6 U.S.C. § 142 — Privacy officer

(a) Appointment and responsibilities. The Secretary must appoint a senior Department official — who reports directly to the Secretary — to take primary responsibility for privacy policy. This officer must: (1) make sure new technologies sustain, rather than erode, privacy protections in how personal information is used, collected, and disclosed; (2) make sure personal information in Privacy Act record systems is handled in full compliance with the fair information practices in the Privacy Act of 1974; (3) evaluate proposed legislation and regulations involving the federal government's collection, use, and disclosure of personal information; (4) conduct a privacy impact assessment of proposed Department rules, including what type of personal information is collected and how many people are affected; (5) coordinate with the Officer for Civil Rights and Civil Liberties so that programs, policies, and procedures touching civil rights, civil liberties, and privacy are addressed together, and so Congress gets appropriate reports on them; and (6) prepare an annual report to Congress on Department activities that affect privacy, including complaints of privacy violations, how the Privacy Act of 1974 is being implemented, internal controls, and other related matters. (b) Authority to investigate. (1) The senior official may: (A) access all Department records, reports, audits, reviews, documents, papers, recommendations, and other materials tied to their responsibilities; (B) conduct whatever investigations and reports on the Department's programs and operations the official judges necessary or useful; (C) with the Secretary's approval, subpoena — from anyone other than a federal agency — information, documents, reports, records, and other evidence needed for the official's responsibilities; and (D) administer or take an oath, affirmation, or affidavit whenever needed for those responsibilities. (2) A subpoena issued under paragraph (1)(C) that someone refuses to obey can be enforced by order of an appropriate U.S. district court. (3) An oath, affirmation, or affidavit taken under paragraph (1)(D) by a Privacy Office employee the senior official designates has the same legal force as one taken before an officer holding an office seal. (c) Supervision and coordination. (1) The senior official must: (A) report to, and be under the general supervision of, the Secretary; and (B) coordinate activities with the Department's Inspector General to avoid duplicating work. (2) Coordination with the Inspector General. (A) Except as described below, the senior official may investigate any matter involving possible violations or abuse in the administration of a Department program or operation relevant to this section. (B) Coordination: (i) Before starting such an investigation, the senior official must first refer the matter, along with all related complaints, allegations, and information, to the Inspector General. (ii) Within 30 days of getting that referral, the Inspector General must decide whether to open an audit or investigation and notify the senior official of that decision. If the Inspector General says it intends to but doesn't actually start an audit or investigation within 90 days of that notice, the Inspector General must further notify the senior official that none was started, no later than 3 days after that 90-day period ends. (iii) The senior official may then investigate the referred matter if the Inspector General notified them it doesn't intend to open an audit or investigation, or if the Inspector General gave the further notice that a promised audit or investigation was never started. (iv) Any Office of Inspector General employee who audits or investigates a referred matter must get adequate training on privacy laws, rules, and regulations, from an entity the Inspector General approves in consultation with the senior official. (d) Notification to Congress on removal. If the Secretary removes the senior official or transfers them to a different position or location within the Department, the Secretary must promptly send both Houses of Congress written notice of the removal or transfer, including the reasons for it. (e) Reports by senior official to Congress. The senior official must: (1) submit reports directly to Congress about performing these responsibilities, without any prior comment or edits by the Secretary, Deputy Secretary, any other Department official, or the Office of Management and Budget; and (2) inform the Senate Homeland Security and Governmental Affairs Committee and the House Homeland Security Committee no later than 30 days after the Secretary disapproves the senior official's subpoena request under (b)(1)(C) or substantially modifies it, or no later than 45 days after making that subpoena request if the Secretary still hasn't approved or disapproved it.