Prohibition on intelligence acquisition of United States person data

(a) Covered data defined In this section, the term covered data means— (1) data, derived data, or any unique identifier that is linked to or is reasonably linkable to a covered person or to an electronic device that is linked to, or is reasonably linkable to, 1 or more covered persons in a household; (2) includes anonymized data that, if combined with other data, can be linked to, or is reasonably linkable to, a covered person or to an electronic device that is linked to, or is reasonably linkable to, 1 or more covered persons in a household; and (3) does not include data that— (A) is lawfully available to the public through Federal, State, or local government records or through widely distributed media; (B) is reasonably believed to have been voluntarily made available to the general public by the covered person; or (C) is a specific communication or transaction with a targeted individual who is not a covered person. (b) Limitation (1) In general Subject to paragraphs (2) through (8), an element of the intelligence community may not acquire a dataset that includes covered data. (2) Authorization pursuant to the Foreign Intelligence Surveillance Act of 1978 An element of the intelligence community may acquire covered data if the data has been authorized for collection pursuant to an order or emergency authorization pursuant to the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.) or the Federal Rules of Criminal Procedure by a court of competent jurisdiction covering the period of the acquisition, subject to the use, dissemination, querying, retention, and other minimization limitations required by such authorization. (3) Authorization for employment-related use An element of the intelligence community may acquire covered data about an employee of, or applicant for employment by, an element of the intelligence community for employment-related purposes, provided that— (A) access to and use of the covered data is limited to such purposes; and (B) the covered data is destroyed at such time as it is no longer necessary for such purposes. (4) Exception for compliance purposes An element of the intelligence community may acquire covered data for the purpose of supporting compliance with collection limitations and minimization requirements imposed by statute, guidelines, procedures, or the United States Constitution, provided that— (A) access to and use of the covered data is limited to such purpose; and (B) the covered data is destroyed at such time as it is no longer necessary for such purpose. (5) Exception for life or safety An element of the intelligence community may acquire covered data if— (A) there is a reasonable belief that— (i) an emergency exists involving an imminent threat of death or serious bodily harm; and (ii) in order to prevent or mitigate this threat, the acquisition must be conducted before authorization pursuant to paragraph (2) can, with due diligence, be obtained; (B) access to and use of the covered data is limited to addressing the threat; (C) the covered data is destroyed at such time as it is no longer necessary for such purpose; and (D) not later than 14 days after the acquisition, a description of the acquisition is provided to the congressional intelligence committees. (6) Exception for consent An element of the intelligence community may acquire covered data if— (A) each covered person linked or reasonably linked to the covered data, or, if such person is incapable of providing consent, a third party legally authorized to consent on behalf of the person, has provided consent to the acquisition and use of the data on a case-by-case basis; (B) access to and use of the covered data is limited to the purposes for which the consent was provided; and (C) the covered data is destroyed at such time as it is no longer necessary for such purposes. (7) Exception for nonsegregable data An element of the intelligence community may acquire a dataset that includes covered data if the covered data is not reasonably segregable prior to acquisition, provided that the element of the intelligence community complies with the minimization procedures in subsection (c). (8) Exception for national security letter data An element of the intelligence community may acquire, through noncompulsory means that are otherwise not contrary to a provision of Federal law, data that, in the United States, the Federal Government has the authority to compel production through a national security letter pursuant to section 2709 of title 18, United States Code, section 626 or 627 of the Consumer Credit Protection Act (15 U.S.C. 1681u, 1681v), or section 1114 of the Right to Financial Privacy Act of 1978 (12 U.S.C. 3414), provided— (A) the person or entity in possession of the data is outside the United States and compelled production is not feasible; (B) the acquisition is conducted consistent with the limitations that would apply if, in the United States, the Federal Government compelled production of such data with a national security letter pursuant to such provisions of law; and (C) the element of the intelligence community maintains all records required by such provisions of law, including the content of relevant certifications, for each covered person or each instance of data, derived data or unique identifier linked to or reasonably linkable to a covered person. (c) Minimization procedures (1) In general The Attorney General shall adopt specific procedures that are reasonably designed to minimize the acquisition and retention of covered data that is not subject to 1 or more of the exceptions set forth in subsection (b). (2) Acquisition and retention The procedures adopted under paragraph (1) shall require elements of the intelligence community to exhaust all reasonable means— (A) to exclude covered data not subject to 1 or more exceptions set forth in subsection (b) from datasets prior to acquisition; and (B) to remove and delete covered data not subject to 1 or more exceptions set forth in subsection (b) prior to the operational use of the acquired dataset or the inclusion of the dataset in a database intended for operational use. (3) Destruction The procedures adopted under paragraph (1) shall require that if an element of the intelligence community identifies covered data acquired in violation of subsection (b), such covered data shall be promptly destroyed. (d) Prohibition on use of data obtained in violation of this section Covered data acquired by an element of the intelligence community in violation of subsection (b), and any evidence derived therefrom, may not be used, received in evidence, or otherwise disseminated in any investigation, trial, hearing, or other proceeding in or before any court, grand jury, department, office, agency, regulatory body, legislative committee, or other authority of the United States, a State, or political subdivision thereof. (e) Reporting requirement (1) In general Not later than 180 days after the date of the enactment of this Act and not less frequently than once each year thereafter, the Director of National Intelligence shall submit to the appropriate committees of Congress and the Privacy and Civil Liberties Oversight Board a report on acquisitions pursuant to this section. (2) Contents The report submitted pursuant to paragraph (1) shall include the following: (A) Datasets A description of datasets that the Director determines contain information of covered persons that is significant in volume proportion, or sensitivity, including— (i) the covered person information in each dataset; and (ii) an estimate of the amount of covered person information in each dataset; (B) Data collection A description of data collected pursuant to subsection (b)(8), including— (i) a description of the covered person information for each acquisition; and (ii) the number of covered persons or instances of data, derived data or unique identifiers linked to or reasonably linkable to a covered person, disaggregated by the national security letter authority for which compelled production would be required. (C) Detected violations A description of covered data identified as having been acquired in violation of subsection (b) in the preceding year, including— (i) an estimate of the number of covered persons whose information was acquired in violation of subsection (b); and (ii) any changes made to the procedures in subsection (c) to address compliance issues. (3) Notifications After submitting the report required by paragraph (1), the Director shall, in coordination with the Under Secretary, notify the appropriate committees of Congress of any changes to the information contained in such report. (4) Availability to the public The Director shall make available to the public on the website of the Director— (A) the unclassified portion of the report submitted pursuant to paragraph (1); and (B) any notifications submitted pursuant to paragraph (3). (f) Rule of construction Nothing in this section shall authorize an acquisition otherwise prohibited by this Act, the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.), or title 18, United States Code.