Each agency shall have a Chief Privacy Officer to assume primary responsibility for privacy and data protection policy, including—
(1)assuring that the use of technologies sustain, and do not erode, privacy protections relating to the use, collection, and disclosure of information in an identifiable form;
(2)assuring that technologies used to collect, use, store, and disclose information in identifiable form allow for continuous auditing of compliance with stated privacy policies and practices governing the collection, use and distribution of information in the operation of the program;
(3)assuring that personal information contained in Privacy Act systems of records is handled in full compliance with fair information practices as defined in the Privacy Act of 1974 [5 U.S.C. 552a];
(4)evaluating legislative and regulatory proposals involving collection, use, and disclosure of personal information by the Federal Government;
(5)conducting a privacy impact assessment of proposed rules of the Department on the privacy of information in an identifiable form, including the type of personally identifiable information collected and the number of people affected;
(6)preparing a report to Congress on an annual basis on activities of the Department that affect privacy, including complaints of privacy violations, implementation of section
552a of title
5, 11  internal controls, and other relevant matters;
(7)ensuring that the Department protects information in an identifiable form and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction;
(8)training and educating employees on privacy and data protection policies to promote awareness of and compliance with established privacy and data protection policies; and
(9)ensuring compliance with the Departments  established privacy and data protection policies.
(b) Establishing privacy and data protection procedures and policies
(1) 3 In general
Within 12 months of December 8, 2004, each agency shall establish and implement comprehensive privacy and data protection procedures governing the agency’s collection, use, sharing, disclosure, transfer, storage and security of information in an identifiable form relating to the agency employees and the public. Such procedures shall be consistent with legal and regulatory guidance, including OMB regulations, the Privacy Act of 1974 [5 U.S.C. 552a], and section 208 of the E-Government Act of 2002.
Each agency shall prepare a written report of its use of information in an identifiable form, along with its privacy and data protection policies and procedures and record it with the Inspector General of the agency to serve as a benchmark for the agency. Each report shall be signed by the agency privacy officer to verify that the agency intends to comply with the procedures in the report. By signing the report the privacy officer also verifies that the agency is only using information in identifiable form as detailed in the report.
(d) Inspector General review
The Inspector General of each agency shall periodically conduct a review of the agency’s implementation of this section and shall report the results of its review to the Committees on Appropriations of the House of Representatives and the Senate, the House Committee on Oversight and Government Reform, and the Senate Committee on Homeland Security and Governmental Affairs. The report required by this review may be incorporated into a related report to Congress otherwise required by law including, but not limited to, section
3545 of title
44, the Federal Information Security Management Act of 2002. The Inspector General may contract with an independent, third party organization to conduct the review.
(1) In general
Upon completion of a review, the Inspector General of an agency shall submit to the head of that agency a detailed report on the review, including recommendations for improvements or enhancements to management of information in identifiable form, and the privacy and data protection procedures of the agency.
(2) Internet availability
Each agency shall make each independent third party review, and each report of the Inspector General relating to that review available to the public.
In this section, the definition of “identifiable form” is consistent with Public Law 107–347, the E-Government Act of 2002, and means any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.
The Privacy Act of 1974, referred to in subsecs. (a)(3) and (b)(1), is Pub. L. 93–579, Dec. 31, 1974, 88 Stat. 1896, which enacted section
552a of Title
5, Government Organization and Employees, and provisions set out as notes under section
552a of Title
5. For complete classification of this Act to the Code, see Short Title of 1974 Amendment note set out under section
552a of Title
5 and Tables.
The Federal Information Security Management Act of 2002, referred to in subsec. (d), is the statutory short title for title III of Pub. L. 107–347, Dec. 17, 2002, 116 Stat. 2946, and for title X of Pub. L. 107–296, Nov. 25, 116 Stat. 2259. For complete classification of these Acts to the Code, see Short Title of 2002 Amendments note set out under section
101 of Title
44, Public Printing and Documents, Short Title note set out under section
101 of Title
6, Domestic Security, and Tables.
The E-Government Act of 2002, referred to in subsec. (f), is Pub. L. 107–347, Dec. 17, 2002, 116 Stat. 2899. Section 208 of the Act is set out as a note under section
3501 of Title
44, Public Printing and Documents. For complete classification of this Act to the Code, see Short Title of 2002 Amendments note set out under section
101 of Title
44 and Tables.
Section was formerly set out as a note under section
552a of Title
5, Government Organization and Employees.
2007—Subsec. (d). Pub. L. 110–161added subsec. (d) and struck out former subsec. (d) which related to independent, third-party reviews.
The table below lists the classification updates, since Jan. 3, 2012, for this section. Updates to a broader range of sections may be found at the update page for containing chapter, title, etc.
The most recent Classification Table update that we have noticed was Tuesday, August 13, 2013
An empty table indicates that we see no relevant changes listed in the classification tables. If you suspect that our system may be missing something, please double-check with the Office of the Law Revision Counsel.
Description of Change
Statutes at Large
LII has no control over and does not endorse any external Internet site that contains links to or references LII.