[House Report 110-755]
[From the U.S. Government Publishing Office]
110th Congress Report
HOUSE OF REPRESENTATIVES
2d Session 110-755
======================================================================
DEPARTMENT OF HOMELAND SECURITY COMPONENT PRIVACY OFFICER ACT OF 2008
_______
July 10, 2008.--Committed to the Committee of the Whole House on the
State of the Union and ordered to be printed
_______
Mr. Thompson of Mississippi, from the Committee on Homeland Security,
submitted the following
R E P O R T
[To accompany H.R. 5170]
[Including cost estimate of the Congressional Budget Office]
The Committee on Homeland Security, to whom was referred the
bill (H.R. 5170) to amend the Homeland Security Act of 2002 to
provide for a privacy official within each component of the
Department of Homeland Security, and for other purposes, having
considered the same, report favorably thereon with an amendment
and recommend that the bill as amended do pass.
CONTENTS
Page
Purpose and Summary.............................................. 3
Background and Need for Legislation.............................. 3
Hearings......................................................... 3
Committee Consideration.......................................... 3
Committee Votes.................................................. 4
Committee Oversight Findings..................................... 4
New Budget Authority, Entitlement Authority, and Tax Expenditures 4
Congressional Budget Office Estimate............................. 4
Statement of General Performance Goals and Objectives............ 5
Congressional Earmarks, Limited Tax Benefits, and Limited Tariff
Benefits....................................................... 6
Federal Mandates Statement....................................... 6
Advisory Committee Statement..................................... 6
Constitutional Authority Statement............................... 6
Applicability to Legislative Branch.............................. 6
Section-by-Section Analysis of the Legislation................... 6
Changes in Existing Law Made by the Bill, as Reported............ 7
The amendment is as follows:
Strike all after the enacting clause and insert the
following:
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Department of Homeland Security
Component Privacy Officer Act of 2008''.
SEC. 2. ESTABLISHMENT OF PRIVACY OFFICIAL WITHIN EACH COMPONENT OF
DEPARTMENT OF HOMELAND SECURITY.
(a) In General.--Subtitle C of title II of the Homeland Security Act
of 2002 (6 U.S.C. 141 et seq.) is amended by inserting after section
222 the following new section:
``SEC. 222A. PRIVACY OFFICIALS.
``(a) Designation.--
``(1) In general.--For each component of the Department under
paragraph (2), the Secretary shall, in consultation with the
head of the component, designate a full-time privacy official,
who shall report directly to the senior official appointed
under section 222. Each such component privacy official shall
have primary responsibility for its component in implementing
the privacy policy for the Department established by the senior
official appointed under section 222.
``(2) Components.--The components of the Department referred
to in this subparagraph are as follows:
``(A) The Transportation Security Administration.
``(B) The Bureau of Citizenship and Immigration
Services.
``(C) Customs and Border Protection.
``(D) Immigration and Customs Enforcement.
``(E) The Federal Emergency Management Agency.
``(F) The Coast Guard.
``(G) The Directorate of Science and Technology.
``(H) The Office of Intelligence and Analysis.
``(I) The Directorate for National Protection and
Programs.
``(b) Responsibilities.--Each privacy official designated under
subsection (a) shall report directly to both the head of the official's
component and the senior official appointed under section 222, and
shall have the following responsibilities with respect to the
component:
``(1) Serve as such senior official's main point of contact
at the component to implement the polices and directives of
such senior official in carrying out section 222.
``(2) Advise the head of that component on privacy
considerations when any law, regulation, program, policy,
procedure, or guideline is proposed, developed, or implemented.
``(3) Assure that the use of technologies by the component
sustain or enhance privacy protections relating to the use,
collection, and disclosure of personal information within the
component.
``(4) Identify privacy issues related to component programs
and apply appropriate privacy policies in accordance with
Federal privacy law and Departmental policies developed to
ensure that the component protects the privacy of individuals
affected by its activities.
``(5) Monitor the component's compliance with all applicable
Federal privacy laws and regulations, implement corrective,
remedial, and preventive actions and notify the senior official
appointed under section 222 of privacy issues or non-
compliance, whenever necessary.
``(6) Ensure that personal information contained in Privacy
Act systems of records is handled in full compliance with
section 552a of title 5, United States Code.
``(7) Assist in drafting and reviewing privacy impact
assessments, privacy threshold assessments, and system of
records notices, in conjunction with and under the direction of
the senior official appointed under section 222, for any new or
substantially changed program or technology that collects,
maintains, or disseminates personally identifiable information
within the official's component.
``(8) Assist in drafting and reviewing privacy impact
assessments, privacy threshold assessments, and system of
records notices in conjunction with and under the direction of
the senior official appointed under section 222, for proposed
rulemakings and regulations within the component.
``(9) Conduct supervision of programs, regulations, policies,
procedures, or guidelines to ensure the component's protection
of privacy and, as necessary, promulgate guidelines and conduct
oversight to ensure the protection of privacy.
``(10) Implement and monitor privacy training for component
employees and contractors in coordination with the senior
official appointed under section 222.
``(11) Provide the senior official appointed under section
222 with written materials and information regarding the
relevant activities of the component, including privacy
violations and abuse, that are needed by the senior official to
successfully prepare the reports the senior official submits to
Congress and prepares on behalf of the Department.
``(12) Any other responsibilities assigned by the Secretary
or the senior official appointed under section 222.
``(c) Role of Component Heads.--The head of a component identified in
subsection (a)(2) shall ensure that the privacy official designated
under subsection (a) for that component--
``(1) has the information, material, and resources necessary
to fulfill the responsibilities of such official under this
section;
``(2) is advised of proposed policy changes and the
development of new programs, rules, regulations, procedures, or
guidelines during the planning stage and is included in the
decision-making process; and
``(3) is given access to material and personnel the privacy
official deems necessary to carry out the official's
responsibilities.
``(d) Limitation.--Nothing in this section shall be considered to
abrogate the role and responsibilities of the senior official appointed
under section 222.''.
(b) Clerical Amendment.--The table of contents in section 1(b) of
such Act is amended by inserting after the item related to section 222
the following new item:
``Sec. 222A. Privacy officials.''.
Purpose and Summary
The purpose of H.R. 5170 is to amend the Homeland Security
Act of 2002 to provide for a privacy official within each
component of the Department of Homeland Security, and for other
purposes.
Background and Need for Legislation
Under the current structure, the Chief Privacy Officer
works closely with other departmental components, such as the
General Counsel's Office, the Policy Office and the Office for
Civil Rights and Civil Liberties in addressing privacy issues;
however, many of the Department Components operate without an
on-site full time privacy professional.
Additionally, components with a designated privacy officer
have generally produced more Privacy Impact Assessments (PIAs)
than components without privacy officers. In fact, of the
eleven DHS components that have published PIAs, only three have
designated privacy officers. Yet these three components account
for 57 percent of all published DHS PIAs. Moreover, according
to the DHS Office of Privacy 2007 Annual Report to Congress
``establishing and increasing the number of well-trained
privacy officers at the component level helps to ensure that
privacy is built into new and existing programs at the
beginning of the development process.'' Additionally, the
presence of a full-time Component Privacy Officer would ensure
that privacy considerations are integrated into the decision-
making process at all of the DHS Components.
Hearings
No hearings were held on H.R. 5170.
Committee Consideration
H.R. 5170 was introduced in the House on January 29, 2008,
by Mr. Carney and Mr. Thompson of Mississippi and referred
solely to the Committee on Homeland Security. Within the
Committee H.R. 5170 was referred to the Subcommittee on
Management, Investigations, and Oversight.
On June 26, 2008, the Chairman discharged the Subcommittee
on Management, Investigations, and Oversight from further
consideration of H.R. 5170. The Committee then proceeded to the
consideration of H.R. 5170 and ordered the measure to be
reported to the House favorably, as amended, by voice vote.
The Committee adopted the measure, as amended, by unanimous
consent.
The following amendment was offered:
An Amendment in the Nature of a Substitute offered by Mr.
Carney (#1); was AGREED TO by unanimous consent.
Committee Votes
Clause 3(b) of rule XIII of the Rules of the House of
Representatives requires the Committee to list the recorded
votes on the motion to report legislation and amendments
thereto.
No recorded votes were requested during Committee
consideration.
Committee Oversight Findings
Pursuant to clause 3(c)(1) of rule XIII of the Rules of the
House of Representatives, the Committee has held oversight
hearings and made findings that are reflected in this report.
New Budget Authority, Entitlement Authority, and Tax Expenditures
In compliance with clause 3(c)(2) of rule XIII of the
Rules of the House of Representatives, the Committee finds that
H.R. 5170, the Department of Homeland Security Component
Privacy Officer Act of 2008, would result in no new or
increased budget authority, entitlement authority, or tax
expenditures or revenues.
Congressional Budget Office Estimate
The Committee adopts as its own the cost estimate prepared
by the Director of the Congressional Budget Office pursuant to
section 402 of the Congressional Budget Act of 1974.
U.S. Congress,
Congressional Budget Office,
Washington, DC, July 8, 2008.
Hon. Bennie G. Thompson,
Chairman, Committee on Homeland Security,
House of Representatives, Washington, DC.
Dear Mr. Chairman: The Congressional Budget Office has
prepared the enclosed cost estimate for H.R. 5170, the
Department of Homeland Security Component Privacy Officer Act
of 2008.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contact is Mark
Grabowicz.
Sincerely,
Robert A. Sunshine
(For Peter R. Orszag, Director).
Enclosure.
H.R. 5170--Department of Homeland Security Component Privacy Officer
Act of 2008
CBO estimates that implementing H.R. 5170 would cost about
$1 million annually, assuming the availability of appropriated
funds. Enacting the bill would not affect direct spending or
revenues. H.R. 5170 contains no intergovernmental or private-
sector mandates as defined in the Unfunded Mandates Reform Act
and would impose no costs on state, local, or tribal
governments.
H.R. 5170 would direct the Department of Homeland Security
(DHS) to designate full-time officials to oversee privacy
considerations and policies for each of the department's nine
components, including the Federal Emergency Management Agency,
the Coast Guard, and the other agencies specified in the bill.
Those individuals would coordinate all privacy matters for
their respective agencies, including training and compliance,
and would report to the Chief Privacy Officer of DHS.
According to DHS, four of the nine department components
already have full-time privacy officials, so implementing H.R.
5170 would require filling five positions. We expect that each
new official would be compensated at level 14 or 15 of the
General Schedule. CBO estimates that the costs for those
positions would total about $1 million annually, including
salaries and benefits for those officials and for the costs of
any support staff.
The CBO staff contact for this estimate is Mark Grabowicz.
This estimate was approved by Peter H. Fontaine, Assistant
Director for Budget Analysis.
Statement of General Performance Goals and Objectives
Pursuant to clause 3(c)(4) of rule XIII of the Rules of
the House of Representatives, H.R. 5170 contains the following
general performance goals and objectives, including outcome
related goals and objectives authorized.
The purpose of this legislation is to create Component
Privacy Officers in the Department of Homeland Security
component agencies. Unfortunately, public trust in the
Department's ability to protect personal privacy rights is
abysmally low. This bill should aid in improving the manner in
which the Department handles privacy related issues and should
also foster the Department's mandate to sustain privacy
protections. In turn, public trust with respect to the
Department should improve. H.R. 5170 adds a new section 222A to
the Homeland Security Act of 2002 (6 U.S.C. 361 et seq.), which
requires the Secretary of Homeland Security, in consultation
with the Component Head, to create Component Privacy Officers
at the following Department of Homeland Security components:
The Transportation Security Administration; The Bureau of
Citizenship and Immigration Services; Customs and Border
Protection; Immigration and Customs Enforcement; The Federal
Emergency Management Agency; The Coast Guard; The Directorate
of Science and Technology; The Office of Intelligence and
Analysis; and The Directorate for National Protection and
Programs.
Congressional Earmarks, Limited Tax Benefits, and Limited Tariff
Benefits
In compliance with rule XXI of the Rules of the House of
Representatives, this bill, as reported, contains no
congressional earmarks, limited tax benefits, or limited tariff
benefits as defined in clause 9(d), 9(e), or 9(f) of the rule
XXI.
Federal Mandates Statement
The Committee adopts as its own the estimate of Federal
mandates prepared by the Director of the Congressional Budget
Office pursuant to section 423 of the Unfunded Mandates Reform
Act.
Advisory Committee Statement
No advisory committees within the meaning of section 5(b)
of the Federal Advisory Committee Act were created by this
legislation.
Constitutional Authority Statement
Pursuant to clause 3(d)(1) of rule XIII of the Rules of the
House of Representatives, the Committee finds that the
Constitutional authority for this legislation is provided in
Article I, section 8, clause 1, which grants Congress the power
to provide for the common Defense of the United States.
Applicability to Legislative Branch
The Committee finds that the legislation does not relate
to the terms and conditions of employment or access to public
services or accommodations within the meaning of section
102(b)(3) of the Congressional Accountability Act.
Section-by-Section Analysis of the Legislation
Section 1. Short title
This section designates the short title as the ``Department
of Homeland Security Component Privacy Act of 2008.''
Section 2. Establishment of privacy official within each component of
Department of Homeland Security
The Homeland Security Act of 2002 (P. L. 107-296) is
amended by inserting after Section 222, which creates the
``senior official'' at the Department that is responsible for
privacy policy, a new section 222A, which will govern the
component privacy officers.
Section 222A. Privacy officials
This section indicates that the Secretary, in consultation
with the head of each Component, shall designate a full-time
privacy official in certain components of the Department of
Homeland Security.
This section states that the components referred to in the
bill are: The Transportation Security Administration; the
Bureau of Citizenship and Immigration Services; Customs and
Border Protection; Immigration and Customs Enforcement; the
Federal Emergency Management Agency; the Coast Guard; the
Directorate of Science and Technology; the Office of
Intelligence and Analysis; and the Directorate for National
Protection and Programs.
Responsibilities. This section states that the Component
Privacy Officers shall have primary responsibility for
implementing the Department's privacy policy in the Component
Privacy Officer's component agency. Additionally, it indicates
that the Component Privacy Officers shall report directly to
the senior official appointed under section 222, hereinafter
referred to for clarification purposes as the ``DHS Chief
Privacy Officer.''
This section also states that in addition to the directly
reporting to the DHS Chief Privacy Officer, each Component
Privacy Officer shall also report directly to the head of that
officer's component. This section also lists the
responsibilities of the Component Privacy Officers and
describes in detail the manner in which they will monitor and
exercise oversight over privacy matters within their respective
components. This section also indicates that in addition to the
responsibilities enumerated in the bill, the Component Privacy
Officers shall also execute any other responsibilities assigned
by the Secretary or the DHS Chief Privacy Officer.
This section states that the head of the components shall
assist the Component Privacy Officers in carrying out their
duties by ensuring that the officers have the information,
material, and resources necessary to fulfill their
responsibilities. This section also provides that the head of
the components shall make certain that the Component Privacy
Officers are advised of proposed policy changes and the
development of new programs, rules, regulations, procedures, or
guidelines during the planning stage. This section also states
that the Component Privacy Officers shall be included in the
component's decision-making process and be given access to the
necessary material and personnel to carry out the
responsibilities set forth in the bill.
This section states that it is not the intention of this
bill to abrogate the current role and responsibilities of the
DHS Privacy Officer.
Changes in Existing Law Made by the Bill, as Reported
In compliance with clause 3(e) of rule XIII of the Rules of
the House of Representatives, changes in existing law made by
the bill, as reported, are shown as follows (new matter is
printed in italic and existing law in which no change is
proposed is shown in roman):
HOMELAND SECURITY ACT OF 2002
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) * * *
(b) Table of Contents.--The table of contents for this Act is
as follows:
* * * * * * *
TITLE II--INFORMATION ANALYSIS AND INFRASTRUCTURE PROTECTION
* * * * * * *
Subtitle C--Information Security
* * * * * * *
Sec. 222A. Privacy officials.
* * * * * * *
TITLE II--INFORMATION ANALYSIS AND INFRASTRUCTURE PROTECTION
* * * * * * *
Subtitle C--Information Security
* * * * * * *
SEC. 222A. PRIVACY OFFICIALS.
(a) Designation.--
(1) In general.--For each component of the Department
under paragraph (2), the Secretary shall, in
consultation with the head of the component, designate
a full-time privacy official, who shall report directly
to the senior official appointed under section 222.
Each such component privacy official shall have primary
responsibility for its component in implementing the
privacy policy for the Department established by the
senior official appointed under section 222.
(2) Components.--The components of the Department
referred to in this subparagraph are as follows:
(A) The Transportation Security
Administration.
(B) The Bureau of Citizenship and Immigration
Services.
(C) Customs and Border Protection.
(D) Immigration and Customs Enforcement.
(E) The Federal Emergency Management Agency.
(F) The Coast Guard.
(G) The Directorate of Science and
Technology.
(H) The Office of Intelligence and Analysis.
(I) The Directorate for National Protection
and Programs.
(b) Responsibilities.--Each privacy official designated under
subsection (a) shall report directly to both the head of the
official's component and the senior official appointed under
section 222, and shall have the following responsibilities with
respect to the component:
(1) Serve as such senior official's main point of
contact at the component to implement the polices and
directives of such senior official in carrying out
section 222.
(2) Advise the head of that component on privacy
considerations when any law, regulation, program,
policy, procedure, or guideline is proposed, developed,
or implemented.
(3) Assure that the use of technologies by the
component sustain or enhance privacy protections
relating to the use, collection, and disclosure of
personal information within the component.
(4) Identify privacy issues related to component
programs and apply appropriate privacy policies in
accordance with Federal privacy law and Departmental
policies developed to ensure that the component
protects the privacy of individuals affected by its
activities.
(5) Monitor the component's compliance with all
applicable Federal privacy laws and regulations,
implement corrective, remedial, and preventive actions
and notify the senior official appointed under section
222 of privacy issues or non-compliance, whenever
necessary.
(6) Ensure that personal information contained in
Privacy Act systems of records is handled in full
compliance with section 552a of title 5, United States
Code.
(7) Assist in drafting and reviewing privacy impact
assessments, privacy threshold assessments, and system
of records notices, in conjunction with and under the
direction of the senior official appointed under
section 222, for any new or substantially changed
program or technology that collects, maintains, or
disseminates personally identifiable information within
the official's component.
(8) Assist in drafting and reviewing privacy impact
assessments, privacy threshold assessments, and system
of records notices in conjunction with and under the
direction of the senior official appointed under
section 222, for proposed rulemakings and regulations
within the component.
(9) Conduct supervision of programs, regulations,
policies, procedures, or guidelines to ensure the
component's protection of privacy and, as necessary,
promulgate guidelines and conduct oversight to ensure
the protection of privacy.
(10) Implement and monitor privacy training for
component employees and contractors in coordination
with the senior official appointed under section 222.
(11) Provide the senior official appointed under
section 222 with written materials and information
regarding the relevant activities of the component,
including privacy violations and abuse, that are needed
by the senior official to successfully prepare the
reports the senior official submits to Congress and
prepares on behalf of the Department.
(12) Any other responsibilities assigned by the
Secretary or the senior official appointed under
section 222.
(c) Role of Component Heads.--The head of a component
identified in subsection (a)(2) shall ensure that the privacy
official designated under subsection (a) for that component--
(1) has the information, material, and resources
necessary to fulfill the responsibilities of such
official under this section;
(2) is advised of proposed policy changes and the
development of new programs, rules, regulations,
procedures, or guidelines during the planning stage and
is included in the decision-making process; and
(3) is given access to material and personnel the
privacy official deems necessary to carry out the
official's responsibilities.
(d) Limitation.--Nothing in this section shall be considered
to abrogate the role and responsibilities of the senior
official appointed under section 222.
* * * * * * *