H.R. 4755 Text - Reported in House - 118th Congress (2023-2024)

SEC. 2. Privacy enhancing technology.

(a) National Science Foundation support of research on privacy enhancing technology.—The Director of the National Science Foundation, in consultation with the heads of other relevant Federal agencies (as determined by the Director), shall support merit-reviewed and competitively awarded research on privacy enhancing technologies, which may include the following:

(1) Fundamental research on technologies for de-identification, pseudonymization, anonymization, or obfuscation to mitigate individuals’ privacy risks in data sets while maintaining fairness, accuracy, and efficiency.

(2) Fundamental research on algorithms and other similar mathematical tools used to protect individual privacy when collecting, storing, sharing, analyzing, or aggregating data.

(3) Fundamental research on technologies that promote data minimization in data collection, sharing, and analytics that takes into account the trade-offs between the data minimization goals and the informational goals of data collection.

(4) Research awards on privacy enhancing technologies coordinated with other relevant Federal agencies and programs.

(5) Supporting education and workforce training research and development activities, including re-training and upskilling of the existing workforce, to increase the number of privacy enhancing technology researchers and practitioners.

(6) Multidisciplinary socio-technical research that fosters broader understanding of privacy preferences, requirements, and human behavior to inform the design and adoption of effective privacy solutions.

(7) Development of freely available privacy enhancing technology software libraries, platforms, and applications.

(8) Fundamental research on techniques that may undermine the protections provided by privacy enhancing technologies, the limitations of such protections, and the trade-offs between privacy and utility required for the deployment of such technologies.

(9) Fundamental research on technologies and techniques to preserve the privacy and confidentiality of individuals from unconsented, unwanted, or unauthorized location tracking, including through GPS.

(b) Integration into the computer and network security program.—Subparagraph (D) of section 4(a)(1) of the Cyber Security Research and Development Act (15 U.S.C. 7403(a)(1)(D)) is amended by inserting “, including privacy enhancing technologies” before the semicolon.

(c) Coordination with the National Institute of Standards and Technology and other stakeholders.—

(1) IN GENERAL.—The Director of the Office of Science and Technology Policy, acting through the Networking and Information Technology Research and Development Program, shall coordinate with the Director of the National Science Foundation, the Director of the National Institute of Standards and Technology, the Federal Trade Commission, and the heads of other Federal agencies, as appropriate, to accelerate the development, deployment, and adoption of privacy enhancing technologies.

(2) OUTREACH.—The Director of the National Institute of Standards and Technology shall conduct outreach to—

(A) receive input from private, public, and academic stakeholders on the development of privacy enhancing technologies; and

(B) facilitate and support ongoing public and private sector engagement to inform the development and dissemination of voluntary, consensus-based technical standards, guidelines, methodologies, procedures, and processes to cost-effectively increase the integration of privacy enhancing technologies in data collection, sharing, and analytics performed by the public and private sectors.

(d) Report on privacy enhancing technology research.—Not later than three years after the date of the enactment of this Act, the Director of the Office of Science and Technology Policy, acting through the Networking and Information Technology Research and Development Program, shall, in coordination with the Director of the National Science Foundation, the Director of the National Institute of Standards and Technology, and the heads of other Federal agencies, as appropriate, submit to the Committee on Commerce, Science, and Transportation of the Senate, the Subcommittee on Commerce, Justice, Science, and Related Agencies of the Committee on Appropriations of the Senate, the Committee on Science, Space, and Technology of the House of Representatives, and the Subcommittee on Commerce, Justice, Science, and Related Agencies of the Committee on Appropriations of the House of Representatives, a report containing information relating to the following:

(1) The progress of research on privacy enhancing technologies.

(2) The progress of the development of voluntary resources described under subsection (c)(2)(B).

(3) Any policy recommendations that could facilitate and improve communication and coordination between the private sector and relevant Federal agencies for the implementation and adoption of privacy enhancing technologies.

(e) Protecting personal identifying information.—Any personal identifying information collected or stored through the activities authorized under this section shall be done in accordance with part 690 of title 45, Code of Federal Regulations (relating to the protection of human subjects), or any successor regulation.

(f) Definition.—In this section, the term “privacy enhancing technology”—

(1) means any software or hardware solution, technical process, or other technological means of mitigating individuals’ privacy risks arising from data processing by enhancing predictability, manageability, disassociability, and confidentiality; and

(2) may include—

(A) cryptographic techniques for facilitating computation or analysis on data while mitigating privacy risks;

(B) techniques for—

(i) publicly sharing data without enabling inferences to be made about specific individuals;

(ii) giving individuals’ control over the dissemination, sharing, and use of their data; and

(iii) generating synthetic data; and

(C) any other technology or approach that reduces the risk of re-identification, including when combined with other information.