TITLE I-PRIVACY PROTECTION COMMISSION

ESTABLISHMENT OF COMMISSION

SEC. 101. (a) There is established as an independent agency of the executive branch of the Government the Privacy Protection Commission.

(b) (1) The Commission shall be composed of five members who shall be appointed by the President, by and with the advice and consent of the Senate, from among members of the public at large who, by reason of their knowledge and expertise in any of the following areas: civil rights and liberties, law, social sciences, and computer technology, business, and State and local government, are well qualified for service on the Commission and who are not otherwise officers or employees of the United States. Not more than three of the members of the Commission shall be adherents of the same political party.

(2) One of the Commissioners shall be appointed Chairman by the President:

(3) A Commissioner appointed as Chairman shall serve as Chairman until the expiration of his term as a Commissioner of the Commission (except that he may continue to serve as Chairman for so long as he remains a Commissioner and his successor as Chairman has not taken office). An individual may be appointed as a Commissioner at the same time he is appointed Chairman.

(c) The Chairman shall preside at all meetings of the Commission and a quorum for the transaction of business shall consist of at least three members present (but the Chairman may designate an Acting Chairman who may preside in the absence of the Chairman). Each member of the Commission, including the Chairman, shall have equal responsibility and authority in all decisions and actions of the Commission, shall have full access to all information relating to the performance of his duties or responsibilities, and shall have one vote. Action of the Commission shall be determined by a majority vote of the members present. The Chairman (or Acting Chairman) shall be the official spokesman of the Commission in its relations with the Congress, Government agencies, persons, or the public, and, on behalf of the Commission, shall see to the faithful execution of the policies and decisions of the Commission, and shall report thereon to the Commission from time to time or as the Commission may direct.

(d) Each Commissioner shall be compensated at the rate provided for under section 5314 of title 5 of the United States Code, relating to level IV of the Executive Schedule.

(e) Commissioners shall serve for terms of three years. No Commissioner may serve more than two terms. Vacancies in the membership of the Commission shall be filled in the same manner in which the original appointment was made.

(f) Vacancies in the membership of the Commission, as long as there are three Commissioners in office, shall not impair the power

of the Commission to execute the functions and powers of the Commission.

(g) The members of the Commission shall not engage in any other employment during their tenure as members of the Commission.

PERSONNEL OF THE COMMISSION

SEC. 102. (a) (1) The Commission shall appoint an Executive Director who shall perform such duties as the Commission may determine. Such appointment may be made without regard to the provisions of title 5, United States Code.

(2) The Executive Director shall be compensated at a rate not in excess of the maximum rate for GS-18 of the General Schedule under section 5332 of title 5, United States Code.

(b) The Commission is authorized to appoint and fix the compensation of such officers and employees, and prescribe their functions and duties, as may be necessary to carry out the provisions of this Act.

(c) The Commission may obtain the services of experts and consultants in accordance with the provisions of section 3109 of title 5, United States Code.

FUNCTIONS OF THE COMMISSION

SEC. 103. (a) The Commission shall

(1) publish annually a United States Directory of Information Systems containing the information specified to provide notice under section 201(c)(3) of this Act for each information system subject to the provisions of this Act and a listing of all statutes which require the collection of such information by a Federal agency;

(2) investigate, determine, and report any violation of any provision of this Act (or any regulation adopted pursuant thereto) to the President, the Attorney General, the Congress, and the General Services Administration where the duties of that agency are involved, and to the Comptroller General when it deems appropriate; and

(3) develop model guidelines for the implementation of this Act and assist Federal agencies in preparing regulations and meeting technical and administrative requirements of this Act. (b) Upon receipt of any report required of a Federal agency describing (1) any proposed information system or data bank, or (2) any significant expansion of an existing information system or data bank, integration of files, programs for records linkage within or among agencies, or centralization of resources and facilities for data processing, the Commission shall-

(A) review such report to determine (i) the probable or potential effect of such proposal on the privacy and other personal or property rights of individuals or the confidentiality of information relating to such individuals, and (ii) its effect on the preservation of the constitutional principles of federalism and separation of powers; and

(B) submit findings and make recommendations to the President, Congress, and the General Services Administration concerning the need for legislative authorization and administrative action relative to any such proposed activity in order to meet the purposes and requirements of this Act.

(c) After receipt of any report required under subsection (b), if the Commission determines and reports to the Congress that a proposal to establish or modify a data bank or information system does not comply with the standards established by or pursuant to this Act, the Federal agency submitting such report shall not proceed to establish or modify any such data bank or information system for a period of sixty days from the date of receipt of notice from the Commission that such data bank or system does not comply with such standards. (d) In addition to its other functions the Commission shall

(1) to the fullest extent practicable, consult with the heads of appropriate departments, agencies, and instrumentalities of the Federal Government, of State and local governments, and other persons in carrying out the provisions of this Act and in conducting the study required by section 106 of this Act;

(2) perform or cause to be performed such research activities as may be necessary to implement title II of this Act, and to assist Federal agencies in complying with the requirements of such title; and

(3) determine what specific categories of information should be prohibited by statute from collection by Federal agencies on the basis that the collection of such information would violate an individual's right of privacy.

CONFIDENTIALITY OF INFORMATION

SEC. 104. (a) Each department, agency, and instrumentality of the executive branch of the Government, including each independent agency, shall furnish to the Commission, upon request made by the Chairman, such data, reports, and other information as the Commission deems necessary to carry out its functions under this Act.

(b) In carrying out its functions and exercising its powers under this Act, the Commission may accept from any Federal agency or other person any identifiable personal data if such data is necessary to carry out such powers and functions. In any case in which the Commission accepts any such information, it shall provide appropriate safeguards to insure that the confidentiality of such information is maintained and that upon completion of the purpose for which such information is required it is destroyed or returned to the agency or person from which it is obtained, as appropriate.

POWERS OF THE COMMISSION

SEC. 105. (a) (1) The Commission may, in carrying out its functions under this Act, conduct such inspections, sit and act at such times and places, hold such hearings, take such testimony, require by subpena the

attendance of such witnesses and the production of such books, records, papers, correspondence, and documents, administer such oaths, have such printing and binding done, and make such expenditures as the Commission deems advisable. Subpenas shall be issued under the signature of the Chairman or any member of the Commission designated by the Chairman and shall be served by any person designated by the Chairman or any such member. Any member of the Commission may administer oaths or affirmations to witnesses appearing before the Commission.

(2) In case of disobedience to a subpena issued under paragraph (1) of this subsection, the Commission may invoke the aid of any district court of the United States in requiring compliance with such subpena. Any district court of the United States within the jurisdiction where such person is found or transacts business may, in case of contumacy or refusal to obey a subpena issued by the Commission, issue an order requiring such person to appear and testify, to produce such books, records, papers, correspondence, and documents, and any failure to obey the order of the court shall be punished by the court as a contempt thereof.

(3) Appearances by the Commission under this Act shall be in its own name. The Commission shall be represented by attorneys designated by it.

(4) Section 6001 (1) of title 18, United States Code, is amended by inserting immediately after "Securities and Exchange Commission, the following: "the Privacy Protection Commission,".

(b) The Commission may delegate any of its functions to such officers and employees of the Commission as the Commission may designate and may authorize such successive redelegations of such functions as it may deem desirable.

(c) In order to carry out the provisions of this Act, the Commission is authorized

(1) to adopt, amend, and repeal rules and regulations governing the manner of its operations, organization, and personnel;

(2) to adopt, amend, and repeal interpretative rules for the implementation of the rights, standards, and safeguards provided under this Act;

(3) to enter into contracts or other arrangements or modifications thereof, with any government, any agency or department of the United States, or with any person, firm, association, or corporation, and such contracts or other arrangements, or modifications thereof, may be entered into without legal consideration, without performance or other bonds, and without regard to section 3709 of the Revised Statutes, as amended (41 U.S.C. 5);

(4) to make advance, progress, and other payments which the Commission deems necessary under this Act without regard to the provisions of section 3648 of the Revised Statutes, as amended (31 U.S.C. 529);

(5) receive complaints of violations of this Act and regulations adopted pursuant thereto; and

(6) to take such other action as may be necessary to carry out the provisions of this Act.

COMMISSION STUDY OF OTHER GOVERNMENTAL AND PRIVATE

ORGANIZATIONS

SEC. 106. (a) (1) The Commission shall make a study of the data banks, automated data processing programs, and information systems of governmental, regional, and private organizations, in order to determine the standards and procedures in force for the protection of personal information, and to determine the extent to which those standards and procedures achieve the purposes of this Act.

(2) The Commission periodically shall report its findings to the President and the Congress and shall complete the study required by this section not later than three years from the date this Act becomes effective.

(3) The Commission shall recommend to the President and the Congress the extent, if any, to which the requirements and principles of this Act should be applied to the information practices of those organizations by legislation, administrative action, or by voluntary adoption of such requirements and principles. In addition, it shall submit such other legislative recommendations as it may determine to be necessary to protect the privacy of individuals while meeting the legitimate needs of government and society for information.

(b) (1) In the course of such study and in its reports, the Commission shall examine and analyze

(A) interstate transfer of information about individuals which is being undertaken through manual files or by computer or other electronic or telecommunications means;

(B) data banks and information programs and systems the operation of which significantly or substantially affect the enjoyment of the privacy and other personal and property rights of individuals;

(C) the use of social security numbers, license plate numbers, universal identifiers, and other symbols to identify individuals in data banks and to gain access to, integrate, or centralize information systems and files; and

(D) the matching and analysis of statistical data, such as Federal census data, with other sources of personal data, such as automobile registries and telephone directories, in order to reconstruct individual responses to statistical questionnaires for commercial or other purposes, in a way which results in a violation of the implied or explicitly recognized confidentiality of such information. (2) The Commission shall include in its examination information activities in the following areas: medical, insurance, education, employment and personnel, credit, banking and financial institutions, credit bureaus, the commercial reporting industry, travel, hotel, and entertainment reservations, and electronic check processing. The Commission may study such other information activities necessary to carry out the congressional policy embodied in this Act, except that the Commission shall not investigate information systems maintained by religious organizations.

(3) In conducting the study, the Commission shall

(A) determine what laws, Executive orders, regulations, directives, and judicial decisions govern the activities under study and