38 U.S.C. § 5726 — Reports and notice to Congress on data breaches
submitted 20 years ago by Pub. L. 109-461 to r/title-38-VETERANS-BENEFITS · 319 words · no verdicts yet
The Secretary must report quarterly to the veterans committees on Department data breaches and identify the responsible facility and corrective-action status. Significant breaches require prompt notice, including to Armed Services committees when the data concerns certain military or Defense Department personnel.
(a) Quarterly reports. (1) Within 30 days after each fiscal quarter, the Secretary* must report to the Senate and House Veterans’ Affairs Committees every data breach* involving sensitive personal information processed or maintained by the Department* during that quarter. (2) For each breach, the report must identify (A) the Department Administration and facility responsible for processing or maintaining the information and (B) the status of remedial or corrective action.
(b) Significant breaches. (1) If the Secretary decides a breach involving the Secretary’s sensitive personal information is significant, the Secretary must notify the Senate and House Veterans’ Affairs Committees. (2) If the information belongs to an Army, Navy, Air Force, or Marine Corps member or a civilian Defense Department officer or employee, the Secretary must also notify the Senate and House Armed Services Committees. (3) The notice must be prompt after discovering the breach and carrying out measures needed to determine its scope, stop further breaches or unauthorized disclosures, and reasonably restore the data system’s integrity*.
Not later than 30 days after the last day of a fiscal quarter, the Secretary* shall submit to the Committees on Veterans’ Affairs of the Senate and House of Representatives a report on any data breach* with respect to sensitive personal information processed or maintained by the Department* that occurred during that quarter.
Each report submitted under paragraph (1) shall identify, for each data breach covered by the report—
the Administration and facility of the Department responsible for processing or maintaining the sensitive personal information involved in the data breach; and
the status of any remedial or corrective action with respect to the data breach.
In the event of a data breach with respect to sensitive personal information processed or maintained by the Secretary that the Secretary determines is significant, the Secretary shall provide notice of such breach to the Committees on Veterans’ Affairs of the Senate and House of Representatives.
In the event of a data breach with respect to sensitive personal information processed or maintained by the Secretary that is the sensitive personal information of a member of the Army, Navy, Air Force, or Marine Corps or a civilian officer or employee of the Department of Defense that the Secretary determines is significant under paragraph (1), the Secretary shall provide the notice required under paragraph (1) to the Committee on Armed Services of the Senate and the Committee on Armed Services of the House of Representatives in addition to the Committees on Veterans’ Affairs of the Senate and House of Representatives.
Notice under paragraphs (1) and (2) shall be provided promptly following the discovery of such a data breach and the implementation of any measures necessary to determine the scope of the breach, prevent any further breach or unauthorized disclosures, and reasonably restore the integrity* of the data system.
Source credit: (Added Pub. L. 109–461, title IX, § 902(a), Dec. 22, 2006, 120 Stat. 3457.)
- 2006Enacted · Pub. L. 109-461 · 120 Stat. 3457
A history note hasn’t been published yet. The record shows enactment by Pub. L. 109-461 on 2006-12-22.
all 0 arguments · sorted by: best
no arguments yet — make the first case