42 U.S.C. § 19085 — National secure data service

(a) In general. Consulting with the Director^* of the Office of Management and Budget and the interagency committee established under section 9413 of title 15, the Director must establish a demonstration project^* to develop, refine, and test models. The models must inform full implementation of the Commission on Evidence-Based Policymaking's recommendation for government-wide data-linkage and access infrastructure for statistical activities conducted for statistical purposes, as defined in chapter 35 of title 44.

(b) Establishment. No later than 1 year after August 9, 2022, the Director must establish a National Secure Data Service demonstration project. The project must—

(1) align, to the extent feasible, with the principles, best practices^*, and priority actions recommended by the Advisory Committee^* on Data for Evidence Building; and

(2) be operated directly by, or through a contract managed by, the National Center for Science and Engineering Statistics.

(c) Data. In carrying out this section, the Director must work with Federal and State^* agencies to collect, acquire, analyze, report, and disseminate statistical data in the United States and other nations to support government-wide evidence-building activities consistent with the Foundations for Evidence-Based Policymaking Act of 2018.

(d) Voluntary participation. Federal and State agencies may participate in the National Secure Data Service demonstration project voluntarily.

(e) Privacy and confidentiality protections. If the Director issues a management contract under subsection (b), the recipient must be designated as an “agent” under subchapter III of chapter 35 of title 44. The recipient then has all requirements and obligations for protecting confidential information set out in the Confidential Information Protection and Statistical Efficiency Act of 2018 and the Privacy Act of 1974.

(f) Technology and privacy standards. In carrying out this subsection, the Director must consider the application and use only of systems and technologies that include protection measures reasonably ensuring that confidential data and statistical products are protected as required under subchapter III of chapter 35 of title 44. The systems and technologies must ensure that—

(A) raw data and other sensitive inputs are not accessible to recipients of statistical outputs from the project;

(B) the project's platform does not reveal any individual entity's data or information to another party in an identifiable form;

(C) no information about the data assets used in the project is revealed to another party, except as included in the final statistical output;

(D) the project permits only authorized analysts to perform statistical queries necessary to answer approved project questions and prohibits all other queries; and

(E) the project conducts privacy-risk assessments to minimize privacy risks to individual entities whose data has been made available by a reporting entity, including risks that could result from data breaches of a system operated by the reporting entity, and to determine approved project questions under subparagraph (D) in a way that minimizes privacy risks to individuals affected by uses of the statistical output.

(2) The project must implement reasonable measures matched to the risks to individuals' privacy to achieve the outcomes under subparagraphs (A) through (E) of paragraph (1). Those measures may include appropriate use of privacy-enhancing technologies and appropriate measures to minimize or prevent reidentification risks, consistent with applicable guidance or regulations issued under subchapter III of chapter 35 of title 44.

(g) Transparency. The National Secure Data Service established under subsection (b) must maintain a public website with up-to-date information about supported projects.

(h) Report. No later than 2 years after August 9, 2022, the National Secure Data Service demonstration project established under subsection (b) must submit a report to Congress that includes—

(1) a description of policies for protecting data, consistent with applicable Federal law;

(2) a comprehensive description of all completed or active data-linkage activities and projects;

(3) an assessment of how effective the demonstration project is at reducing risks and removing barriers to sustained implementation of the National Secure Data Service recommended by the Commission on Evidence-Based Policymaking; and

(4) if the Director considers the project effective, a plan for scaling it up to facilitate data access for evidence-building while ensuring transparency and privacy.

(i) Authorization of appropriations. The statute authorizes appropriations to the Director to carry out this subsection of $9,000,000 for each fiscal year from 2023 through 2027.