S. 1208

119 S1208 IS: Privacy Act Modernization Act of 2025
 U.S. Senate
 2025-03-31
 text/xml
 EN
 Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
 II  119th CONGRESS  1st Session  S. 1208  IN THE SENATE OF THE UNITED STATES   March 31, 2025   Mr. Wyden  (for himself,  Mr. Markey ,  Mr. Merkley , and  Mr. Van Hollen ) introduced the following bill; which was read twice and referred to the  Committee on Homeland Security and Governmental Affairs    A BILL
To amend title 5, United States Code, to address records maintained on individuals, and for other purposes.
1.
Short title
This Act may be cited as the   Privacy Act Modernization Act of 2025  .
2.
Modernizing Privacy Act definitions
(a)
Records
Section 552a(a) of title 5, United States Code, is amended—
(1)
in paragraph (2), by striking  a citizen of the United States or an alien lawfully admitted for permanent residence  and inserting the following: “a natural person who is—
(A)
a United States person, as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978 ( 50 U.S.C. 1801 ); or
(B)
in the United States;
 ;
(2)
by striking paragraphs (4) and (5) and inserting the following:
(4)
the term  record  means any personally identifiable information processed by an agency;
(5)
the term  system of records  means a group of any records maintained by or for, or otherwise under the control of, any agency;
 ;
(3)
in paragraph (12), by striking  and  at the end;
(4)
in paragraph (13), by striking the period at the end and inserting a semicolon; and
(5)
by adding at the end the following:
(14)
the term  personally identifiable information  means any information that identifies, or is linked or reasonably linkable, alone or in combination with other data, to—
(A)
an individual; or
(B)
a device that identifies, or is linked or reasonably linkable to, an individual; and
(15)
the term  process , with respect to personally identifiable information, means to perform an operation or set of operations on the personally identifiable information, including by storing, analyzing, organizing, structuring, using, modifying, or otherwise handling the personally identifiable information, whether or not by automated means.
 .
(b)
Matching programs
Section 552a(a)(8)(A) of title 5, United States Code, is amended—
(1)
in the matter preceding clause (i), by striking  of ;
(2)
in clause (i), in the matter preceding subclause (I), by striking  two or more automated systems of records or a system of records with non-Federal records  and inserting the following:  involving any data from 1 or more systems of records ; and
(3)
in clause (ii), by striking  two or more  and inserting  of 2 or more .
(c)
Government contractors
Section 552a(m)(1) of title 5, United States Code, is amended by striking  for the operation by or on behalf of the agency of a system of records to accomplish an agency function  and inserting  or other agreement, including with another agency, for the operation by or on behalf of the agency of a system of records .
(d)
Technical amendments
Section 552a of title 5, United States Code, is amended—
(1)
in subsection (a)—
(A)
in paragraph (1), by striking  section 552(e)  and inserting  section 552(f) ; and
(B)
in paragraph (8)(B)—
(i)
in clause (iv)(III), by striking  section 404(e), 464, or 1137  and inserting  section 464 or 1137 ; and
(ii)
in clause (x), by striking  section 3(d)(4) of the Achieving a Better Life Experience Act of 2014  and inserting  section 529A(d)(4) of the Internal Revenue Code of 1986 ; and
(2)
in subsection (l), by striking  National Archives of the United States  each place that term appears and inserting  National Archives and Records Administration .
3.
Strengthening protections for individuals
(a)
Additional protections for collections, uses, and disclosures
Section 552a of title 5, United States Code, is amended—
(1)
in subsection (a)(7), by inserting  and is appropriate and reasonably necessary for the efficient and effective conduct of the Government  before the semicolon at the end;
(2)
in subsection (b)(1), by inserting  and that disclosure is consistent with, and related to, a purpose described under subsection (e)(4)(D) of this section  before the semicolon at the end; and
(3)
in subsection (e)—
(A)
in the matter preceding paragraph (1), by striking  that maintains a system of records ;
(B)
in paragraph (2), by striking  under Federal programs ;
(C)
in paragraph (4)—
(i)
by amending subparagraph (D) to read as follows:
(D)
any purpose for which the information is intended to be used, including each routine use;
 ;
(ii)
in subparagraph (H), by striking  and  at the end;
(iii)
in subparagraph (I), by inserting  and  after the semicolon; and
(iv)
by adding at the end the following:
(J)
the legal authority for each purpose for which the records contained in the system are used, which shall contain a citation to the applicable law, executive order, or other authority;
 ;
(D)
in paragraph (11), by striking  and  at the end;
(E)
in paragraph (12), by striking the period at the end and inserting a semicolon; and
(F)
by adding at the end the following:
(13)
use records only for a legally authorized purpose; and
(14)
take reasonable efforts to ensure that a record that is disclosed contains the minimum amount of information necessary to accomplish the purpose of the disclosure.
 .
(b)
Additional protections for matching programs
Section 552a(a)(8)(B) of title 5, United States Code, is amended—
(1)
by amending clause (ii) to read as follows:
(ii)
matches performed to support any research or statistical project, if the results of the match are not intended to be used, and are not used, to—
(I)
make decisions concerning the rights, benefits, or privileges of specific individuals; or
(II)
take any adverse financial, personnel, or disciplinary action, or any other adverse action, against Federal personnel;
 ;
(2)
in clause (viii), by inserting  or  after the semicolon at the end;
(3)
by striking clause (ix); and
(4)
by redesignating clause (x) as clause (ix).
(c)
Additional civil remedies
Section 552a(g) of title 5, United States Code, is amended—
(1)
in paragraph (1)—
(A)
by amending subparagraph (D) to read as follows:
(D)
fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have, or that could reasonably lead to, an adverse effect on any person (including any State or territory (or any political subdivision of any State or territory) or any Indian Tribe),
 ; and
(B)
in the flush text following subparagraph (D), by inserting  or person, as applicable,  after  the individual ; and
(2)
by amending paragraph (4) to read as follows:
(4)
In any suit brought under the provisions of subsection (g)(1)(C) or (D) of this section—
(A)
the court may provide such preliminary and other equitable or declaratory relief as may be appropriate; and
(B)
if the court determines that the agency acted in a manner that was intentional or willful, the United States shall be liable to the individual or person, as applicable, in an amount equal to the sum of—
(i)
actual damages, including nonpecuniary damages, sustained by the individual or person as a result of the refusal or failure, but in no case shall an individual or person entitled to recovery receive less than the sum of $1,000;
(ii)
the costs of the action together with reasonable attorney fees as determined by the court; and
(iii)
punitive damages in an amount determined appropriate by the court.
 .
(d)
Additional criminal penalties
Section 552a(i) of title 5, United States Code, is amended—
(1)
in paragraph (1), by adding at the end the following:  A person who commits an offense described in the previous sentence with the intent to sell, transfer, use, or disclose a record described in that sentence for commercial advantage, personal gain, or malicious harm shall be guilty of a felony and fined not more than $250,000, imprisoned for not more than 10 years, or both. ; and
(2)
in paragraph (3), by striking  misdemeanor and fined not more than $5,000  and inserting  felony and fined not more than $100,000 .
4.
Effective dates
(a)
Definitions
In this section:
(1)
Agency; matching program; recipient agency; record; source agency; system of records
The terms  agency ,  matching program ,  recipient agency ,  record ,  source agency , and  system of records  have the meanings given those terms in section 552a of title 5, United States Code, as amended by section 2.
(2)
Special Government employee
The term  special Government employee  has the meaning given the term in section 202(a) of title 18, United States Code.
(3)
Temporary or intermittent expert or consultant
The term  temporary or intermittent expert or consultant  means an expert or consultant or an organization thereof, the services of which are procured pursuant to section 3109 of title 5, United States Code.
(4)
Temporary transitional Schedule C position
The term  temporary transitional Schedule C position  means a position established under section 213.3302 of title 5, Code of Federal Regulations, or any successor regulation.
(b)
General effective date
Except as provided in subsection (c), the amendments made by sections 2 and 3 shall take effect on the date that is 2 years after the date of enactment of this Act.
(c)
Exceptions
The amendments made by sections 2 and 3 shall take effect on the date of enactment of this Act with respect to each of the following:
(1)
Any use of a record by, any disclosure of a record by or to, any maintenance of a system of records by or for, any control of a system of records by, the taking of any other action that is governed by section 552a of title 5, United States Code (as amended by this Act) by, or the taking of any of the preceding actions that is caused by any action by any of the following:
(A)
The United States DOGE Service, or any successor organization.
(B)
The U.S. DOGE Service Temporary Organization, or any successor organization.
(C)
Any special Government employee, any temporary or intermittent expert or consultant, or any individual occupying a temporary transitional Schedule C position.
(D)
Any agency not described in subparagraph (A) or (B) that is headed by, or subject to the control of—
(i)
the head of the entity described in subparagraph (A);
(ii)
the head of the entity described in subparagraph (B); or
(iii)
any person described in subparagraph (C).
(E)
Any DOGE Team (as described in Executive Order 14158 (90 Fed. Reg. 8441), relating to establishing and implementing the President’s  Department of Government Efficiency ), or any successor organization.
(F)
Any agency that is within, or subject to the review of, an entity described in subparagraph (A), (B), (D), or (E).
(G)
Any officer, employee, expert, consultant, contractor, volunteer, or other individual, without regard to title or compensation, of, within, or providing services to an entity described in subparagraph (A), (B), (D), (E), or (F).
(2)
Any matching program in which—
(A)
an entity or person described in any subparagraph of paragraph (1) is the source agency or recipient agency; or
(B)
a system of records is maintained by or for, or otherwise under the control of, an entity or person described in any subparagraph of paragraph (1).
(d)
Applicability
If a person described in any subparagraph of paragraph (1) or (2) of subsection (c), outside of the capacity of the person as described in the applicable subparagraph, discloses a record, maintains a system of records, controls a system of records, participates in a matching program, takes any other action that is governed by section 552a of title 5, United States Code (as amended by this Act), or causes any other person to take any of the preceding actions, the exception under subsection (c) shall still apply with respect to that action by that person.
5.
Rule of construction
(a)
Definition
In this section, the term  Privacy Act  means section 552a of title 5, United States Code, as in effect at any time before the date of enactment of this Act.
(b)
Rule
Nothing in this Act, or any amendment made by this Act, may be construed to create an inference with respect to the interpretation of any provision of the Privacy Act, any regulation promulgated under the Privacy Act, or any application of such a provision or regulation, including with respect to the scope of activity covered under the Privacy Act, the legality of any activity under the Privacy Act, or the availability of any remedy or award of damages with respect to a violation of the Privacy Act.