6 U.S.C. § 126 — Department of Homeland Security data framework

(a) In general. (1) The Secretary of Homeland Security must develop a data framework that integrates DHS's existing datasets and systems, as appropriate, for authorized personnel to access, consistent with relevant legal authorities and with privacy, civil rights, and civil liberties policies and protections. (2) This framework must include, in accordance with all applicable statutory and regulatory requirements: (A) all information a DHS office or component holds or gets that falls within the scope of the government's information sharing environment — including homeland security information, terrorism information, weapons-of-mass-destruction information, and national intelligence; and (B) any other information or intelligence relevant to the Department's priority mission needs and capability requirements, as the Secretary determines appropriate. (b) Data framework access. (1) The Secretary must ensure the framework is accessible to DHS employees the Secretary determines (A) have an appropriate security clearance, (B) are assigned to a function that requires access to the framework's information, and (C) are trained in the applicable standards for safeguarding and using that information. (2) The Secretary must (A) issue guidance for employees authorized to access and contribute to the framework, and (B) make sure that guidance enforces a duty to share information between DHS offices and components when they access or contribute to the framework for mission needs. (3) The Secretary must set data standards and instruct DHS components to make information available through the framework in a machine-readable standard format, to the greatest extent practicable. (c) Exclusion of information. The Secretary may exclude information from the framework if including it may (1) jeopardize the protection of sources, methods, or activities; (2) compromise a criminal or national security investigation; (3) be inconsistent with other federal laws or regulations; or (4) be duplicative or serve no operational purpose if included. (d) Safeguards. The framework must include systems capabilities for auditing and securing its information, including (1) mechanisms for identifying insider threats, (2) mechanisms for identifying security risks, and (3) safeguards for privacy, civil rights, and civil liberties. (e) Deadline for implementation. Within 2 years of December 19, 2018, the Secretary had to ensure the framework could include the DHS information needed to meet the Department's critical mission operations. (f) Notice to Congress. (1) The Secretary must send the appropriate congressional committees regular status updates on the framework until it is fully operational. (2) Within 60 days after the framework becomes fully operational, the Secretary must notify those committees. (3) The Secretary must annually brief Congress on how DHS components use the framework to support operations that disrupt terrorist activities and incidents in the homeland. (g) Definitions. (1) "Appropriate congressional committee" and "homeland" have the meanings given those terms in section 101 of this title. (2) "Homeland security information" has the meaning given that term in section 482 of this title. (3) "National intelligence" has the meaning given that term in section 3003(5) of title 50. (4) "Terrorism information" has the meaning given that term in section 485 of this title.