,i  #aac? ,,congress  #a/ ,session  ,h4 
,r4 #aaba  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,m>* #ac1 #bjac ,mr4  
,cony]s 7= himself1 ,mr4 ,scott (       
,virg9ia1 & ,mr4 ,johnson ( ,georgia7   
introduc$ ! foll[+ bill2 :i* 0 ref]r$ to
 ! ,committee on ! ,judici>y  ,a ,,bill 
,to protect cyb] privacy1 & = o!r       
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,cyb] ,privacy ,=tification
 ,act ( #bjac4  ,i ,data ,brea*         
,notification  #aja4 ,failure to provide
 notice ( security brea*es involv+      
s5sitive p]sonally id5tifiable in=mation
  7a7 ,9 g5]al ,*apt] #dg ( title #ah1  
,unit$ ,/ates ,code1 is am5d$ by add+ at
 ! end ! foll[+3  #ajdj4 ,failure to    
provide notice ( security brea*es       
involv+ s5sitive p]sonally id5tifiable  
in=mation  7a7 ,:oev]1 hav+ a cov]$     
obligation to provide notice ( a        
security brea* involv+ s5sitive         
p]sonally id5tifiable in=mation1 kn[+ly 
fails to d s1 %all be f9$ "u ?is title  
or imprison$ n m ?an #e ye>s1 or bo?4   

7b7 ,z us$ 9 ?is section--  7#a7 ! t]m  
cov]$ obligation1 ) respect to provid+  
notice ( a security brea*1 means an     
obligation "u ,f$]al law or1 if ! brea* 
is 9 or affects int]/ate or =eign       
comm]ce1 "u ,/ate law2  7#b7 ! t]m      
s5sitive p]sonally id5tifiable in=mation
 means any electronic or digital        
in=mation t includes--  7,a7 an         
individual's fir/ & la/ "n1 or fir/     
initial & la/ "n1 or address or phone   
numb] 9 comb9ation ) any "o ( ! foll[+  
data elem5ts :]e ! data elem5ts are n   
protect$ by a te*nology protection      
measure t r5d]s ! data elem5t           
indeciph]able--  7i7 a nontruncat$      
social security numb]1 driv]'s lic5se   
numb]1 /ate resid5t id5tification numb]1
 passport numb]1 or ali5 regi/ration    
numb]2  7ii7 bo?--  7,i7 "m's maid5 "n1 
if id5tifi$ z su*2 &  7,,ii7 mon?1 day1 
& ye> ( bir?2 &  7iii7 unique biometric 
data su* z a f+]pr9t1 voice pr9t1 a     
ret9a or iris image2 or  7,b7 a f9ancial
 acc\nt numb] or cr$it or debit c>d     

numb] 9 comb9ation ) any security code1 
access code or password t is requir$ =  
an individual to obta9 cr$it1 )draw     
funds1 or engage 9 a f9ancial           
transaction by means ( su* numb]2  7#c7 
! t]m security brea* means a compromise 
( ! security1 confid5tiality1 or        
integrity ( comput]iz$ data t !re is    
reason to believe has result$ 9 improp] 
access to s5sitive p]sonally id5tifiable
 in=mation2 &  7#d7 ! t]m improp] access
 means access )\t au?orization or 9     
excess ( au?orization4  4  7b7 ,cl]ical 
am5dm5t ,! table ( sections at ! beg9n+ 
( *apt] #dg ( title #ah1 ,unit$ ,/ates  
,code1 is am5d$ by add+ at ! end !      
foll[+3  #ajdj4 ,concealm5t ( security  
brea*es involv+ p]sonally id5tifiable   
in=mation4  4  7c7 ,obligation ,to      
report  7#a7 ,9 g5]al ,a p]son :o owns  
or possesses data 9 electronic =m       
conta9+ a means ( id5tification & has k 
( a major security brea* ( ! sy/em      
conta9+ su* data ma9ta9$ by su* p]son1  
mu/ provide prompt notice ( su* brea* to

 ! ,unit$ ,/ates ,secret ,s]vice or     
,f$]al ,bureau ( ,inve/igation4  7#b7   
,publication ( li/ ( notifications ,!   
,secret ,s]vice & ! ,f$]al ,bureau (    
,inve/igation %all annually publi% 9 !  
,f$]al ,regi/] a li/ ( all notifications
 submitt$ ! previ\s cal5d> ye> & !      
id5tity ( ea* entity ) respect to :i* ! 
major security brea* occurr$4  7#c7     
,def9ition ,9 ?is subsection--  7,a7 !  
t]m major security brea* means any      
security brea* involv+--  7i7 means (   
id5tification p]ta9+ to #aj1jjj or m    
individuals is1 or is reasonably believ$
 to h be5 acquir$2  7ii7 databases own$ 
by ! ,f$]al ,gov]nm5t2 or  7iii7 means (
 id5tification ( ,f$]al ,gov]nm5t       
employees or contractors involv$ 9      
national security matt]s or law         
en=cem5t2 &  7,b7 ! t]m means (         
id5tification has ! mean+ giv5 t t]m 9  
section #ajbh ( title #ah1 ,unit$ ,/ates
 ,code4  ,,ii ,non-crim9al privacy      
en=cem5t & privacy impact /atem5ts      
#bja4 ,en=cem5t by ,attorney ,g5]al &   

,/ate au?orities  7a7 ,def9ition (      
au?oriz$ entity ,z us$ 9 ?is section1 ! 
t]m au?oriz$ entity means ! ,attorney   
,g5]al1 ) respect to any conduct        
con/itut+ a violation ( a ,f$]al law    
enact$ aft] ! date ( ! enactm5t ( ?is   
,act relat+ to data security & engag$ 9 
by a bus9ess entity1 & a ,/ate ,attorney
 ,g5]al ) respect to t conduct to !     
ext5t ! conduct adv]sely affects an     
int]e/ ( ! resid5ts ( a ,/ate4  7b7     
,civil p5alty  7#a7 ,g5]ally ,an        
au?oriz$ entity may 9 a civil action    
obta9 a civil p5alty ( n m ?an #ejj1jjj 
f any bus9ess entity t engages 9 conduct
 con/itut+ a violation ( a ,f$]al law   
enact$ aft] ! date ( ! enactm5t ( ?is   
,act relat+ to data security4  7#b7     
,special rule = int5tional violation ,if
 ! violation describ$ 9 subsection 7a7  
is int5tional1 ! maximum civil p5alty is
 #a1jjj1jjj4  7c7 ,injunctive relief ,an
 au?oriz$ entity may1 9 a civil action  
aga9/ a bus9ess entity t has engag$1 or 
is engag$1 9 any conduct con/itut+ a    

violation ( a ,f$]al law enact$ aft] !  
date ( ! enactm5t ( ?is ,act relat+ to  
data security1 obta9 an ord]--  7#a7    
enjo9+ su* act or practice2 or  7#b7    
en=c+ compliance ) t law4  7d7 ,o!r     
rights & rem$ies ,! rights & rem$ies    
available "u ?is section d n affect any 
o!r rights & rem$ies available "u ,f$]al
 or ,/ate law4  #bjb4 ,coord9ation (    
,/ate & ,f$]al ef=ts  7a7 ,notice  7#a7 
,9 g5]al ,a ,/ate consum] protection    
attorney may n br+ an action "u section 
#bja1 until ! attorney g5]al ( ! ,/ate  
involv$ provides to ! ,attorney ,g5]al (
 ! ,unit$ ,/ates--  7,a7 writt5 notice (
 ! action2 &  7,b7 a copy ( ! compla9t =
 ! action4  7#b7 ,exception ,p>agraph   
7#a7 does n apply ) respect to ! fil+ ( 
an action by an attorney g5]al ( a ,/ate
 "u ?is section if ! ,/ate attorney     
g5]al det]m9es t x is n feasible to     
provide ! notice describ$ 9 su*         
subp>agraph be=e ! fil+ ( ! action1 9   
su* a case ! ,/ate attorney g5]al %all  
provide notice & a copy ( ! compla9t to 

! ,attorney ,g5]al at ! "t ! ,/ate      
attorney g5]al files ! action4  7b7     
,f$]al proce$+s ,! ,attorney ,g5]al     
may--  7#a7 move to /ay any non-,f$]al  
action "u section #bja1 p5d+ ! f9al     
disposition ( a p5d+ ,f$]al action "u t 
section2  7#b7 initiate an action 9 an  
appropriate ,unit$ ,/ates di/rict c\rt &
 move to consolidate all p5d+ actions "u
 section #bja1 includ+ ,/ate actions1 9 
t c\rt2 &  7#c7 int]v5e 9 a ,/ate action
 "u section #bja4  7c7 ,p5d+ proce$+s   
,if ! ,attorney ,g5]al in/itutes a      
proce$+ or action = a violation ( a     
,f$]al law enact$ aft] ! date ( !       
enactm5t ( ?is ,act relat+ to data      
security1 no au?ority ( a ,/ate may1    
dur+ ! p5d5cy ( su* proce$+ or action1  
br+ an action "u ?is section aga9/ any  
def5dant nam$ 9 su* crim9al proce$+ or a
 civil action aga9/ any def5dant = any  
violation t is alleg$ 9 t proce$+ or    
action4  7d7 ,def9ition ,z us$ 9 ?is    
section1 ! t]m ,/ate consum] protection 
attorney means ! attorney g5]al ( a     

,/ate or any ,/ate or local law en=cem5t
 ag5cy au?oriz$ by ! ,/ate attorney     
g5]al or by ,/ate /atute to prosecute   
violations ( consum] protection law4    
#bjc4 ,requirem5t t ag5cy rulemak+ take 
into consid]ation impacts on individual 
privacy  7a7 ,9 g5]al ,title #e1 ,unit$ 
,/ates ,code1 is am5d$ by add+ aft]     
section #eec ! foll[+ new section3      
#eec;a4 ,privacy impact assessm5t 9     
rulemak+  7a7 ,initial privacy impact   
assessm5t  7#a7 ,9 g5]al ,:5ev] an ag5cy
 is requir$ by section #eec ( ?is title1
 or any o!r law1 to publi% a g5]al      
notice ( propos$ rulemak+ = a propos$   
rule1 or publi%es a notice ( propos$    
rulemak+ = an int]pretative rule involv+
 ! int]nal rev5ue laws ( ! ,unit$       
,/ates1 & su* rule or propos$ rulemak+  
p]ta9s to ! collection1 ma9t5ance1 use1 
or disclosure ( p]sonally id5tifiable   
in=mation f #aj or m individuals1 o!r   
?an ag5cies1 in/rum5talities1 or        
employees ( ! ,f$]al ,gov]nm5t1 ! ag5cy 
%all prep>e & make available = public   

comm5t an initial privacy impact        
assessm5t t describes ! impact ( !      
propos$ rule on ! privacy ( individuals4
 ,su* assessm5t or a summ>y !re( %all be
 sign$ by ! s5ior ag5cy (ficial ) prim>y
 responsibility = privacy policy & be   
publi%$ 9 ! ,f$]al ,regi/] at ! "t ( !  
publication ( a g5]al notice ( propos$  
rulemak+ = ! rule4  7#b7 ,cont5ts ,ea*  
initial privacy impact assessm5t requir$
 "u ?is subsection %all conta9 ! foll[+3
  7,a7 ,a description & analysis ( !    
ext5t to :i* ! propos$ rule w impact !  
privacy int]e/s ( individuals1 includ+ !
 ext5t to :i* ! propos$ rule--  7i7     
provides notice ( ! collection (        
p]sonally id5tifiable in=mation1 &      
specifies :at p]sonally id5tifiable     
in=mation is to be collect$ & h[ x is to
 be collect$1 ma9ta9$1 us$1 & disclos$2 
7ii7 all[s access to su* in=mation by ! 
p]son to :om ! p]sonally id5tifiable    
in=mation p]ta9s & provides an          
opportunity to correct inaccuracies2    
7iii7 prev5ts su* in=mation1 :i* is     

collect$ = "o purpose1 f be+ us$ = ano!r
 purpose2 &  7iv7 provides security =   
su* in=mation1 includ+ ! provision (    
writt5 notice to any individual1 )9 #ad 
days ( ! date ( compromise1 ^: privacy  
int]e/s are compromis$ by ! unau?oriz$  
release ( p]sonally id5tifiable         
in=mation z a result ( a brea* (        
security at or by ! ag5cy4  7,b7 ,a     
description ( any significant           
alt]natives to ! propos$ rule :i*       
accompli% ! /at$ objectives ( applicable
 /atutes & :i* m9imize any significant  
privacy impact ( ! propos$ rule on      
individuals4  7b7 ,f9al privacy impact  
assessm5t  7#a7 ,9 g5]al ,:5ev] an ag5cy
 promulgates a f9al rule "u section #eec
 ( ?is title1 aft] be+ requir$ by t     
section or any o!r law to publi% a g5]al
 notice ( propos$ rulemak+1 or          
promulgates a f9al int]pretative rule   
involv+ ! int]nal rev5ue laws ( ! ,unit$
 ,/ates1 & su* rule or propos$ rulemak+ 
p]ta9s to ! collection1 ma9t5ance1 use1 
or disclosure ( p]sonally id5tifiable   

in=mation f #aj or m individuals1 o!r   
?an ag5cies1 in/rum5talities1 or        
employees ( ! ,f$]al ,gov]nm5t1 ! ag5cy 
%all prep>e a f9al privacy impact       
assessm5t1 sign$ by ! s5ior ag5cy       
(ficial ) prim>y responsibility =       
privacy policy4  7#b7 ,cont5ts ,ea* f9al
 privacy impact assessm5t requir$ "u ?is
 subsection %all conta9 ! foll[+3  7,a7 
,a description & analysis ( ! ext5t to  
:i* ! f9al rule w impact ! privacy      
int]e/s ( individuals1 includ+ ! ext5t  
to :i* su* rule--  7i7 provides notice (
 ! collection ( p]sonally id5tifiable   
in=mation1 & specifies :at p]sonally    
id5tifiable in=mation is to be collect$ 
& h[ x is to be collect$1 ma9ta9$1 us$1 
& disclos$2  7ii7 all[s access to su*   
in=mation by ! p]son to :om ! p]sonally 
id5tifiable in=mation p]ta9s & provides 
an opportunity to correct inaccuracies2 
7iii7 prev5ts su* in=mation1 :i* is     
collect$ = "o purpose1 f be+ us$ = ano!r
 purpose2 &  7iv7 provides security =   
su* in=mation1 includ+ ! provision (    

writt5 notice to any individual1 )9 #ad 
days ( ! date ( compromise1 ^: privacy  
int]e/s are compromis$ by ! unau?oriz$  
release ( p]sonally id5tifiable         
in=mation z a result ( a brea* (        
security at or by ! ag5cy4  7,b7 ,a     
summ>y ( any significant issues rais$ by
 ! public comm5ts 9 response to !       
initial privacy impact assessm5t1 a     
summ>y ( ! analysis ( ! ag5cy ( su*     
issues1 & a /atem5t ( any *anges made 9 
su* rule z a result ( su* issues4  7,c7 
,a description ( ! /eps ! ag5cy has tak5
 to m9imize ! significant privacy impact
 on individuals consi/5t ) ! /at$       
objectives ( applicable /atutes1 includ+
 a /atem5t ( ! factual1 policy1 & legal 
reasons = select+ ! alt]native adopt$ 9 
! f9al rule & :y ea* "o ( ! o!r         
significant alt]natives to ! rule       
consid]$ by ! ag5cy :i* affect ! privacy
 int]e/s ( individuals 0 reject$4  7#c7 
,availability to public ,! ag5cy %all   
make copies ( ! f9al privacy impact     
assessm5t available to memb]s ( ! public

 & %all publi% 9 ! ,f$]al ,regi/] su*   
assessm5t or a summ>y !re(4  7c7 ,waiv]s
  7#a7 ,em]g5cies ,an ag5cy head may    
waive or delay ! completion ( "s or all 
( ! requirem5ts ( subsections 7a7 & 7b7 
to ! same ext5t z ! ag5cy head may1 "u  
section #fjh1 waive or delay !          
completion ( "s or all ( ! requirem5ts (
 sections #fjc & #fjd1 respectively4    
7#b7 ,national security ,an ag5cy head  
may1 = national security reasons1 or to 
protect f disclosure classifi$          
in=mation1 confid5tial comm]cial        
in=mation1 or in=mation ! disclosure (  
:i* may adv]sely affect a law en=cem5t  
ef=t1 waive or delay ! completion ( "s  
or all ( ! foll[+ requirem5ts3  7,a7 ,! 
requirem5t ( subsection 7a77#a7 to make 
an assessm5t available = public comm5t1 
provid$ t su* assessm5t is made         
available1 9 classifi$ =m1 to !         
,committees on ! ,judici>y ( ! ,h\se (  
,repres5tatives & ! ,s5ate1 9 lieu (    
mak+ su* assessm5t available to !       
public4  7,b7 ,! requirem5t ( subsection

 7a77#a7 to h an assessm5t or summ>y    
!re( publi%$ 9 ! ,f$]al ,regi/]1 provid$
 t su* assessm5t or summ>y is made      
available1 9 classifi$ =m1 to !         
,committees on ! ,judici>y ( ! ,h\se (  
,repres5tatives & ! ,s5ate1 9 lieu (    
publi%+ su* assessm5t or summ>y 9 !     
,f$]al ,regi/]4  7,c7 ,! requirem5ts (  
subsection 7b77#c71 provid$ t ! f9al    
privacy impact assessm5t is made        
available1 9 classifi$ =m1 to !         
,committees on ! ,judici>y ( ! ,h\se (  
,repres5tatives & ! ,s5ate1 9 lieu (    
mak+ su* assessm5t available to ! public
 & publi%+ su* assessm5t 9 ! ,f$]al     
,regi/]4  7d7 ,proc$ures = ga!r+ comm5ts
 ,:5 any rule is promulgat$ :i* may h a 
significant privacy impact on           
individuals1 or a privacy impact on a   
sub/antial numb] ( individuals1 ! head (
 ! ag5cy promulgat+ ! rule or ! (ficial 
( ! ag5cy ) /atutory responsibility = ! 
promulgation ( ! rule %all assure t     
individuals h be5 giv5 an opportunity to
 p>ticipate 9 ! rulemak+ = ! rule ?r\gh 

te*niques su* z--  7#a7 ! inclusion 9 an
 advance notice ( propos$ rulemak+1 if  
issu$1 ( a /atem5t t ! propos$ rule may 
h a significant privacy impact on       
individuals1 or a privacy impact on a   
sub/antial numb] ( individuals2  7#b7 ! 
publication ( a g5]al notice ( propos$  
rulemak+ 9 publications ( national      
circulation likely to be obta9$ by      
individuals2  7#c7 ! direct notification
 ( int]e/$ individuals2  7#d7 ! conduct 
( op5 conf]5ces or public he>+s conc]n+ 
! rule = individuals1 includ+ solicit+ &
 receiv+ comm5ts ov] comput] networks2 &
  7#e7 ! adoption or modification (     
ag5cy proc$ural rules to r$uce ! co/ or 
complexity ( p>ticipation 9 ! rulemak+  
by individuals4  7e7 ,p]iodic review (  
rules  7#a7 ,9 g5]al ,ea* ag5cy %all    
c>ry out a p]iodic review ( ! rules     
promulgat$ by ! ag5cy t h a significant 
privacy impact on individuals1 or a     
privacy impact on a sub/antial numb] (  
individuals4 ,"u su* p]iodic review1 !  
ag5cy %all det]m9e1 = ea* su* rule1 :e!r

 ! rule c be am5d$ or resc9d$ 9 a mann] 
t m9imizes any su* impact :ile rema9+ 9 
accordance ) applicable /atutes4 ,= ea* 
su* det]m9ation1 ! ag5cy %all consid] ! 
foll[+ factors3  7,a7 ,! cont9u$ ne$ = !
 rule4  7,b7 ,! nature ( compla9ts or   
comm5ts receiv$ f ! public conc]n+ !    
rule4  7,c7 ,! complexity ( ! rule4     
7,d7 ,! ext5t to :i* ! rule ov]laps1    
duplicates1 or conflicts ) o!r ,f$]al   
rules1 &1 to ! ext5t feasible1 ) ,/ate &
 local gov]nm5tal rules4  7,e7 ,! l5g? (
 "t s9ce ! rule 0 la/ review$ "u ?is    
subsection4  7,f7 ,! degree to :i*      
te*nology1 economic conditions1 or o!r  
factors h *ang$ 9 ! area affect$ by !   
rule s9ce ! rule 0 la/ review$ "u ?is   
subsection4  7#b7 ,plan requir$ ,ea*    
ag5cy %all c>ry out ! p]iodic review    
requir$ by p>agraph 7#a7 9 accordance ) 
a plan publi%$ by su* ag5cy 9 ! ,f$]al  
,regi/]4 ,ea* su* plan %all provide = ! 
review "u ?is subsection ( ea* rule     
promulgat$ by ! ag5cy n lat] ?an #aj    
ye>s aft] ! date on :i* su* rule 0      

publi%$ z ! f9al rule &1 !reaft]1 n lat]
 ?an #aj ye>s aft] ! date on :i* su*    
rule 0 la/ review$ "u ?is subsection4 ,!
 ag5cy may am5d su* plan at any "t by   
publi%+ ! revision 9 ! ,f$]al ,regi/]4  
7#c7 ,annual publication ,ea* ye>1 ea*  
ag5cy %all publi% 9 ! ,f$]al ,regi/] a  
li/ ( ! rules to be review$ by su* ag5cy
 "u ?is subsection dur+ ! foll[+ ye>4 ,!
 li/ %all include a brief description ( 
ea* su* rule & ! ne$ = & legal basis (  
su* rule & %all invite public comm5t ^u 
! det]m9ation to be made "u ?is         
subsection ) respect to su* rule4  7f7  
,judicial review  7#a7 ,9 g5]al ,= any  
rule subject to ?is section1 an         
individual :o is adv]sely affect$ or    
aggriev$ by f9al ag5cy action is entitl$
 to judicial review ( ag5cy compliance )
 ! requirem5ts ( subsections 7b7 & 7c7 9
 accordance ) *apt] #g4 ,ag5cy          
compliance ) subsection 7d7 %all be     
judicially reviewable 9 connection )    
judicial review ( subsection 7b74  7#b7 
,jurisdiction ,ea* c\rt hav+            

jurisdiction to review su* rule =       
compliance ) section #eec1 or "u any o!r
 provision ( law1 %all h jurisdiction to
 review any claims ( noncompliance )    
subsections 7b7 & 7c7 9 accordance )    
*apt] #g4 ,ag5cy compliance ) subsection
 7d7 %all be judicially reviewable 9    
connection ) judicial review (          
subsection 7b74  7#c7 ,limitations  7,a7
 ,an individual may seek su* review dur+
 ! p]iod beg9n+ on ! date ( f9al ag5cy  
action & end+ #a ye> lat]1 except t :]e 
a provision ( law requires t an action  
*all5g+ a f9al ag5cy action be comm5c$  
be=e ! expiration ( #a ye>1 su* less]   
p]iod %all apply to an action = judicial
 review "u ?is subsection4  7,b7 ,9 !   
case :]e an ag5cy delays ! issuance ( a 
f9al privacy impact assessm5t pursuant  
to subsection 7c71 an action = judicial 
review "u ?is section %all be fil$ n    
lat] ?an--  7i7 #a ye> aft] ! date !    
assessm5t is made available to ! public2
 or  7ii7 :]e a provision ( law requires
 t an action *all5g+ a f9al ag5cy       

regulation be comm5c$ be=e ! expiration 
( ! #a-ye> p]iod1 ! numb] ( days        
specifi$ 9 su* provision ( law t is aft]
 ! date ! assessm5t is made available to
 ! public4  7#d7 ,relief ,9 grant+ any  
relief 9 an action "u ?is subsection1 ! 
c\rt %all ord] ! ag5cy to take          
corrective action consi/5t ) ?is section
 & *apt] #g1 & may--  7,a7 rem& ! rule  
to ! ag5cy2 &  7,b7 def] ! en=cem5t ( ! 
rule aga9/ individuals1 unless ! c\rt   
f9ds t cont9u$ en=cem5t ( ! rule is 9 ! 
public int]e/4  7#e7 ,rule ( con/ruction
 ,no?+ 9 ?is subsection limits !        
au?ority ( any c\rt to /ay ! effective  
date ( any rule or provision !re( "u any
 o!r provision ( law or to grant any o!r
 relief 9 addition to ! requirem5ts (   
?is subsection4  7#f7 ,record ( ag5cy   
action ,9 an action = ! judicial review 
( a rule1 ! privacy impact assessm5t =  
su* rule1 includ+ an assessm5t prep>$ or
 correct$ pursuant to p>agraph 7#d71    
%all con/itute "p ( ! entire record (   
ag5cy action 9 connection ) su* review4 

7#g7 ,exclusivity ,compliance or        
noncompliance by an ag5cy ) ! provisions
 ( ?is section %all be subject to       
judicial review only 9 accordance ) ?is 
subsection4  7#h7 ,sav+s clause ,no?+ 9 
?is subsection b>s judicial review ( any
 o!r impact /atem5t or simil> assessm5t 
requir$ by any o!r law if judicial      
review ( su* /atem5t or assessm5t is    
o!rwise p]mitt$ by law4  7g7 ,def9ition 
,= purposes ( ?is section1 ! t]m        
p]sonally id5tifiable in=mation means   
in=mation t c be us$ to id5tify an      
individual1 includ+ su* individual's "n1
 address1 telephone numb]1 photograph1  
social security numb] or o!r id5tify+   
in=mation4 ,x includes in=mation ab\t   
su* individual's m$ical or f9ancial     
condition4  4  7b7 ,p]iodic review      
transition provisions  7#a7 ,initial    
plan ,= ea* ag5cy1 ! plan requir$ by    
subsection 7e7 ( section #eec;a ( title 
#e1 ,unit$ ,/ates ,code 7z add$ by      
subsection 7a771 %all be publi%$ n lat] 
?an #ahj days aft] ! date ( ! enactm5t (

 ?is ,act4  7#b7 ,review p]iod ,9 ! case
 ( a rule promulgat$ by an ag5cy be=e ! 
date ( ! enactm5t ( ?is ,act1 su* plan  
%all provide = ! p]iodic review ( su*   
rule be=e ! expiration ( ! #aj-ye> p]iod
 beg9n+ on ! date ( ! enactm5t ( ?is    
,act4 ,= any su* rule1 ! head ( ! ag5cy 
may provide = a #a-ye> ext5sion ( su*   
p]iod if ! head ( ! ag5cy1 be=e !       
expiration ( ! p]iod1 c]tifies 9 a      
/atem5t publi%$ 9 ! ,f$]al ,regi/] t    
review+ su* rule be=e ! expiration ( !  
p]iod is n feasible4 ,! head ( ! ag5cy  
may provide = additional #a-ye>         
ext5sions ( ! p]iod pursuant to ! prec$+
 s5t5ce1 b 9 no ev5t may ! p]iod exce$  
#ae ye>s4  7c7 ,congressional review    
,section #hja7;a77#a77;,b7 ( title #e1  
,unit$ ,/ates ,code1 is am5d$--  7#a7 by
 r$esignat+ clauses 7iii7 & 7iv7 z      
clauses 7iv7 & 7v71 respectively2 &     
7#b7 by ins]t+ aft] clause 7ii7 ! foll[+
 new clause3  7iii7 ! ag5cy's actions   
relevant to section #eec;a2  4  7d7     
,cl]ical am5dm5t ,! table ( sections at 

! beg9n+ ( *apt] #e ( title #e1 ,unit$  
,/ates ,code1 is am5d$ by add+ aft] !   
item relat+ to section #eec ! foll[+ new
 item3  #eec;a4 ,privacy impact         
assessm5t 9 rulemak+4  4