,,ii  #aaith ,,congress  #ast ,session  
,s4 #cafa  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,november #g1  
#bjbe ,ms4 ,slotkin 7for herself and    
,ms4 ,ernst7 introduced the following   
bill2 which was read twice and referred 
to the ,committee on ,armed ,services   
,a ,,bill  ,to enhance protection of    
data affecting operational security of  
,department of ,defense personnel1 and  
for other purposes4  #a4  ,short title  
,this ,act may be cited as the          
,protecting ,,dod ,data ,act of #bjbe4  
#b4  ,enhanced protection of data       
affecting operational security of       
,department of ,defense personnel  7a7  
,priorities for protection of personal  
data for operational security  ,in      
carrying out the duties of the          
,secretary of ,defense1 the ,secretary  
shall identify and prioritize the       
protection of personal data that is     
related to or may have impacts on the   
operational security of members of the  
,armed ,forces and civilian employees of

 the ,department of ,defense through the
 prevention of collection1 use1         
dissemination1 or retention of such data
 that does not conform with provisions  
of law and practices relating to privacy
 that were in effect on the day before  
the date of the enactment of this ,act4 
7b7  ,review and issuance of new        
guidance related to protection of       
personal data related to operational    
security  ,not later than ,june #a1     
#bjbf1 the ,secretary of ,defense shall 
review all applicable guidance and      
policy relating to the protection of    
personal data that is related to or may 
have impacts on the operational security
 of ,department personnel and1 if       
necessary1 issue revised or new guidance
 for enhanced protection measures for   
such data4 ,such guidance shall cover   
provisions of law and practices relating
 to privacy and personnel security that 
were in effect on the day before the    
date of the enactment of this ,act4  7c7
  ,storage of data  7#a7  ,limitation   

,the ,secretary shall ensure that no    
,department personal data related to or 
that may have impacts on the operational
 security of ,department personnel is   
stored on a non-,department server or   
cloud service except pursuant to a      
contract or other agreement entered into
 by the ,secretary and a contractor or  
subcontractor of the ,department or1 for
 personnel data1 with the permission of 
the data subject4  7#b7  ,waivers  ,the 
,secretary may waive paragraph 7#a7 in a
 case in which the ,secretary certifies 
in writing that such waiver--  7,a7     
appropriately considers the operational 
security risks to an employee of the    
,department with respect to whom such   
data may relate2  7,b7 does not pose a  
risk to national security2 and  7,c7 is 
necessary in the interest of national   
security4  7d7  ,congressional          
notification of changes to ,departmental
 issuances  7#a7  ,in general  ,not     
later than #cj days after the date on   
which the ,secretary changes a          

,department issuance relating to the    
protection of personal data that is     
related to or may have impacts on the   
operational security of ,department     
personnel1 the ,secretary shall submit  
to ,congress notice of the change4  7#b7
  ,sunset  ,the requirement of paragraph
 7#a7 shall terminate on the date that  
is five years after the date of the     
enactment of this ,act4  7e7            
,congressional notification of events   
7#a7  ,in general  ,not later than #cj  
days after the date of the occurrence of
 an event described in paragraph 7#b71  
the ,secretary shall submit to ,congress
 notice of the event4  7#b7  ,events    
described  ,an event described in this  
paragraph is an occurrence of an event  
in which--  7,a7 the ,secretary issues a
 waiver under subsection 7c77#b72  7,b7 
personal data related to or that may    
have an impact on operational security  
of ,department personnel is not stored  
according to ,department regulations or 
exfiltrated in violation of ,department 

regulations2  7,c7 personal data related
 to or that may have an impact on       
operational security of ,department     
personnel is stored on a non-,department
 server or cloud service that has not   
undergone an authorization process in   
accordance with ,department regulations2
 or  7,d7 personal data related to or   
that may have an impact on operational  
security of ,department of ,defense     
personnel is exposed in any             
cybersecurity incident4  7f7            
,standards1 training1 and reporting     
processes for system owners  7#a7  ,in  
general  ,the ,secretary shall develop  
standards1 training1 reporting1 and     
security debriefing requirements for    
,department personnel who receive write 
or read access privileges as system     
owners across more than one platform of 
,department information systems that    
hosts personal data related to or that  
may have an impact on operational       
security of ,department personnel4  7#b7
  ,security debriefings  ,the ,secretary

 shall ensure that personnel described  
in paragraph 7#a7 are provided regular  
security debriefings1 including after   
departing the ,department4  7#c7        
,notification of congress under certain 
circumstances  ,not later than #cj days 
after the completion of the development 
of the standards1 training1 reporting1  
and security debriefing requirements in 
paragraph 7#a7 the ,secretary shall     
submit to ,congress details of the      
requirements4