PRIA, Government Policy, Made Personal

Summary

The Secretary must appoint a senior privacy official who reports directly to the Secretary and leads privacy policy for the Department. That official must make sure technology and department actions protect people’s personal information, follow the Privacy Act of 1974, review proposed laws and rules that affect privacy, and do privacy impact checks on Department rules (including what data is collected and how many people are affected). The official can access Department records, do investigations and reports, and—if the Secretary agrees—issue subpoenas to non‑federal people. The official can also take oaths or affidavits. Subpoenas can be enforced by a U.S. district court. The official must send Congress an annual report about privacy matters, complaints, and internal controls. The official must work under the Secretary and coordinate with the Inspector General to avoid overlap. Before investigating possible misuse of a program, the official must first send the matter to the Inspector General. The Inspector General has 30 days to say if they will open an audit or investigation and must tell the official. If the Inspector General says they will but does not start within 90 days, they must tell the official within 3 days. Then the official may investigate. Inspector General staff who work on these referrals must get privacy training. If the Secretary removes or moves the official, the Secretary must quickly tell both Houses of Congress and explain why. The official can report to Congress directly and must notify two congressional committees within 30 days if a subpoena request is denied or changed, or within 45 days if the Secretary has not acted.

Title 6, §142

Domestic Security, Source: USLM XML via OLRC

(a)Appointment and responsibilities

The Secretary shall appoint a senior official in the Department, who shall report directly to the Secretary, to assume primary responsibility for privacy policy, including—

(1)assuring that the use of technologies sustain, and do not erode, privacy protections relating to the use, collection, and disclosure of personal information;

(2)assuring that personal information contained in Privacy Act systems of records is handled in full compliance with fair information practices as set out in the Privacy Act of 1974 [5 U.S.C. 552a];

(3)evaluating legislative and regulatory proposals involving collection, use, and disclosure of personal information by the Federal Government;

(4)conducting a privacy impact assessment of proposed rules of the Department or that of the Department on the privacy of personal information, including the type of personal information collected and the number of people affected;

(5)coordinating with the Officer for Civil Rights and Civil Liberties to ensure that—

(A)programs, policies, and procedures involving civil rights, civil liberties, and privacy considerations are addressed in an integrated and comprehensive manner; and

(B)Congress receives appropriate reports on such programs, policies, and procedures; and

(6)preparing a report to Congress on an annual basis on activities of the Department that affect privacy, including complaints of privacy violations, implementation of the Privacy Act of 1974 [5 U.S.C. 552a], internal controls, and other matters.

(b)Authority to investigate

(1)In general

The senior official appointed under subsection (a) may—

(A)have access to all records, reports, audits, reviews, documents, papers, recommendations, and other materials available to the Department that relate to programs and operations with respect to the responsibilities of the senior official under this section;

(B)make such investigations and reports relating to the administration of the programs and operations of the Department as are, in the senior official’s judgment, necessary or desirable;

(C)subject to the approval of the Secretary, require by subpoena the production, by any person other than a Federal agency, of all information, documents, reports, answers, records, accounts, papers, and other data and documentary evidence necessary to performance of the responsibilities of the senior official under this section; and

(D)administer to or take from any person an oath, affirmation, or affidavit, whenever necessary to performance of the responsibilities of the senior official under this section.

(2)Enforcement of subpoenas

Any subpoena issued under paragraph (1)(C) shall, in the case of contumacy or refusal to obey, be enforceable by order of any appropriate United States district court.

(3)Effect of oaths

Any oath, affirmation, or affidavit administered or taken under paragraph (1)(D) by or before an employee of the Privacy Office designated for that purpose by the senior official appointed under subsection (a) shall have the same force and effect as if administered or taken by or before an officer having a seal of office.

(c)Supervision and coordination

(1)In general

The senior official appointed under subsection (a) shall—

(A)report to, and be under the general supervision of, the Secretary; and

(B)coordinate activities with the Inspector General of the Department in order to avoid duplication of effort.

(2)Coordination with the Inspector General

(A)In general

Except as provided in subparagraph (B), the senior official appointed under subsection (a) may investigate any matter relating to possible violations or abuse concerning the administration of any program or operation of the Department relevant to the purposes under this section.

(B)Coordination

(i)Referral

Before initiating any investigation described under subparagraph (A), the senior official shall refer the matter and all related complaints, allegations, and information to the Inspector General of the Department.

(ii)Determinations and notifications by the Inspector General

(I)In general

Not later than 30 days after the receipt of a matter referred under clause (i), the Inspector General shall—

(aa)make a determination regarding whether the Inspector General intends to initiate an audit or investigation of the matter referred under clause (i); and

(bb)notify the senior official of that determination.

(II)Investigation not initiated

If the Inspector General notifies the senior official under subclause (I)(bb) that the Inspector General intended to initiate an audit or investigation, but does not initiate that audit or investigation within 90 days after providing that notification, the Inspector General shall further notify the senior official that an audit or investigation was not initiated. The further notification under this subclause shall be made not later than 3 days after the end of that 90-day period.

(iii)Investigation by senior official

The senior official may investigate a matter referred under clause (i) if—

(I)the Inspector General notifies the senior official under clause (ii)(I)(bb) that the Inspector General does not intend to initiate an audit or investigation relating to that matter; or

(II)the Inspector General provides a further notification under clause (ii)(II) relating to that matter.

(iv)Privacy training

Any employee of the Office of Inspector General who audits or investigates any matter referred under clause (i) shall be required to receive adequate training on privacy laws, rules, and regulations, to be provided by an entity approved by the Inspector General in consultation with the senior official appointed under subsection (a).

(d)Notification to Congress on removal

If the Secretary removes the senior official appointed under subsection (a) or transfers that senior official to another position or location within the Department, the Secretary shall—

(1)promptly submit a written notification of the removal or transfer to Houses of Congress; and

(2)include in any such notification the reasons for the removal or transfer.

(e)Reports by senior official to Congress

The senior official appointed under subsection (a) shall—

(1)submit reports directly to the Congress regarding performance of the responsibilities of the senior official under this section, without any prior comment or amendment by the Secretary, Deputy Secretary, or any other officer or employee of the Department or the Office of Management and Budget; and

(2)inform the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives not later than—

(A)30 days after the Secretary disapproves the senior official’s request for a subpoena under subsection (b)(1)(C) or the Secretary substantively modifies the requested subpoena; or

(B)45 days after the senior official’s request for a subpoena under subsection (b)(1)(C), if that subpoena has not either been approved or disapproved by the Secretary.

Notes & Related Subsidiaries

Editorial Notes

References in Text

The Privacy Act of 1974, referred to in subsec. (a)(2), (6), is Pub. L. 93–579, Dec. 31, 1974, 88 Stat. 1896, which enacted section 552a of Title 5, Government Organization and Employees, and provisions set out as notes under section 552a of Title 5. For complete classification of this Act to the Code, see

Short Title

of 1974 Amendment note set out under section 552a of Title 5 and Tables.

Amendments

2007—Pub. L. 110–53 designated existing provisions as subsec. (a), inserted heading, and added subsecs. (b) to (e). 2004—Pub. L. 108–458, § 8305(1), inserted “, who shall report directly to the Secretary,” after “in the Department” in introductory provisions. Pars. (5), (6). Pub. L. 108–458, § 8305(2)–(4), added par. (5) and redesignated former par. (5) as (6).

§142 Privacy Officer