S2292-118

1. Short title This Act may be cited as the Purchased Data Inventory Act.

2. Definitions Section 3502 of title 44, United States Code, is amended— in paragraph (22), by striking ; and; in paragraph (23), by striking the period and inserting a semicolon; and by adding at the end the following: the term covered data purchase— means data or information, including data or information accessed through a database, that is— obtained by an agency in exchange for anything of value; and reasonably can be used, alone or in combination with other data or information, to identify an individual; does not include bulk data obtained by an agency to be used for statistical purposes; and does not include data obtained in exchange for anything of value from another agency; and the term obtain in exchange for anything of value means to purchase, receive in connection with services provided for consideration, or otherwise obtain in exchange for considerations, including an access fee, service fee, maintenance fee, or licensing fee. (24)the term covered data purchase—(A)means data or information, including data or information accessed through a database, that is—(i)obtained by an agency in exchange for anything of value; and(ii)reasonably can be used, alone or in combination with other data or information, to identify an individual;(B)does not include bulk data obtained by an agency to be used for statistical purposes; and(C)does not include data obtained in exchange for anything of value from another agency; and(25)the term obtain in exchange for anything of value means to purchase, receive in connection with services provided for consideration, or otherwise obtain in exchange for considerations, including an access fee, service fee, maintenance fee, or licensing fee..

3. Chief Data Officers Section 3520 of title 44, United States Code, is amended— in subsection (c)— in paragraph (13), by striking and; in paragraph (14), by striking the period and inserting ; and; and by adding at the end the following: compile the covered data purchases of the agency. by striking subsection (e) and inserting the following: The Chief Data Officer of an agency shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Accountability of the House of Representatives— an annual report on the compliance of the agency with the requirements of this subchapter, including information on each requirement that the agency could not carry out and, if applicable, what the agency needs to carry out such requirement; and an annual report on the covered data purchases of the agency described in subsection (f), which may include an annex of any material that is properly classified pursuant to an Executive order. by adding at the end the following: Not later than 180 days after the date of enactment of this subsection, and annually thereafter the Chief Data Officer of each agency shall compile a report on the covered data purchases of each agency. The Chief Data Officer Council, in consultation with the Federal Privacy Council, or any successor thereto, and the Chief Acquisition Officer Council, shall provide direction to the Chief Data Officers of each agency for consistent interpretation of this section. The report described in paragraph (1) shall include, with respect to each covered data purchase made by the agency during the 3-year period before the date on which the report is submitted— a plain language description of the purpose of the covered data purchase, including, if applicable, a justification for obtaining the data in exchange for anything of value rather than acquiring the data through other means, including through the use of interagency data sharing, subpoena, or other process; if applicable, the procurement instrument identifier for the covered data purchase; the identity of the vendor that provided the covered data purchase; if applicable, links to the relevant privacy documents, including systems of records notices and privacy impact assessments; a plain language description of the contents of the data contained in the covered data purchase; the number of distinct individuals who are reasonably linkable in the covered data purchase; an indication of whether data contained in the covered data purchase is reflected in the data inventory of the agency, as required under section 3511 of title 44, United States Code; and an indication of whether the covered data purchase includes data, metadata, or information relating to— location; electronic device usage; the contents of communications of an individual with other individuals; communications metadata; network system traffic; web browsing history; social media history; media consumption; health; purchase history; personal finances or credit; education; work history; interests; biometrics; identifiable characteristics of protected classes; criminal history; court records, including civil cases; and the family members or friends of an individual. Each agency shall make the report submitted under paragraph (1) available to the public on the website of the agency in a machine-readable, open format and without restrictions on reuse, except for an annex described in subparagraph (B). A report under subparagraph (A) shall include in an annex any necessary information that is properly classified pursuant to an Executive order. (15)compile the covered data purchases of the agency.; (e)ReportsThe Chief Data Officer of an agency shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Accountability of the House of Representatives—(1)an annual report on the compliance of the agency with the requirements of this subchapter, including information on each requirement that the agency could not carry out and, if applicable, what the agency needs to carry out such requirement; and(2)an annual report on the covered data purchases of the agency described in subsection (f), which may include an annex of any material that is properly classified pursuant to an Executive order.; and (f)Covered data purchases(1)ReportNot later than 180 days after the date of enactment of this subsection, and annually thereafter the Chief Data Officer of each agency shall compile a report on the covered data purchases of each agency.(2)ConsistencyThe Chief Data Officer Council, in consultation with the Federal Privacy Council, or any successor thereto, and the Chief Acquisition Officer Council, shall provide direction to the Chief Data Officers of each agency for consistent interpretation of this section.(3)Contents of reportThe report described in paragraph (1) shall include, with respect to each covered data purchase made by the agency during the 3-year period before the date on which the report is submitted—(A)a plain language description of the purpose of the covered data purchase, including, if applicable, a justification for obtaining the data in exchange for anything of value rather than acquiring the data through other means, including through the use of interagency data sharing, subpoena, or other process;(B)if applicable, the procurement instrument identifier for the covered data purchase;(C)the identity of the vendor that provided the covered data purchase;(D)if applicable, links to the relevant privacy documents, including systems of records notices and privacy impact assessments;(E)a plain language description of the contents of the data contained in the covered data purchase;(F)the number of distinct individuals who are reasonably linkable in the covered data purchase;(G)an indication of whether data contained in the covered data purchase is reflected in the data inventory of the agency, as required under section 3511 of title 44, United States Code; and(H)an indication of whether the covered data purchase includes data, metadata, or information relating to—(i)location;(ii)electronic device usage;(iii)the contents of communications of an individual with other individuals;(iv)communications metadata;(v)network system traffic;(vi)web browsing history;(vii)social media history;(viii)media consumption;(ix)health;(x)purchase history;(xi)personal finances or credit;(xii)education;(xiii)work history;(xiv)interests;(xv)biometrics; (xvi)identifiable characteristics of protected classes;(xvii)criminal history;(xviii)court records, including civil cases; and(xix)the family members or friends of an individual.(4)Report publication(A)In generalEach agency shall make the report submitted under paragraph (1) available to the public on the website of the agency in a machine-readable, open format and without restrictions on reuse, except for an annex described in subparagraph (B).(B)AnnexA report under subparagraph (A) shall include in an annex any necessary information that is properly classified pursuant to an Executive order..

4. Chief Data Officer Council Section 3520A of title 44 is amended— in subsection (b)— in paragraph (4), by striking and at the end; in paragraph (5), by striking the period and inserting ; and; and by adding at the end the following: study agency data purchasing habits. in subsection (d)— by inserting , in consultation with the Federal Privacy Council, or any successor thereto, and the Chief Acquisition Officer Council, after The Council; by striking the Committee on Oversight and Government Reform of the House of Representatives and inserting the Committee on Oversight and Accountability of the House of Representatives; and by inserting , including recommendations specified in section 3(e) of the Purchased Data Inventory Act after the work of the Council. (6)study agency data purchasing habits.; and