Davis' legislation, which aims to strengthen a bill to improve data security at the Veterans Administration, would require all federal agencies to tell the public when they have data breaches involving sensitive information. This legislation amends the Federal Information Security Management Act, which Davis introduced and shepherded to passage in 2002.
The legislation directs the Office of Management and Budget to establish procedures for agencies to follow if personal information is lost or stolen. It also would require that individuals be notified if their personal information could be compromised by a breach of data security at a federal agency. It would give Chief Information Officers the power to ensure that agency personnel comply with information security laws and ensure that costly equipment containing sensitive information is accounted for and secure.
As originally drafted, the language (HR 5838) became part of the VA bill, which was introduced after officials there revealed a laptop computer containing sensitive information about veterans had been stolen from an employee's home in suburban Maryland. Davis hopes to add the revised legislation introduced (HR 6163) to the VA bill as well.
The Committee on Government Reform, which Davis chairs, then asked other federal agencies if they were missing laptops or other potentially compromising information. The Commerce Department revealed it couldn't account for more than 1,100 laptops, some containing census data. Half the missing computers were simply not returned by departing or terminated employees. Some agencies have yet to respond to the committee's query.
"This bill is a first step," said Davis. "If new policies and procedures are not forthcoming quickly, or if they lack the teeth to get the job done, I will revisit this matter with additional legislation."
