Access by political appointees and special government employees

(a) In general Section 1106 of the Social Security Act (42 U.S.C. 1306) is amended by adding after subsection (g) the following new subsections: (h) Access by political appointees and special government employees (1) In general (A) Prohibition on access to beneficiary data systems Notwithstanding any other subsection of this section, an individual who is a political appointee (as that term is defined in section 4(a) of the Edward ‘Ted’ Kaufman and Michael Leavitt Presidential Transitions Improvements Act of 2015 (5 U.S.C. 3101 note)) or a special government employee (as that term is defined in section 202(a) of title 18, United States Code) may not access a beneficiary data system. (B) Exception Subparagraph (A) shall not apply with respect to a political appointee or special government employee who has been appointed to, or is employed in, a position within the Social Security Administration with responsibility to research, analyze, or improve the delivery of benefits to program recipients. (2) Beneficiary data system defined In this section, the term beneficiary data system means a system that is maintained by the Social Security Administration for the purposes of administering this Act that— (A) issues or records social security account numbers; (B) is used to determine eligibility for benefits under this Act; (C) to pay benefits under this Act; or (D) otherwise contains records of personally identifiable information, personal health information, or Federal tax information of individuals receiving or applying for a benefit under this Act. (i) Civil penalties (1) In general (A) Disclosure or access by employee of United States If any officer or employee of the United States negligently discloses or accesses any information that pertains to an individual in violation of any provision of subsection (a) or (h), such individual may bring a civil action for damages against the United States in a district court of the United States. (B) Disclosure or access by a person who is not an employee of United States If any person who is not an officer or employee of the United States negligently discloses or accesses any information that pertains to an individual in violation of any provision of subsection (a) or (h), such individual may bring a civil action for damages against such person in a district court of the United States. (2) Exceptions No liability shall arise under this section with respect to any disclosure or access— (A) which results from a good faith, but erroneous, interpretation of subsection (a) or (h); or (B) which is requested by the individual. (3) Damages In any action brought under paragraph (1), upon a finding of liability on the part of the defendant, the defendant shall be liable to the plaintiff in an amount equal to the sum of— (A) the greater of— (i) $5,000 for each act of unauthorized access or disclosure with respect to which such defendant is found liable; or (ii) the sum of— (I) the actual damages sustained by the plaintiff as a result of such unauthorized access or disclosure, plus (II) in the case of a willful access or disclosure or an access or disclosure which is the result of gross negligence, punitive damages, (B) the costs of the action, plus (C) reasonable attorneys fees, except that if the defendant is the United States, reasonable attorneys fees may be awarded only if the plaintiff is the prevailing party. (4) Period for bringing action Notwithstanding any other provision of law, an action to enforce any liability created under this section may be brought, without regard to the amount in controversy, at any time within 5 years after the date of discovery by the plaintiff of the unauthorized disclosure or access. (j) Criminal penalties It shall be unlawful for any officer or employee of the United States to willfully to disclose to any person any information that pertains to an individual in violation of any provision of subsection (a) or (h). Any violation of this subsection shall be a felony punishable upon conviction by a fine in any amount not exceeding $10,000, or imprisonment of not more than 5 years, or both, together with the costs of prosecution, and, in addition to any other punishment, such officer or employee shall be dismissed from office or discharged from employment upon conviction for such offense. (k) Investigation and report (1) Investigation The Inspector General of the Social Security Administration shall investigate each disclosure in violation of subsection (a) and each access of a beneficiary data system in violation of subsection (h). (2) Treatment of disclosure or access For the purposes of this subsection, the Inspector General may, if the Inspector General determines appropriate, treat a series of violations of subsection (a) or (h) as a single violation. (3) Report Not later than 30 days after the Inspector General becomes aware of a violation of subsection (a) or (h), the Inspector General shall submit to Congress a report on such violation, which shall include— (A) a detailed description of the violation; (B) a risk assessment of any threat to the privacy of any individual whose information was disclosed or accessed, national security, cybersecurity, or the integrity of the applicable beneficiary data system as a result of the violation; and (C) a detailed description of any stopped payment during the unauthorized use or access.. (b) Privacy regulations Notwithstanding this section and the amendments made by this section, part 401 of title 20 of the Code of Federal Regulations, as in effect on January 19, 2025, shall have the force and effect of law. (c) GAO study and interim reports (1) In general Not later than 1 year after the date of enactment of this Act, the Comptroller of the United States shall submit to the Committee on Finance of the Senate and the Committee on Ways and Means of the House of Representatives a report including the following information: (A) The results of a study on the effects of the changes made to section 1106 of the Social Security Act (42 U.S.C. 1306) by this section and any subsequently enacted law. (B) Any civil actions brought under subsection (i) of section 1106 of such Act, as added by subsection (a), including the results of such civil action. (C) A summary of any investigations conducted under subsection (k) of section 1106 of such Act, as added by subsection (a). (D) Any convictions for a violation of subsection (a) or (h) of section 1106 of such Act under subsection (j) of such Act, as added by subsection (a). (2) Interim reports Not later than 1 month after the date of enactment of this Act, and monthly thereafter until such time as the report required under paragraph (1) is submitted, the Comptroller of the United States shall submit to the Committee on Ways and Means of the House of Representatives and the Committee on Finance of the Senate an interim report on the information required under paragraph (1), including the status of the study described in subparagraph (A) of such paragraph. (d) Effective date The amendments made by subsections (a) and (b) of this section shall apply to violations of section 1106 of the Social Security Act occurring on or after the date of enactment of this Act.