,i  #aacth ,,congress  #b;d ,session    
,h4 ,r4 #dbae  ,,in ,,the ,,house ,,of  
,,representatives  ,march #ab1 #bjad    
,mr4 ,connolly introduced the following 
bill2 which was referred to the         
,committee on ,oversight and ,government
 ,reform  ,a ,,bill  ,to strengthen     
privacy and data security1 and for other
 purposes4  #a4 ,short title ,this ,act 
may be cited as the ,federal ,agency    
,data ,breach ,notification ,act of     
#bjad4  #b4 ,privacy breach requirements
  7a7 ,information security  7#a7       
,amendment ,subchapter ,,iii of chapter 
#ce of title #dd1 ,united ,states ,code1
 is amended by adding at the end the    
following3  #ceej4 ,privacy breach      
requirements  7a7 ,policies and         
,procedures ,the ,director of the       
,office of ,management and ,budget shall
 establish and oversee policies and     
procedures for agencies to follow in the
 event of a breach of information       
security involving the disclosure of    
personally identifiable information1    

including requirements for--  7#a7 not  
later than #gb hours after the agency   
discovers such a breach1 or discovers   
evidence that reasonably indicates such 
a breach has occurred1 notice to the    
individuals whose personally            
identifiable information could be       
compromised as a result of such breach2 
7#b7 timely reporting to a ,federal     
cybersecurity center1 as designated by  
the ,director of the ,office of         
,management and ,budget2 and  7#c7 any  
additional actions that the ,director   
finds necessary and appropriate1        
including data breach analysis1 fraud   
resolution services1 identity theft     
insurance1 and credit protection or     
monitoring services4  7b7 ,required     
,agency ,action ,the head of each agency
 shall ensure that actions taken in     
response to a breach of information     
security involving the disclosure of    
personally identifiable information     
under the authority or control of the   
agency comply with policies and         

procedures established by the ,director 
of the ,office of ,management and       
,budget under subsection 7a74  7c7      
,report ,not later than ,march #a of    
each year1 the ,director of the ,office 
of ,management and ,budget shall report 
to ,congress on agency compliance with  
the policies and procedures established 
under subsection 7a74  7d7 ,federal     
cybersecurity center defined ,the term  
,federal cybersecurity center means any 
of the following3  7#a7 ,the ,department
 of ,defense ,cyber ,crime ,center4     
7#b7 ,the ,intelligence ,community      
,incident ,response ,center4  7#c7 ,the 
,united ,states ,cyber ,command ,joint  
,operations ,center4  7#d7 ,the         
,national ,cyber ,investigative ,joint  
,task ,force4  7#e7 ,central ,security  
,service ,threat ,operations ,center of 
the ,national ,security ,agency4  7#f7  
,the ,united ,states ,computer          
,emergency ,readiness ,team4  7#g7 ,any 
successor to a center1 team1 or task    
force described in paragraphs 7#a7      

through 7#f74  7#h7 ,any center that the
 ,director of the ,office of ,management
 and ,budget determines is appropriate  
to carry out the requirements of this   
section4  4  7#b7 ,technical and        
,conforming ,amendment ,the table of    
sections for subchapter ,,iii of chapter
 #ce of title #dd1 ,united ,states      
,code1 is amended by adding at the end  
the following3  #ceej4 ,privacy breach  
requirements4  4  7b7 ,amendments to the
 ,e-,government ,act of #bjjb ,section  
#bjh7;b77#a77;,a7 of the ,e-,government 
,act of #bjjb 7#dd ,u4,s4,c4 #ceja note2
 ,public ,law #ajg-cdg7 is amended--    
7#a7 in clause 7i71 by striking or at   
the end2  7#b7 in clause 7ii71 by       
striking the period at the end and      
inserting 2 or2 and  7#c7 by adding at  
the end the following new clause3  7iii7
 using information in an identifiable   
form purchased1 or subscribed to for a  
fee1 from a commercial data source4  4  
7c7 ,authority of the ,director of the  
,office of ,management and ,budget with 

respect to federal information policy   
,section #cejd7;g7 of title #dd1 ,united
 ,states ,code1 is amended--  7#a7 in   
paragraph 7#a71 by striking and at the  
end2  7#b7 in paragraph 7#b71 by        
striking 4 and and inserting 2 and2 and 
7#c7 by adding at the end the following 
new paragraph3  7#c7 designate a        
,federal ,chief ,privacy ,officer within
 the ,office of ,management and ,budget 
who is a noncareer appointee in a       
,senior ,executive ,service position and
 who is a trained and experienced       
privacy professional to carry out the   
responsibilities of the ,director with  
regard to privacy4  4