§3502. Definitions — Inbound Citations
44 U.S.C. § 3502
Cited by 920 provisions in release 119-102.
Citations to 44 U.S.C. § 3502 as a whole
-
(1) The term “agency” has the meaning given that term in section 3502 of title 44.
-
(D) consider the factors of ease, efficiency, transparency, accessibility, fairness, burden (as defined in section 3502 of title 44), and duration, including wait and processing times, with respect to Government service delivery; and
-
Nothing in this subchapter may be construed to diminish or reduce the authority of agency Chief Information Officers for information resources management provided in section 11315 of title 40 or those authorities to manage information resources to accomplish agency missions as established in section 3502 of title 44.
-
(e) The Director shall make the data on the covered website available to the public at no cost over the internet in a searchable, sortable, downloadable, and machine-readable format so that the data qualifies as an open Government data asset, as defined in section 3502 of title 44.
-
(A) has the meaning given the term in section 3502 of title 44; and
-
(1) the term “agency” has the meaning given the term in section 3502 of title 44;
-
(a) In this section, the term “agency” has the meaning given the term in section 3502 of title 44.
-
(4) The term “Federal agency” has the meaning given the term “agency” in section 3502 of title 44.
-
(1) The term “agency” has the meaning given the term in section 3502 of title 44.
-
(1) The term “agency” has the meaning given the term in section 3502 of title 44.
-
(1) made available as an open Government data asset (as defined in section 3502 of title 44);
-
(1) made available as an open Government data asset (as defined in section 3502 of title 44);
-
(1) made available as an open Government data asset (as defined in section 3502 of title 44);
-
(1) made available as an open Government data asset (as defined in section 3502 of title 44);
-
(1) made available as an open Government data asset (as defined in section 3502 of title 44);
-
(2) the terms “data asset”, “machine-readable”, “metadata”, and “open license” have the meanings given the terms in section 3502 of title 44; and
-
(1) made available as an open Government data asset (as defined in section 3502 of title 44);
-
(1) made available as an open Government data asset (as defined in section 3502 of title 44);
-
(1) made available as an open Government data asset (as defined in section 3502 of title 44);
-
(1) The term “agency” has the meaning given that term in section 3502 of title 44.
-
(4) The term “information system” has the meaning given that term in section 3502 of title 44.
-
(C) The term “information technology” has the meaning given the term in section 3502 of title 44.
-
(2) The term “information system” has the meaning given that term in section 3502 of title 44.
-
(2) The Administrator shall ensure that the reports required under this subsection are made available on a public website and are maintained as an open Government data asset (as that term is defined in section 3502 of title 44).
-
(B) the term “open Government data asset” has the meaning given that term under section 3502 of title 44;
-
(B) under an “open license” which has the meaning given that term in section 3502 of title 44; and
-
(C) as an “open Government data asset” and in a “machine-readable” format which have the meaning given those terms in section 3502 of title 44.
-
(3) The term “information resources” has the meaning given that term in section 3502 of title 44.
-
(4) The term “information resources management” has the meaning given that term in section 3502 of title 44.
-
(5) The term “information system” has the meaning given that term in section 3502 of title 44.
-
(B) information systems, as defined in section 3502 of title 44; and
-
(a) Except as provided under subsection (b), the definitions under section 3502 shall apply to this subchapter.
-
In this chapter, the definitions under section 3502 shall apply, and the term—
-
(a) Except as provided under subsection (b), the definitions under sections 3502 and 3552 apply to this section through section 3616.
Citations to §3502(1)
-
(1) the term “agency” has the same meaning as provided in section 3502(1) of title 44;
-
(c) For purposes of this section, the term “agency” has the same meaning as in section 3502(1) of title 44.
-
(10) ensure that information technology is acquired, used, and managed to improve performance of agency missions, including the reduction of information collection burdens on the public; and
-
(1) The Director shall oversee the use of information resources to improve the efficiency and effectiveness of governmental operations to serve agency missions, including burden reduction and service delivery to the public. In performing such oversight, the Director shall—(A) develop, coordinate and oversee the implementation of Federal information resources management policies, principles, standards, and guidelines; and(B) provide direction and oversee—(i) the review and approval of the collection of information and the reduction of the information collection burden;(ii) agency dissemination of and public access to information;(iii) statistical activities;(iv) records management activities;(v) privacy, confidentiality, security, disclosure, and sharing of information; and(vi) the acquisition and use of information technology, including alternative information technologies that provide for electronic submission, maintenance, or disclosure of information as a substitute for paper and for the use and acceptance of electronic signatures.
-
(ii) agency dissemination of and public access to information;
-
(3) initiate and review proposals for changes in legislation, regulations, and agency procedures to improve information resources management practices;
-
(5) oversee agency integration of program and management functions with information resources management functions; and
-
(6) issue guidance for agencies to implement section 3506(b)(6) in a manner that takes into account—(A) risks and restrictions related to the disclosure of personally identifiable information, including the risk that an individual data asset in isolation does not pose a privacy or confidentiality risk but when combined with other available information may pose such a risk;(B) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk;(C) the cost and benefits to the public of converting a data asset into a machine-readable format that is accessible and useful to the public;(D) whether the application of the requirements described in such section to a data asset could result in legal liability;(E) a determination of whether a data asset—(ii) contains confidential business information, that could be withheld under section 552(b)(4) of title 5; or(iii) is otherwise restricted by contract or other binding, written agreement;(F) the requirement that a data asset be disclosed, if it would otherwise be made available under section 552 of title 5 (commonly known as the “Freedom of Information Act”); and(G) any other considerations that the Director determines to be relevant.
-
(1) review and approve proposed agency collections of information;
-
(5) establish and oversee standards and guidelines by which agencies are to estimate the burden to comply with a proposed collection of information;1
-
(2) ensure that budget proposals of agencies are consistent with system-wide priorities for maintaining and improving the quality of Federal statistics and prepare an annual report on statistical program funding;
-
(4) evaluate statistical program performance and agency compliance with Governmentwide policies, principles, standards and guidelines;
-
(ii) representatives of other statistical agencies under rotating membership;
-
(B) all costs of the training shall be paid by the agency requesting training; and
-
(ii) the opinions of domestic and international experts in statistics and demographics, including government experts at the Bureau of the Census and other relevant agencies, who were consulted regarding such change to existing standards;
-
(1) develop and oversee the implementation of policies, principles, standards, and guidelines on privacy, confidentiality, security, disclosure and sharing of information collected or maintained by or for agencies; and
-
(4) ensure, through the review of agency budget proposals, information resources management plans and other means—(A) agency integration of information resources management plans, program plans and budgets for acquisition and use of information technology; and(B) the efficiency and effectiveness of inter-agency information technology initiatives to improve agency performance and the accomplishment of agency missions; and
-
(A) agency integration of information resources management plans, program plans and budgets for acquisition and use of information technology; and
-
(B) the efficiency and effectiveness of inter-agency information technology initiatives to improve agency performance and the accomplishment of agency missions; and
-
(1) in consultation with agency heads, set an annual Governmentwide goal for the reduction of information collection burdens by at least 10 percent during each of fiscal years 1996 and 1997 and 5 percent during each of fiscal years 1998, 1999, 2000, and 2001, and set annual agency goals to—(A) reduce information collection burdens imposed on the public that—(i) represent the maximum practicable opportunity in each agency; and(ii) are consistent with improving agency management of the process for the review of collections of information established under section 3506(c); and(B) improve information resources management in ways that increase the productivity, efficiency and effectiveness of Federal programs, including service delivery to the public;
-
(i) represent the maximum practicable opportunity in each agency; and
-
(ii) are consistent with improving agency management of the process for the review of collections of information established under section 3506(c); and
-
(A) a description of the objectives and the means by which the Federal Government shall apply information resources to improve agency and program performance;
-
(C) a description of progress in applying information resources management to improve agency performance and the accomplishment of missions.
-
(b) For purposes of any pilot project conducted under subsection (a)(2), the Director may, after consultation with the agency head, waive the application of any administrative directive issued by an agency with which the project is conducted, including any directive requiring a collection of information, after giving timely notice to the public and the Congress regarding the need for such waiver.
-
(1) The head of each agency shall develop and maintain an inventory of major information systems (including major national security systems) operated by or under the control of such agency.
-
(2) The identification of information systems in an inventory under this subsection shall include an identification of the interfaces between each such system and all other systems or networks, including those not operated by or under the control of the agency.
-
(1) The head of each agency shall be responsible for—(A) carrying out the agency’s information resources management activities to improve agency productivity, efficiency, and effectiveness; and(B) complying with the requirements of this subchapter and related policies established by the Director.
-
(A) carrying out the agency’s information resources management activities to improve agency productivity, efficiency, and effectiveness; and
-
(A) Except as provided under subparagraph (B), the head of each agency shall designate a Chief Information Officer who shall report directly to such agency head to carry out the responsibilities of the agency under this subchapter.
-
(3) The Chief Information Officer designated under paragraph (2) shall head an office responsible for ensuring agency compliance with and prompt, efficient, and effective implementation of the information policies and information resources management responsibilities established under this subchapter, including the reduction of information collection burdens on the public. The Chief Information Officer and employees of such office shall be selected with special attention to the professional qualifications required to administer the functions described under this subchapter.
-
(4) Each agency program official shall be responsible and accountable for information resources assigned to and supporting the programs under such official. In consultation with the Chief Information Officer designated under paragraph (2) and the agency Chief Financial Officer (or comparable official), each agency program official shall define program information needs and develop strategies, systems, and capabilities to meet those needs.
-
(b) With respect to general information resources management, each agency shall—(1) manage information resources to—(A) reduce information collection burdens on the public;(B) increase program efficiency and effectiveness; and(C) improve the integrity, quality, and utility of information to all users within and outside the agency, including capabilities for ensuring dissemination of public information, public access to government information, and protections for privacy and security;(2) in accordance with guidance by the Director, develop and maintain a strategic information resources management plan that, to the extent practicable—(A) describes how information resources management activities help accomplish agency missions;(i) requires the agency to develop processes and procedures that—(I) require data collection mechanisms created on or after the date of the enactment of the OPEN Government Data Act to be available in an open format; and(II) facilitate collaboration with non-Government entities (including businesses), researchers, and the public for the purpose of understanding how data users value and use government data;(ii) identifies and implements methods for collecting and analyzing digital information on data asset usage by users within and outside of the agency, including designating a point of contact within the agency to assist the public and to respond to quality issues, usability issues, recommendations for improvements, and complaints about adherence to open data requirements within a reasonable period of time;(iii) develops and implements a process to evaluate and improve the timeliness, completeness, consistency, accuracy, usefulness, and availability of open Government data assets;(iv) includes requirements for meeting the goals of the agency open data plan, including the acquisition of technology, provision of training for employees, and the implementation of procurement standards, in accordance with existing law, regulation, and policy, that allow for the acquisition of innovative solutions from public and private sectors;(v) identifies as priority data assets any data asset for which disclosure would be in the public interest and establishes a plan to evaluate each priority data asset for disclosure on the Federal Data Catalogue under section 3511 and for a determination under1 3511(a)(2)(A)(iii)(I)(bb), including an accounting of which priority data assets have not yet been evaluated; and(vi) requires the agency to comply with requirements under section 3511, including any standards established by the Director under such section, when disclosing a data asset pursuant to such section; and(C) is updated annually and made publicly available on the website of the agency not later than 5 days after each such update;(3) develop and maintain an ongoing process to—(A) ensure that information resources management operations and decisions are integrated with organizational planning, budget, financial management, human resources management, and program decisions;(B) in cooperation with the agency Chief Financial Officer (or comparable official), develop a full and accurate accounting of information technology expenditures, related expenses, and results; and(C) establish goals for improving information resources management’s contribution to program productivity, efficiency, and effectiveness, methods for measuring progress towards those goals, and clear roles and responsibilities for achieving those goals;(4) in consultation with the Director, the Administrator of General Services, and the Archivist of the United States, maintain a current and complete inventory of the agency’s information resources, including directories necessary to fulfill the requirements of section 3511 of this subchapter;(5) in consultation with the Director and the Director of the Office of Personnel Management, conduct formal training programs to educate agency program and management officials about information resources management; and(6) in accordance with guidance by the Director—(A) make each data asset of the agency available in an open format; and(B) make each public data asset of the agency available—(i) as an open Government data asset; and(ii) under an open license.
-
(C) improve the integrity, quality, and utility of information to all users within and outside the agency, including capabilities for ensuring dissemination of public information, public access to government information, and protections for privacy and security;
-
(A) describes how information resources management activities help accomplish agency missions;
-
(ii) identifies and implements methods for collecting and analyzing digital information on data asset usage by users within and outside of the agency, including designating a point of contact within the agency to assist the public and to respond to quality issues, usability issues, recommendations for improvements, and complaints about adherence to open data requirements within a reasonable period of time;
-
(iv) includes requirements for meeting the goals of the agency open data plan, including the acquisition of technology, provision of training for employees, and the implementation of procurement standards, in accordance with existing law, regulation, and policy, that allow for the acquisition of innovative solutions from public and private sectors;
-
(vi) requires the agency to comply with requirements under section 3511, including any standards established by the Director under such section, when disclosing a data asset pursuant to such section; and
-
(C) is updated annually and made publicly available on the website of the agency not later than 5 days after each such update;
-
(B) in cooperation with the agency Chief Financial Officer (or comparable official), develop a full and accurate accounting of information technology expenditures, related expenses, and results; and
-
(4) in consultation with the Director, the Administrator of General Services, and the Archivist of the United States, maintain a current and complete inventory of the agency’s information resources, including directories necessary to fulfill the requirements of section 3511 of this subchapter;
-
(5) in consultation with the Director and the Director of the Office of Personnel Management, conduct formal training programs to educate agency program and management officials about information resources management; and
-
(A) make each data asset of the agency available in an open format; and
-
(B) make each public data asset of the agency available—(i) as an open Government data asset; and(ii) under an open license.
-
(c) With respect to the collection of information and the control of paperwork, each agency shall—(1) establish a process within the office headed by the Chief Information Officer designated under subsection (a), that is sufficiently independent of program responsibility to evaluate fairly whether proposed collections of information should be approved under this subchapter, to—(A) review each collection of information before submission to the Director for review under this subchapter, including—(i) an evaluation of the need for the collection of information;(ii) a functional description of the information to be collected;(iii) a plan for the collection of the information;(iv) a specific, objectively supported estimate of burden;(v) a test of the collection of information through a pilot program, if appropriate; and(vi) a plan for the efficient and effective management and use of the information to be collected, including necessary resources;(B) ensure that each information collection—(i) is inventoried, displays a control number and, if appropriate, an expiration date;(ii) indicates the collection is in accordance with the clearance requirements of section 3507; and(iii) informs the person receiving the collection of information of—(I) the reasons the information is being collected;(II) the way such information is to be used;(III) an estimate, to the extent practicable, of the burden of the collection;(IV) whether responses to the collection of information are voluntary, required to obtain a benefit, or mandatory; and(V) the fact that an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a valid control number; and(A) except as provided under subparagraph (B) or section 3507(j), provide 60-day notice in the Federal Register, and otherwise consult with members of the public and affected agencies concerning each proposed collection of information, to solicit comment to—(i) evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility;(ii) evaluate the accuracy of the agency’s estimate of the burden of the proposed collection of information;(iii) enhance the quality, utility, and clarity of the information to be collected; and(iv) minimize the burden of the collection of information on those who are to respond, including through the use of automated collection techniques or other forms of information technology; and(B) for any proposed collection of information contained in a proposed rule (to be reviewed by the Director under section 3507(d)), provide notice and comment through the notice of proposed rulemaking for the proposed rule and such notice shall have the same purposes specified under subparagraph (A)(i) through (iv);(3) certify (and provide a record supporting such certification, including public comments received by the agency) that each collection of information submitted to the Director for review under section 3507—(A) is necessary for the proper performance of the functions of the agency, including that the information has practical utility;(B) is not unnecessarily duplicative of information otherwise reasonably accessible to the agency;(C) reduces to the extent practicable and appropriate the burden on persons who shall provide information to or for the agency, including with respect to small entities, as defined under section 601(6) of title 5, the use of such techniques as—(i) establishing differing compliance or reporting requirements or timetables that take into account the resources available to those who are to respond;(ii) the clarification, consolidation, or simplification of compliance and reporting requirements; or(iii) an exemption from coverage of the collection of information, or any part thereof;(D) is written using plain, coherent, and unambiguous terminology and is understandable to those who are to respond;(E) is to be implemented in ways consistent and compatible, to the maximum extent practicable, with the existing reporting and recordkeeping practices of those who are to respond;(F) indicates for each recordkeeping requirement the length of time persons are required to maintain the records specified;(G) contains the statement required under paragraph (1)(B)(iii);(H) has been developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected, including the processing of the information in a manner which shall enhance, where appropriate, the utility of the information to agencies and the public;(I) uses effective and efficient statistical survey methodology appropriate to the purpose for which the information is to be collected; and(J) to the maximum extent practicable, uses information technology to reduce burden and improve data quality, agency efficiency and responsiveness to the public; and(4) in addition to the requirements of this chapter regarding the reduction of information collection burdens for small business concerns (as defined in section 3 of the Small Business Act (15 U.S.C. 632)), make efforts to further reduce the information collection burden for small business concerns with fewer than 25 employees.
-
(V) the fact that an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a valid control number; and
-
(A) except as provided under subparagraph (B) or section 3507(j), provide 60-day notice in the Federal Register, and otherwise consult with members of the public and affected agencies concerning each proposed collection of information, to solicit comment to—(i) evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility;(ii) evaluate the accuracy of the agency’s estimate of the burden of the proposed collection of information;(iii) enhance the quality, utility, and clarity of the information to be collected; and(iv) minimize the burden of the collection of information on those who are to respond, including through the use of automated collection techniques or other forms of information technology; and
-
(i) evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility;
-
(ii) evaluate the accuracy of the agency’s estimate of the burden of the proposed collection of information;
-
(3) certify (and provide a record supporting such certification, including public comments received by the agency) that each collection of information submitted to the Director for review under section 3507—(A) is necessary for the proper performance of the functions of the agency, including that the information has practical utility;(B) is not unnecessarily duplicative of information otherwise reasonably accessible to the agency;(C) reduces to the extent practicable and appropriate the burden on persons who shall provide information to or for the agency, including with respect to small entities, as defined under section 601(6) of title 5, the use of such techniques as—(i) establishing differing compliance or reporting requirements or timetables that take into account the resources available to those who are to respond;(ii) the clarification, consolidation, or simplification of compliance and reporting requirements; or(iii) an exemption from coverage of the collection of information, or any part thereof;(D) is written using plain, coherent, and unambiguous terminology and is understandable to those who are to respond;(E) is to be implemented in ways consistent and compatible, to the maximum extent practicable, with the existing reporting and recordkeeping practices of those who are to respond;(F) indicates for each recordkeeping requirement the length of time persons are required to maintain the records specified;(G) contains the statement required under paragraph (1)(B)(iii);(H) has been developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected, including the processing of the information in a manner which shall enhance, where appropriate, the utility of the information to agencies and the public;(I) uses effective and efficient statistical survey methodology appropriate to the purpose for which the information is to be collected; and(J) to the maximum extent practicable, uses information technology to reduce burden and improve data quality, agency efficiency and responsiveness to the public; and
-
(A) is necessary for the proper performance of the functions of the agency, including that the information has practical utility;
-
(B) is not unnecessarily duplicative of information otherwise reasonably accessible to the agency;
-
(C) reduces to the extent practicable and appropriate the burden on persons who shall provide information to or for the agency, including with respect to small entities, as defined under section 601(6) of title 5, the use of such techniques as—(i) establishing differing compliance or reporting requirements or timetables that take into account the resources available to those who are to respond;(ii) the clarification, consolidation, or simplification of compliance and reporting requirements; or(iii) an exemption from coverage of the collection of information, or any part thereof;
-
(H) has been developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected, including the processing of the information in a manner which shall enhance, where appropriate, the utility of the information to agencies and the public;
-
(J) to the maximum extent practicable, uses information technology to reduce burden and improve data quality, agency efficiency and responsiveness to the public; and
-
(d) With respect to information dissemination, each agency shall—(1) ensure that the public has timely and equitable access to the agency’s public information, including ensuring such access through—(A) encouraging a diversity of public and private sources for information based on government public information;(B) in cases in which the agency provides public information maintained in electronic format, providing timely and equitable access to the underlying data (in whole or in part); and(C) agency dissemination of public information in an efficient, effective, and economical manner;(2) regularly solicit and consider public input on the agency’s information dissemination activities;(3) provide adequate notice when initiating, substantially modifying, or terminating significant information dissemination products;(4) not, except where specifically authorized by statute—(A) establish an exclusive, restricted, or other distribution arrangement that interferes with timely and equitable availability of public information to the public;(B) restrict or regulate the use, resale, or redissemination of public information by the public;(C) charge fees or royalties for resale or redissemination of public information; or(D) establish user fees for public information that exceed the cost of dissemination;(5) ensure that any public data asset of the agency is machine-readable; and(6) engage the public in using public data assets of the agency and encourage collaboration by—(A) publishing on the website of the agency, on a regular basis (not less than annually), information on the usage of such assets by non-Government users;(B) providing the public with the opportunity to request specific data assets to be prioritized for disclosure and to provide suggestions for the development of agency criteria with respect to prioritizing data assets for disclosure;(C) assisting the public in expanding the use of public data assets; and(D) hosting challenges, competitions, events, or other initiatives designed to create additional value from public data assets of the agency.
-
(1) ensure that the public has timely and equitable access to the agency’s public information, including ensuring such access through—(A) encouraging a diversity of public and private sources for information based on government public information;(B) in cases in which the agency provides public information maintained in electronic format, providing timely and equitable access to the underlying data (in whole or in part); and(C) agency dissemination of public information in an efficient, effective, and economical manner;
-
(B) in cases in which the agency provides public information maintained in electronic format, providing timely and equitable access to the underlying data (in whole or in part); and
-
(C) agency dissemination of public information in an efficient, effective, and economical manner;
-
(2) regularly solicit and consider public input on the agency’s information dissemination activities;
-
(5) ensure that any public data asset of the agency is machine-readable; and
-
(6) engage the public in using public data assets of the agency and encourage collaboration by—(A) publishing on the website of the agency, on a regular basis (not less than annually), information on the usage of such assets by non-Government users;(B) providing the public with the opportunity to request specific data assets to be prioritized for disclosure and to provide suggestions for the development of agency criteria with respect to prioritizing data assets for disclosure;(C) assisting the public in expanding the use of public data assets; and(D) hosting challenges, competitions, events, or other initiatives designed to create additional value from public data assets of the agency.
-
(A) publishing on the website of the agency, on a regular basis (not less than annually), information on the usage of such assets by non-Government users;
-
(B) providing the public with the opportunity to request specific data assets to be prioritized for disclosure and to provide suggestions for the development of agency criteria with respect to prioritizing data assets for disclosure;
-
(D) hosting challenges, competitions, events, or other initiatives designed to create additional value from public data assets of the agency.
-
(e) With respect to statistical policy and coordination, each agency shall—(1) ensure the relevance, accuracy, timeliness, integrity, and objectivity of information collected or created for statistical purposes;(2) inform respondents fully and accurately about the sponsors, purposes, and uses of statistical surveys and studies;(3) protect respondents’ privacy and ensure that disclosure policies fully honor pledges of confidentiality;(4) observe Federal standards and practices for data collection, analysis, documentation, sharing, and dissemination of information;(5) ensure the timely publication of the results of statistical surveys and studies, including information about the quality and limitations of the surveys and studies; and
-
(f) With respect to records management, each agency shall implement and enforce applicable policies and procedures, including requirements for archiving information maintained in electronic format, particularly in the planning, design and operation of information systems.
-
(1) implement and enforce applicable policies, procedures, standards, and guidelines on privacy, confidentiality, security, disclosure and sharing of information collected or maintained by or for the agency; and
-
(h) With respect to Federal information technology, each agency shall—(1) implement and enforce applicable Governmentwide and agency information technology management policies, principles, standards, and guidelines;(2) assume responsibility and accountability for information technology investments;(3) promote the use of information technology by the agency to improve the productivity, efficiency, and effectiveness of agency programs, including the reduction of information collection burdens on the public and improved dissemination of public information;(4) propose changes in legislation, regulations, and agency procedures to improve information technology practices, including changes that improve the ability of the agency to use technology to reduce burden; and(5) assume responsibility for maximizing the value and assessing and managing the risks of major information systems initiatives through a process that is—(A) integrated with budget, financial, and program management decisions; and(B) used to select, control, and evaluate the results of major information systems initiatives.
-
(1) implement and enforce applicable Governmentwide and agency information technology management policies, principles, standards, and guidelines;
-
(3) promote the use of information technology by the agency to improve the productivity, efficiency, and effectiveness of agency programs, including the reduction of information collection burdens on the public and improved dissemination of public information;
-
(4) propose changes in legislation, regulations, and agency procedures to improve information technology practices, including changes that improve the ability of the agency to use technology to reduce burden; and
-
(1) In addition to the requirements described in subsection (c), each agency shall, with respect to the collection of information and the control of paperwork, establish 1 point of contact in the agency to act as a liaison between the agency and small business concerns (as defined in section 3 of the Small Business Act (15 U.S.C. 632)).
-
(a) An agency shall not conduct or sponsor the collection of information unless in advance of the adoption or revision of the collection of information—(1) the agency has—(A) conducted the review established under section 3506(c)(1);(B) evaluated the public comments received under section 3506(c)(2);(C) submitted to the Director the certification required under section 3506(c)(3), the proposed collection of information, copies of pertinent statutory authority, regulations, and other related materials as the Director may specify; and(D) published a notice in the Federal Register—(i) stating that the agency has made such submission; and(ii) setting forth—(I) a title for the collection of information;(II) a summary of the collection of information;(III) a brief description of the need for the information and the proposed use of the information;(IV) a description of the likely respondents and proposed frequency of response to the collection of information;(V) an estimate of the burden that shall result from the collection of information; and(2) the Director has approved the proposed collection of information or approval has been inferred, under the provisions of this section; and(3) the agency has obtained from the Director a control number to be displayed upon the collection of information.
-
(1) the agency has—(A) conducted the review established under section 3506(c)(1);(B) evaluated the public comments received under section 3506(c)(2);(C) submitted to the Director the certification required under section 3506(c)(3), the proposed collection of information, copies of pertinent statutory authority, regulations, and other related materials as the Director may specify; and(D) published a notice in the Federal Register—(i) stating that the agency has made such submission; and(ii) setting forth—(I) a title for the collection of information;(II) a summary of the collection of information;(III) a brief description of the need for the information and the proposed use of the information;(IV) a description of the likely respondents and proposed frequency of response to the collection of information;(V) an estimate of the burden that shall result from the collection of information; and
-
(i) stating that the agency has made such submission; and
-
(3) the agency has obtained from the Director a control number to be displayed upon the collection of information.
-
(1) For any proposed collection of information not contained in a proposed rule, the Director shall notify the agency involved of the decision to approve or disapprove the proposed collection of information.
-
(3) If the Director does not notify the agency of a denial or approval within the 60-day period described under paragraph (2)—(A) the approval may be inferred;(B) a control number shall be assigned without further delay; and(C) the agency may collect the information for not more than 1 year.
-
(C) the agency may collect the information for not more than 1 year.
-
(A) as soon as practicable, but no later than the date of publication of a notice of proposed rulemaking in the Federal Register, each agency shall forward to the Director a copy of any proposed rule which contains a collection of information and any information requested by the Director necessary to make the determination required under this subsection; and
-
(2) When a final rule is published in the Federal Register, the agency shall explain—(A) how any collection of information contained in the final rule responds to the comments, if any, filed by the Director or the public; or(B) the reasons such comments were rejected.
-
(3) If the Director has received notice and failed to comment on an agency rule within 60 days after the notice of proposed rulemaking, the Director may not disapprove any collection of information specifically contained in an agency rule.
-
(A) from disapproving any collection of information which was not specifically required by an agency rule;
-
(B) from disapproving any collection of information contained in an agency rule, if the agency failed to comply with the requirements of paragraph (1) of this subsection;
-
(C) from disapproving any collection of information contained in a final agency rule, if the Director finds within 60 days after the publication of the final rule that the agency’s response to the Director’s comments filed under paragraph (2) of this subsection was unreasonable; or
-
(i) the Director determines that the agency has substantially modified in the final rule the collection of information contained in the proposed rule; and
-
(ii) the agency has not given the Director the information required under paragraph (1) with respect to the modified collection of information, at least 60 days before the issuance of the final rule.
-
(5) This subsection shall apply only when an agency publishes a notice of proposed rulemaking and requests public comments.
-
(6) The decision by the Director to approve or not act upon a collection of information contained in an agency rule shall not be subject to judicial review.
-
(1) Any decision by the Director under subsection (c), (d), (h), or (j) to disapprove a collection of information, or to instruct the agency to make substantive or material change to a collection of information, shall be publicly available and include an explanation of the reasons for such decision.
-
(2) Any written communication between the Administrator of the Office of Information and Regulatory Affairs, or any employee of the Office of Information and Regulatory Affairs, and an agency or person not employed by the Federal Government concerning a proposed collection of information shall be made available to the public.
-
(A) any disapproval by the Director, in whole or in part, of a proposed collection of information of that agency; or
-
(B) an exercise of authority under subsection (d) of section 3507 concerning that agency.
-
(2) The agency shall certify each vote to void such disapproval or exercise to the Director, and explain the reasons for such vote. The Director shall without further delay assign a control number to such collection of information, and such vote to void the disapproval or exercise shall be valid for a period of 3 years.
-
(1) If an agency decides to seek extension of the Director’s approval granted for a currently approved collection of information, the agency shall—(A) conduct the review established under section 3506(c), including the seeking of comment from the public on the continued need for, and burden imposed by the collection of information; and(B) after having made a reasonable effort to seek public comment, but no later than 60 days before the expiration date of the control number assigned by the Director for the currently approved collection of information, submit the collection of information for review and approval under this section, which shall include an explanation of how the agency has used the information that it has collected.
-
(B) after having made a reasonable effort to seek public comment, but no later than 60 days before the expiration date of the control number assigned by the Director for the currently approved collection of information, submit the collection of information for review and approval under this section, which shall include an explanation of how the agency has used the information that it has collected.
-
(2) If under the provisions of this section, the Director disapproves a collection of information contained in an existing rule, or recommends or instructs the agency to make a substantive or material change to a collection of information contained in an existing rule, the Director shall—(A) publish an explanation thereof in the Federal Register; and(B) instruct the agency to undertake a rulemaking within a reasonable time limited to consideration of changes to the collection of information contained in the rule and thereafter to submit the collection of information for approval or disapproval under this subchapter.
-
(B) instruct the agency to undertake a rulemaking within a reasonable time limited to consideration of changes to the collection of information contained in the rule and thereafter to submit the collection of information for approval or disapproval under this subchapter.
-
(3) An agency may not make a substantive or material modification to a collection of information after such collection has been approved by the Director, unless the modification has been submitted to the Director for review and approval under this subchapter.
-
(1) If the Director finds that a senior official of an agency designated under section 3506(a) is sufficiently independent of program responsibility to evaluate fairly whether proposed collections of information should be approved and has sufficient resources to carry out this responsibility effectively, the Director may, by rule in accordance with the notice and comment provisions of chapter 5 of title 5, United States Code, delegate to such official the authority to approve proposed collections of information in specific program areas, for specific purposes, or for all agency purposes.
-
(1) The agency head may request the Director to authorize a collection of information, if an agency head determines that—(A) a collection of information—(i) is needed prior to the expiration of time periods established under this subchapter; and(ii) is essential to the mission of the agency; and(B) the agency cannot reasonably comply with the provisions of this subchapter because—(i) public harm is reasonably likely to result if normal clearance procedures are followed;(ii) an unanticipated event has occurred; or(iii) the use of normal clearance procedures is reasonably likely to prevent or disrupt the collection of information or is reasonably likely to cause a statutory or court ordered deadline to be missed.
-
(ii) is essential to the mission of the agency; and
-
(B) the agency cannot reasonably comply with the provisions of this subchapter because—(i) public harm is reasonably likely to result if normal clearance procedures are followed;(ii) an unanticipated event has occurred; or(iii) the use of normal clearance procedures is reasonably likely to prevent or disrupt the collection of information or is reasonably likely to cause a statutory or court ordered deadline to be missed.
-
(2) The Director shall approve or disapprove any such authorization request within the time requested by the agency head and, if approved, shall assign the collection of information a control number. Any collection of information conducted under this subsection may be conducted without compliance with the provisions of this subchapter for a maximum of 180 days after the date on which the Director received the request to authorize such collection.
-
Before approving a proposed collection of information, the Director shall determine whether the collection of information by the agency is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility. Before making a determination the Director may give the agency and other interested persons an opportunity to be heard or to submit statements in writing. To the extent, if any, that the Director determines that the collection of information by an agency is unnecessary for any reason, the agency may not engage in the collection of information.
-
The Director may designate a central collection agency to obtain information for two or more agencies if the Director determines that the needs of such agencies for information will be adequately served by a single collection agency, and such sharing of data is not inconsistent with applicable law. In such cases the Director shall prescribe (with reference to the collection of information) the duties and functions of the collection agency so designated and of the agencies for which it is to act as agent (including reimbursement for costs). While the designation is in effect, an agency covered by the designation may not obtain for itself information for the agency which is the duty of the collection agency to obtain. The Director may modify the designation from time to time as circumstances require. The authority to designate under this section is subject to the provisions of section 3507(f) of this subchapter.
-
(1) If information obtained by an agency is released by that agency to another agency, all the provisions of law (including penalties) that relate to the unlawful disclosure of information apply to the officers and employees of the agency to which information is released to the same extent and in the same manner as the provisions apply to the officers and employees of the agency which originally obtained the information.
-
(1) In consultation with the Director and in accordance with the guidance established under paragraph (2), the head of each agency shall, to the maximum extent practicable, develop and maintain a comprehensive data inventory that accounts for all data assets created by, collected by, under the control or direction of, or maintained by the agency. The head of each agency shall ensure that such inventory provides a clear and comprehensive understanding of the data assets in the possession of the agency.
-
(2) The Director shall establish guidance for agencies to develop and maintain comprehensive data inventories under paragraph (1). Such guidance shall include the following:(A) A requirement for the head of an agency to include in the comprehensive data inventory metadata on each data asset of the agency, including, to the maximum extent practicable, the following:(i) A description of the data asset, including all variable names and definitions.(ii) The name or title of the data asset.(iii) An indication of whether or not the agency—(I) has determined or can determine if the data asset is—(aa) an open Government data asset;(bb) subject to disclosure or partial disclosure or exempt from disclosure under section 552 of title 5;(cc) a public data asset eligible for disclosure under subsection (b); or(dd) a data asset not subject to open format or open license requirements due to existing limitations or restrictions on government distribution of the asset; or(II) as of the date of such indication, has not made such determination.(iv) Any determination made under section 3582, if available.(v) A description of the method by which the public may access or request access to the data asset.(vi) The date on which the data asset was most recently updated.(vii) Each agency responsible for maintaining the data asset.(viii) The owner of the data asset.(ix) To the extent practicable, any restriction on the use of the data asset.(x) The location of the data asset.(xi) Any other metadata necessary to make the comprehensive data inventory useful to the agency and the public, or otherwise determined useful by the Director.(B) A requirement for the head of an agency to exclude from the comprehensive data inventory any data asset contained on a national security system, as defined in section 11103 of title 40.(C) Criteria for the head of an agency to use in determining which metadata required by subparagraph (A), if any, in the comprehensive data inventory may not be made publicly available, which shall include, at a minimum, a requirement to ensure all information that could not otherwise be withheld from disclosure under section 552 of title 5 is made public in the comprehensive data inventory.(D) A requirement for the head of each agency, in accordance with a procedure established by the Director, to submit for inclusion in the Federal data catalogue maintained under subsection (c) the comprehensive data inventory developed pursuant to subparagraph (C), including any real-time updates to such inventory, and data assets made available in accordance with subparagraph (E) or any electronic hyperlink providing access to such data assets.(E) Criteria for the head of an agency to use in determining whether a particular data asset should not be made publicly available in a manner that takes into account—(i) risks and restrictions related to the disclosure of personally identifiable information, including the risk that an individual data asset in isolation does not pose a privacy or confidentiality risk but when combined with other available information may pose such a risk;(ii) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk;(iii) the cost and benefits to the public of converting the data into a format that could be understood and used by the public;(iv) whether the public dissemination of the data asset could result in legal liability;(v) whether the data asset—(II) contains confidential business information, that could be withheld under section 552(b)(4) of title 5; or(III) is restricted by contract or other binding, written agreement;(vi) whether the holder of a right to such data asset has been consulted;(vii) the expectation that all data assets that would otherwise be made available under section 552 of title 5 be disclosed; and(viii) any other considerations that the Director determines to be relevant.(F) Criteria for the head of an agency to use in assessing the indication of a determination under subparagraph (A)(iii) and how to prioritize any such subsequent determinations in the strategic information management plan under section 3506, in consideration of the existing resources available to the agency.
-
(A) A requirement for the head of an agency to include in the comprehensive data inventory metadata on each data asset of the agency, including, to the maximum extent practicable, the following:(i) A description of the data asset, including all variable names and definitions.(ii) The name or title of the data asset.(iii) An indication of whether or not the agency—(I) has determined or can determine if the data asset is—(aa) an open Government data asset;(bb) subject to disclosure or partial disclosure or exempt from disclosure under section 552 of title 5;(cc) a public data asset eligible for disclosure under subsection (b); or(dd) a data asset not subject to open format or open license requirements due to existing limitations or restrictions on government distribution of the asset; or(II) as of the date of such indication, has not made such determination.(iv) Any determination made under section 3582, if available.(v) A description of the method by which the public may access or request access to the data asset.(vi) The date on which the data asset was most recently updated.(vii) Each agency responsible for maintaining the data asset.(viii) The owner of the data asset.(ix) To the extent practicable, any restriction on the use of the data asset.(x) The location of the data asset.(xi) Any other metadata necessary to make the comprehensive data inventory useful to the agency and the public, or otherwise determined useful by the Director.
-
(iii) An indication of whether or not the agency—(I) has determined or can determine if the data asset is—(aa) an open Government data asset;(bb) subject to disclosure or partial disclosure or exempt from disclosure under section 552 of title 5;(cc) a public data asset eligible for disclosure under subsection (b); or(dd) a data asset not subject to open format or open license requirements due to existing limitations or restrictions on government distribution of the asset; or(II) as of the date of such indication, has not made such determination.
-
(vii) Each agency responsible for maintaining the data asset.
-
(xi) Any other metadata necessary to make the comprehensive data inventory useful to the agency and the public, or otherwise determined useful by the Director.
-
(B) A requirement for the head of an agency to exclude from the comprehensive data inventory any data asset contained on a national security system, as defined in section 11103 of title 40.
-
(C) Criteria for the head of an agency to use in determining which metadata required by subparagraph (A), if any, in the comprehensive data inventory may not be made publicly available, which shall include, at a minimum, a requirement to ensure all information that could not otherwise be withheld from disclosure under section 552 of title 5 is made public in the comprehensive data inventory.
-
(D) A requirement for the head of each agency, in accordance with a procedure established by the Director, to submit for inclusion in the Federal data catalogue maintained under subsection (c) the comprehensive data inventory developed pursuant to subparagraph (C), including any real-time updates to such inventory, and data assets made available in accordance with subparagraph (E) or any electronic hyperlink providing access to such data assets.
-
(E) Criteria for the head of an agency to use in determining whether a particular data asset should not be made publicly available in a manner that takes into account—(i) risks and restrictions related to the disclosure of personally identifiable information, including the risk that an individual data asset in isolation does not pose a privacy or confidentiality risk but when combined with other available information may pose such a risk;(ii) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk;(iii) the cost and benefits to the public of converting the data into a format that could be understood and used by the public;(iv) whether the public dissemination of the data asset could result in legal liability;(v) whether the data asset—(II) contains confidential business information, that could be withheld under section 552(b)(4) of title 5; or(III) is restricted by contract or other binding, written agreement;(vi) whether the holder of a right to such data asset has been consulted;(vii) the expectation that all data assets that would otherwise be made available under section 552 of title 5 be disclosed; and(viii) any other considerations that the Director determines to be relevant.
-
(F) Criteria for the head of an agency to use in assessing the indication of a determination under subparagraph (A)(iii) and how to prioritize any such subsequent determinations in the strategic information management plan under section 3506, in consideration of the existing resources available to the agency.
-
(3) With respect to each data asset created or identified by an agency, the head of the agency shall update the comprehensive data inventory of the agency not later than 90 days after the date of such creation or identification.
-
(b) The head of each agency shall submit public data assets, or links to public data assets available online, as open Government data assets for inclusion in the Federal data catalogue maintained under subsection (c), in accordance with the guidance established under subsection (a)(2).
-
(1) The Administrator of General Services shall maintain a single public interface online as a point of entry dedicated to sharing agency data assets with the public, which shall be known as the “Federal data catalogue”. The Administrator and the Director shall ensure that agencies can submit public data assets, or links to public data assets, for publication and public availability on the interface.
-
(2) the agency fails to inform the person who is to respond to the collection of information that such person is not required to respond to the collection of information unless it displays a valid control number.
-
(b) The protection provided by this section may be raised in the form of a complete defense, bar, or otherwise at any time during the agency administrative process or judicial action applicable thereto.
-
(a) In consultation with the Administrator of General Services, the Archivist of the United States, the Director of the National Institute of Standards and Technology, and the Director of the Office of Personnel Management, the Director shall periodically review selected agency information resources management activities to ascertain the efficiency and effectiveness of such activities to improve agency performance and the accomplishment of agency missions.
-
(b) Each agency having an activity reviewed under subsection (a) shall, within 60 days after receipt of a report on the review, provide a written plan to the Director describing steps (including milestones) to—(1) be taken to address information resources management problems identified in the report; and
-
(2) The Director shall include in any such report a description of the extent to which agencies have—(A) reduced information collection burdens on the public, including—(i) a summary of accomplishments and planned initiatives to reduce collection of information burdens;(ii) a list of all violations of this subchapter and of any rules, guidelines, policies, and procedures issued pursuant to this subchapter;(iii) a list of any increase in the collection of information burden, including the authority for each such collection; and(iv) a list of agencies that in the preceding year did not reduce information collection burdens in accordance with section 3505(a)(1), a list of the programs and statutory responsibilities of those agencies that precluded that reduction, and recommendations to assist those agencies to reduce information collection burdens in accordance with that section;(B) improved the quality and utility of statistical information;(C) improved public access to Government information; and(D) improved program performance and the accomplishment of agency missions through information resources management.
-
(iv) a list of agencies that in the preceding year did not reduce information collection burdens in accordance with section 3505(a)(1), a list of the programs and statutory responsibilities of those agencies that precluded that reduction, and recommendations to assist those agencies to reduce information collection burdens in accordance with that section;
-
(D) improved program performance and the accomplishment of agency missions through information resources management.
-
(b) The preparation of any report required by this section shall be based on performance results reported by the agencies and shall not increase the collection of information burden on persons outside the Federal Government.
-
Upon the request of the Director, each agency (other than an independent regulatory agency) shall, to the extent practicable, make its services, personnel, and facilities available to the Director for the performance of functions under this subchapter.
-
(a) In developing information resources management policies, plans, rules, regulations, procedures, and guidelines and in reviewing collections of information, the Director shall provide interested agencies and persons early and meaningful opportunity to comment.
-
(b) Any person may request the Director to review any collection of information conducted by or for an agency to determine, if, under this subchapter, a person shall maintain, provide, or disclose the information to or for the agency. Unless the request is frivolous, the Director shall, in coordination with the agency responsible for the collection of information—(1) respond to the request within 60 days after receiving the request, unless such period is extended by the Director to a specified date and the person making the request is given notice of such extension; and(2) take appropriate remedial action, if necessary.
-
(a) Except as otherwise provided in this subchapter, the authority of an agency under any other law to prescribe policies, rules, regulations, and procedures for Federal information resources management activities is subject to the authority of the Director under this subchapter.
-
(i) a civil action to which the United States or any official or agency thereof is a party; or
-
(ii) an administrative action or investigation involving an agency against specific individuals or entities;
-
(e) Nothing in this subchapter shall be interpreted as increasing or decreasing the authority of the President, the Office of Management and Budget or the Director thereof, under the laws of the United States, with respect to the substantive policies and programs of departments, agencies and offices, including the substantive authority of any Federal agency to enforce the civil rights laws.
-
(b) The Chief Data Officer of an agency shall be designated on the basis of demonstrated training and experience in data management, governance (including creation, application, and maintenance of data standards), collection, analysis, protection, use, and dissemination, including with respect to any statistical and related techniques to protect and de-identify confidential data.
-
(1) be responsible for lifecycle data management;(2) coordinate with any official in the agency responsible for using, protecting, disseminating, and generating data to ensure that the data needs of the agency are met;(3) manage data assets of the agency, including the standardization of data format, sharing of data assets, and publication of data assets in accordance with applicable law;(4) in carrying out the requirements under paragraphs (3) and (5), consult with any statistical official of the agency (as designated under section 314 of title 5);(5) carry out the requirements of the agency under subsections (b) through (d), (f), and (i) of section 3506, section 3507, and section 3511;(6) ensure that, to the extent practicable, agency data conforms with data management best practices;(7) engage agency employees, the public, and contractors in using public data assets and encourage collaborative approaches on improving data use;(8) support the Performance Improvement Officer of the agency in identifying and using data to carry out the functions described in section 1124(a)(2) of title 31;(9) support the Evaluation Officer of the agency in obtaining data to carry out the functions described in section 313(d) of title 5;(10) review the impact of the infrastructure of the agency on data asset accessibility and coordinate with the Chief Information Officer of the agency to improve such infrastructure to reduce barriers that inhibit data asset accessibility;(11) ensure that, to the extent practicable, the agency maximizes the use of data in the agency, including for the production of evidence (as defined in section 3561), cybersecurity, and the improvement of agency operations;(12) identify points of contact for roles and responsibilities related to open data use and implementation (as required by the Director);(13) serve as the agency liaison to other agencies and the Office of Management and Budget on the best way to use existing agency data for statistical purposes (as defined in section 3561); and(14) comply with any regulation and guidance issued under subchapter III, including the acquisition and maintenance of any required certification and training.
-
(3) manage data assets of the agency, including the standardization of data format, sharing of data assets, and publication of data assets in accordance with applicable law;
-
(4) in carrying out the requirements under paragraphs (3) and (5), consult with any statistical official of the agency (as designated under section 314 of title 5);
-
(5) carry out the requirements of the agency under subsections (b) through (d), (f), and (i) of section 3506, section 3507, and section 3511;
-
(7) engage agency employees, the public, and contractors in using public data assets and encourage collaborative approaches on improving data use;
-
(8) support the Performance Improvement Officer of the agency in identifying and using data to carry out the functions described in section 1124(a)(2) of title 31;
-
(9) support the Evaluation Officer of the agency in obtaining data to carry out the functions described in section 313(d) of title 5;
-
(10) review the impact of the infrastructure of the agency on data asset accessibility and coordinate with the Chief Information Officer of the agency to improve such infrastructure to reduce barriers that inhibit data asset accessibility;
-
(11) ensure that, to the extent practicable, the agency maximizes the use of data in the agency, including for the production of evidence (as defined in section 3561), cybersecurity, and the improvement of agency operations;
-
(13) serve as the agency liaison to other agencies and the Office of Management and Budget on the best way to use existing agency data for statistical purposes (as defined in section 3561); and
-
(1) To the extent necessary to comply with statistical laws, the Chief Data Officer of an agency shall delegate any responsibility under subsection (c) to the head of a statistical agency or unit (as defined in section 3561) within the agency.
-
(2) To the extent permissible under law, the individual to whom a responsibility has been delegated under paragraph (1) shall consult with the Chief Data Officer of the agency in carrying out such responsibility.
-
(3) The Chief Data Officer of the agency shall defer to the individual to whom a responsibility has been delegated under paragraph (1) regarding the necessary delegation of such responsibility with respect to any data acquired, maintained, or disseminated by the agency under applicable statistical law.
-
(e) The Chief Data Officer of an agency shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Government Reform of the House of Representatives an annual report on the compliance of the agency with the requirements of this subchapter, including information on each requirement that the agency could not carry out and, if applicable, what the agency needs to carry out such requirement.
-
(3) identify ways in which agencies can improve upon the production of evidence for use in policymaking;
-
(6) recognize that the selection of specific technical hardware and software information security solutions should be left to individual agencies from among commercially developed products.
-
(1) The term “binding operational directive” means a compulsory direction to an agency that—(A) is for purposes of safeguarding Federal information and information systems from a known or reasonably suspected information security threat, vulnerability, or risk;(B) shall be in accordance with policies, principles, standards, and guidelines issued by the Director; and
-
(A) The term “national security system” means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency—(i) the function, operation, or use of which—(I) involves intelligence activities;(II) involves cryptologic activities related to national security;(III) involves command and control of military forces;(IV) involves equipment that is an integral part of a weapon or weapons system; or(V) subject to subparagraph (B), is critical to the direct fulfillment of military or intelligence missions; or(ii) is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.
-
(a) The Director shall oversee agency information security policies and practices, including—(1) developing and overseeing the implementation of policies, principles, standards, and guidelines on information security, including through ensuring timely agency adoption of and compliance with standards promulgated under section 11331 of title 40;(2) requiring agencies, consistent with the standards promulgated under such section 11331 and the requirements of this subchapter, to identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of—(A) information collected or maintained by or on behalf of an agency; or(B) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;(3) ensuring that the Secretary carries out the authorities and functions under subsection (b);(4) coordinating the development of standards and guidelines under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3) with agencies and offices operating or exercising control of national security systems (including the National Security Agency) to assure, to the maximum extent feasible, that such standards and guidelines are complementary with standards and guidelines developed for national security systems;(5) overseeing agency compliance with the requirements of this subchapter and section 1326 of title 41, including through any authorized action under section 11303 of title 40, to enforce accountability for compliance with such requirements; and(6) coordinating information security policies and procedures with related information resources management policies and procedures.
-
(1) developing and overseeing the implementation of policies, principles, standards, and guidelines on information security, including through ensuring timely agency adoption of and compliance with standards promulgated under section 11331 of title 40;
-
(2) requiring agencies, consistent with the standards promulgated under such section 11331 and the requirements of this subchapter, to identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of—(A) information collected or maintained by or on behalf of an agency; or(B) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;
-
(A) information collected or maintained by or on behalf of an agency; or
-
(B) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;
-
(4) coordinating the development of standards and guidelines under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3) with agencies and offices operating or exercising control of national security systems (including the National Security Agency) to assure, to the maximum extent feasible, that such standards and guidelines are complementary with standards and guidelines developed for national security systems;
-
(5) overseeing agency compliance with the requirements of this subchapter and section 1326 of title 41, including through any authorized action under section 11303 of title 40, to enforce accountability for compliance with such requirements; and
-
(b) The Secretary, in consultation with the Director, shall administer the implementation of agency information security policies and practices for information systems, except for national security systems and information systems described in paragraph (2) or (3) of subsection (e), including—(1) assisting the Director in carrying out the authorities and functions under paragraphs (1), (2), (3), (5), and (6) of subsection (a);(2) developing and overseeing the implementation of binding operational directives to agencies to implement the policies, principles, standards, and guidelines developed by the Director under subsection (a)(1) and the requirements of this subchapter, which may be revised or repealed by the Director if the operational directives issued on behalf of the Director are not in accordance with policies, principles, standards, and guidelines developed by the Director, including—(A) requirements for reporting security incidents to the Federal information security incident center established under section 3556;(B) requirements for the contents of the annual reports required to be submitted under section 3554(c)(1);(C) requirements for the mitigation of exigent risks to information systems; and(D) other operational requirements as the Director or Secretary, in consultation with the Director, may determine necessary;(3) monitoring agency implementation of information security policies and practices;(4) convening meetings with senior agency officials to help ensure effective implementation of information security policies and practices;(5) coordinating Government-wide efforts on information security policies and practices, including consultation with the Chief Information Officers Council established under section 3603 and the Director of the National Institute of Standards and Technology;(6) providing operational and technical assistance to agencies in implementing policies, principles, standards, and guidelines on information security, including implementation of standards promulgated under section 11331 of title 40, including by—(A) operating the Federal information security incident center established under section 3556;(B) upon request by an agency, deploying, operating, and maintaining technology to assist the agency to continuously diagnose and mitigate against cyber threats and vulnerabilities, with or without reimbursement;(C) compiling and analyzing data on agency information security; and(D) developing and conducting targeted operational evaluations, including threat and vulnerability assessments, on the information systems;(7) hunting for and identifying, with or without advance notice to or authorization from agencies, threats and vulnerabilities within Federal information systems;(A) providing services, functions, and capabilities, including operation of the agency’s information security program, to assist the agency with meeting the requirements set forth in section 3554(b); and
-
(2) developing and overseeing the implementation of binding operational directives to agencies to implement the policies, principles, standards, and guidelines developed by the Director under subsection (a)(1) and the requirements of this subchapter, which may be revised or repealed by the Director if the operational directives issued on behalf of the Director are not in accordance with policies, principles, standards, and guidelines developed by the Director, including—(A) requirements for reporting security incidents to the Federal information security incident center established under section 3556;(B) requirements for the contents of the annual reports required to be submitted under section 3554(c)(1);(C) requirements for the mitigation of exigent risks to information systems; and
-
(3) monitoring agency implementation of information security policies and practices;
-
(4) convening meetings with senior agency officials to help ensure effective implementation of information security policies and practices;
-
(6) providing operational and technical assistance to agencies in implementing policies, principles, standards, and guidelines on information security, including implementation of standards promulgated under section 11331 of title 40, including by—(A) operating the Federal information security incident center established under section 3556;(B) upon request by an agency, deploying, operating, and maintaining technology to assist the agency to continuously diagnose and mitigate against cyber threats and vulnerabilities, with or without reimbursement;(C) compiling and analyzing data on agency information security; and(D) developing and conducting targeted operational evaluations, including threat and vulnerability assessments, on the information systems;
-
(C) compiling and analyzing data on agency information security; and
-
(7) hunting for and identifying, with or without advance notice to or authorization from agencies, threats and vulnerabilities within Federal information systems;
-
(A) providing services, functions, and capabilities, including operation of the agency’s information security program, to assist the agency with meeting the requirements set forth in section 3554(b); and
-
(A) providing services, functions, and capabilities, including operation of the agency’s information security program, to assist the agency with meeting the requirements set forth in section 3554(b); and
-
(4) an assessment of agency compliance with standards promulgated under section 11331 of title 40; and
-
(A) Subject to subparagraph (B), in response to a known or reasonably suspected information security threat, vulnerability, or incident that represents a substantial threat to the information security of an agency, the Secretary may issue an emergency directive to the head of an agency to take any lawful action with respect to the operation of the information system, including such systems used or operated by another entity on behalf of an agency, that collects, processes, stores, transmits, disseminates, or otherwise maintains agency information, for the purpose of protecting the information system from, or mitigating, an information security threat.
-
(i) adopting the least intrusive means possible under the circumstances to secure the agency information systems; and
-
(A) Notwithstanding section 3554, the Secretary may authorize the use under this subsection of the intrusion detection and prevention capabilities established under section 230(b)(1)1 of the Homeland Security Act of 2002 for the purpose of ensuring the security of agency information systems, if—(i) the Secretary determines there is an imminent threat to agency information systems;(ii) the Secretary determines a directive under subsection (b)(2)(C) or paragraph (1)(A) is not reasonably likely to result in a timely response to the threat;(iii) the Secretary determines the risk posed by the imminent threat outweighs any adverse consequences reasonably expected to result from the use of the intrusion detection and prevention capabilities under the control of the Secretary;(iv) the Secretary provides prior notice to the Director, and the head and chief information officer (or equivalent official) of each agency to which specific actions will be taken pursuant to this paragraph, and notifies the appropriate congressional committees and authorizing committees of each such agency within 7 days of taking an action under this paragraph of—(I) any action taken under this paragraph; and(II) the reasons for and duration and nature of the action;(v) the action of the Secretary is consistent with applicable law; and(vi) the Secretary authorizes the use of the intrusion detection and prevention capabilities in accordance with the advance procedures established under subparagraph (C).
-
(i) the Secretary determines there is an imminent threat to agency information systems;
-
(iv) the Secretary provides prior notice to the Director, and the head and chief information officer (or equivalent official) of each agency to which specific actions will be taken pursuant to this paragraph, and notifies the appropriate congressional committees and authorizing committees of each such agency within 7 days of taking an action under this paragraph of—(I) any action taken under this paragraph; and(II) the reasons for and duration and nature of the action;
-
(A) protect agency information from unauthorized access, use, disclosure, disruption, modification, or destruction; or
-
(i) information collected or maintained by or on behalf of an agency; or
-
(ii) that portion of an information system used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.
-
(1) Notwithstanding any other provision of law, including any provision of law that would otherwise restrict or prevent the head of an agency from disclosing information to the Secretary, the Secretary in carrying out this section and title XXII of the Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) may access, use, retain, and disclose, and the head of an agency may disclose to the Secretary, information, for the purpose of protecting information and information systems from cybersecurity risks.
-
(a) The head of each agency shall—(1) be responsible for—(A) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of—(i) information collected or maintained by or on behalf of the agency; and(ii) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;(B) complying with the requirements of this subchapter, subchapter III of chapter 13 of title 41, and related policies, procedures, standards, and guidelines, including—(i) information security standards promulgated under section 11331 of title 40;(ii) operational directives developed by the Secretary under section 3553(b);(iii) policies and procedures issued by the Director;(iv) information security standards and guidelines for national security systems issued in accordance with law and as directed by the President;(v) emergency directives issued by the Secretary under section 3553(h); and(vi) responsibilities relating to assessing and avoiding, mitigating, transferring, or accepting supply chain risks under section 1326 of title 41, and complying with exclusion and removal orders issued under section 1323 of such title; and(C) ensuring that information security management processes are integrated with agency strategic, operational, and budgetary planning processes;(2) ensure that senior agency officials provide information security for the information and information systems that support the operations and assets under their control, including through—(A) assessing the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of such information or information systems;(B) determining the levels of information security appropriate to protect such information and information systems in accordance with standards promulgated under section 11331 of title 40, for information security classifications and related requirements;(C) implementing policies and procedures to cost-effectively reduce risks to an acceptable level; and(D) periodically testing and evaluating information security controls and techniques to ensure that they are effectively implemented;(3) delegate to the agency Chief Information Officer established under section 3506 (or comparable official in an agency not covered by such section) the authority to ensure compliance with the requirements imposed on the agency under this subchapter, including—(A) designating a senior agency information security officer who shall—(i) carry out the Chief Information Officer’s responsibilities under this section;(ii) possess professional qualifications, including training and experience, required to administer the functions described under this section;(iii) have information security duties as that official’s primary duty; and(iv) head an office with the mission and resources to assist in ensuring agency compliance with this section;(B) developing and maintaining an agencywide information security program as required by subsection (b);(C) developing and maintaining information security policies, procedures, and control techniques to address all applicable requirements, including those issued under section 3553 of this title and section 11331 of title 40;(D) training and overseeing personnel with significant responsibilities for information security with respect to such responsibilities; and(E) assisting senior agency officials concerning their responsibilities under paragraph (2);(4) ensure that the agency has trained personnel sufficient to assist the agency in complying with the requirements of this subchapter and related policies, procedures, standards, and guidelines;(5) ensure that the agency Chief Information Officer, in coordination with other senior agency officials, reports annually to the agency head on the effectiveness of the agency information security program, including progress of remedial actions;(6) ensure that senior agency officials, including chief information officers of component agencies or equivalent officials, carry out responsibilities under this subchapter as directed by the official delegated authority under paragraph (3); and(7) ensure that all personnel are held accountable for complying with the agency-wide information security program implemented under subsection (b).
-
(i) information collected or maintained by or on behalf of the agency; and
-
(ii) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;
-
(C) ensuring that information security management processes are integrated with agency strategic, operational, and budgetary planning processes;
-
(2) ensure that senior agency officials provide information security for the information and information systems that support the operations and assets under their control, including through—(A) assessing the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of such information or information systems;(B) determining the levels of information security appropriate to protect such information and information systems in accordance with standards promulgated under section 11331 of title 40, for information security classifications and related requirements;(C) implementing policies and procedures to cost-effectively reduce risks to an acceptable level; and(D) periodically testing and evaluating information security controls and techniques to ensure that they are effectively implemented;
-
(3) delegate to the agency Chief Information Officer established under section 3506 (or comparable official in an agency not covered by such section) the authority to ensure compliance with the requirements imposed on the agency under this subchapter, including—(A) designating a senior agency information security officer who shall—(i) carry out the Chief Information Officer’s responsibilities under this section;(ii) possess professional qualifications, including training and experience, required to administer the functions described under this section;(iii) have information security duties as that official’s primary duty; and(iv) head an office with the mission and resources to assist in ensuring agency compliance with this section;(B) developing and maintaining an agencywide information security program as required by subsection (b);(C) developing and maintaining information security policies, procedures, and control techniques to address all applicable requirements, including those issued under section 3553 of this title and section 11331 of title 40;(D) training and overseeing personnel with significant responsibilities for information security with respect to such responsibilities; and(E) assisting senior agency officials concerning their responsibilities under paragraph (2);
-
(A) designating a senior agency information security officer who shall—(i) carry out the Chief Information Officer’s responsibilities under this section;(ii) possess professional qualifications, including training and experience, required to administer the functions described under this section;(iii) have information security duties as that official’s primary duty; and(iv) head an office with the mission and resources to assist in ensuring agency compliance with this section;
-
(iv) head an office with the mission and resources to assist in ensuring agency compliance with this section;
-
(E) assisting senior agency officials concerning their responsibilities under paragraph (2);
-
(5) ensure that the agency Chief Information Officer, in coordination with other senior agency officials, reports annually to the agency head on the effectiveness of the agency information security program, including progress of remedial actions;
-
(6) ensure that senior agency officials, including chief information officers of component agencies or equivalent officials, carry out responsibilities under this subchapter as directed by the official delegated authority under paragraph (3); and
-
(7) ensure that all personnel are held accountable for complying with the agency-wide information security program implemented under subsection (b).
-
(b) Each agency shall develop, document, and implement an agency-wide information security program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source, that includes—(1) periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency, which may include using automated tools consistent with standards and guidelines promulgated under section 11331 of title 40;(2) policies and procedures that—(A) are based on the risk assessments required by paragraph (1);(B) cost-effectively reduce information security risks to an acceptable level;(C) ensure that information security is addressed throughout the life cycle of each agency information system; and(D) ensure compliance with—(i) the requirements of this subchapter;(ii) policies and procedures as may be prescribed by the Director, and information security standards promulgated under section 11331 of title 40;(iii) minimally acceptable system configuration requirements, as determined by the agency; and(iv) any other applicable requirements, including standards and guidelines for national security systems issued in accordance with law and as directed by the President;(3) subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate;(4) security awareness training to inform personnel, including contractors and other users of information systems that support the operations and assets of the agency, of—(A) information security risks associated with their activities; and(B) their responsibilities in complying with agency policies and procedures designed to reduce these risks;(5) periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, of which such testing—(A) shall include testing of management, operational, and technical controls of every information system identified in the inventory required under section 3505(c);1(B) may include testing relied on in an evaluation under section 3555; and(C) shall include using automated tools, consistent with standards and guidelines promulgated under section 11331 of title 40;(6) a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency;(7) procedures for detecting, reporting, and responding to security incidents, which—(A) shall be consistent with the standards and guidelines described in section 3556(b);(B) may include using automated tools; and(C) shall include—(i) mitigating risks associated with such incidents before substantial damage is done;(ii) notifying and consulting with the Federal information security incident center established in section 3556; and(iii) notifying and consulting with, as appropriate—(I) law enforcement agencies and relevant Offices of Inspector General and Offices of General Counsel;(II) an office designated by the President for any incident involving a national security system;(III) for a major incident, the committees of Congress described in subsection (c)(1)—(aa) not later than 7 days after the date on which there is a reasonable basis to conclude that the major incident has occurred; and(bb) after the initial notification under item (aa), within a reasonable period of time after additional information relating to the incident is discovered, including the summary required under subsection (c)(1)(A)(i); and(IV) any other agency or office, in accordance with law or as directed by the President; and(8) plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.
-
(1) periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency, which may include using automated tools consistent with standards and guidelines promulgated under section 11331 of title 40;
-
(C) ensure that information security is addressed throughout the life cycle of each agency information system; and
-
(iii) minimally acceptable system configuration requirements, as determined by the agency; and
-
(4) security awareness training to inform personnel, including contractors and other users of information systems that support the operations and assets of the agency, of—(A) information security risks associated with their activities; and(B) their responsibilities in complying with agency policies and procedures designed to reduce these risks;
-
(B) their responsibilities in complying with agency policies and procedures designed to reduce these risks;
-
(6) a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency;
-
(I) law enforcement agencies and relevant Offices of Inspector General and Offices of General Counsel;
-
(IV) any other agency or office, in accordance with law or as directed by the President; and
-
(8) plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.
-
(A) Each agency shall submit to the Director, the Secretary, the Committee on Government Reform, the Committee on Homeland Security, and the Committee on Science of the House of Representatives, the Committee on Homeland Security and Governmental Affairs and the Committee on Commerce, Science, and Transportation of the Senate, the appropriate authorization and appropriations committees of Congress, and the Comptroller General a report on the adequacy and effectiveness of information security policies, procedures, and practices, including—(i) a description of each major information security incident or related sets of incidents, including summaries of—(I) the threats and threat actors, vulnerabilities, and impacts relating to the incident;(II) the risk assessments conducted under section 3554(a)(2)(A) of the affected information systems before the date on which the incident occurred;(III) the status of compliance of the affected information systems with applicable security requirements at the time of the incident; and(IV) the detection, response, and remediation actions;(ii) the total number of information security incidents, including a description of incidents resulting in significant compromise of information security, system impact levels, types of incident, and locations of affected systems;(iii) a description of each major information security incident that involved a breach of personally identifiable information, as defined by the Director, including—(I) the number of individuals whose information was affected by the major information security incident; and(II) a description of the information that was breached or exposed; and
-
(ii) The head of an agency shall ensure that, to the greatest extent practicable, information is included in the unclassified version of the reports submitted by the agency under subparagraph (A).
-
(2) Each agency shall address the adequacy and effectiveness of information security policies, procedures, and practices in management plans and reports.
-
(1) In addition to the requirements of subsection (c), each agency, in consultation with the Director, shall include as part of the performance plan required under section 1115 of title 31 a description of—(A) the time periods; and(B) the resources, including budget, staffing, and training,that are necessary to implement the program required under subsection (b).
-
(e) Each agency shall provide the public with timely notice and opportunities for comment on proposed information security policies and procedures to the extent that such policies and procedures affect communication with the public.
-
(1) Each year each agency shall have performed an independent evaluation of the information security program and practices of that agency to determine the effectiveness of such program and practices.
-
(A) testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agency’s information systems;
-
(B) an assessment of the effectiveness of the information security policies, procedures, and practices of the agency; and
-
(2) for each agency to which paragraph (1) does not apply, the head of the agency shall engage an independent external auditor to perform the evaluation.
-
(c) For each agency operating or exercising control of a national security system, that portion of the evaluation required by this section directly relating to a national security system shall be performed—(1) only by an entity designated by the agency head; and(2) in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws.
-
(1) only by an entity designated by the agency head; and
-
(d) The evaluation required by this section may be based in whole or in part on an audit, evaluation, or report relating to programs or practices of the applicable agency.
-
(f) Agencies and evaluators shall take appropriate steps to ensure the protection of information which, if disclosed, may adversely affect information security. Such protections shall be commensurate with the risk and comply with all applicable laws and regulations.
-
(1) the adequacy and effectiveness of agency information security policies and practices; and
-
(i) The Comptroller General may provide technical assistance to an Inspector General or the head of an agency, as applicable, to assist the Inspector General or head of an agency in carrying out the duties under this section, including by testing information security controls and procedures.
-
(1) provide timely technical assistance to operators of agency information systems regarding security incidents, including guidance on detecting and handling information security incidents;
-
(3) inform operators of agency information systems about current and potential information security threats, and vulnerabilities;
-
(4) provide, as appropriate, intelligence and other information about cyber threats, vulnerabilities, and incidents to agencies to assist in risk assessments conducted under section 3554(b); and
-
(5) consult with the National Institute of Standards and Technology, agencies or offices operating or exercising control of national security systems (including the National Security Agency), and such other agencies or offices in accordance with law and as directed by the President regarding information security incidents and related matters.
-
(b) Each agency operating or exercising control of a national security system shall share information about information security incidents, threats, and vulnerabilities with the Federal information security incident center to the extent consistent with standards and guidelines for national security systems, issued in accordance with law and as directed by the President.
-
The head of each agency operating or exercising control of a national security system shall be responsible for ensuring that the agency—
-
Nothing in this subchapter, section 11331 of title 40, or section 20 of the National Standards1 and Technology Act (15 U.S.C. 278g–3) may be construed as affecting the authority of the President, the Office of Management and Budget or the Director thereof, the National Institute of Standards and Technology, or the head of any agency, with respect to the authorized use or disclosure of information, including with regard to the protection of personal privacy under section 552a of title 5, the disclosure of information under section 552 of title 5, the management and disposition of records under chapters2 29, 31, or 33 of title 44, the management of information resources under subchapter I of chapter 35 of this title, or the disclosure of information to the Congress or the Comptroller General of the United States.
-
(a) If, on or after the date that is 180 days after the date of the enactment of this section, an agency creates a website that is intended for use by the public or conducts a redesign of an existing legacy website that is intended for use by the public, the agency shall ensure to the greatest extent practicable that the website is mobile friendly.
-
(1) The term “agency” has the meaning given that term in section 551 of title 5.
-
(1) The term “agency” means any entity that falls within the definition of the term “executive agency”, as defined in section 102 of title 31, or “agency”, as defined in section 3502.
-
(i) who is an employee of a private organization or a researcher affiliated with an institution of higher learning (including a person granted special sworn status by the Bureau of the Census under section 23(c) of title 13), and with whom a contract or other agreement is executed, on a temporary basis, by an executive agency to perform exclusively statistical activities under the control and supervision of an officer or employee of that agency;
-
(ii) who is working under the authority of a government entity with which a contract or other agreement is executed by an executive agency to perform exclusively statistical activities under the control of an officer or employee of that agency;
-
(iii) who is a self-employed researcher, a consultant, a contractor, or an employee of a contractor, and with whom a contract or other agreement is executed by an executive agency to perform a statistical activity under the control of an officer or employee of that agency; or
-
(B) who agrees in writing to comply with all provisions of law that affect information acquired by that agency.
-
(11) The term “statistical agency or unit” means an agency or organizational unit of the executive branch whose activities are predominantly the collection, compilation, processing, or analysis of information for statistical purposes, as designated by the Director under section 3562.
-
(a) The Director shall coordinate and oversee the confidentiality and disclosure policies established by this subchapter. The Director may promulgate rules or provide other guidance to ensure consistent interpretation of this subchapter by the affected agencies. The Director shall develop a process by which the Director designates agencies or organizational units as statistical agencies and units. The Director shall promulgate guidance to implement such process, which shall include specific criteria for such designation and methods by which the Director will ensure transparency in the process.
-
(b) Subject to subsection (c), agencies may promulgate rules to implement this subchapter. Rules governing disclosures of information that are authorized by this subchapter shall be promulgated by the agency that originally collected the information.
-
(2) Each Designated Statistical Agency (as defined in section 3576(e)) shall report annually to the Director, the Committee on Oversight and Government Reform of the House of Representatives, and the Committee on Homeland Security and Governmental Affairs of the Senate on the actions it has taken to implement section 3576. The report shall include copies of each written agreement entered into pursuant to section 3576(c)(1) for the applicable year.
-
(b) The head of each agency shall enable, support, and facilitate statistical agencies or units in carrying out the responsibilities described in subsection (a)(1).
-
(a) This subchapter does not diminish the authority under section 3510 of the Director to direct, and of an agency to make, disclosures that are not inconsistent with any applicable law.
-
(e) This subchapter shall not be construed to limit any authorities of the Congressional Budget Office to work (consistent with laws governing the confidentiality of information the disclosure of which would be a violation of law) with databases of Designated Statistical Agencies (as defined in section 3576(e)), either separately or, for data that may be shared pursuant to section 3576(c) or other authority, jointly in order to improve the general utility of these databases for the statistical purpose of analyzing pension and health care financing issues.
-
(g) Notwithstanding section 3572, information collected by an agency for exclusively statistical purposes under a pledge of confidentiality may be provided by the collecting agency to a law enforcement agency for the prosecution of submissions to the collecting agency of false statistical information under statutes that authorize criminal penalties (such as section 221 of title 13) or civil penalties for the provision of false statistical information, unless such disclosure or use would otherwise be prohibited under Federal law.
-
(i) Nothing in this subchapter shall be construed to affect the authority of the Congress, including its committees, members, or agents, to obtain data or information for a statistical purpose, including for oversight of an agency’s statistical activities.
-
(1) Individuals, businesses, and other organizations have varying degrees of legal protection when providing information to the agencies for strictly statistical purposes.
-
(2) Pledges of confidentiality by agencies provide assurances to the public that information about individuals or organizations or provided by individuals or organizations for exclusively statistical purposes will be held in confidence and will not be used against such individuals or organizations in any agency action.
-
(4) Declining trust of the public in the protection of information provided under a pledge of confidentiality to the agencies adversely affects both the accuracy and completeness of statistical analyses.
-
(1) To ensure that information supplied by individuals or organizations to an agency for statistical purposes under a pledge of confidentiality is used exclusively for statistical purposes.
-
(2) To ensure that individuals or organizations who supply information under a pledge of confidentiality to agencies for statistical purposes will neither have that information disclosed in identifiable form to anyone not authorized by this subchapter nor have that information used for any purpose other than a statistical purpose.
-
(2) A disclosure pursuant to paragraph (1) is authorized only when the head of the agency approves such disclosure and the disclosure is not prohibited by any other law.
-
(e) A statistical agency or unit may designate agents, by contract or by entering into a special agreement containing the provisions required under section 3561(2) for treatment as an agent under that section, who may perform exclusively statistical activities, subject to the limitations and penalties described in this subchapter.
-
(f) Whoever, being an officer, employee, or agent of an agency acquiring information for exclusively statistical purposes, having taken and subscribed the oath of office, or having sworn to observe the limitations imposed by this section, comes into possession of such information by reason of his or her being an officer, employee, or agent and, knowing that the disclosure of the specific information is prohibited under the provisions of this subchapter, willfully discloses the information in any manner to a person or agency not entitled to receive it, shall be guilty of a class E felony and imprisoned for not more than 5 years, or fined not more than $250,000, or both.
-
(4) Enhanced sharing of business data among the Bureau of the Census, the Bureau of Economic Analysis, and the Bureau of Labor Statistics for exclusively statistical purposes will improve their ability to track more accurately the large and rapidly changing nature of United States business. In particular, the statistical agencies will be able to better ensure that businesses are consistently classified in appropriate industries, resolve data anomalies, produce statistical samples that are consistently adjusted for the entry and exit of new businesses in a timely manner, and correct faulty reporting errors quickly and efficiently.
-
(3) To improve the comparability and accuracy of Federal economic statistics by allowing the Bureau of the Census, the Bureau of Economic Analysis, and the Bureau of Labor Statistics to update sample frames, develop consistent classifications of establishments and companies into industries, improve coverage, and reconcile significant differences in data produced by the three agencies.
-
(b) The head of each of the Designated Statistical Agencies shall—(1) identify opportunities to eliminate duplication and otherwise reduce reporting burden and cost imposed on the public in providing information for statistical purposes;(2) enter into joint statistical projects to improve the quality and reduce the cost of statistical programs; and(3) protect the confidentiality of individually identifiable information acquired for statistical purposes by adhering to safeguard principles, including—(A) emphasizing to their officers, employees, and agents the importance of protecting the confidentiality of information in cases where the identity of individual respondents can reasonably be inferred by either direct or indirect means;(B) training their officers, employees, and agents in their legal obligations to protect the confidentiality of individually identifiable information and in the procedures that must be followed to provide access to such information;(C) implementing appropriate measures to assure the physical and electronic security of confidential data;(D) establishing a system of records that identifies individuals accessing confidential data and the project for which the data were required; and(E) being prepared to document their compliance with safeguard principles to other agencies authorized by law to monitor such compliance.
-
(E) being prepared to document their compliance with safeguard principles to other agencies authorized by law to monitor such compliance.
-
(1) A Designated Statistical Agency may provide business data in an identifiable form to another Designated Statistical Agency under the terms of a written agreement among the agencies sharing the business data that specifies—(A) the business data to be shared;(B) the statistical purposes for which the business data are to be used;(C) the officers, employees, and agents authorized to examine the business data to be shared; and(D) appropriate security procedures to safeguard the confidentiality of the business data.
-
(2) The provision of business data by an agency to a Designated Statistical Agency under this section shall in no way alter the responsibility of the agency providing the data under other statutes (including sections 552 and 552b of title 5) with respect to the provision or withholding of such information by the agency providing the data.
-
(3) Examination of business data in identifiable form shall be limited to the officers, employees, and agents authorized to examine the individual reports in accordance with written agreements pursuant to this section. Officers, employees, and agents of a Designated Statistical Agency who receive data pursuant to this section shall be subject to all provisions of law, including penalties, that relate—
-
(4) Whenever a written agreement concerns data that respondents were required by law to report and the respondents were not informed that the data could be shared among the Designated Statistical Agencies, for exclusively statistical purposes, the terms of such agreement shall be described in a public notice issued by the agency that intends to provide the data. Such notice shall allow a minimum of 60 days for public comment.
-
(e) In this section, the term “Designated Statistical Agency” means each of the following:(1) The Census Bureau of the Department of Commerce.(2) The Bureau of Economic Analysis of the Department of Commerce.(3) The Bureau of Labor Statistics of the Department of Labor.
-
(a) The head of an agency shall, to the extent practicable, make any data asset maintained by the agency available, upon request, to any statistical agency or unit for purposes of developing evidence.
-
(c) The Director shall prescribe regulations for agencies to carry out this section. Such regulations shall—(1) require the timely provision of data assets under subsection (a);(2) provide a list of statutes that exempt agencies from the requirement under subsection (a) pursuant to subsection (b)(1);(3) establish clear and consistent standards, to the extent possible, for complying with section 552a of title 5 (commonly known as the “Privacy Act of 1974”) and any other applicable law requiring the protection and confidentiality of individually identifiable information; and(4) require a transparent process for statistical agencies and units to request data assets from agencies and for agencies to respond to such requests.
-
(2) provide a list of statutes that exempt agencies from the requirement under subsection (a) pursuant to subsection (b)(1);
-
(4) require a transparent process for statistical agencies and units to request data assets from agencies and for agencies to respond to such requests.
-
(a) To the extent practicable, each statistical agency or unit shall expand access to data assets of such agency or unit acquired or accessed under this subchapter to develop evidence while protecting such assets from inappropriate access and use, in accordance with the regulations promulgated under subsection (b).
-
(b) The Director shall promulgate regulations, in accordance with applicable law, for statistical agencies and units to carry out the requirement under subsection (a). Such regulations shall include the following:(1) Standards for each statistical agency or unit to assess each data asset owned or accessed by the statistical agency or unit for purposes of categorizing the sensitivity level of each such asset and identifying the corresponding level of accessibility to each such asset. Such standards shall include—(A) common sensitivity levels and corresponding levels of accessibility that may be assigned to a data asset, including a requisite minimum and maximum number of sensitivity levels for each statistical agency or unit to use;(B) criteria for determining the sensitivity level and corresponding level of accessibility of each data asset; and(C) criteria for determining whether a less sensitive and more accessible version of a data asset can be produced.(2) Standards for each statistical agency or unit to improve access to a data asset pursuant to paragraph (1) or (3) by removing or obscuring information in such a manner that the identity of the data subject is less likely to be reasonably inferred by either direct or indirect means.(3) A requirement for each statistical agency or unit to conduct a comprehensive risk assessment of any data asset acquired or accessed under this subchapter prior to any public release of such asset, including standards for such comprehensive risk assessment and criteria for making a determination of whether to release the data.(4) Requirements for each statistical agency or unit to make any process or assessment established, produced, or conducted pursuant to this section transparent and easy to understand, including the following:(A) A requirement to make information on the assessment of the sensitivity level of each data asset conducted pursuant to paragraph (1) available on the Federal data catalogue established under section 3511(c)(1).(B) A requirement to make any comprehensive risk assessment, and associated determinations, conducted under paragraph (3) available on the Federal data catalogue established under section 3511(c)(1).
-
(1) Standards for each statistical agency or unit to assess each data asset owned or accessed by the statistical agency or unit for purposes of categorizing the sensitivity level of each such asset and identifying the corresponding level of accessibility to each such asset. Such standards shall include—(A) common sensitivity levels and corresponding levels of accessibility that may be assigned to a data asset, including a requisite minimum and maximum number of sensitivity levels for each statistical agency or unit to use;(B) criteria for determining the sensitivity level and corresponding level of accessibility of each data asset; and(C) criteria for determining whether a less sensitive and more accessible version of a data asset can be produced.
-
(A) common sensitivity levels and corresponding levels of accessibility that may be assigned to a data asset, including a requisite minimum and maximum number of sensitivity levels for each statistical agency or unit to use;
-
(2) Standards for each statistical agency or unit to improve access to a data asset pursuant to paragraph (1) or (3) by removing or obscuring information in such a manner that the identity of the data subject is less likely to be reasonably inferred by either direct or indirect means.
-
(3) A requirement for each statistical agency or unit to conduct a comprehensive risk assessment of any data asset acquired or accessed under this subchapter prior to any public release of such asset, including standards for such comprehensive risk assessment and criteria for making a determination of whether to release the data.
-
(4) Requirements for each statistical agency or unit to make any process or assessment established, produced, or conducted pursuant to this section transparent and easy to understand, including the following:(A) A requirement to make information on the assessment of the sensitivity level of each data asset conducted pursuant to paragraph (1) available on the Federal data catalogue established under section 3511(c)(1).(B) A requirement to make any comprehensive risk assessment, and associated determinations, conducted under paragraph (3) available on the Federal data catalogue established under section 3511(c)(1).
-
(2) ensure that statistical agencies and units have the ability to make information public on the Federal data catalogue established under section 3511(c)(1), in accordance with requirements established pursuant to subsection (b).
-
(a) The Director shall establish a process through which agencies, the Congressional Budget Office, State, local, and Tribal governments, researchers, and other individuals, as appropriate, may apply to access the data assets accessed or acquired under this subchapter by a statistical agency or unit for purposes of developing evidence. The process shall include the following:(1) Sufficient detail to ensure that each statistical agency or unit establishes an identical process.(2) A common application form.(3) Criteria for statistical agencies and units to determine whether to grant an applicant access to a data asset.(4) Timeframes for prompt determinations by each statistical agency or unit.(5) An appeals process for adverse decisions and noncompliance with the process established under this subsection.(6) Standards for transparency, including requirements to make the following information publicly available:(A) Each application received.(B) The status of each application.(C) The determination made for each application.(D) Any other information, as appropriate, to ensure full transparency of the process established under this subsection.
-
(1) Sufficient detail to ensure that each statistical agency or unit establishes an identical process.
-
(3) Criteria for statistical agencies and units to determine whether to grant an applicant access to a data asset.
-
(4) Timeframes for prompt determinations by each statistical agency or unit.
-
(b) In establishing the process required under subsection (a), the Director shall consult with stakeholders, including the public, agencies, State and local governments, and representatives of non-governmental researchers.
-
(c) The head of each statistical agency or unit shall implement the process established under subsection (a).
Citations to §3502(2)
-
(1) minimize the paperwork burden for individuals, small businesses, educational and nonprofit institutions, Federal contractors, State, local and tribal governments, and other persons resulting from the collection of information by or for the Federal Government;
-
(3) coordinate, integrate, and to the extent practicable and appropriate, make uniform Federal information resources management policies and practices as a means to improve the productivity, efficiency, and effectiveness of Government programs, including the reduction of information collection burdens on the public and the improvement of service delivery to the public;
-
(6) strengthen the partnership between the Federal Government and State, local, and tribal governments by minimizing the burden and maximizing the utility of information created, collected, maintained, used, disseminated, and retained by or for the Federal Government;
-
(10) ensure that information technology is acquired, used, and managed to improve performance of agency missions, including the reduction of information collection burdens on the public; and
-
(1) The Director shall oversee the use of information resources to improve the efficiency and effectiveness of governmental operations to serve agency missions, including burden reduction and service delivery to the public. In performing such oversight, the Director shall—(A) develop, coordinate and oversee the implementation of Federal information resources management policies, principles, standards, and guidelines; and(B) provide direction and oversee—(i) the review and approval of the collection of information and the reduction of the information collection burden;(ii) agency dissemination of and public access to information;(iii) statistical activities;(iv) records management activities;(v) privacy, confidentiality, security, disclosure, and sharing of information; and(vi) the acquisition and use of information technology, including alternative information technologies that provide for electronic submission, maintenance, or disclosure of information as a substitute for paper and for the use and acceptance of electronic signatures.
-
(i) the review and approval of the collection of information and the reduction of the information collection burden;
-
(2) coordinate the review of the collection of information associated with Federal procurement and acquisition by the Office of Information and Regulatory Affairs with the Office of Federal Procurement Policy, with particular emphasis on applying information technology to improve the efficiency and effectiveness of Federal procurement, acquisition and payment, and to reduce information collection burdens on the public;
-
(3) minimize the Federal information collection burden, with particular emphasis on those individuals and entities most adversely affected;
-
(5) establish and oversee standards and guidelines by which agencies are to estimate the burden to comply with a proposed collection of information;1
-
(5) promote the use of information technology by the Federal Government to improve the productivity, efficiency, and effectiveness of Federal programs, including through dissemination of public information and the reduction of information collection burdens on the public.
-
(1) in consultation with agency heads, set an annual Governmentwide goal for the reduction of information collection burdens by at least 10 percent during each of fiscal years 1996 and 1997 and 5 percent during each of fiscal years 1998, 1999, 2000, and 2001, and set annual agency goals to—(A) reduce information collection burdens imposed on the public that—(i) represent the maximum practicable opportunity in each agency; and(ii) are consistent with improving agency management of the process for the review of collections of information established under section 3506(c); and(B) improve information resources management in ways that increase the productivity, efficiency and effectiveness of Federal programs, including service delivery to the public;
-
(A) reduce information collection burdens imposed on the public that—(i) represent the maximum practicable opportunity in each agency; and(ii) are consistent with improving agency management of the process for the review of collections of information established under section 3506(c); and
-
(3) The Chief Information Officer designated under paragraph (2) shall head an office responsible for ensuring agency compliance with and prompt, efficient, and effective implementation of the information policies and information resources management responsibilities established under this subchapter, including the reduction of information collection burdens on the public. The Chief Information Officer and employees of such office shall be selected with special attention to the professional qualifications required to administer the functions described under this subchapter.
-
(A) reduce information collection burdens on the public;
-
(iv) a specific, objectively supported estimate of burden;
-
(III) an estimate, to the extent practicable, of the burden of the collection;
-
(ii) evaluate the accuracy of the agency’s estimate of the burden of the proposed collection of information;
-
(iv) minimize the burden of the collection of information on those who are to respond, including through the use of automated collection techniques or other forms of information technology; and
-
(C) reduces to the extent practicable and appropriate the burden on persons who shall provide information to or for the agency, including with respect to small entities, as defined under section 601(6) of title 5, the use of such techniques as—(i) establishing differing compliance or reporting requirements or timetables that take into account the resources available to those who are to respond;(ii) the clarification, consolidation, or simplification of compliance and reporting requirements; or(iii) an exemption from coverage of the collection of information, or any part thereof;
-
(J) to the maximum extent practicable, uses information technology to reduce burden and improve data quality, agency efficiency and responsiveness to the public; and
-
(4) in addition to the requirements of this chapter regarding the reduction of information collection burdens for small business concerns (as defined in section 3 of the Small Business Act (15 U.S.C. 632)), make efforts to further reduce the information collection burden for small business concerns with fewer than 25 employees.
-
(3) promote the use of information technology by the agency to improve the productivity, efficiency, and effectiveness of agency programs, including the reduction of information collection burdens on the public and improved dissemination of public information;
-
(4) propose changes in legislation, regulations, and agency procedures to improve information technology practices, including changes that improve the ability of the agency to use technology to reduce burden; and
-
(V) an estimate of the burden that shall result from the collection of information; and
-
(A) conduct the review established under section 3506(c), including the seeking of comment from the public on the continued need for, and burden imposed by the collection of information; and
-
(A) reduced information collection burdens on the public, including—(i) a summary of accomplishments and planned initiatives to reduce collection of information burdens;(ii) a list of all violations of this subchapter and of any rules, guidelines, policies, and procedures issued pursuant to this subchapter;(iii) a list of any increase in the collection of information burden, including the authority for each such collection; and(iv) a list of agencies that in the preceding year did not reduce information collection burdens in accordance with section 3505(a)(1), a list of the programs and statutory responsibilities of those agencies that precluded that reduction, and recommendations to assist those agencies to reduce information collection burdens in accordance with that section;
-
(i) a summary of accomplishments and planned initiatives to reduce collection of information burdens;
-
(iii) a list of any increase in the collection of information burden, including the authority for each such collection; and
-
(iv) a list of agencies that in the preceding year did not reduce information collection burdens in accordance with section 3505(a)(1), a list of the programs and statutory responsibilities of those agencies that precluded that reduction, and recommendations to assist those agencies to reduce information collection burdens in accordance with that section;
-
(b) The preparation of any report required by this section shall be based on performance results reported by the agencies and shall not increase the collection of information burden on persons outside the Federal Government.
-
(3) The quality of Federal statistics depends on the willingness of businesses to respond to statistical surveys. Reducing reporting burdens will increase response rates, and therefore lead to more accurate characterizations of the economy.
-
(2) To reduce the paperwork burdens imposed on businesses that provide requested information to the Federal Government.
-
(1) identify opportunities to eliminate duplication and otherwise reduce reporting burden and cost imposed on the public in providing information for statistical purposes;
Citations to §3502(3)
-
(1) minimize the paperwork burden for individuals, small businesses, educational and nonprofit institutions, Federal contractors, State, local and tribal governments, and other persons resulting from the collection of information by or for the Federal Government;
-
(i) the review and approval of the collection of information and the reduction of the information collection burden;
-
(c) With respect to the collection of information and the control of paperwork, the Director shall—(1) review and approve proposed agency collections of information;(2) coordinate the review of the collection of information associated with Federal procurement and acquisition by the Office of Information and Regulatory Affairs with the Office of Federal Procurement Policy, with particular emphasis on applying information technology to improve the efficiency and effectiveness of Federal procurement, acquisition and payment, and to reduce information collection burdens on the public;(3) minimize the Federal information collection burden, with particular emphasis on those individuals and entities most adversely affected;(4) maximize the practical utility of and public benefit from information collected by or for the Federal Government;(5) establish and oversee standards and guidelines by which agencies are to estimate the burden to comply with a proposed collection of information;1(6) publish in the Federal Register and make available on the Internet (in consultation with the Small Business Administration) on an annual basis a list of the compliance assistance resources available to small businesses, with the first such publication occurring not later than 1 year after the date of enactment of the Small Business Paperwork Relief Act of 2002.
-
(2) coordinate the review of the collection of information associated with Federal procurement and acquisition by the Office of Information and Regulatory Affairs with the Office of Federal Procurement Policy, with particular emphasis on applying information technology to improve the efficiency and effectiveness of Federal procurement, acquisition and payment, and to reduce information collection burdens on the public;
-
(5) establish and oversee standards and guidelines by which agencies are to estimate the burden to comply with a proposed collection of information;1
-
(b) For purposes of any pilot project conducted under subsection (a)(2), the Director may, after consultation with the agency head, waive the application of any administrative directive issued by an agency with which the project is conducted, including any directive requiring a collection of information, after giving timely notice to the public and the Congress regarding the need for such waiver.
-
(c) With respect to the collection of information and the control of paperwork, each agency shall—(1) establish a process within the office headed by the Chief Information Officer designated under subsection (a), that is sufficiently independent of program responsibility to evaluate fairly whether proposed collections of information should be approved under this subchapter, to—(A) review each collection of information before submission to the Director for review under this subchapter, including—(i) an evaluation of the need for the collection of information;(ii) a functional description of the information to be collected;(iii) a plan for the collection of the information;(iv) a specific, objectively supported estimate of burden;(v) a test of the collection of information through a pilot program, if appropriate; and(vi) a plan for the efficient and effective management and use of the information to be collected, including necessary resources;(B) ensure that each information collection—(i) is inventoried, displays a control number and, if appropriate, an expiration date;(ii) indicates the collection is in accordance with the clearance requirements of section 3507; and(iii) informs the person receiving the collection of information of—(I) the reasons the information is being collected;(II) the way such information is to be used;(III) an estimate, to the extent practicable, of the burden of the collection;(IV) whether responses to the collection of information are voluntary, required to obtain a benefit, or mandatory; and(V) the fact that an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a valid control number; and(A) except as provided under subparagraph (B) or section 3507(j), provide 60-day notice in the Federal Register, and otherwise consult with members of the public and affected agencies concerning each proposed collection of information, to solicit comment to—(i) evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility;(ii) evaluate the accuracy of the agency’s estimate of the burden of the proposed collection of information;(iii) enhance the quality, utility, and clarity of the information to be collected; and(iv) minimize the burden of the collection of information on those who are to respond, including through the use of automated collection techniques or other forms of information technology; and(B) for any proposed collection of information contained in a proposed rule (to be reviewed by the Director under section 3507(d)), provide notice and comment through the notice of proposed rulemaking for the proposed rule and such notice shall have the same purposes specified under subparagraph (A)(i) through (iv);(3) certify (and provide a record supporting such certification, including public comments received by the agency) that each collection of information submitted to the Director for review under section 3507—(A) is necessary for the proper performance of the functions of the agency, including that the information has practical utility;(B) is not unnecessarily duplicative of information otherwise reasonably accessible to the agency;(C) reduces to the extent practicable and appropriate the burden on persons who shall provide information to or for the agency, including with respect to small entities, as defined under section 601(6) of title 5, the use of such techniques as—(i) establishing differing compliance or reporting requirements or timetables that take into account the resources available to those who are to respond;(ii) the clarification, consolidation, or simplification of compliance and reporting requirements; or(iii) an exemption from coverage of the collection of information, or any part thereof;(D) is written using plain, coherent, and unambiguous terminology and is understandable to those who are to respond;(E) is to be implemented in ways consistent and compatible, to the maximum extent practicable, with the existing reporting and recordkeeping practices of those who are to respond;(F) indicates for each recordkeeping requirement the length of time persons are required to maintain the records specified;(G) contains the statement required under paragraph (1)(B)(iii);(H) has been developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected, including the processing of the information in a manner which shall enhance, where appropriate, the utility of the information to agencies and the public;(I) uses effective and efficient statistical survey methodology appropriate to the purpose for which the information is to be collected; and(J) to the maximum extent practicable, uses information technology to reduce burden and improve data quality, agency efficiency and responsiveness to the public; and(4) in addition to the requirements of this chapter regarding the reduction of information collection burdens for small business concerns (as defined in section 3 of the Small Business Act (15 U.S.C. 632)), make efforts to further reduce the information collection burden for small business concerns with fewer than 25 employees.
-
(A) review each collection of information before submission to the Director for review under this subchapter, including—(i) an evaluation of the need for the collection of information;(ii) a functional description of the information to be collected;(iii) a plan for the collection of the information;(iv) a specific, objectively supported estimate of burden;(v) a test of the collection of information through a pilot program, if appropriate; and(vi) a plan for the efficient and effective management and use of the information to be collected, including necessary resources;
-
(i) an evaluation of the need for the collection of information;
-
(v) a test of the collection of information through a pilot program, if appropriate; and
-
(iii) informs the person receiving the collection of information of—(I) the reasons the information is being collected;(II) the way such information is to be used;(III) an estimate, to the extent practicable, of the burden of the collection;(IV) whether responses to the collection of information are voluntary, required to obtain a benefit, or mandatory; and(V) the fact that an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a valid control number; and
-
(IV) whether responses to the collection of information are voluntary, required to obtain a benefit, or mandatory; and
-
(V) the fact that an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a valid control number; and
-
(A) except as provided under subparagraph (B) or section 3507(j), provide 60-day notice in the Federal Register, and otherwise consult with members of the public and affected agencies concerning each proposed collection of information, to solicit comment to—(i) evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility;(ii) evaluate the accuracy of the agency’s estimate of the burden of the proposed collection of information;(iii) enhance the quality, utility, and clarity of the information to be collected; and(iv) minimize the burden of the collection of information on those who are to respond, including through the use of automated collection techniques or other forms of information technology; and
-
(i) evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility;
-
(ii) evaluate the accuracy of the agency’s estimate of the burden of the proposed collection of information;
-
(iv) minimize the burden of the collection of information on those who are to respond, including through the use of automated collection techniques or other forms of information technology; and
-
(B) for any proposed collection of information contained in a proposed rule (to be reviewed by the Director under section 3507(d)), provide notice and comment through the notice of proposed rulemaking for the proposed rule and such notice shall have the same purposes specified under subparagraph (A)(i) through (iv);
-
(3) certify (and provide a record supporting such certification, including public comments received by the agency) that each collection of information submitted to the Director for review under section 3507—(A) is necessary for the proper performance of the functions of the agency, including that the information has practical utility;(B) is not unnecessarily duplicative of information otherwise reasonably accessible to the agency;(C) reduces to the extent practicable and appropriate the burden on persons who shall provide information to or for the agency, including with respect to small entities, as defined under section 601(6) of title 5, the use of such techniques as—(i) establishing differing compliance or reporting requirements or timetables that take into account the resources available to those who are to respond;(ii) the clarification, consolidation, or simplification of compliance and reporting requirements; or(iii) an exemption from coverage of the collection of information, or any part thereof;(D) is written using plain, coherent, and unambiguous terminology and is understandable to those who are to respond;(E) is to be implemented in ways consistent and compatible, to the maximum extent practicable, with the existing reporting and recordkeeping practices of those who are to respond;(F) indicates for each recordkeeping requirement the length of time persons are required to maintain the records specified;(G) contains the statement required under paragraph (1)(B)(iii);(H) has been developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected, including the processing of the information in a manner which shall enhance, where appropriate, the utility of the information to agencies and the public;(I) uses effective and efficient statistical survey methodology appropriate to the purpose for which the information is to be collected; and(J) to the maximum extent practicable, uses information technology to reduce burden and improve data quality, agency efficiency and responsiveness to the public; and
-
(iii) an exemption from coverage of the collection of information, or any part thereof;
-
(1) In addition to the requirements described in subsection (c), each agency shall, with respect to the collection of information and the control of paperwork, establish 1 point of contact in the agency to act as a liaison between the agency and small business concerns (as defined in section 3 of the Small Business Act (15 U.S.C. 632)).
-
(a) An agency shall not conduct or sponsor the collection of information unless in advance of the adoption or revision of the collection of information—(1) the agency has—(A) conducted the review established under section 3506(c)(1);(B) evaluated the public comments received under section 3506(c)(2);(C) submitted to the Director the certification required under section 3506(c)(3), the proposed collection of information, copies of pertinent statutory authority, regulations, and other related materials as the Director may specify; and(D) published a notice in the Federal Register—(i) stating that the agency has made such submission; and(ii) setting forth—(I) a title for the collection of information;(II) a summary of the collection of information;(III) a brief description of the need for the information and the proposed use of the information;(IV) a description of the likely respondents and proposed frequency of response to the collection of information;(V) an estimate of the burden that shall result from the collection of information; and(2) the Director has approved the proposed collection of information or approval has been inferred, under the provisions of this section; and(3) the agency has obtained from the Director a control number to be displayed upon the collection of information.
-
(C) submitted to the Director the certification required under section 3506(c)(3), the proposed collection of information, copies of pertinent statutory authority, regulations, and other related materials as the Director may specify; and
-
(I) a title for the collection of information;
-
(II) a summary of the collection of information;
-
(IV) a description of the likely respondents and proposed frequency of response to the collection of information;
-
(V) an estimate of the burden that shall result from the collection of information; and
-
(2) the Director has approved the proposed collection of information or approval has been inferred, under the provisions of this section; and
-
(3) the agency has obtained from the Director a control number to be displayed upon the collection of information.
-
(1) For any proposed collection of information not contained in a proposed rule, the Director shall notify the agency involved of the decision to approve or disapprove the proposed collection of information.
-
(1) For any proposed collection of information contained in a proposed rule—(A) as soon as practicable, but no later than the date of publication of a notice of proposed rulemaking in the Federal Register, each agency shall forward to the Director a copy of any proposed rule which contains a collection of information and any information requested by the Director necessary to make the determination required under this subsection; and(B) within 60 days after the notice of proposed rulemaking is published in the Federal Register, the Director may file public comments pursuant to the standards set forth in section 3508 on the collection of information contained in the proposed rule;
-
(A) as soon as practicable, but no later than the date of publication of a notice of proposed rulemaking in the Federal Register, each agency shall forward to the Director a copy of any proposed rule which contains a collection of information and any information requested by the Director necessary to make the determination required under this subsection; and
-
(B) within 60 days after the notice of proposed rulemaking is published in the Federal Register, the Director may file public comments pursuant to the standards set forth in section 3508 on the collection of information contained in the proposed rule;
-
(A) how any collection of information contained in the final rule responds to the comments, if any, filed by the Director or the public; or
-
(3) If the Director has received notice and failed to comment on an agency rule within 60 days after the notice of proposed rulemaking, the Director may not disapprove any collection of information specifically contained in an agency rule.
-
(A) from disapproving any collection of information which was not specifically required by an agency rule;
-
(B) from disapproving any collection of information contained in an agency rule, if the agency failed to comply with the requirements of paragraph (1) of this subsection;
-
(C) from disapproving any collection of information contained in a final agency rule, if the Director finds within 60 days after the publication of the final rule that the agency’s response to the Director’s comments filed under paragraph (2) of this subsection was unreasonable; or
-
(D) from disapproving any collection of information contained in a final rule, if—(i) the Director determines that the agency has substantially modified in the final rule the collection of information contained in the proposed rule; and(ii) the agency has not given the Director the information required under paragraph (1) with respect to the modified collection of information, at least 60 days before the issuance of the final rule.
-
(i) the Director determines that the agency has substantially modified in the final rule the collection of information contained in the proposed rule; and
-
(ii) the agency has not given the Director the information required under paragraph (1) with respect to the modified collection of information, at least 60 days before the issuance of the final rule.
-
(6) The decision by the Director to approve or not act upon a collection of information contained in an agency rule shall not be subject to judicial review.
-
(1) Any decision by the Director under subsection (c), (d), (h), or (j) to disapprove a collection of information, or to instruct the agency to make substantive or material change to a collection of information, shall be publicly available and include an explanation of the reasons for such decision.
-
(2) Any written communication between the Administrator of the Office of Information and Regulatory Affairs, or any employee of the Office of Information and Regulatory Affairs, and an agency or person not employed by the Federal Government concerning a proposed collection of information shall be made available to the public.
-
(B) any communication relating to a collection of information which is not approved under this subchapter, the disclosure of which could lead to retaliation or discrimination against the communicator.
-
(A) any disapproval by the Director, in whole or in part, of a proposed collection of information of that agency; or
-
(2) The agency shall certify each vote to void such disapproval or exercise to the Director, and explain the reasons for such vote. The Director shall without further delay assign a control number to such collection of information, and such vote to void the disapproval or exercise shall be valid for a period of 3 years.
-
(g) The Director may not approve a collection of information for a period in excess of 3 years.
-
(1) If an agency decides to seek extension of the Director’s approval granted for a currently approved collection of information, the agency shall—(A) conduct the review established under section 3506(c), including the seeking of comment from the public on the continued need for, and burden imposed by the collection of information; and(B) after having made a reasonable effort to seek public comment, but no later than 60 days before the expiration date of the control number assigned by the Director for the currently approved collection of information, submit the collection of information for review and approval under this section, which shall include an explanation of how the agency has used the information that it has collected.
-
(A) conduct the review established under section 3506(c), including the seeking of comment from the public on the continued need for, and burden imposed by the collection of information; and
-
(B) after having made a reasonable effort to seek public comment, but no later than 60 days before the expiration date of the control number assigned by the Director for the currently approved collection of information, submit the collection of information for review and approval under this section, which shall include an explanation of how the agency has used the information that it has collected.
-
(2) If under the provisions of this section, the Director disapproves a collection of information contained in an existing rule, or recommends or instructs the agency to make a substantive or material change to a collection of information contained in an existing rule, the Director shall—(A) publish an explanation thereof in the Federal Register; and(B) instruct the agency to undertake a rulemaking within a reasonable time limited to consideration of changes to the collection of information contained in the rule and thereafter to submit the collection of information for approval or disapproval under this subchapter.
-
(B) instruct the agency to undertake a rulemaking within a reasonable time limited to consideration of changes to the collection of information contained in the rule and thereafter to submit the collection of information for approval or disapproval under this subchapter.
-
(3) An agency may not make a substantive or material modification to a collection of information after such collection has been approved by the Director, unless the modification has been submitted to the Director for review and approval under this subchapter.
-
(1) The agency head may request the Director to authorize a collection of information, if an agency head determines that—(A) a collection of information—(i) is needed prior to the expiration of time periods established under this subchapter; and(ii) is essential to the mission of the agency; and(B) the agency cannot reasonably comply with the provisions of this subchapter because—(i) public harm is reasonably likely to result if normal clearance procedures are followed;(ii) an unanticipated event has occurred; or(iii) the use of normal clearance procedures is reasonably likely to prevent or disrupt the collection of information or is reasonably likely to cause a statutory or court ordered deadline to be missed.
-
(A) a collection of information—(i) is needed prior to the expiration of time periods established under this subchapter; and(ii) is essential to the mission of the agency; and
-
(iii) the use of normal clearance procedures is reasonably likely to prevent or disrupt the collection of information or is reasonably likely to cause a statutory or court ordered deadline to be missed.
-
(2) The Director shall approve or disapprove any such authorization request within the time requested by the agency head and, if approved, shall assign the collection of information a control number. Any collection of information conducted under this subsection may be conducted without compliance with the provisions of this subchapter for a maximum of 180 days after the date on which the Director received the request to authorize such collection.
-
Before approving a proposed collection of information, the Director shall determine whether the collection of information by the agency is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility. Before making a determination the Director may give the agency and other interested persons an opportunity to be heard or to submit statements in writing. To the extent, if any, that the Director determines that the collection of information by an agency is unnecessary for any reason, the agency may not engage in the collection of information.
-
The Director may designate a central collection agency to obtain information for two or more agencies if the Director determines that the needs of such agencies for information will be adequately served by a single collection agency, and such sharing of data is not inconsistent with applicable law. In such cases the Director shall prescribe (with reference to the collection of information) the duties and functions of the collection agency so designated and of the agencies for which it is to act as agent (including reimbursement for costs). While the designation is in effect, an agency covered by the designation may not obtain for itself information for the agency which is the duty of the collection agency to obtain. The Director may modify the designation from time to time as circumstances require. The authority to designate under this section is subject to the provisions of section 3507(f) of this subchapter.
-
(a) Notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information that is subject to this subchapter if—(1) the collection of information does not display a valid control number assigned by the Director in accordance with this subchapter; or(2) the agency fails to inform the person who is to respond to the collection of information that such person is not required to respond to the collection of information unless it displays a valid control number.
-
(1) the collection of information does not display a valid control number assigned by the Director in accordance with this subchapter; or
-
(2) the agency fails to inform the person who is to respond to the collection of information that such person is not required to respond to the collection of information unless it displays a valid control number.
-
(i) a summary of accomplishments and planned initiatives to reduce collection of information burdens;
-
(iii) a list of any increase in the collection of information burden, including the authority for each such collection; and
-
(b) The preparation of any report required by this section shall be based on performance results reported by the agencies and shall not increase the collection of information burden on persons outside the Federal Government.
-
(b) Any person may request the Director to review any collection of information conducted by or for an agency to determine, if, under this subchapter, a person shall maintain, provide, or disclose the information to or for the agency. Unless the request is frivolous, the Director shall, in coordination with the agency responsible for the collection of information—(1) respond to the request within 60 days after receiving the request, unless such period is extended by the Director to a specified date and the person making the request is given notice of such extension; and(2) take appropriate remedial action, if necessary.
-
(1) Except as provided in paragraph (2), this subchapter shall not apply to the collection of information—(A) during the conduct of a Federal criminal investigation or prosecution, or during the disposition of a particular criminal matter;(B) during the conduct of—(i) a civil action to which the United States or any official or agency thereof is a party; or(ii) an administrative action or investigation involving an agency against specific individuals or entities;(C) by compulsory process pursuant to the Antitrust Civil Process Act and section 13 of the Federal Trade Commission Improvements Act of 1980; or(D) during the conduct of intelligence activities as defined in section 3.4(e) of Executive Order No. 12333, issued December 4, 1981, or successor orders, or during the conduct of cryptologic activities that are communications security activities.
-
(2) This subchapter applies to the collection of information during the conduct of general investigations (other than information collected in an antitrust investigation to the extent provided in subparagraph (C) of paragraph (1)) undertaken with reference to a category of individuals or entities such as a class of licensees or an entire industry.
Citations to §3502(3)(A)(i)
-
(c) With respect to a survey authorized under subsection (a) that includes a person referred to in that subsection who is not an employee of the United States or is not otherwise considered an employee of the United States for the purposes of section 3502(3)(A)(i) of title 44, the person shall be considered as being an employee of the United States for the purposes of that section.
-
(c) Each individual surveyed under subsection (a) shall be considered an employee of the United States for purposes of section 3502(3)(A)(i) of title 44.
Citations to §3502(4)
-
(b) There shall be at the head of the Office an Administrator who shall be appointed by the President, by and with the advice and consent of the Senate. The Director shall delegate to the Administrator the authority to administer all functions under this subchapter, except that any such delegation shall not relieve the Director of responsibility for the administration of such functions. The Administrator shall serve as principal adviser to the Director on Federal information resources management policy.
-
(1) The Director shall oversee the use of information resources to improve the efficiency and effectiveness of governmental operations to serve agency missions, including burden reduction and service delivery to the public. In performing such oversight, the Director shall—(A) develop, coordinate and oversee the implementation of Federal information resources management policies, principles, standards, and guidelines; and(B) provide direction and oversee—(i) the review and approval of the collection of information and the reduction of the information collection burden;(ii) agency dissemination of and public access to information;(iii) statistical activities;(iv) records management activities;(v) privacy, confidentiality, security, disclosure, and sharing of information; and(vi) the acquisition and use of information technology, including alternative information technologies that provide for electronic submission, maintenance, or disclosure of information as a substitute for paper and for the use and acceptance of electronic signatures.
-
(2) The authority of the Director under this subchapter shall be exercised consistent with applicable law.
-
(b) With respect to general information resources management policy, the Director shall—(1) develop and oversee the implementation of uniform information resources management policies, principles, standards, and guidelines;(2) foster greater sharing, dissemination, and access to public information, including through—(A) the use of comprehensive data inventories and the Federal data catalogue under section 3511; and(B) the development and utilization of common standards for information collection, storage, processing and communication, including standards for security, interconnectivity and interoperability;(3) initiate and review proposals for changes in legislation, regulations, and agency procedures to improve information resources management practices;(4) oversee the development and implementation of best practices in information resources management, including training;(5) oversee agency integration of program and management functions with information resources management functions; and(6) issue guidance for agencies to implement section 3506(b)(6) in a manner that takes into account—(A) risks and restrictions related to the disclosure of personally identifiable information, including the risk that an individual data asset in isolation does not pose a privacy or confidentiality risk but when combined with other available information may pose such a risk;(B) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk;(C) the cost and benefits to the public of converting a data asset into a machine-readable format that is accessible and useful to the public;(D) whether the application of the requirements described in such section to a data asset could result in legal liability;(E) a determination of whether a data asset—(ii) contains confidential business information, that could be withheld under section 552(b)(4) of title 5; or(iii) is otherwise restricted by contract or other binding, written agreement;(F) the requirement that a data asset be disclosed, if it would otherwise be made available under section 552 of title 5 (commonly known as the “Freedom of Information Act”); and(G) any other considerations that the Director determines to be relevant.
-
(G) any other considerations that the Director determines to be relevant.
-
(c) With respect to the collection of information and the control of paperwork, the Director shall—(1) review and approve proposed agency collections of information;(2) coordinate the review of the collection of information associated with Federal procurement and acquisition by the Office of Information and Regulatory Affairs with the Office of Federal Procurement Policy, with particular emphasis on applying information technology to improve the efficiency and effectiveness of Federal procurement, acquisition and payment, and to reduce information collection burdens on the public;(3) minimize the Federal information collection burden, with particular emphasis on those individuals and entities most adversely affected;(4) maximize the practical utility of and public benefit from information collected by or for the Federal Government;(5) establish and oversee standards and guidelines by which agencies are to estimate the burden to comply with a proposed collection of information;1(6) publish in the Federal Register and make available on the Internet (in consultation with the Small Business Administration) on an annual basis a list of the compliance assistance resources available to small businesses, with the first such publication occurring not later than 1 year after the date of enactment of the Small Business Paperwork Relief Act of 2002.
-
(d) With respect to information dissemination, the Director shall develop and oversee the implementation of policies, principles, standards, and guidelines to—(1) apply to Federal agency dissemination of public information, regardless of the form or format in which such information is disseminated; and(2) promote public access to public information and fulfill the purposes of this subchapter, including through the effective use of information technology.
-
(e) With respect to statistical policy and coordination, the Director shall—(1) coordinate the activities of the Federal statistical system to ensure—(A) the efficiency and effectiveness of the system; and(B) the integrity, objectivity, impartiality, utility, and confidentiality of information collected for statistical purposes;(2) ensure that budget proposals of agencies are consistent with system-wide priorities for maintaining and improving the quality of Federal statistics and prepare an annual report on statistical program funding;(3) develop and oversee the implementation of Governmentwide policies, principles, standards, and guidelines concerning—(A) statistical collection procedures and methods;(B) statistical data classification;(C) statistical information presentation and dissemination;(D) timely release of statistical data; and(E) such statistical data sources as may be required for the administration of Federal programs;(4) evaluate statistical program performance and agency compliance with Governmentwide policies, principles, standards and guidelines;(5) promote the sharing of information collected for statistical purposes consistent with privacy rights and confidentiality pledges;(6) coordinate the participation of the United States in international statistical activities, including the development of comparable statistics;(7) appoint a chief statistician who is a trained and experienced professional statistician to carry out the functions described under this subsection;(8) establish an Interagency Council on Statistical Policy to advise and assist the Director in carrying out the functions under this subsection that shall—(A) be headed by the chief statistician; and(B) consist of—(i) the heads of the major statistical programs; and(ii) representatives of other statistical agencies under rotating membership;(9) provide opportunities for training in statistical policy functions to employees of the Federal Government under which—(A) each trainee shall be selected at the discretion of the Director based on agency requests and shall serve under the chief statistician for at least 6 months and not more than 1 year; and(B) all costs of the training shall be paid by the agency requesting training; and(10) ensure that any change to the standards of core-based statistical area (as defined in section 4 of the MAPS Act of 2021) delineations pursuant to this subsection shall—(A) be accompanied by a public report that explains—(i) the scientific basis, criteria, and methodology for such change to existing standards, including clear quantitative thresholds for determining any future statistical re-delineations; and(ii) the opinions of domestic and international experts in statistics and demographics, including government experts at the Bureau of the Census and other relevant agencies, who were consulted regarding such change to existing standards;(B) not be influenced by any non-statistical considerations such as impact on program administration or service delivery; and(C) not propagate automatically for any non-statistical use by any domestic assistance program (as defined in section 4 of the MAPS Act of 2021).
-
(8) establish an Interagency Council on Statistical Policy to advise and assist the Director in carrying out the functions under this subsection that shall—(A) be headed by the chief statistician; and(B) consist of—(i) the heads of the major statistical programs; and(ii) representatives of other statistical agencies under rotating membership;
-
(f) With respect to records management, the Director shall—(1) provide advice and assistance to the Archivist of the United States and the Administrator of General Services to promote coordination in the administration of chapters 29, 31, and 33 of this title with the information resources management policies, principles, standards, and guidelines established under this subchapter;(2) review compliance by agencies with—(B) regulations promulgated by the Archivist of the United States and the Administrator of General Services; and(3) oversee the application of records management policies, principles, standards, and guidelines, including requirements for archiving information maintained in electronic format, in the planning and design of information systems.
-
(g) With respect to privacy and security, the Director shall—(1) develop and oversee the implementation of policies, principles, standards, and guidelines on privacy, confidentiality, security, disclosure and sharing of information collected or maintained by or for agencies; and(2) oversee and coordinate compliance with sections 552 and 552a of title 5, sections 20 and 21 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3 and 278g–4), section 11331 of title 40 and subchapter II of this chapter, and related information management laws.
-
(h) With respect to Federal information technology, the Director shall—(1) in consultation with the Director of the National Institute of Standards and Technology and the Administrator of General Services—(A) develop and oversee the implementation of policies, principles, standards, and guidelines for information technology functions and activities of the Federal Government, including periodic evaluations of major information systems; and(B) oversee the development and implementation of standards under section 11331 of title 40;2(2) monitor the effectiveness of, and compliance with, directives issued under subtitle III of title 40 and directives issued under section 3222 of title 40;(3) coordinate the development and review by the Office of Information and Regulatory Affairs of policy associated with Federal procurement and acquisition of information technology with the Office of Federal Procurement Policy;(4) ensure, through the review of agency budget proposals, information resources management plans and other means—(A) agency integration of information resources management plans, program plans and budgets for acquisition and use of information technology; and(B) the efficiency and effectiveness of inter-agency information technology initiatives to improve agency performance and the accomplishment of agency missions; and(5) promote the use of information technology by the Federal Government to improve the productivity, efficiency, and effectiveness of Federal programs, including through dissemination of public information and the reduction of information collection burdens on the public.
-
(1) in consultation with the Director of the National Institute of Standards and Technology and the Administrator of General Services—(A) develop and oversee the implementation of policies, principles, standards, and guidelines for information technology functions and activities of the Federal Government, including periodic evaluations of major information systems; and(B) oversee the development and implementation of standards under section 11331 of title 40;2
-
(a) In carrying out the functions under this subchapter, the Director shall—(1) in consultation with agency heads, set an annual Governmentwide goal for the reduction of information collection burdens by at least 10 percent during each of fiscal years 1996 and 1997 and 5 percent during each of fiscal years 1998, 1999, 2000, and 2001, and set annual agency goals to—(A) reduce information collection burdens imposed on the public that—(i) represent the maximum practicable opportunity in each agency; and(ii) are consistent with improving agency management of the process for the review of collections of information established under section 3506(c); and(B) improve information resources management in ways that increase the productivity, efficiency and effectiveness of Federal programs, including service delivery to the public;(2) with selected agencies and non-Federal entities on a voluntary basis, conduct pilot projects to test alternative policies, practices, regulations, and procedures to fulfill the purposes of this subchapter, particularly with regard to minimizing the Federal information collection burden; and(3) in consultation with the Administrator of General Services, the Director of the National Institute of Standards and Technology, the Archivist of the United States, and the Director of the Office of Personnel Management, develop and maintain a Governmentwide strategic plan for information resources management, that shall include—(A) a description of the objectives and the means by which the Federal Government shall apply information resources to improve agency and program performance;(B) plans for—(i) reducing information burdens on the public, including reducing such burdens through the elimination of duplication and meeting shared data needs with shared resources;(ii) enhancing public access to and dissemination of, information, using electronic and other formats; and(iii) meeting the information technology needs of the Federal Government in accordance with the purposes of this subchapter; and(C) a description of progress in applying information resources management to improve agency performance and the accomplishment of missions.
-
(3) in consultation with the Administrator of General Services, the Director of the National Institute of Standards and Technology, the Archivist of the United States, and the Director of the Office of Personnel Management, develop and maintain a Governmentwide strategic plan for information resources management, that shall include—(A) a description of the objectives and the means by which the Federal Government shall apply information resources to improve agency and program performance;(B) plans for—(i) reducing information burdens on the public, including reducing such burdens through the elimination of duplication and meeting shared data needs with shared resources;(ii) enhancing public access to and dissemination of, information, using electronic and other formats; and(iii) meeting the information technology needs of the Federal Government in accordance with the purposes of this subchapter; and(C) a description of progress in applying information resources management to improve agency performance and the accomplishment of missions.
-
(b) For purposes of any pilot project conducted under subsection (a)(2), the Director may, after consultation with the agency head, waive the application of any administrative directive issued by an agency with which the project is conducted, including any directive requiring a collection of information, after giving timely notice to the public and the Congress regarding the need for such waiver.
-
(4) The Director shall issue guidance for and oversee the implementation of the requirements of this subsection.
-
(B) complying with the requirements of this subchapter and related policies established by the Director.
-
(2) in accordance with guidance by the Director, develop and maintain a strategic information resources management plan that, to the extent practicable—(A) describes how information resources management activities help accomplish agency missions;(i) requires the agency to develop processes and procedures that—(I) require data collection mechanisms created on or after the date of the enactment of the OPEN Government Data Act to be available in an open format; and(II) facilitate collaboration with non-Government entities (including businesses), researchers, and the public for the purpose of understanding how data users value and use government data;(ii) identifies and implements methods for collecting and analyzing digital information on data asset usage by users within and outside of the agency, including designating a point of contact within the agency to assist the public and to respond to quality issues, usability issues, recommendations for improvements, and complaints about adherence to open data requirements within a reasonable period of time;(iii) develops and implements a process to evaluate and improve the timeliness, completeness, consistency, accuracy, usefulness, and availability of open Government data assets;(iv) includes requirements for meeting the goals of the agency open data plan, including the acquisition of technology, provision of training for employees, and the implementation of procurement standards, in accordance with existing law, regulation, and policy, that allow for the acquisition of innovative solutions from public and private sectors;(v) identifies as priority data assets any data asset for which disclosure would be in the public interest and establishes a plan to evaluate each priority data asset for disclosure on the Federal Data Catalogue under section 3511 and for a determination under1 3511(a)(2)(A)(iii)(I)(bb), including an accounting of which priority data assets have not yet been evaluated; and(vi) requires the agency to comply with requirements under section 3511, including any standards established by the Director under such section, when disclosing a data asset pursuant to such section; and(C) is updated annually and made publicly available on the website of the agency not later than 5 days after each such update;
-
(vi) requires the agency to comply with requirements under section 3511, including any standards established by the Director under such section, when disclosing a data asset pursuant to such section; and
-
(4) in consultation with the Director, the Administrator of General Services, and the Archivist of the United States, maintain a current and complete inventory of the agency’s information resources, including directories necessary to fulfill the requirements of section 3511 of this subchapter;
-
(5) in consultation with the Director and the Director of the Office of Personnel Management, conduct formal training programs to educate agency program and management officials about information resources management; and
-
(6) in accordance with guidance by the Director—(A) make each data asset of the agency available in an open format; and(B) make each public data asset of the agency available—(i) as an open Government data asset; and(ii) under an open license.
-
(A) review each collection of information before submission to the Director for review under this subchapter, including—(i) an evaluation of the need for the collection of information;(ii) a functional description of the information to be collected;(iii) a plan for the collection of the information;(iv) a specific, objectively supported estimate of burden;(v) a test of the collection of information through a pilot program, if appropriate; and(vi) a plan for the efficient and effective management and use of the information to be collected, including necessary resources;
-
(B) for any proposed collection of information contained in a proposed rule (to be reviewed by the Director under section 3507(d)), provide notice and comment through the notice of proposed rulemaking for the proposed rule and such notice shall have the same purposes specified under subparagraph (A)(i) through (iv);
-
(3) certify (and provide a record supporting such certification, including public comments received by the agency) that each collection of information submitted to the Director for review under section 3507—(A) is necessary for the proper performance of the functions of the agency, including that the information has practical utility;(B) is not unnecessarily duplicative of information otherwise reasonably accessible to the agency;(C) reduces to the extent practicable and appropriate the burden on persons who shall provide information to or for the agency, including with respect to small entities, as defined under section 601(6) of title 5, the use of such techniques as—(i) establishing differing compliance or reporting requirements or timetables that take into account the resources available to those who are to respond;(ii) the clarification, consolidation, or simplification of compliance and reporting requirements; or(iii) an exemption from coverage of the collection of information, or any part thereof;(D) is written using plain, coherent, and unambiguous terminology and is understandable to those who are to respond;(E) is to be implemented in ways consistent and compatible, to the maximum extent practicable, with the existing reporting and recordkeeping practices of those who are to respond;(F) indicates for each recordkeeping requirement the length of time persons are required to maintain the records specified;(G) contains the statement required under paragraph (1)(B)(iii);(H) has been developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected, including the processing of the information in a manner which shall enhance, where appropriate, the utility of the information to agencies and the public;(I) uses effective and efficient statistical survey methodology appropriate to the purpose for which the information is to be collected; and(J) to the maximum extent practicable, uses information technology to reduce burden and improve data quality, agency efficiency and responsiveness to the public; and
-
(C) submitted to the Director the certification required under section 3506(c)(3), the proposed collection of information, copies of pertinent statutory authority, regulations, and other related materials as the Director may specify; and
-
(2) the Director has approved the proposed collection of information or approval has been inferred, under the provisions of this section; and
-
(3) the agency has obtained from the Director a control number to be displayed upon the collection of information.
-
(b) The Director shall provide at least 30 days for public comment prior to making a decision under subsection (c), (d), or (h), except as provided under subsection (j).
-
(1) For any proposed collection of information not contained in a proposed rule, the Director shall notify the agency involved of the decision to approve or disapprove the proposed collection of information.
-
(2) The Director shall provide the notification under paragraph (1), within 60 days after receipt or publication of the notice under subsection (a)(1)(D), whichever is later.
-
(3) If the Director does not notify the agency of a denial or approval within the 60-day period described under paragraph (2)—(A) the approval may be inferred;(B) a control number shall be assigned without further delay; and(C) the agency may collect the information for not more than 1 year.
-
(A) as soon as practicable, but no later than the date of publication of a notice of proposed rulemaking in the Federal Register, each agency shall forward to the Director a copy of any proposed rule which contains a collection of information and any information requested by the Director necessary to make the determination required under this subsection; and
-
(B) within 60 days after the notice of proposed rulemaking is published in the Federal Register, the Director may file public comments pursuant to the standards set forth in section 3508 on the collection of information contained in the proposed rule;
-
(A) how any collection of information contained in the final rule responds to the comments, if any, filed by the Director or the public; or
-
(3) If the Director has received notice and failed to comment on an agency rule within 60 days after the notice of proposed rulemaking, the Director may not disapprove any collection of information specifically contained in an agency rule.
-
(4) No provision in this section shall be construed to prevent the Director, in the Director’s discretion—(A) from disapproving any collection of information which was not specifically required by an agency rule;(B) from disapproving any collection of information contained in an agency rule, if the agency failed to comply with the requirements of paragraph (1) of this subsection;(C) from disapproving any collection of information contained in a final agency rule, if the Director finds within 60 days after the publication of the final rule that the agency’s response to the Director’s comments filed under paragraph (2) of this subsection was unreasonable; or(D) from disapproving any collection of information contained in a final rule, if—(i) the Director determines that the agency has substantially modified in the final rule the collection of information contained in the proposed rule; and(ii) the agency has not given the Director the information required under paragraph (1) with respect to the modified collection of information, at least 60 days before the issuance of the final rule.
-
(C) from disapproving any collection of information contained in a final agency rule, if the Director finds within 60 days after the publication of the final rule that the agency’s response to the Director’s comments filed under paragraph (2) of this subsection was unreasonable; or
-
(i) the Director determines that the agency has substantially modified in the final rule the collection of information contained in the proposed rule; and
-
(ii) the agency has not given the Director the information required under paragraph (1) with respect to the modified collection of information, at least 60 days before the issuance of the final rule.
-
(6) The decision by the Director to approve or not act upon a collection of information contained in an agency rule shall not be subject to judicial review.
-
(1) Any decision by the Director under subsection (c), (d), (h), or (j) to disapprove a collection of information, or to instruct the agency to make substantive or material change to a collection of information, shall be publicly available and include an explanation of the reasons for such decision.
-
(A) any disapproval by the Director, in whole or in part, of a proposed collection of information of that agency; or
-
(2) The agency shall certify each vote to void such disapproval or exercise to the Director, and explain the reasons for such vote. The Director shall without further delay assign a control number to such collection of information, and such vote to void the disapproval or exercise shall be valid for a period of 3 years.
-
(g) The Director may not approve a collection of information for a period in excess of 3 years.
-
(1) If an agency decides to seek extension of the Director’s approval granted for a currently approved collection of information, the agency shall—(A) conduct the review established under section 3506(c), including the seeking of comment from the public on the continued need for, and burden imposed by the collection of information; and(B) after having made a reasonable effort to seek public comment, but no later than 60 days before the expiration date of the control number assigned by the Director for the currently approved collection of information, submit the collection of information for review and approval under this section, which shall include an explanation of how the agency has used the information that it has collected.
-
(B) after having made a reasonable effort to seek public comment, but no later than 60 days before the expiration date of the control number assigned by the Director for the currently approved collection of information, submit the collection of information for review and approval under this section, which shall include an explanation of how the agency has used the information that it has collected.
-
(2) If under the provisions of this section, the Director disapproves a collection of information contained in an existing rule, or recommends or instructs the agency to make a substantive or material change to a collection of information contained in an existing rule, the Director shall—(A) publish an explanation thereof in the Federal Register; and(B) instruct the agency to undertake a rulemaking within a reasonable time limited to consideration of changes to the collection of information contained in the rule and thereafter to submit the collection of information for approval or disapproval under this subchapter.
-
(3) An agency may not make a substantive or material modification to a collection of information after such collection has been approved by the Director, unless the modification has been submitted to the Director for review and approval under this subchapter.
-
(1) If the Director finds that a senior official of an agency designated under section 3506(a) is sufficiently independent of program responsibility to evaluate fairly whether proposed collections of information should be approved and has sufficient resources to carry out this responsibility effectively, the Director may, by rule in accordance with the notice and comment provisions of chapter 5 of title 5, United States Code, delegate to such official the authority to approve proposed collections of information in specific program areas, for specific purposes, or for all agency purposes.
-
(2) A delegation by the Director under this section shall not preclude the Director from reviewing individual collections of information if the Director determines that circumstances warrant such a review. The Director shall retain authority to revoke such delegations, both in general and with regard to any specific matter. In acting for the Director, any official to whom approval authority has been delegated under this section shall comply fully with the rules and regulations promulgated by the Director.
-
(1) The agency head may request the Director to authorize a collection of information, if an agency head determines that—(A) a collection of information—(i) is needed prior to the expiration of time periods established under this subchapter; and(ii) is essential to the mission of the agency; and(B) the agency cannot reasonably comply with the provisions of this subchapter because—(i) public harm is reasonably likely to result if normal clearance procedures are followed;(ii) an unanticipated event has occurred; or(iii) the use of normal clearance procedures is reasonably likely to prevent or disrupt the collection of information or is reasonably likely to cause a statutory or court ordered deadline to be missed.
-
(2) The Director shall approve or disapprove any such authorization request within the time requested by the agency head and, if approved, shall assign the collection of information a control number. Any collection of information conducted under this subsection may be conducted without compliance with the provisions of this subchapter for a maximum of 180 days after the date on which the Director received the request to authorize such collection.
-
Before approving a proposed collection of information, the Director shall determine whether the collection of information by the agency is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility. Before making a determination the Director may give the agency and other interested persons an opportunity to be heard or to submit statements in writing. To the extent, if any, that the Director determines that the collection of information by an agency is unnecessary for any reason, the agency may not engage in the collection of information.
-
The Director may designate a central collection agency to obtain information for two or more agencies if the Director determines that the needs of such agencies for information will be adequately served by a single collection agency, and such sharing of data is not inconsistent with applicable law. In such cases the Director shall prescribe (with reference to the collection of information) the duties and functions of the collection agency so designated and of the agencies for which it is to act as agent (including reimbursement for costs). While the designation is in effect, an agency covered by the designation may not obtain for itself information for the agency which is the duty of the collection agency to obtain. The Director may modify the designation from time to time as circumstances require. The authority to designate under this section is subject to the provisions of section 3507(f) of this subchapter.
-
(1) In consultation with the Director and in accordance with the guidance established under paragraph (2), the head of each agency shall, to the maximum extent practicable, develop and maintain a comprehensive data inventory that accounts for all data assets created by, collected by, under the control or direction of, or maintained by the agency. The head of each agency shall ensure that such inventory provides a clear and comprehensive understanding of the data assets in the possession of the agency.
-
(2) The Director shall establish guidance for agencies to develop and maintain comprehensive data inventories under paragraph (1). Such guidance shall include the following:(A) A requirement for the head of an agency to include in the comprehensive data inventory metadata on each data asset of the agency, including, to the maximum extent practicable, the following:(i) A description of the data asset, including all variable names and definitions.(ii) The name or title of the data asset.(iii) An indication of whether or not the agency—(I) has determined or can determine if the data asset is—(aa) an open Government data asset;(bb) subject to disclosure or partial disclosure or exempt from disclosure under section 552 of title 5;(cc) a public data asset eligible for disclosure under subsection (b); or(dd) a data asset not subject to open format or open license requirements due to existing limitations or restrictions on government distribution of the asset; or(II) as of the date of such indication, has not made such determination.(iv) Any determination made under section 3582, if available.(v) A description of the method by which the public may access or request access to the data asset.(vi) The date on which the data asset was most recently updated.(vii) Each agency responsible for maintaining the data asset.(viii) The owner of the data asset.(ix) To the extent practicable, any restriction on the use of the data asset.(x) The location of the data asset.(xi) Any other metadata necessary to make the comprehensive data inventory useful to the agency and the public, or otherwise determined useful by the Director.(B) A requirement for the head of an agency to exclude from the comprehensive data inventory any data asset contained on a national security system, as defined in section 11103 of title 40.(C) Criteria for the head of an agency to use in determining which metadata required by subparagraph (A), if any, in the comprehensive data inventory may not be made publicly available, which shall include, at a minimum, a requirement to ensure all information that could not otherwise be withheld from disclosure under section 552 of title 5 is made public in the comprehensive data inventory.(D) A requirement for the head of each agency, in accordance with a procedure established by the Director, to submit for inclusion in the Federal data catalogue maintained under subsection (c) the comprehensive data inventory developed pursuant to subparagraph (C), including any real-time updates to such inventory, and data assets made available in accordance with subparagraph (E) or any electronic hyperlink providing access to such data assets.(E) Criteria for the head of an agency to use in determining whether a particular data asset should not be made publicly available in a manner that takes into account—(i) risks and restrictions related to the disclosure of personally identifiable information, including the risk that an individual data asset in isolation does not pose a privacy or confidentiality risk but when combined with other available information may pose such a risk;(ii) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk;(iii) the cost and benefits to the public of converting the data into a format that could be understood and used by the public;(iv) whether the public dissemination of the data asset could result in legal liability;(v) whether the data asset—(II) contains confidential business information, that could be withheld under section 552(b)(4) of title 5; or(III) is restricted by contract or other binding, written agreement;(vi) whether the holder of a right to such data asset has been consulted;(vii) the expectation that all data assets that would otherwise be made available under section 552 of title 5 be disclosed; and(viii) any other considerations that the Director determines to be relevant.(F) Criteria for the head of an agency to use in assessing the indication of a determination under subparagraph (A)(iii) and how to prioritize any such subsequent determinations in the strategic information management plan under section 3506, in consideration of the existing resources available to the agency.
-
(xi) Any other metadata necessary to make the comprehensive data inventory useful to the agency and the public, or otherwise determined useful by the Director.
-
(D) A requirement for the head of each agency, in accordance with a procedure established by the Director, to submit for inclusion in the Federal data catalogue maintained under subsection (c) the comprehensive data inventory developed pursuant to subparagraph (C), including any real-time updates to such inventory, and data assets made available in accordance with subparagraph (E) or any electronic hyperlink providing access to such data assets.
-
(viii) any other considerations that the Director determines to be relevant.
-
(1) The Administrator of General Services shall maintain a single public interface online as a point of entry dedicated to sharing agency data assets with the public, which shall be known as the “Federal data catalogue”. The Administrator and the Director shall ensure that agencies can submit public data assets, or links to public data assets, for publication and public availability on the interface.
-
(2) The Director shall collaborate with the Office of Government Information Services and the Administrator of General Services to develop and maintain an online repository of tools, best practices, and schema standards to facilitate the adoption of open data practices across the Federal Government, which shall—(A) include any definitions, regulations, policies, checklists, and case studies related to open data policy;(B) facilitate collaboration and the adoption of best practices across the Federal Government relating to the adoption of open data practices; and(C) be made available on the Federal data catalogue maintained under paragraph (1).
-
(3) The Director shall ensure the Federal data catalogue maintained under paragraph (1) provides information on how the public can access a data asset included in a comprehensive data inventory under subsection (a) that is not yet available on the Federal data catalogue, including information regarding the application process established under section 3583 of title 44.
-
(d) The Director shall delegate to the Administrator of the Office of Information and Regulatory Affairs and the Administrator of the Office of Electronic Government the authority to jointly issue guidance required under this section.
-
(1) the collection of information does not display a valid control number assigned by the Director in accordance with this subchapter; or
-
(a) In consultation with the Administrator of General Services, the Archivist of the United States, the Director of the National Institute of Standards and Technology, and the Director of the Office of Personnel Management, the Director shall periodically review selected agency information resources management activities to ascertain the efficiency and effectiveness of such activities to improve agency performance and the accomplishment of agency missions.
-
(b) Each agency having an activity reviewed under subsection (a) shall, within 60 days after receipt of a report on the review, provide a written plan to the Director describing steps (including milestones) to—(1) be taken to address information resources management problems identified in the report; and
-
(c) Notwithstanding any other provision of law, the Director shall treat or review a rule or order prescribed or proposed by the Director of the Bureau of Consumer Financial Protection on the same terms and conditions as apply to any rule or order prescribed or proposed by the Board of Governors of the Federal Reserve System.
-
(1) The Director shall—(A) keep the Congress and congressional committees fully and currently informed of the major activities under this subchapter; and(B) submit a report on such activities to the President of the Senate and the Speaker of the House of Representatives annually and at such other times as the Director determines necessary.
-
(B) submit a report on such activities to the President of the Senate and the Speaker of the House of Representatives annually and at such other times as the Director determines necessary.
-
(2) The Director shall include in any such report a description of the extent to which agencies have—(A) reduced information collection burdens on the public, including—(i) a summary of accomplishments and planned initiatives to reduce collection of information burdens;(ii) a list of all violations of this subchapter and of any rules, guidelines, policies, and procedures issued pursuant to this subchapter;(iii) a list of any increase in the collection of information burden, including the authority for each such collection; and(iv) a list of agencies that in the preceding year did not reduce information collection burdens in accordance with section 3505(a)(1), a list of the programs and statutory responsibilities of those agencies that precluded that reduction, and recommendations to assist those agencies to reduce information collection burdens in accordance with that section;(B) improved the quality and utility of statistical information;(C) improved public access to Government information; and(D) improved program performance and the accomplishment of agency missions through information resources management.
-
Upon the request of the Director, each agency (other than an independent regulatory agency) shall, to the extent practicable, make its services, personnel, and facilities available to the Director for the performance of functions under this subchapter.
-
The Director shall promulgate rules, regulations, or procedures necessary to exercise the authority provided by this subchapter.
-
(a) In developing information resources management policies, plans, rules, regulations, procedures, and guidelines and in reviewing collections of information, the Director shall provide interested agencies and persons early and meaningful opportunity to comment.
-
(b) Any person may request the Director to review any collection of information conducted by or for an agency to determine, if, under this subchapter, a person shall maintain, provide, or disclose the information to or for the agency. Unless the request is frivolous, the Director shall, in coordination with the agency responsible for the collection of information—(1) respond to the request within 60 days after receiving the request, unless such period is extended by the Director to a specified date and the person making the request is given notice of such extension; and(2) take appropriate remedial action, if necessary.
-
(a) Except as otherwise provided in this subchapter, the authority of an agency under any other law to prescribe policies, rules, regulations, and procedures for Federal information resources management activities is subject to the authority of the Director under this subchapter.
-
(b) Nothing in this subchapter shall be deemed to affect or reduce the authority of the Secretary of Commerce or the Director of the Office of Management and Budget pursuant to Reorganization Plan No. 1 of 1977 (as amended) and Executive order, relating to telecommunications and information policy, procurement and management of telecommunications and information systems, spectrum use, and related matters.
-
(e) Nothing in this subchapter shall be interpreted as increasing or decreasing the authority of the President, the Office of Management and Budget or the Director thereof, under the laws of the United States, with respect to the substantive policies and programs of departments, agencies and offices, including the substantive authority of any Federal agency to enforce the civil rights laws.
-
Under the conditions and procedures prescribed in section 716 of title 31, the Director and personnel in the Office of Information and Regulatory Affairs shall furnish such information as the Comptroller General may require for the discharge of the responsibilities of the Comptroller General. For the purpose of obtaining such information, the Comptroller General or representatives thereof shall have access to all books, documents, papers and records, regardless of form or format, of the Office.
-
(2) The Director shall select the Chair of the Council from among the members of the Council.
-
(4) The Director shall appoint a representative for all Chief Information Officers and Evaluation Officers, and such representative shall serve as an ex officio member of the Council.
-
(d) The Council shall submit to the Director, the Committee on Homeland Security and Governmental Affairs of the Senate, and the Committee on Oversight and Government Reform of the House of Representatives a biennial report on the work of the Council.
-
(B) shall be in accordance with policies, principles, standards, and guidelines issued by the Director; and
-
(a) The Director shall oversee agency information security policies and practices, including—(1) developing and overseeing the implementation of policies, principles, standards, and guidelines on information security, including through ensuring timely agency adoption of and compliance with standards promulgated under section 11331 of title 40;(2) requiring agencies, consistent with the standards promulgated under such section 11331 and the requirements of this subchapter, to identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of—(A) information collected or maintained by or on behalf of an agency; or(B) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;(3) ensuring that the Secretary carries out the authorities and functions under subsection (b);(4) coordinating the development of standards and guidelines under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3) with agencies and offices operating or exercising control of national security systems (including the National Security Agency) to assure, to the maximum extent feasible, that such standards and guidelines are complementary with standards and guidelines developed for national security systems;(5) overseeing agency compliance with the requirements of this subchapter and section 1326 of title 41, including through any authorized action under section 11303 of title 40, to enforce accountability for compliance with such requirements; and(6) coordinating information security policies and procedures with related information resources management policies and procedures.
-
(b) The Secretary, in consultation with the Director, shall administer the implementation of agency information security policies and practices for information systems, except for national security systems and information systems described in paragraph (2) or (3) of subsection (e), including—(1) assisting the Director in carrying out the authorities and functions under paragraphs (1), (2), (3), (5), and (6) of subsection (a);(2) developing and overseeing the implementation of binding operational directives to agencies to implement the policies, principles, standards, and guidelines developed by the Director under subsection (a)(1) and the requirements of this subchapter, which may be revised or repealed by the Director if the operational directives issued on behalf of the Director are not in accordance with policies, principles, standards, and guidelines developed by the Director, including—(A) requirements for reporting security incidents to the Federal information security incident center established under section 3556;(B) requirements for the contents of the annual reports required to be submitted under section 3554(c)(1);(C) requirements for the mitigation of exigent risks to information systems; and(D) other operational requirements as the Director or Secretary, in consultation with the Director, may determine necessary;(3) monitoring agency implementation of information security policies and practices;(4) convening meetings with senior agency officials to help ensure effective implementation of information security policies and practices;(5) coordinating Government-wide efforts on information security policies and practices, including consultation with the Chief Information Officers Council established under section 3603 and the Director of the National Institute of Standards and Technology;(6) providing operational and technical assistance to agencies in implementing policies, principles, standards, and guidelines on information security, including implementation of standards promulgated under section 11331 of title 40, including by—(A) operating the Federal information security incident center established under section 3556;(B) upon request by an agency, deploying, operating, and maintaining technology to assist the agency to continuously diagnose and mitigate against cyber threats and vulnerabilities, with or without reimbursement;(C) compiling and analyzing data on agency information security; and(D) developing and conducting targeted operational evaluations, including threat and vulnerability assessments, on the information systems;(7) hunting for and identifying, with or without advance notice to or authorization from agencies, threats and vulnerabilities within Federal information systems;(A) providing services, functions, and capabilities, including operation of the agency’s information security program, to assist the agency with meeting the requirements set forth in section 3554(b); and
-
(2) developing and overseeing the implementation of binding operational directives to agencies to implement the policies, principles, standards, and guidelines developed by the Director under subsection (a)(1) and the requirements of this subchapter, which may be revised or repealed by the Director if the operational directives issued on behalf of the Director are not in accordance with policies, principles, standards, and guidelines developed by the Director, including—(A) requirements for reporting security incidents to the Federal information security incident center established under section 3556;(B) requirements for the contents of the annual reports required to be submitted under section 3554(c)(1);(C) requirements for the mitigation of exigent risks to information systems; and
-
(5) coordinating Government-wide efforts on information security policies and practices, including consultation with the Chief Information Officers Council established under section 3603 and the Director of the National Institute of Standards and Technology;
-
(c) Not later than March 1 of each year, the Director, in consultation with the Secretary, shall submit to Congress a report on the effectiveness of information security policies and practices during the preceding year, including—(1) a summary of the incidents described in the annual reports required to be submitted under section 3554(c)(1), including a summary of the information required under section 3554(c)(1)(A)(iii);(2) a description of the threshold for reporting major information security incidents;(3) a summary of the results of evaluations required to be performed under section 3555;(4) an assessment of agency compliance with standards promulgated under section 11331 of title 40; and
-
(d) Except for the authorities and functions described in subsection (a)(5) and subsection (c), the authorities and functions of the Director and the Secretary under this section shall not apply to national security systems.
-
(1) The authorities of the Director described in paragraphs (1) and (2) of subsection (a) shall be delegated to the Secretary of Defense in the case of systems described in paragraph (2) and to the Director of National Intelligence in the case of systems described in paragraph (3).
-
(A) consult with the Director of the National Institute of Standards and Technology regarding any binding operational directive that implements standards and guidelines developed by the National Institute of Standards and Technology; and
-
(A) in coordination with the Director, and in consultation with Federal contractors as appropriate, establish procedures governing the circumstances under which a directive may be issued under this subsection, which shall include—(i) thresholds and other criteria;(ii) privacy and civil liberties protections; and(iii) providing notice to potentially affected third parties;
-
(E) consult with the Director of the National Institute of Standards and Technology regarding any directive under this subsection that implements standards and guidelines developed by the National Institute of Standards and Technology;
-
(iv) the Secretary provides prior notice to the Director, and the head and chief information officer (or equivalent official) of each agency to which specific actions will be taken pursuant to this paragraph, and notifies the appropriate congressional committees and authorizing committees of each such agency within 7 days of taking an action under this paragraph of—(I) any action taken under this paragraph; and(II) the reasons for and duration and nature of the action;
-
(C) The Secretary shall, in coordination with the Director, and in consultation with the heads of Federal agencies, establish procedures governing the circumstances under which the Secretary may authorize the use of the intrusion detection and prevention capabilities under subparagraph (A). The Secretary shall submit the procedures to Congress.
-
(i) Not later than February 1 of each year, the Director and the Secretary shall submit to the appropriate congressional committees a report regarding the specific actions the Director and the Secretary have taken pursuant to subsection (a)(5), including any actions taken pursuant to section 11303(b)(5) of title 40.
-
(iii) policies and procedures issued by the Director;
-
(ii) policies and procedures as may be prescribed by the Director, and information security standards promulgated under section 11331 of title 40;
-
(A) Each agency shall submit to the Director, the Secretary, the Committee on Government Reform, the Committee on Homeland Security, and the Committee on Science of the House of Representatives, the Committee on Homeland Security and Governmental Affairs and the Committee on Commerce, Science, and Transportation of the Senate, the appropriate authorization and appropriations committees of Congress, and the Comptroller General a report on the adequacy and effectiveness of information security policies, procedures, and practices, including—(i) a description of each major information security incident or related sets of incidents, including summaries of—(I) the threats and threat actors, vulnerabilities, and impacts relating to the incident;(II) the risk assessments conducted under section 3554(a)(2)(A) of the affected information systems before the date on which the incident occurred;(III) the status of compliance of the affected information systems with applicable security requirements at the time of the incident; and(IV) the detection, response, and remediation actions;(ii) the total number of information security incidents, including a description of incidents resulting in significant compromise of information security, system impact levels, types of incident, and locations of affected systems;(iii) a description of each major information security incident that involved a breach of personally identifiable information, as defined by the Director, including—(I) the number of individuals whose information was affected by the major information security incident; and(II) a description of the information that was breached or exposed; and
-
(iii) a description of each major information security incident that involved a breach of personally identifiable information, as defined by the Director, including—(I) the number of individuals whose information was affected by the major information security incident; and(II) a description of the information that was breached or exposed; and
-
(1) In addition to the requirements of subsection (c), each agency, in consultation with the Director, shall include as part of the performance plan required under section 1115 of title 31 a description of—(A) the time periods; and(B) the resources, including budget, staffing, and training,that are necessary to implement the program required under subsection (b).
-
(2) To the extent an evaluation required under this section directly relates to a national security system, the evaluation results submitted to the Director shall contain only a summary and assessment of that portion of the evaluation directly relating to a national security system.
-
(1) The Director shall summarize the results of the evaluations conducted under this section in the report to Congress required under section 3553(c).
-
(2) The Director’s report to Congress under this subsection shall summarize information regarding information security relating to national security systems in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws.
-
(3) Evaluations and any other descriptions of information systems under the authority and control of the Director of National Intelligence or of National Foreign Intelligence Programs systems under the authority and control of the Secretary of Defense shall be made available to Congress only through the appropriate oversight committees of Congress, in accordance with applicable laws.
-
(j) The Director, in consultation with the Secretary, the Chief Information Officers Council established under section 3603, the Council of the Inspectors General on Integrity and Efficiency, and other interested parties as appropriate, shall ensure the development of guidance for evaluating the effectiveness of an information security program and practices.
-
Nothing in this subchapter, section 11331 of title 40, or section 20 of the National Standards1 and Technology Act (15 U.S.C. 278g–3) may be construed as affecting the authority of the President, the Office of Management and Budget or the Director thereof, the National Institute of Standards and Technology, or the head of any agency, with respect to the authorized use or disclosure of information, including with regard to the protection of personal privacy under section 552a of title 5, the disclosure of information under section 552 of title 5, the management and disposition of records under chapters2 29, 31, or 33 of title 44, the management of information resources under subchapter I of chapter 35 of this title, or the disclosure of information to the Congress or the Comptroller General of the United States.
-
(11) The term “statistical agency or unit” means an agency or organizational unit of the executive branch whose activities are predominantly the collection, compilation, processing, or analysis of information for statistical purposes, as designated by the Director under section 3562.
-
(a) The Director shall coordinate and oversee the confidentiality and disclosure policies established by this subchapter. The Director may promulgate rules or provide other guidance to ensure consistent interpretation of this subchapter by the affected agencies. The Director shall develop a process by which the Director designates agencies or organizational units as statistical agencies and units. The Director shall promulgate guidance to implement such process, which shall include specific criteria for such designation and methods by which the Director will ensure transparency in the process.
-
(2) Each Designated Statistical Agency (as defined in section 3576(e)) shall report annually to the Director, the Committee on Oversight and Government Reform of the House of Representatives, and the Committee on Homeland Security and Governmental Affairs of the Senate on the actions it has taken to implement section 3576. The report shall include copies of each written agreement entered into pursuant to section 3576(c)(1) for the applicable year.
-
(3) The Director shall include a summary of reports submitted to the Director under this subsection and actions taken by the Director to advance the purposes of this subchapter in the annual report to Congress on statistical programs prepared under section 3504(e)(2).
-
(c) The Director shall prescribe regulations to carry out this section.
-
(a) This subchapter does not diminish the authority under section 3510 of the Director to direct, and of an agency to make, disclosures that are not inconsistent with any applicable law.
-
(c) The Director shall prescribe regulations for agencies to carry out this section. Such regulations shall—(1) require the timely provision of data assets under subsection (a);(2) provide a list of statutes that exempt agencies from the requirement under subsection (a) pursuant to subsection (b)(1);(3) establish clear and consistent standards, to the extent possible, for complying with section 552a of title 5 (commonly known as the “Privacy Act of 1974”) and any other applicable law requiring the protection and confidentiality of individually identifiable information; and(4) require a transparent process for statistical agencies and units to request data assets from agencies and for agencies to respond to such requests.
-
(b) The Director shall promulgate regulations, in accordance with applicable law, for statistical agencies and units to carry out the requirement under subsection (a). Such regulations shall include the following:(1) Standards for each statistical agency or unit to assess each data asset owned or accessed by the statistical agency or unit for purposes of categorizing the sensitivity level of each such asset and identifying the corresponding level of accessibility to each such asset. Such standards shall include—(A) common sensitivity levels and corresponding levels of accessibility that may be assigned to a data asset, including a requisite minimum and maximum number of sensitivity levels for each statistical agency or unit to use;(B) criteria for determining the sensitivity level and corresponding level of accessibility of each data asset; and(C) criteria for determining whether a less sensitive and more accessible version of a data asset can be produced.(2) Standards for each statistical agency or unit to improve access to a data asset pursuant to paragraph (1) or (3) by removing or obscuring information in such a manner that the identity of the data subject is less likely to be reasonably inferred by either direct or indirect means.(3) A requirement for each statistical agency or unit to conduct a comprehensive risk assessment of any data asset acquired or accessed under this subchapter prior to any public release of such asset, including standards for such comprehensive risk assessment and criteria for making a determination of whether to release the data.(4) Requirements for each statistical agency or unit to make any process or assessment established, produced, or conducted pursuant to this section transparent and easy to understand, including the following:(A) A requirement to make information on the assessment of the sensitivity level of each data asset conducted pursuant to paragraph (1) available on the Federal data catalogue established under section 3511(c)(1).(B) A requirement to make any comprehensive risk assessment, and associated determinations, conducted under paragraph (3) available on the Federal data catalogue established under section 3511(c)(1).
-
(c) The Director shall—(1) make public all standards and policies established under this section; and(2) ensure that statistical agencies and units have the ability to make information public on the Federal data catalogue established under section 3511(c)(1), in accordance with requirements established pursuant to subsection (b).
-
(a) The Director shall establish a process through which agencies, the Congressional Budget Office, State, local, and Tribal governments, researchers, and other individuals, as appropriate, may apply to access the data assets accessed or acquired under this subchapter by a statistical agency or unit for purposes of developing evidence. The process shall include the following:(1) Sufficient detail to ensure that each statistical agency or unit establishes an identical process.(2) A common application form.(3) Criteria for statistical agencies and units to determine whether to grant an applicant access to a data asset.(4) Timeframes for prompt determinations by each statistical agency or unit.(5) An appeals process for adverse decisions and noncompliance with the process established under this subsection.(6) Standards for transparency, including requirements to make the following information publicly available:(A) Each application received.(B) The status of each application.(C) The determination made for each application.(D) Any other information, as appropriate, to ensure full transparency of the process established under this subsection.
-
(b) In establishing the process required under subsection (a), the Director shall consult with stakeholders, including the public, agencies, State and local governments, and representatives of non-governmental researchers.
Citations to §3502(5)
-
(1) An independent regulatory agency which is administered by 2 or more members of a commission, board, or similar body, may by majority vote void—(A) any disapproval by the Director, in whole or in part, of a proposed collection of information of that agency; or(B) an exercise of authority under subsection (d) of section 3507 concerning that agency.
-
Upon the request of the Director, each agency (other than an independent regulatory agency) shall, to the extent practicable, make its services, personnel, and facilities available to the Director for the performance of functions under this subchapter.
Citations to §3502(6)
-
(1) The Director shall oversee the use of information resources to improve the efficiency and effectiveness of governmental operations to serve agency missions, including burden reduction and service delivery to the public. In performing such oversight, the Director shall—(A) develop, coordinate and oversee the implementation of Federal information resources management policies, principles, standards, and guidelines; and(B) provide direction and oversee—(i) the review and approval of the collection of information and the reduction of the information collection burden;(ii) agency dissemination of and public access to information;(iii) statistical activities;(iv) records management activities;(v) privacy, confidentiality, security, disclosure, and sharing of information; and(vi) the acquisition and use of information technology, including alternative information technologies that provide for electronic submission, maintenance, or disclosure of information as a substitute for paper and for the use and acceptance of electronic signatures.
-
(A) a description of the objectives and the means by which the Federal Government shall apply information resources to improve agency and program performance;
-
(i) preparation and maintenance of the inventory of information resources under section 3506(b)(4);
-
(4) Each agency program official shall be responsible and accountable for information resources assigned to and supporting the programs under such official. In consultation with the Chief Information Officer designated under paragraph (2) and the agency Chief Financial Officer (or comparable official), each agency program official shall define program information needs and develop strategies, systems, and capabilities to meet those needs.
-
(1) manage information resources to—(A) reduce information collection burdens on the public;(B) increase program efficiency and effectiveness; and(C) improve the integrity, quality, and utility of information to all users within and outside the agency, including capabilities for ensuring dissemination of public information, public access to government information, and protections for privacy and security;
-
(4) in consultation with the Director, the Administrator of General Services, and the Archivist of the United States, maintain a current and complete inventory of the agency’s information resources, including directories necessary to fulfill the requirements of section 3511 of this subchapter;
-
(1) provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support Federal operations and assets;
-
Nothing in this subchapter, section 11331 of title 40, or section 20 of the National Standards1 and Technology Act (15 U.S.C. 278g–3) may be construed as affecting the authority of the President, the Office of Management and Budget or the Director thereof, the National Institute of Standards and Technology, or the head of any agency, with respect to the authorized use or disclosure of information, including with regard to the protection of personal privacy under section 552a of title 5, the disclosure of information under section 552 of title 5, the management and disposition of records under chapters2 29, 31, or 33 of title 44, the management of information resources under subchapter I of chapter 35 of this title, or the disclosure of information to the Congress or the Comptroller General of the United States.
-
(B) includes the development, implementation, or maintenance of methods, technical or administrative procedures, or information resources that support the purposes described in subparagraph (A).
Citations to §3502(7)
-
(3) coordinate, integrate, and to the extent practicable and appropriate, make uniform Federal information resources management policies and practices as a means to improve the productivity, efficiency, and effectiveness of Government programs, including the reduction of information collection burdens on the public and the improvement of service delivery to the public;
-
(11) improve the responsibility and accountability of the Office of Management and Budget and all other Federal agencies to Congress and to the public for implementing the information collection review process, information resources management, and related policies and guidelines established under this subchapter.
-
(b) There shall be at the head of the Office an Administrator who shall be appointed by the President, by and with the advice and consent of the Senate. The Director shall delegate to the Administrator the authority to administer all functions under this subchapter, except that any such delegation shall not relieve the Director of responsibility for the administration of such functions. The Administrator shall serve as principal adviser to the Director on Federal information resources management policy.
-
(A) develop, coordinate and oversee the implementation of Federal information resources management policies, principles, standards, and guidelines; and
-
(b) With respect to general information resources management policy, the Director shall—(1) develop and oversee the implementation of uniform information resources management policies, principles, standards, and guidelines;(2) foster greater sharing, dissemination, and access to public information, including through—(A) the use of comprehensive data inventories and the Federal data catalogue under section 3511; and(B) the development and utilization of common standards for information collection, storage, processing and communication, including standards for security, interconnectivity and interoperability;(3) initiate and review proposals for changes in legislation, regulations, and agency procedures to improve information resources management practices;(4) oversee the development and implementation of best practices in information resources management, including training;(5) oversee agency integration of program and management functions with information resources management functions; and(6) issue guidance for agencies to implement section 3506(b)(6) in a manner that takes into account—(A) risks and restrictions related to the disclosure of personally identifiable information, including the risk that an individual data asset in isolation does not pose a privacy or confidentiality risk but when combined with other available information may pose such a risk;(B) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk;(C) the cost and benefits to the public of converting a data asset into a machine-readable format that is accessible and useful to the public;(D) whether the application of the requirements described in such section to a data asset could result in legal liability;(E) a determination of whether a data asset—(ii) contains confidential business information, that could be withheld under section 552(b)(4) of title 5; or(iii) is otherwise restricted by contract or other binding, written agreement;(F) the requirement that a data asset be disclosed, if it would otherwise be made available under section 552 of title 5 (commonly known as the “Freedom of Information Act”); and(G) any other considerations that the Director determines to be relevant.
-
(1) develop and oversee the implementation of uniform information resources management policies, principles, standards, and guidelines;
-
(3) initiate and review proposals for changes in legislation, regulations, and agency procedures to improve information resources management practices;
-
(4) oversee the development and implementation of best practices in information resources management, including training;
-
(5) oversee agency integration of program and management functions with information resources management functions; and
-
(1) provide advice and assistance to the Archivist of the United States and the Administrator of General Services to promote coordination in the administration of chapters 29, 31, and 33 of this title with the information resources management policies, principles, standards, and guidelines established under this subchapter;
-
(4) ensure, through the review of agency budget proposals, information resources management plans and other means—(A) agency integration of information resources management plans, program plans and budgets for acquisition and use of information technology; and(B) the efficiency and effectiveness of inter-agency information technology initiatives to improve agency performance and the accomplishment of agency missions; and
-
(A) agency integration of information resources management plans, program plans and budgets for acquisition and use of information technology; and
-
(B) improve information resources management in ways that increase the productivity, efficiency and effectiveness of Federal programs, including service delivery to the public;
-
(3) in consultation with the Administrator of General Services, the Director of the National Institute of Standards and Technology, the Archivist of the United States, and the Director of the Office of Personnel Management, develop and maintain a Governmentwide strategic plan for information resources management, that shall include—(A) a description of the objectives and the means by which the Federal Government shall apply information resources to improve agency and program performance;(B) plans for—(i) reducing information burdens on the public, including reducing such burdens through the elimination of duplication and meeting shared data needs with shared resources;(ii) enhancing public access to and dissemination of, information, using electronic and other formats; and(iii) meeting the information technology needs of the Federal Government in accordance with the purposes of this subchapter; and(C) a description of progress in applying information resources management to improve agency performance and the accomplishment of missions.
-
(C) a description of progress in applying information resources management to improve agency performance and the accomplishment of missions.
-
(C) used to support information resources management, including—(i) preparation and maintenance of the inventory of information resources under section 3506(b)(4);(ii) information technology planning, budgeting, acquisition, and management under section 3506(h), subtitle III of title 40, and related laws and guidance;(iii) monitoring, testing, and evaluation of information security controls under subchapter II;(iv) preparation of the index of major information systems required under section 552(g) of title 5, United States Code; and(v) preparation of information system inventories required for records management under chapters 21, 29, 31, and 33.
-
(A) carrying out the agency’s information resources management activities to improve agency productivity, efficiency, and effectiveness; and
-
(3) The Chief Information Officer designated under paragraph (2) shall head an office responsible for ensuring agency compliance with and prompt, efficient, and effective implementation of the information policies and information resources management responsibilities established under this subchapter, including the reduction of information collection burdens on the public. The Chief Information Officer and employees of such office shall be selected with special attention to the professional qualifications required to administer the functions described under this subchapter.
-
(b) With respect to general information resources management, each agency shall—(1) manage information resources to—(A) reduce information collection burdens on the public;(B) increase program efficiency and effectiveness; and(C) improve the integrity, quality, and utility of information to all users within and outside the agency, including capabilities for ensuring dissemination of public information, public access to government information, and protections for privacy and security;(2) in accordance with guidance by the Director, develop and maintain a strategic information resources management plan that, to the extent practicable—(A) describes how information resources management activities help accomplish agency missions;(i) requires the agency to develop processes and procedures that—(I) require data collection mechanisms created on or after the date of the enactment of the OPEN Government Data Act to be available in an open format; and(II) facilitate collaboration with non-Government entities (including businesses), researchers, and the public for the purpose of understanding how data users value and use government data;(ii) identifies and implements methods for collecting and analyzing digital information on data asset usage by users within and outside of the agency, including designating a point of contact within the agency to assist the public and to respond to quality issues, usability issues, recommendations for improvements, and complaints about adherence to open data requirements within a reasonable period of time;(iii) develops and implements a process to evaluate and improve the timeliness, completeness, consistency, accuracy, usefulness, and availability of open Government data assets;(iv) includes requirements for meeting the goals of the agency open data plan, including the acquisition of technology, provision of training for employees, and the implementation of procurement standards, in accordance with existing law, regulation, and policy, that allow for the acquisition of innovative solutions from public and private sectors;(v) identifies as priority data assets any data asset for which disclosure would be in the public interest and establishes a plan to evaluate each priority data asset for disclosure on the Federal Data Catalogue under section 3511 and for a determination under1 3511(a)(2)(A)(iii)(I)(bb), including an accounting of which priority data assets have not yet been evaluated; and(vi) requires the agency to comply with requirements under section 3511, including any standards established by the Director under such section, when disclosing a data asset pursuant to such section; and(C) is updated annually and made publicly available on the website of the agency not later than 5 days after each such update;(3) develop and maintain an ongoing process to—(A) ensure that information resources management operations and decisions are integrated with organizational planning, budget, financial management, human resources management, and program decisions;(B) in cooperation with the agency Chief Financial Officer (or comparable official), develop a full and accurate accounting of information technology expenditures, related expenses, and results; and(C) establish goals for improving information resources management’s contribution to program productivity, efficiency, and effectiveness, methods for measuring progress towards those goals, and clear roles and responsibilities for achieving those goals;(4) in consultation with the Director, the Administrator of General Services, and the Archivist of the United States, maintain a current and complete inventory of the agency’s information resources, including directories necessary to fulfill the requirements of section 3511 of this subchapter;(5) in consultation with the Director and the Director of the Office of Personnel Management, conduct formal training programs to educate agency program and management officials about information resources management; and(6) in accordance with guidance by the Director—(A) make each data asset of the agency available in an open format; and(B) make each public data asset of the agency available—(i) as an open Government data asset; and(ii) under an open license.
-
(2) in accordance with guidance by the Director, develop and maintain a strategic information resources management plan that, to the extent practicable—(A) describes how information resources management activities help accomplish agency missions;(i) requires the agency to develop processes and procedures that—(I) require data collection mechanisms created on or after the date of the enactment of the OPEN Government Data Act to be available in an open format; and(II) facilitate collaboration with non-Government entities (including businesses), researchers, and the public for the purpose of understanding how data users value and use government data;(ii) identifies and implements methods for collecting and analyzing digital information on data asset usage by users within and outside of the agency, including designating a point of contact within the agency to assist the public and to respond to quality issues, usability issues, recommendations for improvements, and complaints about adherence to open data requirements within a reasonable period of time;(iii) develops and implements a process to evaluate and improve the timeliness, completeness, consistency, accuracy, usefulness, and availability of open Government data assets;(iv) includes requirements for meeting the goals of the agency open data plan, including the acquisition of technology, provision of training for employees, and the implementation of procurement standards, in accordance with existing law, regulation, and policy, that allow for the acquisition of innovative solutions from public and private sectors;(v) identifies as priority data assets any data asset for which disclosure would be in the public interest and establishes a plan to evaluate each priority data asset for disclosure on the Federal Data Catalogue under section 3511 and for a determination under1 3511(a)(2)(A)(iii)(I)(bb), including an accounting of which priority data assets have not yet been evaluated; and(vi) requires the agency to comply with requirements under section 3511, including any standards established by the Director under such section, when disclosing a data asset pursuant to such section; and(C) is updated annually and made publicly available on the website of the agency not later than 5 days after each such update;
-
(A) describes how information resources management activities help accomplish agency missions;
-
(A) ensure that information resources management operations and decisions are integrated with organizational planning, budget, financial management, human resources management, and program decisions;
-
(C) establish goals for improving information resources management’s contribution to program productivity, efficiency, and effectiveness, methods for measuring progress towards those goals, and clear roles and responsibilities for achieving those goals;
-
(5) in consultation with the Director and the Director of the Office of Personnel Management, conduct formal training programs to educate agency program and management officials about information resources management; and
-
(a) In consultation with the Administrator of General Services, the Archivist of the United States, the Director of the National Institute of Standards and Technology, and the Director of the Office of Personnel Management, the Director shall periodically review selected agency information resources management activities to ascertain the efficiency and effectiveness of such activities to improve agency performance and the accomplishment of agency missions.
-
(1) be taken to address information resources management problems identified in the report; and
-
(D) improved program performance and the accomplishment of agency missions through information resources management.
-
(a) In developing information resources management policies, plans, rules, regulations, procedures, and guidelines and in reviewing collections of information, the Director shall provide interested agencies and persons early and meaningful opportunity to comment.
-
(a) Except as otherwise provided in this subchapter, the authority of an agency under any other law to prescribe policies, rules, regulations, and procedures for Federal information resources management activities is subject to the authority of the Director under this subchapter.
-
(6) coordinating information security policies and procedures with related information resources management policies and procedures.
Citations to §3502(8)
-
(ii) test the effectiveness of information security control techniques of an appropriate subset of the contractor’s information systems (as defined in section 3502(8) of title 44) relating to such functions under this subchapter and an assessment of compliance with the requirements of this subsection and related information security policies, procedures, standards and guidelines, including policies and procedures as may be prescribed by the Director of the Office of Management and Budget and applicable information security standards promulgated under section 11331 of title 40.1
-
(3) oversee the application of records management policies, principles, standards, and guidelines, including requirements for archiving information maintained in electronic format, in the planning and design of information systems.
-
(A) develop and oversee the implementation of policies, principles, standards, and guidelines for information technology functions and activities of the Federal Government, including periodic evaluations of major information systems; and
-
(1) The head of each agency shall develop and maintain an inventory of major information systems (including major national security systems) operated by or under the control of such agency.
-
(2) The identification of information systems in an inventory under this subsection shall include an identification of the interfaces between each such system and all other systems or networks, including those not operated by or under the control of the agency.
-
(iv) preparation of the index of major information systems required under section 552(g) of title 5, United States Code; and
-
(v) preparation of information system inventories required for records management under chapters 21, 29, 31, and 33.
-
(f) With respect to records management, each agency shall implement and enforce applicable policies and procedures, including requirements for archiving information maintained in electronic format, particularly in the planning, design and operation of information systems.
-
(5) assume responsibility for maximizing the value and assessing and managing the risks of major information systems initiatives through a process that is—(A) integrated with budget, financial, and program management decisions; and(B) used to select, control, and evaluate the results of major information systems initiatives.
-
(B) used to select, control, and evaluate the results of major information systems initiatives.
-
(b) Nothing in this subchapter shall be deemed to affect or reduce the authority of the Secretary of Commerce or the Director of the Office of Management and Budget pursuant to Reorganization Plan No. 1 of 1977 (as amended) and Executive order, relating to telecommunications and information policy, procurement and management of telecommunications and information systems, spectrum use, and related matters.
-
(3) provide for development and maintenance of minimum controls required to protect Federal information and information systems;
-
(A) is for purposes of safeguarding Federal information and information systems from a known or reasonably suspected information security threat, vulnerability, or risk;
-
(A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or
-
(3) The term “information security” means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—(A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;(B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and(C) availability, which means ensuring timely and reliable access to and use of information.
-
(A) The term “national security system” means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency—(i) the function, operation, or use of which—(I) involves intelligence activities;(II) involves cryptologic activities related to national security;(III) involves command and control of military forces;(IV) involves equipment that is an integral part of a weapon or weapons system; or(V) subject to subparagraph (B), is critical to the direct fulfillment of military or intelligence missions; or(ii) is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.
-
(B) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;
-
(b) The Secretary, in consultation with the Director, shall administer the implementation of agency information security policies and practices for information systems, except for national security systems and information systems described in paragraph (2) or (3) of subsection (e), including—(1) assisting the Director in carrying out the authorities and functions under paragraphs (1), (2), (3), (5), and (6) of subsection (a);(2) developing and overseeing the implementation of binding operational directives to agencies to implement the policies, principles, standards, and guidelines developed by the Director under subsection (a)(1) and the requirements of this subchapter, which may be revised or repealed by the Director if the operational directives issued on behalf of the Director are not in accordance with policies, principles, standards, and guidelines developed by the Director, including—(A) requirements for reporting security incidents to the Federal information security incident center established under section 3556;(B) requirements for the contents of the annual reports required to be submitted under section 3554(c)(1);(C) requirements for the mitigation of exigent risks to information systems; and(D) other operational requirements as the Director or Secretary, in consultation with the Director, may determine necessary;(3) monitoring agency implementation of information security policies and practices;(4) convening meetings with senior agency officials to help ensure effective implementation of information security policies and practices;(5) coordinating Government-wide efforts on information security policies and practices, including consultation with the Chief Information Officers Council established under section 3603 and the Director of the National Institute of Standards and Technology;(6) providing operational and technical assistance to agencies in implementing policies, principles, standards, and guidelines on information security, including implementation of standards promulgated under section 11331 of title 40, including by—(A) operating the Federal information security incident center established under section 3556;(B) upon request by an agency, deploying, operating, and maintaining technology to assist the agency to continuously diagnose and mitigate against cyber threats and vulnerabilities, with or without reimbursement;(C) compiling and analyzing data on agency information security; and(D) developing and conducting targeted operational evaluations, including threat and vulnerability assessments, on the information systems;(7) hunting for and identifying, with or without advance notice to or authorization from agencies, threats and vulnerabilities within Federal information systems;(A) providing services, functions, and capabilities, including operation of the agency’s information security program, to assist the agency with meeting the requirements set forth in section 3554(b); and
-
(C) requirements for the mitigation of exigent risks to information systems; and
-
(D) developing and conducting targeted operational evaluations, including threat and vulnerability assessments, on the information systems;
-
(7) hunting for and identifying, with or without advance notice to or authorization from agencies, threats and vulnerabilities within Federal information systems;
-
(A) Subject to subparagraph (B), in response to a known or reasonably suspected information security threat, vulnerability, or incident that represents a substantial threat to the information security of an agency, the Secretary may issue an emergency directive to the head of an agency to take any lawful action with respect to the operation of the information system, including such systems used or operated by another entity on behalf of an agency, that collects, processes, stores, transmits, disseminates, or otherwise maintains agency information, for the purpose of protecting the information system from, or mitigating, an information security threat.
-
(i) adopting the least intrusive means possible under the circumstances to secure the agency information systems; and
-
(A) Notwithstanding section 3554, the Secretary may authorize the use under this subsection of the intrusion detection and prevention capabilities established under section 230(b)(1)1 of the Homeland Security Act of 2002 for the purpose of ensuring the security of agency information systems, if—(i) the Secretary determines there is an imminent threat to agency information systems;(ii) the Secretary determines a directive under subsection (b)(2)(C) or paragraph (1)(A) is not reasonably likely to result in a timely response to the threat;(iii) the Secretary determines the risk posed by the imminent threat outweighs any adverse consequences reasonably expected to result from the use of the intrusion detection and prevention capabilities under the control of the Secretary;(iv) the Secretary provides prior notice to the Director, and the head and chief information officer (or equivalent official) of each agency to which specific actions will be taken pursuant to this paragraph, and notifies the appropriate congressional committees and authorizing committees of each such agency within 7 days of taking an action under this paragraph of—(I) any action taken under this paragraph; and(II) the reasons for and duration and nature of the action;(v) the action of the Secretary is consistent with applicable law; and(vi) the Secretary authorizes the use of the intrusion detection and prevention capabilities in accordance with the advance procedures established under subparagraph (C).
-
(i) the Secretary determines there is an imminent threat to agency information systems;
-
(ii) that portion of an information system used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.
-
(1) Notwithstanding any other provision of law, including any provision of law that would otherwise restrict or prevent the head of an agency from disclosing information to the Secretary, the Secretary in carrying out this section and title XXII of the Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) may access, use, retain, and disclose, and the head of an agency may disclose to the Secretary, information, for the purpose of protecting information and information systems from cybersecurity risks.
-
(2) Paragraph (1) shall not apply to national security systems or to information systems described in paragraph (2) or (3) of subsection (e).
-
(ii) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;
-
(2) ensure that senior agency officials provide information security for the information and information systems that support the operations and assets under their control, including through—(A) assessing the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of such information or information systems;(B) determining the levels of information security appropriate to protect such information and information systems in accordance with standards promulgated under section 11331 of title 40, for information security classifications and related requirements;(C) implementing policies and procedures to cost-effectively reduce risks to an acceptable level; and(D) periodically testing and evaluating information security controls and techniques to ensure that they are effectively implemented;
-
(A) assessing the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of such information or information systems;
-
(B) determining the levels of information security appropriate to protect such information and information systems in accordance with standards promulgated under section 11331 of title 40, for information security classifications and related requirements;
-
(b) Each agency shall develop, document, and implement an agency-wide information security program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source, that includes—(1) periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency, which may include using automated tools consistent with standards and guidelines promulgated under section 11331 of title 40;(2) policies and procedures that—(A) are based on the risk assessments required by paragraph (1);(B) cost-effectively reduce information security risks to an acceptable level;(C) ensure that information security is addressed throughout the life cycle of each agency information system; and(D) ensure compliance with—(i) the requirements of this subchapter;(ii) policies and procedures as may be prescribed by the Director, and information security standards promulgated under section 11331 of title 40;(iii) minimally acceptable system configuration requirements, as determined by the agency; and(iv) any other applicable requirements, including standards and guidelines for national security systems issued in accordance with law and as directed by the President;(3) subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate;(4) security awareness training to inform personnel, including contractors and other users of information systems that support the operations and assets of the agency, of—(A) information security risks associated with their activities; and(B) their responsibilities in complying with agency policies and procedures designed to reduce these risks;(5) periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, of which such testing—(A) shall include testing of management, operational, and technical controls of every information system identified in the inventory required under section 3505(c);1(B) may include testing relied on in an evaluation under section 3555; and(C) shall include using automated tools, consistent with standards and guidelines promulgated under section 11331 of title 40;(6) a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency;(7) procedures for detecting, reporting, and responding to security incidents, which—(A) shall be consistent with the standards and guidelines described in section 3556(b);(B) may include using automated tools; and(C) shall include—(i) mitigating risks associated with such incidents before substantial damage is done;(ii) notifying and consulting with the Federal information security incident center established in section 3556; and(iii) notifying and consulting with, as appropriate—(I) law enforcement agencies and relevant Offices of Inspector General and Offices of General Counsel;(II) an office designated by the President for any incident involving a national security system;(III) for a major incident, the committees of Congress described in subsection (c)(1)—(aa) not later than 7 days after the date on which there is a reasonable basis to conclude that the major incident has occurred; and(bb) after the initial notification under item (aa), within a reasonable period of time after additional information relating to the incident is discovered, including the summary required under subsection (c)(1)(A)(i); and(IV) any other agency or office, in accordance with law or as directed by the President; and(8) plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.
-
(1) periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency, which may include using automated tools consistent with standards and guidelines promulgated under section 11331 of title 40;
-
(C) ensure that information security is addressed throughout the life cycle of each agency information system; and
-
(3) subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate;
-
(4) security awareness training to inform personnel, including contractors and other users of information systems that support the operations and assets of the agency, of—(A) information security risks associated with their activities; and(B) their responsibilities in complying with agency policies and procedures designed to reduce these risks;
-
(A) shall include testing of management, operational, and technical controls of every information system identified in the inventory required under section 3505(c);1
-
(8) plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.
-
(II) the risk assessments conducted under section 3554(a)(2)(A) of the affected information systems before the date on which the incident occurred;
-
(III) the status of compliance of the affected information systems with applicable security requirements at the time of the incident; and
-
(A) testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agency’s information systems;
-
(3) Evaluations and any other descriptions of information systems under the authority and control of the Director of National Intelligence or of National Foreign Intelligence Programs systems under the authority and control of the Secretary of Defense shall be made available to Congress only through the appropriate oversight committees of Congress, in accordance with applicable laws.
-
(1) provide timely technical assistance to operators of agency information systems regarding security incidents, including guidance on detecting and handling information security incidents;
-
(3) inform operators of agency information systems about current and potential information security threats, and vulnerabilities;
Citations to §3502(9)
-
(7) provide for the dissemination of public information on a timely basis, on equitable terms, and in a manner that promotes the utility of the information to the public and makes effective use of information technology;
-
(10) ensure that information technology is acquired, used, and managed to improve performance of agency missions, including the reduction of information collection burdens on the public; and
-
(vi) the acquisition and use of information technology, including alternative information technologies that provide for electronic submission, maintenance, or disclosure of information as a substitute for paper and for the use and acceptance of electronic signatures.
-
(2) coordinate the review of the collection of information associated with Federal procurement and acquisition by the Office of Information and Regulatory Affairs with the Office of Federal Procurement Policy, with particular emphasis on applying information technology to improve the efficiency and effectiveness of Federal procurement, acquisition and payment, and to reduce information collection burdens on the public;
-
(2) promote public access to public information and fulfill the purposes of this subchapter, including through the effective use of information technology.
-
(h) With respect to Federal information technology, the Director shall—(1) in consultation with the Director of the National Institute of Standards and Technology and the Administrator of General Services—(A) develop and oversee the implementation of policies, principles, standards, and guidelines for information technology functions and activities of the Federal Government, including periodic evaluations of major information systems; and(B) oversee the development and implementation of standards under section 11331 of title 40;2(2) monitor the effectiveness of, and compliance with, directives issued under subtitle III of title 40 and directives issued under section 3222 of title 40;(3) coordinate the development and review by the Office of Information and Regulatory Affairs of policy associated with Federal procurement and acquisition of information technology with the Office of Federal Procurement Policy;(4) ensure, through the review of agency budget proposals, information resources management plans and other means—(A) agency integration of information resources management plans, program plans and budgets for acquisition and use of information technology; and(B) the efficiency and effectiveness of inter-agency information technology initiatives to improve agency performance and the accomplishment of agency missions; and(5) promote the use of information technology by the Federal Government to improve the productivity, efficiency, and effectiveness of Federal programs, including through dissemination of public information and the reduction of information collection burdens on the public.
-
(A) develop and oversee the implementation of policies, principles, standards, and guidelines for information technology functions and activities of the Federal Government, including periodic evaluations of major information systems; and
-
(3) coordinate the development and review by the Office of Information and Regulatory Affairs of policy associated with Federal procurement and acquisition of information technology with the Office of Federal Procurement Policy;
-
(A) agency integration of information resources management plans, program plans and budgets for acquisition and use of information technology; and
-
(B) the efficiency and effectiveness of inter-agency information technology initiatives to improve agency performance and the accomplishment of agency missions; and
-
(5) promote the use of information technology by the Federal Government to improve the productivity, efficiency, and effectiveness of Federal programs, including through dissemination of public information and the reduction of information collection burdens on the public.
-
(iii) meeting the information technology needs of the Federal Government in accordance with the purposes of this subchapter; and
-
(ii) information technology planning, budgeting, acquisition, and management under section 3506(h), subtitle III of title 40, and related laws and guidance;
-
(B) in cooperation with the agency Chief Financial Officer (or comparable official), develop a full and accurate accounting of information technology expenditures, related expenses, and results; and
-
(iv) minimize the burden of the collection of information on those who are to respond, including through the use of automated collection techniques or other forms of information technology; and
-
(J) to the maximum extent practicable, uses information technology to reduce burden and improve data quality, agency efficiency and responsiveness to the public; and
-
(h) With respect to Federal information technology, each agency shall—(1) implement and enforce applicable Governmentwide and agency information technology management policies, principles, standards, and guidelines;(2) assume responsibility and accountability for information technology investments;(3) promote the use of information technology by the agency to improve the productivity, efficiency, and effectiveness of agency programs, including the reduction of information collection burdens on the public and improved dissemination of public information;(4) propose changes in legislation, regulations, and agency procedures to improve information technology practices, including changes that improve the ability of the agency to use technology to reduce burden; and(5) assume responsibility for maximizing the value and assessing and managing the risks of major information systems initiatives through a process that is—(A) integrated with budget, financial, and program management decisions; and(B) used to select, control, and evaluate the results of major information systems initiatives.
-
(1) implement and enforce applicable Governmentwide and agency information technology management policies, principles, standards, and guidelines;
-
(2) assume responsibility and accountability for information technology investments;
-
(3) promote the use of information technology by the agency to improve the productivity, efficiency, and effectiveness of agency programs, including the reduction of information collection burdens on the public and improved dissemination of public information;
-
(4) propose changes in legislation, regulations, and agency procedures to improve information technology practices, including changes that improve the ability of the agency to use technology to reduce burden; and
-
(4) The term “information technology” has the meaning given that term in section 11101 of title 40.
Citations to §3502(10)
-
(1) minimize the paperwork burden for individuals, small businesses, educational and nonprofit institutions, Federal contractors, State, local and tribal governments, and other persons resulting from the collection of information by or for the Federal Government;
-
(iii) informs the person receiving the collection of information of—(I) the reasons the information is being collected;(II) the way such information is to be used;(III) an estimate, to the extent practicable, of the burden of the collection;(IV) whether responses to the collection of information are voluntary, required to obtain a benefit, or mandatory; and(V) the fact that an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a valid control number; and
-
(V) the fact that an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a valid control number; and
-
(C) reduces to the extent practicable and appropriate the burden on persons who shall provide information to or for the agency, including with respect to small entities, as defined under section 601(6) of title 5, the use of such techniques as—(i) establishing differing compliance or reporting requirements or timetables that take into account the resources available to those who are to respond;(ii) the clarification, consolidation, or simplification of compliance and reporting requirements; or(iii) an exemption from coverage of the collection of information, or any part thereof;
-
(F) indicates for each recordkeeping requirement the length of time persons are required to maintain the records specified;
-
(2) Any written communication between the Administrator of the Office of Information and Regulatory Affairs, or any employee of the Office of Information and Regulatory Affairs, and an agency or person not employed by the Federal Government concerning a proposed collection of information shall be made available to the public.
-
Before approving a proposed collection of information, the Director shall determine whether the collection of information by the agency is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility. Before making a determination the Director may give the agency and other interested persons an opportunity to be heard or to submit statements in writing. To the extent, if any, that the Director determines that the collection of information by an agency is unnecessary for any reason, the agency may not engage in the collection of information.
-
(a) Notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information that is subject to this subchapter if—(1) the collection of information does not display a valid control number assigned by the Director in accordance with this subchapter; or(2) the agency fails to inform the person who is to respond to the collection of information that such person is not required to respond to the collection of information unless it displays a valid control number.
-
(2) the agency fails to inform the person who is to respond to the collection of information that such person is not required to respond to the collection of information unless it displays a valid control number.
-
(b) The preparation of any report required by this section shall be based on performance results reported by the agencies and shall not increase the collection of information burden on persons outside the Federal Government.
-
(a) In developing information resources management policies, plans, rules, regulations, procedures, and guidelines and in reviewing collections of information, the Director shall provide interested agencies and persons early and meaningful opportunity to comment.
-
(b) Any person may request the Director to review any collection of information conducted by or for an agency to determine, if, under this subchapter, a person shall maintain, provide, or disclose the information to or for the agency. Unless the request is frivolous, the Director shall, in coordination with the agency responsible for the collection of information—(1) respond to the request within 60 days after receiving the request, unless such period is extended by the Director to a specified date and the person making the request is given notice of such extension; and(2) take appropriate remedial action, if necessary.
-
(i) who is an employee of a private organization or a researcher affiliated with an institution of higher learning (including a person granted special sworn status by the Bureau of the Census under section 23(c) of title 13), and with whom a contract or other agreement is executed, on a temporary basis, by an executive agency to perform exclusively statistical activities under the control and supervision of an officer or employee of that agency;
-
(f) Whoever, being an officer, employee, or agent of an agency acquiring information for exclusively statistical purposes, having taken and subscribed the oath of office, or having sworn to observe the limitations imposed by this section, comes into possession of such information by reason of his or her being an officer, employee, or agent and, knowing that the disclosure of the specific information is prohibited under the provisions of this subchapter, willfully discloses the information in any manner to a person or agency not entitled to receive it, shall be guilty of a class E felony and imprisoned for not more than 5 years, or fined not more than $250,000, or both.
Citations to §3502(11)
-
(4) maximize the practical utility of and public benefit from information collected by or for the Federal Government;
-
(i) evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility;
-
(A) is necessary for the proper performance of the functions of the agency, including that the information has practical utility;
-
Before approving a proposed collection of information, the Director shall determine whether the collection of information by the agency is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility. Before making a determination the Director may give the agency and other interested persons an opportunity to be heard or to submit statements in writing. To the extent, if any, that the Director determines that the collection of information by an agency is unnecessary for any reason, the agency may not engage in the collection of information.
Citations to §3502(12)
-
(7) provide for the dissemination of public information on a timely basis, on equitable terms, and in a manner that promotes the utility of the information to the public and makes effective use of information technology;
-
(2) foster greater sharing, dissemination, and access to public information, including through—(A) the use of comprehensive data inventories and the Federal data catalogue under section 3511; and(B) the development and utilization of common standards for information collection, storage, processing and communication, including standards for security, interconnectivity and interoperability;
-
(1) apply to Federal agency dissemination of public information, regardless of the form or format in which such information is disseminated; and
-
(2) promote public access to public information and fulfill the purposes of this subchapter, including through the effective use of information technology.
-
(5) promote the use of information technology by the Federal Government to improve the productivity, efficiency, and effectiveness of Federal programs, including through dissemination of public information and the reduction of information collection burdens on the public.
-
(C) improve the integrity, quality, and utility of information to all users within and outside the agency, including capabilities for ensuring dissemination of public information, public access to government information, and protections for privacy and security;
-
(1) ensure that the public has timely and equitable access to the agency’s public information, including ensuring such access through—(A) encouraging a diversity of public and private sources for information based on government public information;(B) in cases in which the agency provides public information maintained in electronic format, providing timely and equitable access to the underlying data (in whole or in part); and(C) agency dissemination of public information in an efficient, effective, and economical manner;
-
(A) encouraging a diversity of public and private sources for information based on government public information;
-
(B) in cases in which the agency provides public information maintained in electronic format, providing timely and equitable access to the underlying data (in whole or in part); and
-
(C) agency dissemination of public information in an efficient, effective, and economical manner;
-
(A) establish an exclusive, restricted, or other distribution arrangement that interferes with timely and equitable availability of public information to the public;
-
(B) restrict or regulate the use, resale, or redissemination of public information by the public;
-
(C) charge fees or royalties for resale or redissemination of public information; or
-
(D) establish user fees for public information that exceed the cost of dissemination;
-
(3) promote the use of information technology by the agency to improve the productivity, efficiency, and effectiveness of agency programs, including the reduction of information collection burdens on the public and improved dissemination of public information;
Citations to §3502(13)
-
(F) indicates for each recordkeeping requirement the length of time persons are required to maintain the records specified;
Citations to §3502(14)
-
(1) If information obtained by an agency is released by that agency to another agency, all the provisions of law (including penalties) that relate to the unlawful disclosure of information apply to the officers and employees of the agency to which information is released to the same extent and in the same manner as the provisions apply to the officers and employees of the agency which originally obtained the information.
-
(a) Notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information that is subject to this subchapter if—(1) the collection of information does not display a valid control number assigned by the Director in accordance with this subchapter; or(2) the agency fails to inform the person who is to respond to the collection of information that such person is not required to respond to the collection of information unless it displays a valid control number.
-
(g) Notwithstanding section 3572, information collected by an agency for exclusively statistical purposes under a pledge of confidentiality may be provided by the collecting agency to a law enforcement agency for the prosecution of submissions to the collecting agency of false statistical information under statutes that authorize criminal penalties (such as section 221 of title 13) or civil penalties for the provision of false statistical information, unless such disclosure or use would otherwise be prohibited under Federal law.
-
(h) Nothing in this subchapter shall be construed as restricting or diminishing any confidentiality protections or penalties for unauthorized disclosure that otherwise apply to data or information collected for statistical purposes or nonstatistical purposes, including, but not limited to, section 6103 of the Internal Revenue Code of 1986.
-
(e) A statistical agency or unit may designate agents, by contract or by entering into a special agreement containing the provisions required under section 3561(2) for treatment as an agent under that section, who may perform exclusively statistical activities, subject to the limitations and penalties described in this subchapter.
-
(3) Examination of business data in identifiable form shall be limited to the officers, employees, and agents authorized to examine the individual reports in accordance with written agreements pursuant to this section. Officers, employees, and agents of a Designated Statistical Agency who receive data pursuant to this section shall be subject to all provisions of law, including penalties, that relate—
Citations to §3502(15)
-
(A) the use of comprehensive data inventories and the Federal data catalogue under section 3511; and
-
(1) In consultation with the Director and in accordance with the guidance established under paragraph (2), the head of each agency shall, to the maximum extent practicable, develop and maintain a comprehensive data inventory that accounts for all data assets created by, collected by, under the control or direction of, or maintained by the agency. The head of each agency shall ensure that such inventory provides a clear and comprehensive understanding of the data assets in the possession of the agency.
-
(2) The Director shall establish guidance for agencies to develop and maintain comprehensive data inventories under paragraph (1). Such guidance shall include the following:(A) A requirement for the head of an agency to include in the comprehensive data inventory metadata on each data asset of the agency, including, to the maximum extent practicable, the following:(i) A description of the data asset, including all variable names and definitions.(ii) The name or title of the data asset.(iii) An indication of whether or not the agency—(I) has determined or can determine if the data asset is—(aa) an open Government data asset;(bb) subject to disclosure or partial disclosure or exempt from disclosure under section 552 of title 5;(cc) a public data asset eligible for disclosure under subsection (b); or(dd) a data asset not subject to open format or open license requirements due to existing limitations or restrictions on government distribution of the asset; or(II) as of the date of such indication, has not made such determination.(iv) Any determination made under section 3582, if available.(v) A description of the method by which the public may access or request access to the data asset.(vi) The date on which the data asset was most recently updated.(vii) Each agency responsible for maintaining the data asset.(viii) The owner of the data asset.(ix) To the extent practicable, any restriction on the use of the data asset.(x) The location of the data asset.(xi) Any other metadata necessary to make the comprehensive data inventory useful to the agency and the public, or otherwise determined useful by the Director.(B) A requirement for the head of an agency to exclude from the comprehensive data inventory any data asset contained on a national security system, as defined in section 11103 of title 40.(C) Criteria for the head of an agency to use in determining which metadata required by subparagraph (A), if any, in the comprehensive data inventory may not be made publicly available, which shall include, at a minimum, a requirement to ensure all information that could not otherwise be withheld from disclosure under section 552 of title 5 is made public in the comprehensive data inventory.(D) A requirement for the head of each agency, in accordance with a procedure established by the Director, to submit for inclusion in the Federal data catalogue maintained under subsection (c) the comprehensive data inventory developed pursuant to subparagraph (C), including any real-time updates to such inventory, and data assets made available in accordance with subparagraph (E) or any electronic hyperlink providing access to such data assets.(E) Criteria for the head of an agency to use in determining whether a particular data asset should not be made publicly available in a manner that takes into account—(i) risks and restrictions related to the disclosure of personally identifiable information, including the risk that an individual data asset in isolation does not pose a privacy or confidentiality risk but when combined with other available information may pose such a risk;(ii) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk;(iii) the cost and benefits to the public of converting the data into a format that could be understood and used by the public;(iv) whether the public dissemination of the data asset could result in legal liability;(v) whether the data asset—(II) contains confidential business information, that could be withheld under section 552(b)(4) of title 5; or(III) is restricted by contract or other binding, written agreement;(vi) whether the holder of a right to such data asset has been consulted;(vii) the expectation that all data assets that would otherwise be made available under section 552 of title 5 be disclosed; and(viii) any other considerations that the Director determines to be relevant.(F) Criteria for the head of an agency to use in assessing the indication of a determination under subparagraph (A)(iii) and how to prioritize any such subsequent determinations in the strategic information management plan under section 3506, in consideration of the existing resources available to the agency.
-
(A) A requirement for the head of an agency to include in the comprehensive data inventory metadata on each data asset of the agency, including, to the maximum extent practicable, the following:(i) A description of the data asset, including all variable names and definitions.(ii) The name or title of the data asset.(iii) An indication of whether or not the agency—(I) has determined or can determine if the data asset is—(aa) an open Government data asset;(bb) subject to disclosure or partial disclosure or exempt from disclosure under section 552 of title 5;(cc) a public data asset eligible for disclosure under subsection (b); or(dd) a data asset not subject to open format or open license requirements due to existing limitations or restrictions on government distribution of the asset; or(II) as of the date of such indication, has not made such determination.(iv) Any determination made under section 3582, if available.(v) A description of the method by which the public may access or request access to the data asset.(vi) The date on which the data asset was most recently updated.(vii) Each agency responsible for maintaining the data asset.(viii) The owner of the data asset.(ix) To the extent practicable, any restriction on the use of the data asset.(x) The location of the data asset.(xi) Any other metadata necessary to make the comprehensive data inventory useful to the agency and the public, or otherwise determined useful by the Director.
-
(xi) Any other metadata necessary to make the comprehensive data inventory useful to the agency and the public, or otherwise determined useful by the Director.
-
(B) A requirement for the head of an agency to exclude from the comprehensive data inventory any data asset contained on a national security system, as defined in section 11103 of title 40.
-
(C) Criteria for the head of an agency to use in determining which metadata required by subparagraph (A), if any, in the comprehensive data inventory may not be made publicly available, which shall include, at a minimum, a requirement to ensure all information that could not otherwise be withheld from disclosure under section 552 of title 5 is made public in the comprehensive data inventory.
-
(D) A requirement for the head of each agency, in accordance with a procedure established by the Director, to submit for inclusion in the Federal data catalogue maintained under subsection (c) the comprehensive data inventory developed pursuant to subparagraph (C), including any real-time updates to such inventory, and data assets made available in accordance with subparagraph (E) or any electronic hyperlink providing access to such data assets.
-
(3) With respect to each data asset created or identified by an agency, the head of the agency shall update the comprehensive data inventory of the agency not later than 90 days after the date of such creation or identification.
-
(3) The Director shall ensure the Federal data catalogue maintained under paragraph (1) provides information on how the public can access a data asset included in a comprehensive data inventory under subsection (a) that is not yet available on the Federal data catalogue, including information regarding the application process established under section 3583 of title 44.
Citations to §3502(16)
-
(A) the use of comprehensive data inventories and the Federal data catalogue under section 3511; and
-
(B) statistical data classification;
-
(D) timely release of statistical data; and
-
(E) such statistical data sources as may be required for the administration of Federal programs;
-
(i) requires the agency to develop processes and procedures that—(I) require data collection mechanisms created on or after the date of the enactment of the OPEN Government Data Act to be available in an open format; and(II) facilitate collaboration with non-Government entities (including businesses), researchers, and the public for the purpose of understanding how data users value and use government data;(ii) identifies and implements methods for collecting and analyzing digital information on data asset usage by users within and outside of the agency, including designating a point of contact within the agency to assist the public and to respond to quality issues, usability issues, recommendations for improvements, and complaints about adherence to open data requirements within a reasonable period of time;(iii) develops and implements a process to evaluate and improve the timeliness, completeness, consistency, accuracy, usefulness, and availability of open Government data assets;(iv) includes requirements for meeting the goals of the agency open data plan, including the acquisition of technology, provision of training for employees, and the implementation of procurement standards, in accordance with existing law, regulation, and policy, that allow for the acquisition of innovative solutions from public and private sectors;(v) identifies as priority data assets any data asset for which disclosure would be in the public interest and establishes a plan to evaluate each priority data asset for disclosure on the Federal Data Catalogue under section 3511 and for a determination under1 3511(a)(2)(A)(iii)(I)(bb), including an accounting of which priority data assets have not yet been evaluated; and(vi) requires the agency to comply with requirements under section 3511, including any standards established by the Director under such section, when disclosing a data asset pursuant to such section; and
-
(I) require data collection mechanisms created on or after the date of the enactment of the OPEN Government Data Act to be available in an open format; and
-
(ii) identifies and implements methods for collecting and analyzing digital information on data asset usage by users within and outside of the agency, including designating a point of contact within the agency to assist the public and to respond to quality issues, usability issues, recommendations for improvements, and complaints about adherence to open data requirements within a reasonable period of time;
-
(iv) includes requirements for meeting the goals of the agency open data plan, including the acquisition of technology, provision of training for employees, and the implementation of procurement standards, in accordance with existing law, regulation, and policy, that allow for the acquisition of innovative solutions from public and private sectors;
-
(v) identifies as priority data assets any data asset for which disclosure would be in the public interest and establishes a plan to evaluate each priority data asset for disclosure on the Federal Data Catalogue under section 3511 and for a determination under1 3511(a)(2)(A)(iii)(I)(bb), including an accounting of which priority data assets have not yet been evaluated; and
-
(J) to the maximum extent practicable, uses information technology to reduce burden and improve data quality, agency efficiency and responsiveness to the public; and
-
(B) in cases in which the agency provides public information maintained in electronic format, providing timely and equitable access to the underlying data (in whole or in part); and
-
(4) observe Federal standards and practices for data collection, analysis, documentation, sharing, and dissemination of information;
-
The Director may designate a central collection agency to obtain information for two or more agencies if the Director determines that the needs of such agencies for information will be adequately served by a single collection agency, and such sharing of data is not inconsistent with applicable law. In such cases the Director shall prescribe (with reference to the collection of information) the duties and functions of the collection agency so designated and of the agencies for which it is to act as agent (including reimbursement for costs). While the designation is in effect, an agency covered by the designation may not obtain for itself information for the agency which is the duty of the collection agency to obtain. The Director may modify the designation from time to time as circumstances require. The authority to designate under this section is subject to the provisions of section 3507(f) of this subchapter.
-
(D) A requirement for the head of each agency, in accordance with a procedure established by the Director, to submit for inclusion in the Federal data catalogue maintained under subsection (c) the comprehensive data inventory developed pursuant to subparagraph (C), including any real-time updates to such inventory, and data assets made available in accordance with subparagraph (E) or any electronic hyperlink providing access to such data assets.
-
(iii) the cost and benefits to the public of converting the data into a format that could be understood and used by the public;
-
(b) The head of each agency shall submit public data assets, or links to public data assets available online, as open Government data assets for inclusion in the Federal data catalogue maintained under subsection (c), in accordance with the guidance established under subsection (a)(2).
-
(1) The Administrator of General Services shall maintain a single public interface online as a point of entry dedicated to sharing agency data assets with the public, which shall be known as the “Federal data catalogue”. The Administrator and the Director shall ensure that agencies can submit public data assets, or links to public data assets, for publication and public availability on the interface.
-
(2) The Director shall collaborate with the Office of Government Information Services and the Administrator of General Services to develop and maintain an online repository of tools, best practices, and schema standards to facilitate the adoption of open data practices across the Federal Government, which shall—(A) include any definitions, regulations, policies, checklists, and case studies related to open data policy;(B) facilitate collaboration and the adoption of best practices across the Federal Government relating to the adoption of open data practices; and(C) be made available on the Federal data catalogue maintained under paragraph (1).
-
(A) include any definitions, regulations, policies, checklists, and case studies related to open data policy;
-
(B) facilitate collaboration and the adoption of best practices across the Federal Government relating to the adoption of open data practices; and
-
(C) be made available on the Federal data catalogue maintained under paragraph (1).
-
(3) The Director shall ensure the Federal data catalogue maintained under paragraph (1) provides information on how the public can access a data asset included in a comprehensive data inventory under subsection (a) that is not yet available on the Federal data catalogue, including information regarding the application process established under section 3583 of title 44.
-
(b) The Chief Data Officer of an agency shall be designated on the basis of demonstrated training and experience in data management, governance (including creation, application, and maintenance of data standards), collection, analysis, protection, use, and dissemination, including with respect to any statistical and related techniques to protect and de-identify confidential data.
-
(1) be responsible for lifecycle data management;(2) coordinate with any official in the agency responsible for using, protecting, disseminating, and generating data to ensure that the data needs of the agency are met;(3) manage data assets of the agency, including the standardization of data format, sharing of data assets, and publication of data assets in accordance with applicable law;(4) in carrying out the requirements under paragraphs (3) and (5), consult with any statistical official of the agency (as designated under section 314 of title 5);(5) carry out the requirements of the agency under subsections (b) through (d), (f), and (i) of section 3506, section 3507, and section 3511;(6) ensure that, to the extent practicable, agency data conforms with data management best practices;(7) engage agency employees, the public, and contractors in using public data assets and encourage collaborative approaches on improving data use;(8) support the Performance Improvement Officer of the agency in identifying and using data to carry out the functions described in section 1124(a)(2) of title 31;(9) support the Evaluation Officer of the agency in obtaining data to carry out the functions described in section 313(d) of title 5;(10) review the impact of the infrastructure of the agency on data asset accessibility and coordinate with the Chief Information Officer of the agency to improve such infrastructure to reduce barriers that inhibit data asset accessibility;(11) ensure that, to the extent practicable, the agency maximizes the use of data in the agency, including for the production of evidence (as defined in section 3561), cybersecurity, and the improvement of agency operations;(12) identify points of contact for roles and responsibilities related to open data use and implementation (as required by the Director);(13) serve as the agency liaison to other agencies and the Office of Management and Budget on the best way to use existing agency data for statistical purposes (as defined in section 3561); and(14) comply with any regulation and guidance issued under subchapter III, including the acquisition and maintenance of any required certification and training.
-
(1) be responsible for lifecycle data management;
-
(3) manage data assets of the agency, including the standardization of data format, sharing of data assets, and publication of data assets in accordance with applicable law;
-
(7) engage agency employees, the public, and contractors in using public data assets and encourage collaborative approaches on improving data use;
-
(8) support the Performance Improvement Officer of the agency in identifying and using data to carry out the functions described in section 1124(a)(2) of title 31;
-
(9) support the Evaluation Officer of the agency in obtaining data to carry out the functions described in section 313(d) of title 5;
-
(11) ensure that, to the extent practicable, the agency maximizes the use of data in the agency, including for the production of evidence (as defined in section 3561), cybersecurity, and the improvement of agency operations;
-
(13) serve as the agency liaison to other agencies and the Office of Management and Budget on the best way to use existing agency data for statistical purposes (as defined in section 3561); and
-
(1) To the extent necessary to comply with statistical laws, the Chief Data Officer of an agency shall delegate any responsibility under subsection (c) to the head of a statistical agency or unit (as defined in section 3561) within the agency.
-
(2) To the extent permissible under law, the individual to whom a responsibility has been delegated under paragraph (1) shall consult with the Chief Data Officer of the agency in carrying out such responsibility.
-
(3) The Chief Data Officer of the agency shall defer to the individual to whom a responsibility has been delegated under paragraph (1) regarding the necessary delegation of such responsibility with respect to any data acquired, maintained, or disseminated by the agency under applicable statistical law.
-
(e) The Chief Data Officer of an agency shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Government Reform of the House of Representatives an annual report on the compliance of the agency with the requirements of this subchapter, including information on each requirement that the agency could not carry out and, if applicable, what the agency needs to carry out such requirement.
-
(a) There is established in the Office of Management and Budget a Chief Data Officer Council (in this section referred to as the “Council”).
-
(1) establish Governmentwide best practices for the use, protection, dissemination, and generation of data;
-
(4) consult with the public and engage with private users of Government data and other stakeholders on how to improve access to data assets of the Federal Government; and
-
(5) identify and evaluate new technology solutions for improving the collection and use of data.
-
(C) compiling and analyzing data on agency information security; and
-
(3) The term “business data” means operating and financial data and information about businesses, tax-exempt organizations, and government entities.
-
(A) means the use of data in identifiable form for any purpose that is not a statistical purpose, including any administrative, regulatory, law enforcement, adjudicatory, or other purpose that affects the rights, privileges, or benefits of a particular identifiable respondent; and
-
(B) includes the disclosure under section 552 of title 5 of data that are acquired for exclusively statistical purposes under a pledge of confidentiality.
-
(A) means the collection, compilation, processing, or analysis of data for the purpose of describing or making estimates concerning the whole, or relevant groups or components within, the economy, society, or the natural environment; and
-
(4) The term “relevant”, when used with respect to statistical information, means processes, activities, and other such matters likely to be useful to policymakers and public and private sector data users.
-
(c) This subchapter shall not be construed as authorizing the disclosure for nonstatistical purposes of demographic data or information collected by the Bureau of the Census pursuant to section 9 of title 13.
-
(d) Data or information acquired by the Energy Information Administration under a pledge of confidentiality and designated by the Energy Information Administration to be used for exclusively statistical purposes shall not be disclosed in identifiable form for nonstatistical purposes under—(1) section 12, 20, or 59 of the Federal Energy Administration Act of 1974 (15 U.S.C. 771, 779, 790h);(2) section 11 of the Energy Supply and Environmental Coordination Act of 1974 (15 U.S.C. 796); or(3) section 205 or 407 of the Department of Energy Organization Act (42 U.S.C. 7135, 7177).
-
(e) This subchapter shall not be construed to limit any authorities of the Congressional Budget Office to work (consistent with laws governing the confidentiality of information the disclosure of which would be a violation of law) with databases of Designated Statistical Agencies (as defined in section 3576(e)), either separately or, for data that may be shared pursuant to section 3576(c) or other authority, jointly in order to improve the general utility of these databases for the statistical purpose of analyzing pension and health care financing issues.
-
(f) Nothing in this subchapter shall preempt applicable State law regarding the confidentiality of data collected by the States.
-
(h) Nothing in this subchapter shall be construed as restricting or diminishing any confidentiality protections or penalties for unauthorized disclosure that otherwise apply to data or information collected for statistical purposes or nonstatistical purposes, including, but not limited to, section 6103 of the Internal Revenue Code of 1986.
-
(i) Nothing in this subchapter shall be construed to affect the authority of the Congress, including its committees, members, or agents, to obtain data or information for a statistical purpose, including for oversight of an agency’s statistical activities.
-
(4) Enhanced sharing of business data among the Bureau of the Census, the Bureau of Economic Analysis, and the Bureau of Labor Statistics for exclusively statistical purposes will improve their ability to track more accurately the large and rapidly changing nature of United States business. In particular, the statistical agencies will be able to better ensure that businesses are consistently classified in appropriate industries, resolve data anomalies, produce statistical samples that are consistently adjusted for the entry and exit of new businesses in a timely manner, and correct faulty reporting errors quickly and efficiently.
-
(5) Congress enacted the International Investment and Trade in Services Survey Act (Public Law 94–472), which allowed the Bureau of the Census, the Bureau of Economic Analysis, and the Bureau of Labor Statistics to share data on foreign-owned companies. The Act not only expanded detailed industry coverage from 135 industries to over 800 industries with no increase in the data collected from respondents but also demonstrated how data sharing can result in the creation of valuable data products.
-
(6) With part B of this subchapter, the sharing of business data among the Bureau of the Census, the Bureau of Economic Analysis, and the Bureau of Labor Statistics continues to ensure the highest level of confidentiality for respondents to statistical surveys.
-
(1) To authorize the sharing of business data among the Bureau of the Census, the Bureau of Economic Analysis, and the Bureau of Labor Statistics for exclusively statistical purposes.
-
(3) To improve the comparability and accuracy of Federal economic statistics by allowing the Bureau of the Census, the Bureau of Economic Analysis, and the Bureau of Labor Statistics to update sample frames, develop consistent classifications of establishments and companies into industries, improve coverage, and reconcile significant differences in data produced by the three agencies.
-
(C) implementing appropriate measures to assure the physical and electronic security of confidential data;
-
(1) A Designated Statistical Agency may provide business data in an identifiable form to another Designated Statistical Agency under the terms of a written agreement among the agencies sharing the business data that specifies—(A) the business data to be shared;(B) the statistical purposes for which the business data are to be used;(C) the officers, employees, and agents authorized to examine the business data to be shared; and(D) appropriate security procedures to safeguard the confidentiality of the business data.
-
(A) the business data to be shared;
-
(B) the statistical purposes for which the business data are to be used;
-
(C) the officers, employees, and agents authorized to examine the business data to be shared; and
-
(D) appropriate security procedures to safeguard the confidentiality of the business data.
-
(2) The provision of business data by an agency to a Designated Statistical Agency under this section shall in no way alter the responsibility of the agency providing the data under other statutes (including sections 552 and 552b of title 5) with respect to the provision or withholding of such information by the agency providing the data.
-
(3) Examination of business data in identifiable form shall be limited to the officers, employees, and agents authorized to examine the individual reports in accordance with written agreements pursuant to this section. Officers, employees, and agents of a Designated Statistical Agency who receive data pursuant to this section shall be subject to all provisions of law, including penalties, that relate—
-
(4) Whenever a written agreement concerns data that respondents were required by law to report and the respondents were not informed that the data could be shared among the Designated Statistical Agencies, for exclusively statistical purposes, the terms of such agreement shall be described in a public notice issued by the agency that intends to provide the data. Such notice shall allow a minimum of 60 days for public comment.
-
(2) Standards for each statistical agency or unit to improve access to a data asset pursuant to paragraph (1) or (3) by removing or obscuring information in such a manner that the identity of the data subject is less likely to be reasonably inferred by either direct or indirect means.
-
(3) A requirement for each statistical agency or unit to conduct a comprehensive risk assessment of any data asset acquired or accessed under this subchapter prior to any public release of such asset, including standards for such comprehensive risk assessment and criteria for making a determination of whether to release the data.
-
(A) A requirement to make information on the assessment of the sensitivity level of each data asset conducted pursuant to paragraph (1) available on the Federal data catalogue established under section 3511(c)(1).
-
(B) A requirement to make any comprehensive risk assessment, and associated determinations, conducted under paragraph (3) available on the Federal data catalogue established under section 3511(c)(1).
-
(2) ensure that statistical agencies and units have the ability to make information public on the Federal data catalogue established under section 3511(c)(1), in accordance with requirements established pursuant to subsection (b).
Citations to §3502(17)
-
(A) risks and restrictions related to the disclosure of personally identifiable information, including the risk that an individual data asset in isolation does not pose a privacy or confidentiality risk but when combined with other available information may pose such a risk;
-
(B) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk;
-
(C) the cost and benefits to the public of converting a data asset into a machine-readable format that is accessible and useful to the public;
-
(D) whether the application of the requirements described in such section to a data asset could result in legal liability;
-
(E) a determination of whether a data asset—(ii) contains confidential business information, that could be withheld under section 552(b)(4) of title 5; or(iii) is otherwise restricted by contract or other binding, written agreement;
-
(F) the requirement that a data asset be disclosed, if it would otherwise be made available under section 552 of title 5 (commonly known as the “Freedom of Information Act”); and
-
(ii) identifies and implements methods for collecting and analyzing digital information on data asset usage by users within and outside of the agency, including designating a point of contact within the agency to assist the public and to respond to quality issues, usability issues, recommendations for improvements, and complaints about adherence to open data requirements within a reasonable period of time;
-
(v) identifies as priority data assets any data asset for which disclosure would be in the public interest and establishes a plan to evaluate each priority data asset for disclosure on the Federal Data Catalogue under section 3511 and for a determination under1 3511(a)(2)(A)(iii)(I)(bb), including an accounting of which priority data assets have not yet been evaluated; and
-
(vi) requires the agency to comply with requirements under section 3511, including any standards established by the Director under such section, when disclosing a data asset pursuant to such section; and
-
(A) make each data asset of the agency available in an open format; and
-
(B) providing the public with the opportunity to request specific data assets to be prioritized for disclosure and to provide suggestions for the development of agency criteria with respect to prioritizing data assets for disclosure;
-
(1) In consultation with the Director and in accordance with the guidance established under paragraph (2), the head of each agency shall, to the maximum extent practicable, develop and maintain a comprehensive data inventory that accounts for all data assets created by, collected by, under the control or direction of, or maintained by the agency. The head of each agency shall ensure that such inventory provides a clear and comprehensive understanding of the data assets in the possession of the agency.
-
(A) A requirement for the head of an agency to include in the comprehensive data inventory metadata on each data asset of the agency, including, to the maximum extent practicable, the following:(i) A description of the data asset, including all variable names and definitions.(ii) The name or title of the data asset.(iii) An indication of whether or not the agency—(I) has determined or can determine if the data asset is—(aa) an open Government data asset;(bb) subject to disclosure or partial disclosure or exempt from disclosure under section 552 of title 5;(cc) a public data asset eligible for disclosure under subsection (b); or(dd) a data asset not subject to open format or open license requirements due to existing limitations or restrictions on government distribution of the asset; or(II) as of the date of such indication, has not made such determination.(iv) Any determination made under section 3582, if available.(v) A description of the method by which the public may access or request access to the data asset.(vi) The date on which the data asset was most recently updated.(vii) Each agency responsible for maintaining the data asset.(viii) The owner of the data asset.(ix) To the extent practicable, any restriction on the use of the data asset.(x) The location of the data asset.(xi) Any other metadata necessary to make the comprehensive data inventory useful to the agency and the public, or otherwise determined useful by the Director.
-
(i) A description of the data asset, including all variable names and definitions.
-
(ii) The name or title of the data asset.
-
(I) has determined or can determine if the data asset is—(aa) an open Government data asset;(bb) subject to disclosure or partial disclosure or exempt from disclosure under section 552 of title 5;(cc) a public data asset eligible for disclosure under subsection (b); or(dd) a data asset not subject to open format or open license requirements due to existing limitations or restrictions on government distribution of the asset; or
-
(dd) a data asset not subject to open format or open license requirements due to existing limitations or restrictions on government distribution of the asset; or
-
(ix) To the extent practicable, any restriction on the use of the data asset.
-
(v) A description of the method by which the public may access or request access to the data asset.
-
(vi) The date on which the data asset was most recently updated.
-
(vii) Each agency responsible for maintaining the data asset.
-
(viii) The owner of the data asset.
-
(x) The location of the data asset.
-
(B) A requirement for the head of an agency to exclude from the comprehensive data inventory any data asset contained on a national security system, as defined in section 11103 of title 40.
-
(D) A requirement for the head of each agency, in accordance with a procedure established by the Director, to submit for inclusion in the Federal data catalogue maintained under subsection (c) the comprehensive data inventory developed pursuant to subparagraph (C), including any real-time updates to such inventory, and data assets made available in accordance with subparagraph (E) or any electronic hyperlink providing access to such data assets.
-
(E) Criteria for the head of an agency to use in determining whether a particular data asset should not be made publicly available in a manner that takes into account—(i) risks and restrictions related to the disclosure of personally identifiable information, including the risk that an individual data asset in isolation does not pose a privacy or confidentiality risk but when combined with other available information may pose such a risk;(ii) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk;(iii) the cost and benefits to the public of converting the data into a format that could be understood and used by the public;(iv) whether the public dissemination of the data asset could result in legal liability;(v) whether the data asset—(II) contains confidential business information, that could be withheld under section 552(b)(4) of title 5; or(III) is restricted by contract or other binding, written agreement;(vi) whether the holder of a right to such data asset has been consulted;(vii) the expectation that all data assets that would otherwise be made available under section 552 of title 5 be disclosed; and(viii) any other considerations that the Director determines to be relevant.
-
(i) risks and restrictions related to the disclosure of personally identifiable information, including the risk that an individual data asset in isolation does not pose a privacy or confidentiality risk but when combined with other available information may pose such a risk;
-
(ii) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk;
-
(iv) whether the public dissemination of the data asset could result in legal liability;
-
(v) whether the data asset—(II) contains confidential business information, that could be withheld under section 552(b)(4) of title 5; or(III) is restricted by contract or other binding, written agreement;
-
(vi) whether the holder of a right to such data asset has been consulted;
-
(vii) the expectation that all data assets that would otherwise be made available under section 552 of title 5 be disclosed; and
-
(3) With respect to each data asset created or identified by an agency, the head of the agency shall update the comprehensive data inventory of the agency not later than 90 days after the date of such creation or identification.
-
(1) The Administrator of General Services shall maintain a single public interface online as a point of entry dedicated to sharing agency data assets with the public, which shall be known as the “Federal data catalogue”. The Administrator and the Director shall ensure that agencies can submit public data assets, or links to public data assets, for publication and public availability on the interface.
-
(3) The Director shall ensure the Federal data catalogue maintained under paragraph (1) provides information on how the public can access a data asset included in a comprehensive data inventory under subsection (a) that is not yet available on the Federal data catalogue, including information regarding the application process established under section 3583 of title 44.
-
(3) manage data assets of the agency, including the standardization of data format, sharing of data assets, and publication of data assets in accordance with applicable law;
-
(10) review the impact of the infrastructure of the agency on data asset accessibility and coordinate with the Chief Information Officer of the agency to improve such infrastructure to reduce barriers that inhibit data asset accessibility;
-
(4) consult with the public and engage with private users of Government data and other stakeholders on how to improve access to data assets of the Federal Government; and
-
(4) The term “data asset” has the meaning given that term in section 3502.
-
(a) The head of an agency shall, to the extent practicable, make any data asset maintained by the agency available, upon request, to any statistical agency or unit for purposes of developing evidence.
-
(b) Subsection (a) does not apply to any data asset that is subject to a statute that—(1) prohibits the sharing or intended use of such asset in a manner as to leave no discretion on the issue; or(2) if enacted after the date of the enactment of this section, specifically cites to this paragraph.
-
(1) require the timely provision of data assets under subsection (a);
-
(4) require a transparent process for statistical agencies and units to request data assets from agencies and for agencies to respond to such requests.
-
(a) To the extent practicable, each statistical agency or unit shall expand access to data assets of such agency or unit acquired or accessed under this subchapter to develop evidence while protecting such assets from inappropriate access and use, in accordance with the regulations promulgated under subsection (b).
-
(1) Standards for each statistical agency or unit to assess each data asset owned or accessed by the statistical agency or unit for purposes of categorizing the sensitivity level of each such asset and identifying the corresponding level of accessibility to each such asset. Such standards shall include—(A) common sensitivity levels and corresponding levels of accessibility that may be assigned to a data asset, including a requisite minimum and maximum number of sensitivity levels for each statistical agency or unit to use;(B) criteria for determining the sensitivity level and corresponding level of accessibility of each data asset; and(C) criteria for determining whether a less sensitive and more accessible version of a data asset can be produced.
-
(A) common sensitivity levels and corresponding levels of accessibility that may be assigned to a data asset, including a requisite minimum and maximum number of sensitivity levels for each statistical agency or unit to use;
-
(B) criteria for determining the sensitivity level and corresponding level of accessibility of each data asset; and
-
(C) criteria for determining whether a less sensitive and more accessible version of a data asset can be produced.
-
(2) Standards for each statistical agency or unit to improve access to a data asset pursuant to paragraph (1) or (3) by removing or obscuring information in such a manner that the identity of the data subject is less likely to be reasonably inferred by either direct or indirect means.
-
(3) A requirement for each statistical agency or unit to conduct a comprehensive risk assessment of any data asset acquired or accessed under this subchapter prior to any public release of such asset, including standards for such comprehensive risk assessment and criteria for making a determination of whether to release the data.
-
(A) A requirement to make information on the assessment of the sensitivity level of each data asset conducted pursuant to paragraph (1) available on the Federal data catalogue established under section 3511(c)(1).
-
(a) The Director shall establish a process through which agencies, the Congressional Budget Office, State, local, and Tribal governments, researchers, and other individuals, as appropriate, may apply to access the data assets accessed or acquired under this subchapter by a statistical agency or unit for purposes of developing evidence. The process shall include the following:(1) Sufficient detail to ensure that each statistical agency or unit establishes an identical process.(2) A common application form.(3) Criteria for statistical agencies and units to determine whether to grant an applicant access to a data asset.(4) Timeframes for prompt determinations by each statistical agency or unit.(5) An appeals process for adverse decisions and noncompliance with the process established under this subsection.(6) Standards for transparency, including requirements to make the following information publicly available:(A) Each application received.(B) The status of each application.(C) The determination made for each application.(D) Any other information, as appropriate, to ensure full transparency of the process established under this subsection.
-
(3) Criteria for statistical agencies and units to determine whether to grant an applicant access to a data asset.
Citations to §3502(18)
-
(C) the cost and benefits to the public of converting a data asset into a machine-readable format that is accessible and useful to the public;
-
(5) ensure that any public data asset of the agency is machine-readable; and
Citations to §3502(19)
-
(A) A requirement for the head of an agency to include in the comprehensive data inventory metadata on each data asset of the agency, including, to the maximum extent practicable, the following:(i) A description of the data asset, including all variable names and definitions.(ii) The name or title of the data asset.(iii) An indication of whether or not the agency—(I) has determined or can determine if the data asset is—(aa) an open Government data asset;(bb) subject to disclosure or partial disclosure or exempt from disclosure under section 552 of title 5;(cc) a public data asset eligible for disclosure under subsection (b); or(dd) a data asset not subject to open format or open license requirements due to existing limitations or restrictions on government distribution of the asset; or(II) as of the date of such indication, has not made such determination.(iv) Any determination made under section 3582, if available.(v) A description of the method by which the public may access or request access to the data asset.(vi) The date on which the data asset was most recently updated.(vii) Each agency responsible for maintaining the data asset.(viii) The owner of the data asset.(ix) To the extent practicable, any restriction on the use of the data asset.(x) The location of the data asset.(xi) Any other metadata necessary to make the comprehensive data inventory useful to the agency and the public, or otherwise determined useful by the Director.
-
(xi) Any other metadata necessary to make the comprehensive data inventory useful to the agency and the public, or otherwise determined useful by the Director.
-
(C) Criteria for the head of an agency to use in determining which metadata required by subparagraph (A), if any, in the comprehensive data inventory may not be made publicly available, which shall include, at a minimum, a requirement to ensure all information that could not otherwise be withheld from disclosure under section 552 of title 5 is made public in the comprehensive data inventory.
Citations to §3502(20)
-
(iii) develops and implements a process to evaluate and improve the timeliness, completeness, consistency, accuracy, usefulness, and availability of open Government data assets;
-
(i) as an open Government data asset; and
-
(aa) an open Government data asset;
-
(b) The head of each agency shall submit public data assets, or links to public data assets available online, as open Government data assets for inclusion in the Federal data catalogue maintained under subsection (c), in accordance with the guidance established under subsection (a)(2).
Citations to §3502(21)
-
(5) The term “open license” has the same meaning given such term in section 3502(21) of title 44.
-
(ii) under an open license.
-
(dd) a data asset not subject to open format or open license requirements due to existing limitations or restrictions on government distribution of the asset; or
Citations to §3502(22)
-
(B) make each public data asset of the agency available—(i) as an open Government data asset; and(ii) under an open license.
-
(5) ensure that any public data asset of the agency is machine-readable; and
-
(6) engage the public in using public data assets of the agency and encourage collaboration by—(A) publishing on the website of the agency, on a regular basis (not less than annually), information on the usage of such assets by non-Government users;(B) providing the public with the opportunity to request specific data assets to be prioritized for disclosure and to provide suggestions for the development of agency criteria with respect to prioritizing data assets for disclosure;(C) assisting the public in expanding the use of public data assets; and(D) hosting challenges, competitions, events, or other initiatives designed to create additional value from public data assets of the agency.
-
(C) assisting the public in expanding the use of public data assets; and
-
(D) hosting challenges, competitions, events, or other initiatives designed to create additional value from public data assets of the agency.
-
(cc) a public data asset eligible for disclosure under subsection (b); or
-
(b) The head of each agency shall submit public data assets, or links to public data assets available online, as open Government data assets for inclusion in the Federal data catalogue maintained under subsection (c), in accordance with the guidance established under subsection (a)(2).
-
(1) The Administrator of General Services shall maintain a single public interface online as a point of entry dedicated to sharing agency data assets with the public, which shall be known as the “Federal data catalogue”. The Administrator and the Director shall ensure that agencies can submit public data assets, or links to public data assets, for publication and public availability on the interface.
-
(7) engage agency employees, the public, and contractors in using public data assets and encourage collaborative approaches on improving data use;
Citations to §3502(23)
-
(1) To the extent necessary to comply with statistical laws, the Chief Data Officer of an agency shall delegate any responsibility under subsection (c) to the head of a statistical agency or unit (as defined in section 3561) within the agency.