Sec. 404. Prohibition on intelligence acquisition of United States person data
1,328 words·~6 min read·
/bill/119/s/4082/is/section-404A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
In this section, the term covered data means— data, derived data, or any unique identifier that is linked to or is reasonably linkable to a covered person or to an electronic device that is linked to, or is reasonably linkable to, 1 or more covered persons in a household; includes anonymized data that, if combined with other data, can be linked to, or is reasonably linkable to, a covered person or to an electronic device that is linked to, or is reasonably linkable to, 1 or more covered persons in a household; and does not include data that— is lawfully available to the public through Federal, State, or local government records or through widely distributed media; is reasonably believed to have been voluntarily made available to the general public by the covered person; or is a specific communication or transaction with a targeted individual who is not a covered person.
Subject to paragraphs
(2)through (8), an element of the intelligence community may not acquire a dataset that includes covered data. An element of the intelligence community may acquire covered data if the data has been authorized for collection pursuant to an order or emergency authorization pursuant to the Foreign Intelligence Surveillance Act of 1978 ( 50 U.S.C. 1801 et seq. ) or the Federal Rules of Criminal Procedure by a court of competent jurisdiction covering the period of the acquisition, subject to the use, dissemination, querying, retention, and other minimization limitations required by such authorization. An element of the intelligence community may acquire covered data about an employee of, or applicant for employment by, an element of the intelligence community for employment-related purposes, provided that— access to and use of the covered data is limited to such purposes; and the covered data is destroyed at such time as it is no longer necessary for such purposes. An element of the intelligence community may acquire covered data for the purpose of supporting compliance with collection limitations and minimization requirements imposed by statute, guidelines, procedures, or the United States Constitution, provided that— access to and use of the covered data is limited to such purpose; and the covered data is destroyed at such time as it is no longer necessary for such purpose. An element of the intelligence community may acquire covered data if— there is a reasonable belief that— an emergency exists involving an imminent threat of death or serious bodily harm; and in order to prevent or mitigate this threat, the acquisition must be conducted before authorization pursuant to paragraph
(2)can, with due diligence, be obtained; access to and use of the covered data is limited to addressing the threat; the covered data is destroyed at such time as it is no longer necessary for such purpose; and not later than 14 days after the acquisition, a description of the acquisition is provided to the congressional intelligence committees. An element of the intelligence community may acquire covered data if— each covered person linked or reasonably linked to the covered data, or, if such person is incapable of providing consent, a third party legally authorized to consent on behalf of the person, has provided consent to the acquisition and use of the data on a case-by-case basis; access to and use of the covered data is limited to the purposes for which the consent was provided; and the covered data is destroyed at such time as it is no longer necessary for such purposes. An element of the intelligence community may acquire a dataset that includes covered data if the covered data is not reasonably segregable prior to acquisition, provided that the element of the intelligence community complies with the minimization procedures in subsection (c). An element of the intelligence community may acquire, through noncompulsory means that are otherwise not contrary to a provision of Federal law, data that, in the United States, the Federal Government has the authority to compel production through a national security letter pursuant to section 2709 of title 18, United States Code, section 626 or 627 of the Consumer Credit Protection Act ( 15 U.S.C. 1681u , 1681v), or section 1114 of the Right to Financial Privacy Act of 1978 ( 12 U.S.C. 3414 ), provided— the person or entity in possession of the data is outside the United States and compelled production is not feasible; the acquisition is conducted consistent with the limitations that would apply if, in the United States, the Federal Government compelled production of such data with a national security letter pursuant to such provisions of law; and the element of the intelligence community maintains all records required by such provisions of law, including the content of relevant certifications, for each covered person or each instance of data, derived data or unique identifier linked to or reasonably linkable to a covered person. The Attorney General shall adopt specific procedures that are reasonably designed to minimize the acquisition and retention of covered data that is not subject to 1 or more of the exceptions set forth in subsection (b). The procedures adopted under paragraph
(1)shall require elements of the intelligence community to exhaust all reasonable means— to exclude covered data not subject to 1 or more exceptions set forth in subsection
(b)from datasets prior to acquisition; and to remove and delete covered data not subject to 1 or more exceptions set forth in subsection
(b)prior to the operational use of the acquired dataset or the inclusion of the dataset in a database intended for operational use. The procedures adopted under paragraph
(1)shall require that if an element of the intelligence community identifies covered data acquired in violation of subsection (b), such covered data shall be promptly destroyed. Covered data acquired by an element of the intelligence community in violation of subsection (b), and any evidence derived therefrom, may not be used, received in evidence, or otherwise disseminated in any investigation, trial, hearing, or other proceeding in or before any court, grand jury, department, office, agency, regulatory body, legislative committee, or other authority of the United States, a State, or political subdivision thereof. Not later than 180 days after the date of the enactment of this Act and not less frequently than once each year thereafter, the Director of National Intelligence shall submit to the appropriate committees of Congress and the Privacy and Civil Liberties Oversight Board a report on acquisitions pursuant to this section. The report submitted pursuant to paragraph
(1)shall include the following: A description of datasets that the Director determines contain information of covered persons that is significant in volume proportion, or sensitivity, including— the covered person information in each dataset; and an estimate of the amount of covered person information in each dataset; A description of data collected pursuant to subsection (b)(8), including— a description of the covered person information for each acquisition; and the number of covered persons or instances of data, derived data or unique identifiers linked to or reasonably linkable to a covered person, disaggregated by the national security letter authority for which compelled production would be required. A description of covered data identified as having been acquired in violation of subsection
(b)in the preceding year, including— an estimate of the number of covered persons whose information was acquired in violation of subsection (b); and any changes made to the procedures in subsection
(c)to address compliance issues. After submitting the report required by paragraph (1), the Director shall, in coordination with the Under Secretary, notify the appropriate committees of Congress of any changes to the information contained in such report. The Director shall make available to the public on the website of the Director— the unclassified portion of the report submitted pursuant to paragraph (1); and any notifications submitted pursuant to paragraph (3). Nothing in this section shall authorize an acquisition otherwise prohibited by this Act, the Foreign Intelligence Surveillance Act of 1978 ( 50 U.S.C. 1801 et seq. ), or title 18, United States Code.
Connectionstraces to 3
Traces to 3 documents
Citation graph
cites case law
Sec. 404
Prohibition on intelligence acquisition of United States person data
Cites 3Cited by 0 across 0 sources