Limitation on intelligence acquisition of United States person data

(a) Definitions In this section: (1) Appropriate committees of congress The term appropriate committees of Congress means— (A) the congressional intelligence committees (as defined in section 3 of the National Security Act of 1947 (50 U.S.C. 3003)); (B) the Committee on the Judiciary of the Senate; and (C) the Committee on the Judiciary of the House of Representatives. (2) Covered data The term covered data means data, derived data, or any unique identifier that— (A) is linked to or is reasonably linkable to a covered person; and (B) does not include— (i) data that— (I) is lawfully available to the public through Federal, State, or local government records or through widely distributed media; (II) is reasonably believed to have been voluntarily made available to the general public by the covered person; or (III) is a specific communication or transaction with a targeted individual who is not a covered person; or (ii) human intelligence other than data transfers. (3) Covered person The term covered person means an individual who— (A) is reasonably believed to be located in the United States at the time of the creation or acquisition of the covered data; or (B) is a United States person. (4) Intelligence community The term intelligence community has the meaning given such term in section 3 of the National Security Act of 1947 (50 U.S.C. 3003). (5) State, United States, United States person The terms State, United States, and United States person have the meanings given such terms in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801). (b) Limitation (1) In general Subject to paragraphs (2) through (7), an element of the intelligence community may not acquire covered data, which shall include acquiring covered data directly or indirectly, such as by acquiring covered data from another entity that directly acquired the covered data. (2) Authorization pursuant to court order An element of the intelligence community may acquire covered data if the collection has been authorized by an order issued pursuant to the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.) or title 18, United States Code, by a court of competent jurisdiction covering the period of the acquisition, subject to the use, dissemination, querying, retention, and other minimization limitations required by such authorization. (3) Authorization for employment-related use An element of the intelligence community may acquire covered data about an employee of, or applicant for employment by, an element of the intelligence community for employment-related purposes, but only if— (A) access to and use of the covered data is limited to such purposes; and (B) the covered data is destroyed at such time as it is no longer necessary for such purposes. (4) Exception for compliance purposes An element of the intelligence community may acquire covered data for the purpose of supporting compliance with collection limitations and minimization requirements imposed by statute, guidelines, procedures, or the Constitution of the United States, but only if— (A) access to and use of the covered data is limited to such purpose; and (B) the covered data is destroyed at such time as it is no longer necessary for such purpose. (5) Exception for life or safety An element of the intelligence community may acquire covered data if there is a reasonable belief that an emergency exists involving an imminent threat of death or serious bodily harm and the covered data is necessary to mitigate that threat, but only if— (A) access to and use of the covered data is limited to addressing the threat; and (B) the covered data is destroyed at such time as it is no longer necessary for such purpose. (6) Exception for consent An element of the intelligence community may acquire covered data if— (A) each covered person linked or reasonably linkable to the covered data, or, if such person is incapable of providing consent, a third party legally authorized to consent on behalf of the person, has provided consent to the acquisition and use of the data on a case-by-case basis; (B) access to and use of the covered data is limited to the purposes for which the consent was provided; and (C) the covered data is destroyed at such time as it is no longer necessary for such purposes. (7) Exception for nonsegregable data An element of the intelligence community may acquire a dataset that includes covered data if the covered data is not reasonably segregable prior to acquisition, but only if the element of the intelligence community complies with the minimization procedures in subsection (c). (c) Minimization procedures (1) In general The Attorney General shall adopt specific procedures that are reasonably designed to minimize the acquisition and retention, and to restrict the querying, of covered data that is not subject to 1 or more of the exceptions set forth in subsection (b). (2) Acquisition and retention The procedures adopted under paragraph (1) shall require elements of the intelligence community to exhaust all reasonable means— (A) to exclude covered data not subject to 1 or more exceptions set forth in subsection (b) from datasets prior to acquisition; and (B) to remove and delete covered data not subject to 1 or more exceptions set forth in subsection (b) prior to the operational use of the acquired dataset or the inclusion of the dataset in a database intended for operational use. (3) Destruction The procedures adopted under paragraph (1) shall require that if an element of the intelligence community identifies covered data not subject to 1 or more exceptions set forth in paragraphs (2) through (6) of subsection (b), such covered data shall be promptly destroyed. (4) Querying (A) In general Except as provided in subparagraphs (B) and (C), no officer or employee of an element of the intelligence community may conduct a query of covered data, including covered data already subjected to minimization, in an effort to find records of or about a particular covered person. (B) Exceptions Subparagraph (A) shall not apply to a query related to a particular covered person if— (i) such covered person is the subject of a court order issued under the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.) or title 18, United States Code, that would authorize the element of the intelligence community to compel the production of the covered data, during the effective period of that order; (ii) the purpose of the query is to retrieve information about an employee of, or applicant for employment by, an element of the intelligence community, provided that any covered data accessed through such query is used only for such purpose; (iii) the query is conducted for the purpose of supporting compliance with collection limitations and minimization requirements imposed by statute, guidelines, procedures, or the Constitution of the United States, provided that any covered data accessed through such query is used only for such purpose; (iv) the officer or employee of an element of the intelligence community carrying out the query has a reasonable belief that an emergency exists involving an imminent threat of death or serious bodily harm, and that in order to prevent or mitigate such threat, the query must be conducted before a court order can, with due diligence, be obtained, provided that any covered data accessed through such query is used only for such purpose; or (v) such covered person or, if such person is incapable of providing consent, a third party legally authorized to consent on behalf of the person has consented to the query, provided that any use of covered data accessed through such query is limited to the purposes for which the consent was provided. (C) Special rule for nonsegregable datasets For a query of a dataset acquired under subsection (b)(7)— (i) each query shall be reasonably designed to exclude personal data of covered persons, unless the query is subject to an exception set forth in subparagraph (B); and (ii) any personal data of covered persons returned pursuant to a query that is not subject to an exception set forth in paragraphs (2) through (7) of subsection (b) shall not be reviewed and shall immediately be destroyed. (d) Prohibition on use of data obtained in violation of this Section Covered data acquired by an element of the intelligence community in violation of subsection (b), and any evidence derived therefrom, may not be used, received in evidence, or otherwise disseminated in any investigation by or in any trial, hearing, or other proceeding in or before any court, grand jury, department, office, agency, regulatory body, legislative committee, or other authority of the United States, a State, or political subdivision thereof. (e) Reporting requirement (1) In general Not later than 180 days after the date of the enactment of this Act, the Director of National Intelligence shall submit to the appropriate committees of Congress and the Privacy and Civil Liberties Oversight Board a report on the acquisition of datasets that the Director anticipates will contain information of covered persons that is significant in volume, proportion, or sensitivity. (2) Contents The report submitted pursuant to paragraph (1) shall include the following: (A) A description of the covered person information in each dataset. (B) An estimate of the amount of covered person information in each dataset. (3) Notifications After submitting the report required by paragraph (1), the Director shall, in coordination with the Under Secretary of Defense for Intelligence and Security, notify the appropriate committees of Congress of any changes to the information contained in such report. (4) Availability to the public The Director shall make available to the public on the website of the Director— (A) the unclassified portion of the report submitted pursuant to paragraph (1); and (B) any notifications submitted pursuant to paragraph (3). (f) Rule of construction Nothing in this section shall authorize an acquisition otherwise prohibited by the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.) or title 18, United States Code.