HR1877-119

3. Civil damages for unauthorized access or disclosure of certain information Section 1106 of the Social Security Act (42 U.S.C. 1301) is further amended by adding after subsection (h), as added by section 2, the following: If any officer or employee of the United States negligently discloses or accesses any information that pertains to an individual in violation of any provision of subsection (a) or (h), such individual may bring a civil action for damages against the United States in a district court of the United States. If any person who is not an officer or employee of the United States negligently discloses or accesses any information that pertains to an individual in violation of any provision of subsection (a) or (h), such individual may bring a civil action for damages against such person in a district court of the United States. No liability shall arise under this section with respect to any disclosure or access— which results from a good faith, but erroneous, interpretation of subsection (a) or (h); or which is requested by the individual. In any action brought under paragraph (1), upon a finding of liability on the part of the defendant, the defendant shall be liable to the plaintiff in an amount equal to the sum of— the greater of— $5,000 for each act of unauthorized access or disclosure with respect to which such defendant is found liable; or the sum of— the actual damages sustained by the plaintiff as a result of such unauthorized access or disclosure, plus in the case of a willful access or disclosure or an access or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action, plus reasonable attorneys fees, except that if the defendant is the United States, reasonable attorneys fees may be awarded only if the plaintiff is the prevailing party. Notwithstanding any other provision of law, an action to enforce any liability created under this section may be brought, without regard to the amount in controversy, at any time within 2 years after the date of discovery by the plaintiff of the unauthorized disclosure or access. If any person is criminally charged by indictment or information with disclosing or accessing any information that pertains to an individual in violation of subsection (a) or (h), the Commissioner of Social Security shall notify such individual as soon as practicable of such disclosure or access. The Commissioner shall also notify such individual if a Federal or State agency (upon notice to the Commissioner by such Federal or State agency) proposes an administrative determination as to disciplinary or adverse action against an employee arising from the employee’s unauthorized disclosure or access of the individual’s information. The notice described in this subsection shall include the date of the unauthorized disclosure or access and the rights of the individual under such administrative determination. (i)Civil penalties(1)In general(A)Disclosure or access by employee of United StatesIf any officer or employee of the United States negligently discloses or accesses any information that pertains to an individual in violation of any provision of subsection (a) or (h), such individual may bring a civil action for damages against the United States in a district court of the United States.(B)Disclosure or access by a person who is not an employee of United StatesIf any person who is not an officer or employee of the United States negligently discloses or accesses any information that pertains to an individual in violation of any provision of subsection (a) or (h), such individual may bring a civil action for damages against such person in a district court of the United States.(2)ExceptionsNo liability shall arise under this section with respect to any disclosure or access—(A)which results from a good faith, but erroneous, interpretation of subsection (a) or (h); or(B)which is requested by the individual.(3)DamagesIn any action brought under paragraph (1), upon a finding of liability on the part of the defendant, the defendant shall be liable to the plaintiff in an amount equal to the sum of—(A)the greater of—(i)$5,000 for each act of unauthorized access or disclosure with respect to which such defendant is found liable; or(ii)the sum of—(I)the actual damages sustained by the plaintiff as a result of such unauthorized access or disclosure, plus(II)in the case of a willful access or disclosure or an access or disclosure which is the result of gross negligence, punitive damages, plus(B)the costs of the action, plus(C)reasonable attorneys fees, except that if the defendant is the United States, reasonable attorneys fees may be awarded only if the plaintiff is the prevailing party.(4)Period for bringing actionNotwithstanding any other provision of law, an action to enforce any liability created under this section may be brought, without regard to the amount in controversy, at any time within 2 years after the date of discovery by the plaintiff of the unauthorized disclosure or access.(5)Notification of unlawful disclosure or accessIf any person is criminally charged by indictment or information with disclosing or accessing any information that pertains to an individual in violation of subsection (a) or (h), the Commissioner of Social Security shall notify such individual as soon as practicable of such disclosure or access. The Commissioner shall also notify such individual if a Federal or State agency (upon notice to the Commissioner by such Federal or State agency) proposes an administrative determination as to disciplinary or adverse action against an employee arising from the employee’s unauthorized disclosure or access of the individual’s information. The notice described in this subsection shall include the date of the unauthorized disclosure or access and the rights of the individual under such administrative determination..