38 U.S.C. § 5725 — Contracts for data processing or maintenance
submitted 20 years ago by Pub. L. 109-461 to r/title-38-VETERANS-BENEFITS · 208 words · no verdicts yet
Contracts requiring access to sensitive personal information must restrict disclosure and require prompt breach reporting. They must also provide liquidated damages, and collected amounts fund credit-protection services.
(a) If the Secretary* contracts for a Department* function requiring access to sensitive personal information, the contract must require that (1) the contractor, directly or through an affiliate, not disclose the information to anyone unless the disclosure is lawful and expressly allowed by the contract; and (2) the contractor and every subcontractor promptly notify the Secretary of a data breach* involving the information.
(b) Every such contract must require the contractor to pay the Secretary liquidated damages if a data breach involves sensitive personal information processed or maintained by the contractor or a subcontractor.
(c) The Secretary must deposit or credit amounts collected under subsection (b) to the Department account that paid the contractor. The amounts remain available without fiscal-year expiration, only to provide credit-protection services under section 5724(b).
If the Secretary* enters into a contract for the performance of any Department* function that requires access to sensitive personal information, the Secretary shall require as a condition of the contract that—
the contractor shall not, directly or through an affiliate of the contractor, disclose such information to any other person unless the disclosure is lawful and is expressly permitted under the contract;
the contractor, or any subcontractor for a subcontract of the contract, shall promptly notify the Secretary of any data breach* that occurs with respect to such information.
Each contract subject to the requirements of subsection (a) shall provide for liquidated damages to be paid by the contractor to the Secretary in the event of a data breach with respect to any sensitive personal information processed or maintained by the contractor or any subcontractor under that contract.
Any amount collected by the Secretary under subsection (b) shall be deposited in or credited to the Department account from which the contractor was paid and shall remain available for obligation without fiscal year limitation exclusively for the purpose of providing credit protection services pursuant to section 5724(b) of this title.
Source credit: (Added Pub. L. 109–461, title IX, § 902(a), Dec. 22, 2006, 120 Stat. 3456.)
- 2006Enacted · Pub. L. 109-461 · 120 Stat. 3456
A history note hasn’t been published yet. The record shows enactment by Pub. L. 109-461 on 2006-12-22.
all 0 arguments · sorted by: best
no arguments yet — make the first case