; and

is first made accessible to the public and collects or stores personally identifiable information of individuals, on or after October 1, 2012.

Operational— The term operational means, with respect to a website, that such website elicits, collects, stores, or maintains personally identifiable information of members of the public and is accessible to the public.

Personally identifiable information (PII)— The terms personally identifiable information and PII mean any information about an individual elicited, collected, stored, or maintained by an agency, including—

any information that can be used to distinguish or trace the identity of an individual, such as a name, a social security number, a date and place of birth, a mother’s maiden name, or biometric records; and

any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

Responsible agency— The term responsible agency means, with respect to a new Federal PII website, the agency that is responsible for the operation (whether directly or through contracts with other entities) of the website.

Secure— The term secure means, with respect to a new Federal PII website, that the following requirements are met:

The website is in compliance with subchapter II of chapter 35 of title 44, United States Code.

The website ensures that personally identifiable information elicited, collected, stored, or maintained in connection with the website is captured at the latest possible step in a user input sequence.

State— The term State means each State of the United States, the District of Columbia, each territory or possession of the United States, and each federally recognized Indian tribe.