Sponsors (4)
Want to know what is actually in this bill?
This is not an official government website.
Copyright © 2026 PLEJ LC. All rights reserved.
Alters the effective date provisions for amendments made by sections 2 and 3 to 5 U.S.C. 552a: generally effective 2 years after enactment, but effective upon enactment with respect to specified entities and activities listed in subsection (c).
Insert text before the semicolon at the end of subsection (a)(7).
Insert text before the semicolon at the end of subsection (b)(1).
Multiple amendments to subsection (e): strike specified punctuation in introductory matter and paragraph (2); revise paragraph (4) including amending subparagraph (D) to require disclosure of any purpose for which information is intended to be used (including each routine use), adjust subparagraph (H) and (I) punctuation, and add subparagraph (J) requiring citation to the legal authority for each purpose; strike and adjust punctuation in paragraphs (11) and (12); and add new paragraphs (13) (use records only for a legally authorized purpose) and (14) (reasonable efforts to ensure disclosed records contain only minimum necessary information).
Amendments to matching program exceptions: replace clause (ii) with text allowing matches performed to support research or statistical projects only if results are not intended to be used (and are not used) to make decisions concerning individual rights/benefits or to take adverse actions against Federal personnel; insert text after the semicolon in clause (viii); strike clause (ix); and redesignate clause (x) as clause (ix).
Amend paragraph (1)(D) to cover failures to comply that have, or could reasonably lead to, an adverse effect on any person (including any State or territory or political subdivision or any Indian Tribe). Revise paragraph (4) to authorize courts in suits under subsection (g)(1)(C) or (D) to provide equitable or declaratory relief and, if the agency acted intentionally or willfully, make the United States liable for (i) actual damages including nonpecuniary damages with a guaranteed minimum recovery of $1,000, (ii) costs and reasonable attorney fees, and (iii) punitive damages as appropriate.
Add a felony offense for anyone who commits the described offense with intent to sell, transfer, use, or disclose a record for commercial advantage, personal gain, or malicious harm, punishable by a fine not more than $250,000, imprisonment not more than 10 years, or both. Also amend paragraph (3) by striking 'misdemeanor and fined not more than $5,000' and inserting revised felony language (text as printed contains an insertion error).
Updates the federal Privacy Act to modernize definitions, tighten limits on how agencies collect, use, and disclose personal records, and raise civil and criminal penalties for wrongful disclosure or misuse. It requires agencies to state legal authority and purpose for uses of records, to apply a “minimum necessary” standard, and creates sharper limits and duties around automated matching programs and government contractor handling of records. Implements these changes mostly two years after enactment, but lists several immediate exceptions that take effect on the date of enactment; also includes a provision saying the Act’s amendments are not to be used to reinterpret or expand existing Privacy Act law or remedies beyond current law.
Revises the definition of who is a "natural person" for purposes of the Act to mean either (A) a United States person as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801) or (B) a person in the United States. (Amendment appears in paragraph (2) of 5 U.S.C. 552a(a).)
Defines the term "record" to mean any personally identifiable information processed by an agency. (Replaces prior paragraphs (4) and (5) in 5 U.S.C. 552a(a).)
Defines the term "system of records" to mean a group of any records maintained by or for, or otherwise under the control of, any agency. (Replaces prior paragraph in 5 U.S.C. 552a(a).)
Amends paragraph (12) by striking the word "and" at the end (a punctuation/grammatical change).
Amends paragraph (13) by changing the final period to a semicolon (a punctuation/grammatical change to allow addition of further definitions).
Who is affected and how:
Federal agencies: Directly affected because they must revise policies, system-of-record notices, internal procedures, data inventories, privacy impact assessments, training programs, and contractual terms with third parties to meet new purpose, documentation, and minimum-necessary rules. Agencies will face greater legal exposure for intentional or willful violations and may need to budget for compliance activities.
Individuals (people whose records are held by the federal government): Gain stronger statutory protections, tighter limits on disclosure and reuse of personal information, and enhanced civil remedies making it easier to recover damages and attorney’s fees when harm results from intentional or willful violations.
Government contractors and third-party processors: Must update contract terms, safeguards, and data-handling practices to comply with new statutory requirements and to limit agency exposure; increased compliance burden and potential liability for mishandling records.
Researchers and statistical users of government administrative data: Face tighter controls on matching programs and statistical uses; may encounter additional procedural hurdles, restrictions on data elements shared, or limits on how matched data are used or disclosed.
Courts and litigants: May see more Privacy Act litigation because of stronger remedies and clearer statutory language, but the Act’s non-interpretation clause could limit use of this statute to change court interpretations of the pre-existing Privacy Act.
Potential costs and benefits:
Timing and transition:
Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
Introduced March 31, 2025 by Ronald Lee Wyden · Last progress March 31, 2025
Expand sections to see detailed analysis
Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
Introduced in Senate