Privacy Act Modernization Act of 2025

119 S1208 IS: Privacy Act Modernization Act of 2025 U.S. Senate 2025-03-31 text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain. II 119th CONGRESS 1st Session S. 1208 IN THE SENATE OF THE UNITED STATES March 31, 2025 Mr. Wyden (for himself, Mr. Markey , Mr. Merkley , and Mr. Van Hollen ) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs A BILL To amend title 5, United States Code, to address records maintained on individuals, and for other purposes. 1. Short title This Act may be cited as the Privacy Act Modernization Act of 2025 . 2. Modernizing Privacy Act definitions (a) Records Section 552a(a) of title 5, United States Code, is amended— (1) in paragraph (2), by striking a citizen of the United States or an alien lawfully admitted for permanent residence and inserting the following: “a natural person who is— (A) a United States person, as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978 ( 50 U.S.C. 1801 ); or (B) in the United States; ; (2) by striking paragraphs (4) and (5) and inserting the following: (4) the term record means any personally identifiable information processed by an agency; (5) the term system of records means a group of any records maintained by or for, or otherwise under the control of, any agency; ; (3) in paragraph (12), by striking and at the end; (4) in paragraph (13), by striking the period at the end and inserting a semicolon; and (5) by adding at the end the following: (14) the term personally identifiable information means any information that identifies, or is linked or reasonably linkable, alone or in combination with other data, to— (A) an individual; or (B) a device that identifies, or is linked or reasonably linkable to, an individual; and (15) the term process , with respect to personally identifiable information, means to perform an operation or set of operations on the personally identifiable information, including by storing, analyzing, organizing, structuring, using, modifying, or otherwise handling the personally identifiable information, whether or not by automated means. . (b) Matching programs Section 552a(a)(8)(A) of title 5, United States Code, is amended— (1) in the matter preceding clause (i), by striking of ; (2) in clause (i), in the matter preceding subclause (I), by striking two or more automated systems of records or a system of records with non-Federal records and inserting the following: involving any data from 1 or more systems of records ; and (3) in clause (ii), by striking two or more and inserting of 2 or more . (c) Government contractors Section 552a(m)(1) of title 5, United States Code, is amended by striking for the operation by or on behalf of the agency of a system of records to accomplish an agency function and inserting or other agreement, including with another agency, for the operation by or on behalf of the agency of a system of records . (d) Technical amendments Section 552a of title 5, United States Code, is amended— (1) in subsection (a)— (A) in paragraph (1), by striking section 552(e) and inserting section 552(f) ; and (B) in paragraph (8)(B)— (i) in clause (iv)(III), by striking section 404(e), 464, or 1137 and inserting section 464 or 1137 ; and (ii) in clause (x), by striking section 3(d)(4) of the Achieving a Better Life Experience Act of 2014 and inserting section 529A(d)(4) of the Internal Revenue Code of 1986 ; and (2) in subsection (l), by striking National Archives of the United States each place that term appears and inserting National Archives and Records Administration . 3. Strengthening protections for individuals (a) Additional protections for collections, uses, and disclosures Section 552a of title 5, United States Code, is amended— (1) in subsection (a)(7), by inserting and is appropriate and reasonably necessary for the efficient and effective conduct of the Government before the semicolon at the end; (2) in subsection (b)(1), by inserting and that disclosure is consistent with, and related to, a purpose described under subsection (e)(4)(D) of this section before the semicolon at the end; and (3) in subsection (e)— (A) in the matter preceding paragraph (1), by striking that maintains a system of records ; (B) in paragraph (2), by striking under Federal programs ; (C) in paragraph (4)— (i) by amending subparagraph (D) to read as follows: (D) any purpose for which the information is intended to be used, including each routine use; ; (ii) in subparagraph (H), by striking and at the end; (iii) in subparagraph (I), by inserting and after the semicolon; and (iv) by adding at the end the following: (J) the legal authority for each purpose for which the records contained in the system are used, which shall contain a citation to the applicable law, executive order, or other authority; ; (D) in paragraph (11), by striking and at the end; (E) in paragraph (12), by striking the period at the end and inserting a semicolon; and (F) by adding at the end the following: (13) use records only for a legally authorized purpose; and (14) take reasonable efforts to ensure that a record that is disclosed contains the minimum amount of information necessary to accomplish the purpose of the disclosure. . (b) Additional protections for matching programs Section 552a(a)(8)(B) of title 5, United States Code, is amended— (1) by amending clause (ii) to read as follows: (ii) matches performed to support any research or statistical project, if the results of the match are not intended to be used, and are not used, to— (I) make decisions concerning the rights, benefits, or privileges of specific individuals; or (II) take any adverse financial, personnel, or disciplinary action, or any other adverse action, against Federal personnel; ; (2) in clause (viii), by inserting or after the semicolon at the end; (3) by striking clause (ix); and (4) by redesignating clause (x) as clause (ix). (c) Additional civil remedies Section 552a(g) of title 5, United States Code, is amended— (1) in paragraph (1)— (A) by amending subparagraph (D) to read as follows: (D) fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have, or that could reasonably lead to, an adverse effect on any person (including any State or territory (or any political subdivision of any State or territory) or any Indian Tribe), ; and (B) in the flush text following subparagraph (D), by inserting or person, as applicable, after the individual ; and (2) by amending paragraph (4) to read as follows: (4) In any suit brought under the provisions of subsection (g)(1)(C) or (D) of this section— (A) the court may provide such preliminary and other equitable or declaratory relief as may be appropriate; and (B) if the court determines that the agency acted in a manner that was intentional or willful, the United States shall be liable to the individual or person, as applicable, in an amount equal to the sum of— (i) actual damages, including nonpecuniary damages, sustained by the individual or person as a result of the refusal or failure, but in no case shall an individual or person entitled to recovery receive less than the sum of $1,000; (ii) the costs of the action together with reasonable attorney fees as determined by the court; and (iii) punitive damages in an amount determined appropriate by the court. . (d) Additional criminal penalties Section 552a(i) of title 5, United States Code, is amended— (1) in paragraph (1), by adding at the end the following: A person who commits an offense described in the previous sentence with the intent to sell, transfer, use, or disclose a record described in that sentence for commercial advantage, personal gain, or malicious harm shall be guilty of a felony and fined not more than $250,000, imprisoned for not more than 10 years, or both. ; and (2) in paragraph (3), by striking misdemeanor and fined not more than $5,000 and inserting felony and fined not more than $100,000 . 4. Effective dates (a) Definitions In this section: (1) Agency; matching program; recipient agency; record; source agency; system of records The terms agency , matching program , recipient agency , record , source agency , and system of records have the meanings given those terms in section 552a of title 5, United States Code, as amended by section 2. (2) Special Government employee The term special Government employee has the meaning given the term in section 202(a) of title 18, United States Code. (3) Temporary or intermittent expert or consultant The term temporary or intermittent expert or consultant means an expert or consultant or an organization thereof, the services of which are procured pursuant to section 3109 of title 5, United States Code. (4) Temporary transitional Schedule C position The term temporary transitional Schedule C position means a position established under section 213.3302 of title 5, Code of Federal Regulations, or any successor regulation. (b) General effective date Except as provided in subsection (c), the amendments made by sections 2 and 3 shall take effect on the date that is 2 years after the date of enactment of this Act. (c) Exceptions The amendments made by sections 2 and 3 shall take effect on the date of enactment of this Act with respect to each of the following: (1) Any use of a record by, any disclosure of a record by or to, any maintenance of a system of records by or for, any control of a system of records by, the taking of any other action that is governed by section 552a of title 5, United States Code (as amended by this Act) by, or the taking of any of the preceding actions that is caused by any action by any of the following: (A) The United States DOGE Service, or any successor organization. (B) The U.S. DOGE Service Temporary Organization, or any successor organization. (C) Any special Government employee, any temporary or intermittent expert or consultant, or any individual occupying a temporary transitional Schedule C position. (D) Any agency not described in subparagraph (A) or (B) that is headed by, or subject to the control of— (i) the head of the entity described in subparagraph (A); (ii) the head of the entity described in subparagraph (B); or (iii) any person described in subparagraph (C). (E) Any DOGE Team (as described in Executive Order 14158 (90 Fed. Reg. 8441), relating to establishing and implementing the President’s Department of Government Efficiency ), or any successor organization. (F) Any agency that is within, or subject to the review of, an entity described in subparagraph (A), (B), (D), or (E). (G) Any officer, employee, expert, consultant, contractor, volunteer, or other individual, without regard to title or compensation, of, within, or providing services to an entity described in subparagraph (A), (B), (D), (E), or (F). (2) Any matching program in which— (A) an entity or person described in any subparagraph of paragraph (1) is the source agency or recipient agency; or (B) a system of records is maintained by or for, or otherwise under the control of, an entity or person described in any subparagraph of paragraph (1). (d) Applicability If a person described in any subparagraph of paragraph (1) or (2) of subsection (c), outside of the capacity of the person as described in the applicable subparagraph, discloses a record, maintains a system of records, controls a system of records, participates in a matching program, takes any other action that is governed by section 552a of title 5, United States Code (as amended by this Act), or causes any other person to take any of the preceding actions, the exception under subsection (c) shall still apply with respect to that action by that person. 5. Rule of construction (a) Definition In this section, the term Privacy Act means section 552a of title 5, United States Code, as in effect at any time before the date of enactment of this Act. (b) Rule Nothing in this Act, or any amendment made by this Act, may be construed to create an inference with respect to the interpretation of any provision of the Privacy Act, any regulation promulgated under the Privacy Act, or any application of such a provision or regulation, including with respect to the scope of activity covered under the Privacy Act, the legality of any activity under the Privacy Act, or the availability of any remedy or award of damages with respect to a violation of the Privacy Act.