Summary:
Free Flow of Information Act of 2013 - (Sec. 2) Prohibits a federal entity (an entity or employee of the judicial or executive branch or an administrative agency of the federal government with the power to issue a subpoena or other compulsory process), in any proceeding or in connection with any issue arising under federal law, from compelling a covered journalist to disclose protected information, unless a U.S. judge in the jurisdiction where the compulsory process has been or would be issued determines, after providing notice and an opportunity for the journalist to be heard, that all reasonable alternative sources have been exhausted and that separate specified conditions have been met depending on whether the matter is a criminal investigation or prosecution. (Thus, establishes a qualified privilege for journalists to withhold confidential information unless a judge makes a determination to compel disclosure under conditions that apply differently in criminal and civil matters.)

Defines a "covered journalist" as a person who:

 is, or on the date on which the protected information sought was obtained or created by the person asserting protection, was an employee, independent contractor, or agent of an entity or service that disseminates news or information by various means (newspaper; nonfiction book; wire service; news agency; news website, mobile application or other news or information service; news program; magazine or other periodical; or through television or radio broadcast, multichannel video programming distributor, or motion picture for public showing) and who, with the primary intent to investigate events and procure material to disseminate news to the public, engages, or as of the relevant date, engaged in the regular gathering, preparation, collection, photographing, recording, writing, editing, reporting, or publishing on such matters through specified methods; or at the inception of the process of gathering the news or information sought, had the primary intent to investigate issues or events and procure material in order to disseminate news to the public and regularly conducted interviews, reviewed documents, captured images of events, or directly observed events, and either: (1) would have been included as a member of specified news or information services for any continuous 1-year period within the 20 years prior to the relevant date or any continuous 3-month period within the 5 years prior to the relevant date; (2) had substantially contributed, as an author, editor, photographer, or producer, to a significant number of articles, stories, programs, or publications within 5 years prior to the relevant date; or (3) was a student participating in a journalistic medium at an institution of higher education on the relevant date. Provides for supervisors, editors, employers, parent companies, subsidiaries, or affiliates of such persons to be treated as covered journalists.

Authorizes a U.S. judge to provide the protections of this Act to a person who does not meet the definition of a covered journalist if such protections would be in the interest of justice and necessary to protect lawful and legitimate news-gathering activities.

Excludes from the definition of a "covered journalist": (1) any person or entity whose principal function is to publish primary source documents that have been disclosed to such person or entity without authorization; and (2) specified foreign powers or agents of foreign powers, members or affiliates of foreign terrorist organizations, specially designated global terrorists, and other terrorist organizations or people reasonably likely to commit, attempt, or provide support for terrorism.

Defines "protected information" as:

 information identifying a source who provided information under a promise or agreement of confidentiality made by a covered journalist as part of engaging in journalism; or any records, contents of a communication, documents, or information that a covered journalist obtained or created as part of engaging in journalism and upon a promise or agreement of confidentiality. Requires, as a prerequisite for compelled disclosure in a criminal investigation or prosecution, a determination by the judge that:

 if the party seeking to compel disclosure is the federal government, based on public information or information obtained from a source other than the covered journalist, there are reasonable grounds to believe a crime has occurred; based on such public or source information, the protected information is essential to the investigation or prosecution or to the defense against the prosecution; the Attorney General certifies that the decision to request compelled disclosure was consistent with federal regulations, if compelled disclosure is sought by a member of the Department of Justice (DOJ) in circumstances governed by regulations specifying DOJ policy with respect to the news media; and the covered journalist has not established by clear and convincing evidence that disclosure would be contrary to public interest, including the interest in gathering and disseminating information or news as well as maintaining the free flow of information and the public interest in compelling disclosure, including the extent of any harm to national security. Requires, in matters other than criminal investigations or prosecutions, based on public information or information obtained from a source other than the covered journalist, a determination by the judge that:

 the protected information sought is essential to the resolution of the matter, and the party seeking to compel disclosure establishes that the interest in compelling disclosure clearly outweighs the public interest in gathering and disseminating the information or news at issue and maintaining the free flow of information. Prohibits such compelled disclosure conditions from precluding: (1) warrant requirements for certain communications under the Electronic Communications Privacy Act, or (2) search and seizure procedures set forth in the Federal Rules of Criminal Procedure.

(Sec. 3) Provides an exception from such judicial determination requirements, and thereby makes the qualified privilege inapplicable, for compelled disclosures of information or items obtained as the result of the eyewitness observations of, or obtained during the course of, alleged criminal conduct by the covered journalist , including any physical evidence or visual or audio recording of the conduct.

Prohibits such exception from applying, and instead requires the appropriate judicial determinations for compelled disclosure, subject to other specified exceptions, if the alleged criminal conduct is the act of communicating the documents or information at issue (thereby preempting certain provisions of Privacy Protection Act of 1980 relating to the seizure of materials when there is probable cause to believe that a member of the media has committed a crime by receiving, possessing, or communicating national defense or classified information).

(Sec. 4) Provides an additional exception from judicial determination requirements, and thereby makes the qualified privilege inapplicable, for compelled disclosures of protected information that is reasonably necessary to stop, prevent, or mitigate a specific case of death, kidnapping, substantial bodily harm, certain offenses against minors, or the incapacitation or destruction of critical infrastructure.

(Sec. 5) Sets forth a separate framework of judicial findings for a court to make under a preponderance of the evidence standard to compel disclosure of protected information sought by the federal government in criminal investigations or prosecutions involving an act of terrorism or other acts that have caused, or are reasonably likely to cause, significant and articulable harm to national security, including a standard designated specifically for matters involving an alleged unlawful disclosure of properly classified information.

Directs federal courts, in determining what constitutes harm to national security, to give appropriate deference to a specific factual showing submitted by the head of any executive branch agency concerned.

Prohibits such compelled disclosure based solely on the potential for a subsequent unlawful disclosure by the source sought to be identified without any showing of additional facts beyond such potential disclosure.

(Sec. 6) Requires the compelled disclosure standards and exemptions under this Act to apply in the same manner when information from the account of a person known to be, or reasonably likely to be, a covered journalist is sought from a covered service provider. Provides an exception from certain compelled disclosure requirements with respect to service providers when the Federal Bureau of Investigation (FBI) requests telephone toll and electronic communications transactional records for counterintelligence purposes, thereby enabling such disclosure to be compelled without reasonable grounds to believe that a crime has occurred and without a certification from the Attorney General.

Defines "covered service provider" as:

 any person that transmits information of the customer's choosing by electronic means; a telecommunications carrier, information service, interactive computer service, or information content provider under the Communications Act of 1934; a remote computing or electronic communications service; or any commercial entity that maintains records related to a covered journalist. Requires a covered journalist to be given notice, and an opportunity to be heard, before a judge may compel disclosure from such service providers.

Permits notice requirements to be delayed if the judge determines by clear and convincing evidence that such notice would: (1) pose a clear and substantial threat to the integrity of a criminal investigation, (2) risk grave harm to national security, or (3) present an imminent risk of death or serious bodily harm.

Specifies that a substantial threat to the integrity of a criminal investigation exists when the target of the investigation may learn of the investigation and destroy evidence if notice is provided.

Allows the court to extend the delay of notice under specified circumstances.

(Sec. 7) Prohibits this Act from superseding, diluting, or precluding any law or court decision addressing compelled disclosure by a covered journalist or service provider of: (1) information identifying a source who provided information without a promise or agreement of confidentiality made by the covered journalist as part of engaging in journalism; or (2) records, other information, or contents of a communication obtained without a promise or agreement of confidentiality.

(Sec. 8) Allows a judge to: (1) receive and consider submissions from the parties in camera or under seal and, if necessary, ex parte; and (2) find a journalist to be in civil or criminal contempt for a failure to comply with an order compelling disclosure of protected information.

Requires courts of appeal to provide an expedited appeal process.

(Sec. 9) Prohibits this Act from being construed to: (1) preempt any law or claim relating to defamation, slander, or libel; (2) modify privacy requirements relating to a federal agency's disclosure of records pertaining to individuals; (3) modify certain grand jury secrecy rules; (4) create new obligations or affect the authorities of federal entities with respect to the acquisition or dissemination of information under the Foreign Intelligence Surveillance Act of 1978 (FISA); or (5) preclude voluntary disclosure of information to a federal entity in a situation not governed by this Act.

(Sec. 10) Directs the DOJ Inspector General to conduct an audit of the use of this Act through December 31, 2016, and to report to Congress regarding its examination of: (1) each instance in which a court failed to compel the disclosure of protected information, and (2) whether any procedural impediments have had a detrimental operational impact on the activities of the FBI. Permits the Attorney General and the Director of National Intelligence (DNI) to provide comments to be included in such report.

free flow information act sec prohibits federal entity entity employee judicial executive branch administrative agency federal government power issue subpoena compulsory process proceeding connection issue arising federal law compelling covered disclose protected information judge jurisdiction compulsory process issued determines providing notice opportunity heard reasonable alternative sources exhausted separate specified conditions met depending matter criminal investigation prosecution establishes qualified privilege journalists withhold confidential information judge makes determination compel disclosure conditions apply criminal civil matters defines covered person date protected information sought obtained created person asserting protection employee independent contractor agent entity service disseminates news information means newspaper book wire service news agency news website mobile application news information service news program magazine television radio broadcast multichannel video programming distributor motion picture public showing primary intent investigate events procure material disseminate news public engages relevant date engaged regular gathering preparation collection photographing recording writing editing reporting publishing matters specified methods inception process gathering news information sought primary intent investigate issues events procure material order disseminate news public regularly conducted interviews reviewed documents captured images events directly observed events included member specified news information services continuous year period years prior relevant date continuous month period years prior relevant date substantially contributed author producer significant number articles programs publications years prior relevant date student participating medium institution higher education relevant date provides supervisors employers parent companies subsidiaries affiliates persons treated covered journalists authorizes judge provide protections act person meet definition covered protections interest justice necessary protect lawful legitimate news gathering activities excludes definition covered person entity principal function publish primary source documents disclosed person entity authorization specified foreign powers agents foreign powers members affiliates foreign terrorist organizations specially designated global terrorists terrorist organizations people reasonably likely commit attempt provide support terrorism defines protected information information identifying source provided information promise agreement confidentiality covered engaging journalism records contents communication documents information covered obtained created engaging journalism promise agreement confidentiality requires prerequisite compelled disclosure criminal investigation prosecution determination judge party seeking compel disclosure federal government based public information information obtained source covered reasonable grounds believe crime occurred based public source information protected information essential investigation prosecution defense prosecution attorney general certifies decision request compelled disclosure consistent federal regulations compelled disclosure sought member department_of_justice doj circumstances governed regulations specifying doj policy respect news media covered established clear convincing evidence disclosure contrary public interest including interest gathering disseminating information news maintaining free flow information public interest compelling disclosure including extent harm national security requires matters criminal investigations prosecutions based public information information obtained source covered determination judge protected information sought essential resolution matter party seeking compel disclosure establishes interest compelling disclosure clearly outweighs public interest gathering disseminating information news issue maintaining free flow information prohibits compelled disclosure conditions precluding warrant requirements certain communications search seizure procedures set forth federal_rules_of_criminal_procedure sec provides exception judicial determination requirements makes qualified privilege inapplicable compelled disclosures information items obtained result eyewitness observations obtained course alleged criminal conduct covered including physical evidence visual audio recording conduct prohibits exception applying instead requires appropriate judicial determinations compelled disclosure subject specified exceptions alleged criminal conduct act communicating documents information issue preempting certain provisions privacy protection act relating seizure materials probable cause believe member media committed crime receiving possessing communicating national defense classified information sec provides additional exception judicial determination requirements makes qualified privilege inapplicable compelled disclosures protected information reasonably necessary stop prevent mitigate specific case death kidnapping substantial bodily harm certain offenses minors destruction critical infrastructure sec sets forth separate framework judicial findings court preponderance evidence standard compel disclosure protected information sought federal government criminal investigations prosecutions involving act terrorism acts caused reasonably likely cause significant articulable harm national security including standard designated specifically matters involving alleged unlawful disclosure properly classified information directs federal courts determining constitutes harm national security appropriate deference specific factual showing submitted head executive branch agency concerned prohibits compelled disclosure based solely potential subsequent unlawful disclosure source sought identified showing additional facts potential disclosure sec requires compelled disclosure standards exemptions act apply manner information account person known reasonably likely covered sought covered service provider provides exception certain compelled disclosure requirements respect service providers federal_bureau_of_investigation fbi requests telephone toll electronic communications transactional records counterintelligence purposes enabling disclosure compelled reasonable grounds believe crime occurred certification attorney general defines covered service provider person transmits information customer choosing electronic means telecommunications carrier information service interactive computer service information content provider communications act remote computing electronic communications service commercial entity maintains records related covered requires covered given notice opportunity heard judge compel disclosure service providers permits notice requirements delayed judge determines clear convincing evidence notice pose clear substantial threat integrity criminal investigation risk grave harm national security present imminent risk death bodily harm specifies substantial threat integrity criminal investigation exists target investigation learn investigation destroy evidence notice provided allows court extend delay notice specified circumstances sec prohibits act superseding precluding law court decision addressing compelled disclosure covered service provider information identifying source provided information promise agreement confidentiality covered engaging journalism records information contents communication obtained promise agreement confidentiality sec allows judge receive consider submissions parties camera seal necessary parte find civil criminal contempt failure comply order compelling disclosure protected information requires courts appeal provide expedited appeal process sec prohibits act construed preempt law claim relating defamation slander libel modify privacy requirements relating federal agency disclosure records pertaining individuals modify certain grand jury secrecy rules create new obligations affect authorities federal entities respect acquisition dissemination information foreign_intelligence_surveillance_act fisa preclude voluntary disclosure information federal entity situation governed act sec directs doj inspector general conduct audit use act december report congress examination instance court failed compel disclosure protected information procedural impediments detrimental operational impact activities fbi permits attorney general director national_intelligence dni provide comments included report


Summary:
Preserving Freedom from Unwarranted Surveillance Act of 2013 - Prohibits a person or entity acting under the authority of (or funded in whole or in part by) the federal government from using a drone to gather evidence or other information pertaining to criminal conduct or conduct in violation of a statute or regulation except to the extent authorized in a warrant satisfying the requirements of the Fourth Amendment to the Constitution.

Defines a "drone" as an unmanned aircraft operated without the possibility of direct human intervention from within or on the aircraft.

Exempts from such prohibition the use of drones to: (1) patrol national borders to prevent or deter illegal entry of any persons or illegal substances, (2) prevent imminent danger to the life of an individual when drones are used by law enforcement under exigent circumstances, or (3) counter a high risk of a terrorist attack by a specific individual or organization based on credible intelligence determined by the Secretary of Homeland Security (DHS).

Authorizes civil actions by aggrieved parties.

Prohibits evidence obtained or collected in violation of this Act from being admissible in a criminal prosecution in any court in the United States.

preserving freedom unwarranted surveillance act prohibits person entity acting authority funded federal government drone gather evidence information pertaining criminal conduct conduct violation statute regulation extent authorized warrant satisfying requirements fourth amendment constitution defines drone unmanned aircraft operated possibility direct human intervention aircraft exempts prohibition use drones patrol national borders prevent deter illegal entry persons illegal substances prevent imminent danger life individual drones law enforcement exigent circumstances counter high risk terrorist attack specific individual organization based credible intelligence determined secretary homeland_security dhs authorizes civil actions aggrieved parties prohibits evidence obtained collected violation act admissible criminal prosecution court united_states


Summary:
Safeguarding Privacy and Fostering Aerospace Innovation Act of 2013 - Amends the federal criminal code to make it unlawful for any person to use a civil unmanned aircraft system (drone) to willfully conduct surveillance of another person (targeted person), unless: (1) the person conducting the surveillance obtains prior express written consent of the targeted person, (2) there is an emergency situation in which the life of an individual is threatened, or (3) the targeted person is in a public place where surveillance would not be highly offensive to a reasonable person.

 Prescribes penalties for violations of these requirements.

Requires the owner of a drone to clearly mark it with the owner's name, address, and telephone number.

safeguarding privacy fostering aerospace innovation act amends federal criminal code unlawful person use civil unmanned aircraft system drone willfully conduct surveillance person targeted person person conducting surveillance obtains prior express written consent targeted person emergency situation life individual threatened targeted person public place surveillance highly offensive reasonable person prescribes penalties violations requirements requires owner drone clearly mark owner address telephone number


Summary: Fourth Amendment Restoration Act of 2013 - Provides that the Fourth Amendment to the Constitution shall not be construed to allow any U.S. government agency to search the phone records of Americans without a warrant based on probable cause.

Civil rights and liberties, minority issues

fourth amendment restoration act provides fourth amendment constitution shall construed allow government agency search phone records americans warrant based probable cause


Summary:
Data Security and Breach Notification Act of 2013 - Requires commercial entities that acquire, maintain, store, or utilize personal information (covered entities) to take reasonable measures to protect and secure data in electronic form containing personal information.

Directs a covered entity that owns or licenses such data to give notice of any breach of security that the entity reasonably believes has caused or will cause identity theft or other actual financial harm to each individual: (1) who is a U.S. citizen or resident; and (2) whose personal information was, or that the covered entity reasonably believes has been, accessed and acquired by an unauthorized person.

Requires a covered entity to notify the Secret Service or the Federal Bureau of Investigation (FBI) of a security breach of personal information involving more than 10,000 individuals.

Requires a third-party entity contracted to maintain, store, or process data containing personal information to notify the covered entity of a breach of security of a system. Requires a service provider to notify the covered entity if it becomes aware of a breach of security involving personal information owned or possessed by a covered entity and if such covered entity can be reasonably identified.

Allows delays of notifications to avoid interfering with a civil or criminal investigation or threatening national or homeland security.

Sets forth the methods for notification under this Act.

Preempts information security practices of the Communications Act of 1934 applicable to telecommunication carriers, satellite operators, and cable operators.

Sets forth the enforcement authority for the Federal Trade Commission (FTC) along with civil monetary penalties for violations of this Act.

Exempts certain financial institutions and entities subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

data_security breach notification act requires commercial entities acquire maintain store utilize personal information covered entities reasonable measures protect secure data electronic form containing personal information directs covered entity owns licenses data notice breach security entity reasonably believes caused cause identity theft actual financial harm individual citizen resident personal information covered entity reasonably believes accessed acquired unauthorized person requires covered entity notify secret_service federal_bureau_of_investigation fbi security breach personal information involving individuals requires party entity contracted maintain store process data containing personal information notify covered entity breach security system requires service provider notify covered entity aware breach security involving personal information owned possessed covered entity covered entity reasonably identified allows delays notifications avoid interfering civil criminal investigation threatening national homeland security sets forth methods notification act preempts information security practices communications act applicable telecommunication carriers satellite operators cable operators sets forth enforcement authority federal_trade_commission ftc civil monetary penalties violations act exempts certain financial institutions entities subject health_insurance_portability_and_accountability_act hipaa


Summary:
Health Care Conscience Rights Act - Amends title I of the Patient Protection and Affordable Care Act to declare that nothing in such title shall require an individual to purchase individual health insurance coverage that includes coverage of an abortion or other item or service to which the individual has a moral or religious objection, or prevent an issuer from offering or issuing, to that individual, individual coverage excluding such item or service.

Makes similar denials about requiring a sponsor to sponsor, purchase, or provide such coverage, or a health insurance issuer or group health plan sponsor to cover an abortion or other item or service to which the sponsor or issuer has a moral or religious objection.

Denies also that such title authorizes imposition of a tax, penalty, fee, fine, or other sanction, or imposition of coverage of such an item or service, in relation to health insurance coverage or a group health plan that excludes such an item or service.

Amends the Public Health Service Act to codify the prohibition against any action by the federal government and any state or local government receiving federal financial assistance to subject a health professional, a hospital, a provider-sponsored organization, a health maintenance organization, an accountable care organization, a health insurance plan, or any other kind of health care facility, organization, or plan to discrimination on the basis that the entity refuses to participate in abortion-related activities.

Requires the Secretary of Health and Human Services to designate the Director of the Office for Civil Rights of the Department of Health and Human Services (HHS) to receive and investigate complaints alleging a violation of abortion discrimination prohibition.

Creates a cause of action for the Attorney General or any person or entity adversely affected to obtain equitable or legal relief for any violation of this abortion discrimination prohibition. Allows commencement of an action to be commenced and the granting of relief without a prerequisite pursuit of administrative remedies. Allows such an action against a federal or state governmental entity.

title patient_protection affordable care act declare title shall require individual purchase individual health insurance coverage includes coverage abortion item service individual moral religious objection prevent issuer offering issuing individual individual coverage excluding item service makes similar denials requiring sponsor sponsor purchase provide coverage health insurance issuer group health plan sponsor cover abortion item service sponsor issuer moral religious objection denies title authorizes imposition tax penalty fee fine sanction imposition coverage item service relation health insurance coverage group health plan excludes item service amends public_health_service_act codify prohibition action federal government state local government receiving federal financial assistance subject health professional hospital provider sponsored organization health maintenance organization accountable care organization health insurance plan kind health care facility organization plan discrimination basis entity refuses participate abortion related activities requires secretary health_and_human_services designate director office_for_civil_rights_of_the_department_of_health_and_human_services hhs receive investigate complaints alleging violation abortion discrimination prohibition creates cause action attorney general person entity adversely affected obtain equitable legal relief violation abortion discrimination prohibition allows commencement action commenced granting relief prerequisite pursuit administrative remedies allows action federal state governmental entity


Summary:
FISA Accountability and Privacy Protection Act of 2013 - Amends the FISA Amendments Act of 2008 to repeal on June 1, 2015, procedures outlined under the Foreign Intelligence Surveillance Act of 1978 (FISA) regarding the targeting by the United States of non-U.S. persons located outside the United States in order to acquire foreign intelligence information.

 Amends provisions of FISA, the Right to Financial Privacy Act of 1978, the National Security Act of 1947, and the Fair Credit Reporting Act (FCRA) concerning national security letters to, effective June 1, 2015, make such provisions read as they read on October 25, 2001. Repeals a separate related FCRA provision.

Amends FISA to revise requirements for applications for access to business records and other tangible things in counterterrorism investigations to require an applicant to present a statement of facts and circumstances showing reasonable grounds to believe that the records sought are relevant to an investigation. Imposes similar requirements for orders for pen registers and trap and trace devices. Defines and requires "minimization procedures" for minimizing the retention and dissemination of information obtained from such records and devices.

Revises requirements for obtaining orders to prohibit disclosure of the receipt of a national security letter.

Requires the Federal Bureau of Investigation (FBI) or other appropriate agency to notify persons challenging a nondisclosure order if facts supporting such order no longer exist.

Amends FISA to eliminate: (1) the requirement that recipients of any order to produce records wait one year before challenging such order or a nondisclosure requirement in court, and (2) the conclusive presumption that disclosure of an order for tangible things would endanger national security or a person's life or safety or would interfere with a criminal or terrorist investigation or with diplomatic relations.

Revises procedures for obtaining judicial review of national security letter nondisclosure orders. Allows the recipient of a nondisclosure order to request judicial review of the order and requires the government to respond by setting forth specific facts in a certification that justify the need for nondisclosure based upon national security and other concerns. Requires courts, in considering whether to grant a nondisclosure order, to give substantial weight to the facts alleged by the government in its certification.

Modifies the standard for obtaining a national security letter to require the FBI or other agency issuing a national security letter to provide a written statement of specific facts showing that there are reasonable grounds to believe that the information sought is relevant to an authorized investigation.

Modifies reporting requirements for national security letters to require a breakdown of the types of persons targeted (e.g., U.S. persons and non-U.S. persons) and whether such persons are subjects of authorized national security investigations.

Amends FISA to require the Attorney General to submit an annual unclassified report summarizing how the authorities under such Act are used, including the impact of such use on the privacy of U.S. persons.

Extends through 2013 provisions requiring the Inspector General of the Department of Justice (DOJ) to conduct audits on investigative authority provided to the FBI under FISA and on the effectiveness and use of national security letters. Repeals a requirement for such audits to include information on bureaucratic or procedural impediments to the use of such letters. Directs the Inspector General to report to Congress on the results of such audits: (1) by January 1, 2014, for audits conducted for 2010 and 2011, and (2) by January 1, 2015, for audits conducted for 2012 and 2013.

Requires reports by the inspectors general of each element of DOJ assessing the use and value of information obtained through such investigative authority and national security letters.

Sets forth similar audit and reporting requirements regarding the use of pen registers and trap and trace devices and requires submission to the Attorney General and the Director of National Intelligence (DNI) as well as Congress.

Amends the federal criminal code to reduce from 30 to 7 days the period for giving delayed notice of the execution of a search warrant in a criminal investigation when the warrant permits the giving of such delayed notice.

 Authorizes the Inspector General of the Intelligence Community to review the acquisition, use, and dissemination of acquired surveillance information in order to review its compliance with adopted targeting and minimization procedures, as well as with guidelines for the protection of privacy rights of U.S. persons. Requires such Inspector General to report to the Attorney General, the DNI, and specified congressional committees on reviews conducted.

Rescinds specified unobligated balances available in the DOJ Assets Forfeiture Fund.

amends fisa amendments act repeal june procedures outlined foreign_intelligence_surveillance_act fisa targeting united_states persons located outside united_states order acquire foreign intelligence information amends provisions fisa right financial privacy act national security act fair credit reporting act fcra concerning national security letters effective june provisions read read october repeals separate related fcra provision amends fisa revise requirements applications access business records tangible things counterterrorism investigations require applicant present statement facts circumstances showing reasonable grounds believe records sought relevant investigation imposes similar requirements orders pen registers trap trace devices defines requires minimization procedures minimizing retention dissemination information obtained records devices revises requirements obtaining orders prohibit disclosure receipt national security letter requires federal_bureau_of_investigation fbi appropriate agency notify persons challenging nondisclosure order facts supporting order longer exist amends fisa eliminate requirement recipients order produce records wait year challenging order nondisclosure requirement court conclusive presumption disclosure order tangible things endanger national security person life safety interfere criminal terrorist investigation diplomatic relations revises procedures obtaining judicial review national security letter nondisclosure orders allows recipient nondisclosure order request judicial review order requires government respond setting forth specific facts certification justify need nondisclosure based national security concerns requires courts considering grant nondisclosure order substantial weight facts alleged government certification modifies standard obtaining national security letter require fbi agency issuing national security letter provide written statement specific facts showing reasonable grounds believe information sought relevant authorized investigation modifies reporting requirements national security letters require breakdown types persons targeted persons persons persons subjects authorized national security investigations amends fisa require attorney general submit annual unclassified report summarizing authorities act including impact use privacy persons extends provisions requiring inspector general department justice doj conduct audits investigative authority provided fbi fisa effectiveness use national security letters repeals requirement audits include information bureaucratic procedural impediments use letters directs inspector general report congress results audits january audits conducted january audits conducted requires reports inspectors general element doj assessing use value information obtained investigative authority national security letters sets forth similar audit reporting requirements use pen registers trap trace devices requires submission attorney general director national_intelligence dni congress amends federal criminal code reduce days period giving delayed notice execution search warrant criminal investigation warrant permits giving delayed notice authorizes inspector general intelligence_community review acquisition use dissemination acquired surveillance information order review compliance adopted targeting minimization procedures guidelines protection privacy rights persons requires inspector general report attorney general dni specified congressional committees reviews conducted rescinds specified unobligated balances available


Summary:
Password Protection Act of 2013 - Amends the federal criminal code to subject to a fine any employer who knowingly and intentionally: (1) compels or coerces any person to provide the employer with a password or similar information to access a protected computer not owned by such employer; or (2) discharges, disciplines, discriminates, or threatens to take such actions, against any person who fails to authorize access to such computer, has filed a complaint or instituted a proceeding regarding such action, or testified or is about to testify in any such proceeding.

Declares that nothing in this Act shall be construed to limit the authority of a court of competent jurisdiction to grant equitable relief in a civil action, if the court believes that the information sought to be obtained is relevant to protecting the intellectual property, a trade secret, or confidential business information of the party seeking relief.

Exempts an employer's actions from such prohibition if: (1) the employer discharges or disciplines an individual for good cause; (2) the employer complies with federal or state laws or regulations governing brokers, dealers, and investment advisers; (3) a state enacts a law that specifically waives such prohibition with respect to a particular class of state or agency employees and the employer's action relates to an employee in such class; or (4) an executive agency, military department, or other executive branch entity specifically waives the prohibition with respect to a particular class of employees who may have access to classified information.

password protection act amends federal criminal code subject fine employer knowingly intentionally coerces person provide employer password similar information access protected computer owned employer discharges disciplines discriminates threatens actions person fails authorize access computer filed complaint instituted proceeding action testified testify proceeding declares act shall construed limit authority court competent jurisdiction grant equitable relief civil action court believes information sought obtained relevant protecting intellectual property trade secret confidential business information party seeking relief exempts employer actions prohibition employer discharges disciplines individual good cause employer complies federal state laws regulations governing brokers dealers investment advisers state enacts law specifically waives prohibition respect particular class state agency employees employer action relates employee class executive agency military department executive branch entity specifically waives prohibition respect particular class employees access classified information


Summary: Trust But Verify Act or the PIN Act - Prohibits an American Health Benefit Exchange (established under the Patient Protection and Affordable Care Act) from offering health insurance coverage through the Exchange until the Comptroller General (GAO) certifies to Congress that the Department of Health and Human Services (HHS), and any related federal agencies involved in the administration of such Exchanges, have implemented all appropriate actions necessary to safeguard the personal health and financial information of enrollees and to protect against fraud and abuse.

trust verify act pin act prohibits american_health_benefit_exchange established patient_protection affordable care act offering health insurance coverage exchange comptroller general gao certifies congress department_of_health_and_human_services hhs related federal agencies involved administration exchanges implemented appropriate actions necessary safeguard personal health financial information enrollees protect fraud abuse


Summary:
Drug Free Commercial Driver Act of 2013 - Revises regulations that require motor carriers to conduct preemployment, reasonable suspicion, random, and post-accident testing of commercial motor vehicle operators for controlled substances or alcohol.

Allows motor carriers to use hair testing as an acceptable alternative to urinalysis for detecting use of controlled substances by an operator, but only for preemployment testing and random testing (but the latter only if the motor carrier tested the operator at preemployment using the same method).

Requires the Secretary of Transportation (DOT) to develop requirements for laboratories and testing procedures for controlled substances that include mandatory guidelines that establish, among other things, laboratory protocols and cut-off levels for hair testing to detect the use of such substances.

Allows any motor carrier that demonstrates it has consistently carried out a generally applicable hair testing program during the most recent one-year period to apply to the Administrator of the Federal Motor Carrier Safety Administration for exemption from mandatory urinalysis testing.

drug free commercial driver act revises regulations require motor carriers conduct reasonable suspicion random post accident testing commercial motor vehicle operators controlled substances alcohol allows motor carriers use hair testing acceptable alternative detecting use controlled substances operator testing random testing motor carrier tested operator method requires secretary transportation dot develop requirements laboratories testing procedures controlled substances include mandatory guidelines establish things laboratory protocols cut levels hair testing detect use substances allows motor carrier demonstrates consistently carried generally applicable hair testing program recent year period apply administrator federal_motor_carrier_safety_administration exemption mandatory testing


Summary:
Do Not Track Kids Act of 2013 - Amends the Children's Online Privacy Protection Act of 1998 to apply the prohibitions against collecting personal information from children to online applications and mobile applications directed to children. Establishes additional privacy protections against the collection of personal or geolocation information from children and minors.

Revises the definition of:

 "operator" to include online and mobile applications (currently, only Internet websites and online services) and to make such definition apply specifically to operators and providers of such websites, services, or applications who, for commercial purposes, in interstate or foreign commerce: (1) collect or maintain, directly or through a service provider, personal information from or about their users; (2) allow another person to collect such personal information; or (3) allow users of such websites, services, or applications to publicly disclose personal information; and "disclosure" as the release of personal information (currently, the release of personal information collected from a child in identifiable form). Requires verifiable parental consent, under specified circumstances, for the collection, use, or disclosure of personal information of a child, including certain online contact information collected in response to a specific request from a child when such information is used to contact a different child.

Prohibits, without verifiable parental consent in the case of a child or without consent of the minor in the case of a minor, an operator of a website, online service, online application, or mobile application directed to children or minors, or an operator having actual knowledge that personal information being collected is from children or minors, from: (1) using, disclosing to third parties, or compiling personal information collected from children or minors for targeted marketing purposes; and (2) collecting geolocation information in a manner that violates the regulations prescribed under this Act.

Defines a "minor" as an individual over the age of 12 and under the age of 16.

Prohibits an operator from discontinuing service provided to a child or minor on the basis of a refusal, by the child's parent or the minor, to permit the further use or maintenance in retrievable form, or future collection, of certain personal or geolocation information from such individuals, to the extent that the operator is capable of providing such service without such information.

Requires an operator of a website, online service, online application, or mobile application directed to children or minors to treat all users as children or minors for purposes of this Act, except as permitted by regulation. Prohibits an operator of a website, online service, or such applications directed to minors from collecting personal information from minors unless such operator has adopted, and complies with, a Digital Marketing Bill of Rights for Teens that is consistent with the Fair Information Practices Principles established by this Act. Requires the Federal Trade Commission (FTC) to promulgate regulations that require operators to implement mechanisms that permit a user to erase content submitted by such user that is publicly available through such websites, services, or applications and that contains or displays personal information of children or minors.

Sets forth enforcement provisions.

track kids act amends children online privacy protection act apply prohibitions collecting personal information children online applications mobile applications directed children establishes additional privacy protections collection personal geolocation information children minors revises definition operator include online mobile applications currently internet websites online services definition apply specifically operators providers websites services applications commercial purposes interstate foreign commerce collect maintain directly service provider personal information users allow person collect personal information allow users websites services applications publicly disclose personal information disclosure release personal information currently release personal information collected child identifiable form requires verifiable parental consent specified circumstances collection use disclosure personal information child including certain online contact information collected response specific request child information contact different child prohibits verifiable parental consent case child consent minor case minor operator website online service online application mobile application directed children minors operator having actual knowledge personal information collected children minors disclosing parties compiling personal information collected children minors targeted marketing purposes collecting geolocation information manner violates regulations prescribed act defines minor individual age age prohibits operator discontinuing service provided child minor basis refusal child parent minor permit use maintenance retrievable form future collection certain personal geolocation information individuals extent operator capable providing service information requires operator website online service online application mobile application directed children minors treat users children minors purposes act permitted regulation prohibits operator website online service applications directed minors collecting personal information minors operator adopted complies digital_marketing_bill_of_rights_for_teens consistent fair_information_practices_principles established act requires federal_trade_commission ftc promulgate regulations require operators implement mechanisms permit user erase content submitted user publicly available websites services applications contains displays personal information children minors sets forth enforcement provisions


Summary:
Freedoms and Privacy Act of 2013 - Amends the Foreign Intelligence Surveillance Act of 1978 (FISA), with respect to provisions governing the use and disclosure of information obtained under such Act, to require:

 the application of rules for the use in court proceedings of classified information underthe Classified Information Procedures Act to information acquired from electronic surveillance, physical searches, and pen registers and trap and trace devices under FISA; notification to an aggrieved person under FISA of all information that has been collected and used in an investigation relevant to a FISA criminal proceeding, including information not intended to be entered into evidence; a FISA court to provide a defendant with information that was used to obtain an order (and a copy of such order) authorizing: (1) surveillance of such defendant or another aggrieved person, (2) physical searches, or (3) the use of pen registers and trap and trace devices; the Attorney General, or a designee of the Attorney General who was appointed by and with the advice and consent of the Senate, to certify in writing the basis for authorizing disclosure of FISA-related information, including information from targets outside the United States, for law enforcement purposes (other than for international terrorism or clandestine intelligence investigations); the collection of foreign intelligence information to be the primary purpose (currently, a significant purpose) of a FISA court warrant application; the Attorney General to make available to all Members of Congress every six months a report on FISA information shared between the intelligence community and law enforcement and summaries of investigations and criminal proceedings using such shared information; and the Attorney General to make available to all Members of Congress: (1) standard minimization procedures (i.e., specific procedures to minimize the retention, and prohibit the dissemination, of information concerning unconsenting U.S. persons consistent with the need to obtain, produce, and disseminate foreign intelligence information) applied to the acquisition, retention, use, and dissemination of information; and (2) annual reports setting forth a review and justification of all standard minimization procedures.

freedoms privacy act amends foreign intelligence surveillance act fisa respect provisions governing use disclosure information obtained act require application rules use court proceedings classified information information acquired electronic surveillance physical searches pen registers trap trace devices fisa notification aggrieved person fisa information collected investigation relevant fisa criminal proceeding including information intended entered evidence fisa court provide defendant information obtain order copy order authorizing surveillance defendant aggrieved person physical searches use pen registers trap trace devices attorney general designee attorney general appointed advice consent senate certify writing basis authorizing disclosure fisa related information including information targets outside united_states law enforcement purposes international terrorism clandestine intelligence investigations collection foreign intelligence information primary purpose currently significant purpose fisa court warrant application attorney general available members congress months report fisa information shared intelligence community law enforcement summaries investigations criminal proceedings shared information attorney general available members congress standard minimization procedures specific procedures minimize retention prohibit dissemination information concerning persons consistent need obtain produce disseminate foreign intelligence information applied acquisition retention use dissemination information annual reports setting forth review justification standard minimization procedures


Summary:
Abortion Insurance Full Disclosure Act of 2013 - Amends the Patient Protection and Affordable Care Act, with respect to abortion coverage in qualified plans offered through a health care exchange in a state, to modify the notice rules to require that:

 in the case of services regarding abortions both for which public funding is prohibited and allowed, the extent of coverage shall be prominently displayed in any marketing or advertising materials, comparison tools, or summaries of benefits and coverage explanations made available by the issuer of the plan, by an exchange, or by the Secretary of Health and Human Services (HHS), including information made available through an Internet portal or exchange; and in the case of abortions for which public funding is prohibited and where the premium for the plan is disclosed, the surcharge attributable to such services, consisting of an amount equal to the actuarial value of the coverage, shall be disclosed and identified separately.

abortion insurance disclosure act amends patient protection affordable care act respect abortion coverage qualified plans offered health care exchange state modify notice rules require case services abortions public funding prohibited allowed extent coverage shall prominently displayed marketing advertising materials comparison tools summaries benefits coverage explanations available issuer plan exchange secretary health_and_human_services hhs including information available internet portal exchange case abortions public funding prohibited premium plan disclosed surcharge attributable services consisting equal actuarial value coverage shall disclosed identified separately


Summary:
Personal Data Privacy and Security Act of 2014 - Defines "sensitive personally identifiable information" to include: (1) specified combinations of data elements in electronic or digital form, such as an individual's name, home address or telephone number, mother's maiden name, and date of birth; (2) a non-truncated social security number, driver's license number, passport number, or government-issued unique identification number; (3) unique biometric data; (4) a unique account identifier; and (5) any security code, access code, password, or secure code that could be used to generate such codes or passwords.

Title I: Enhancing Punishment for Identity Theft and Other Violations of Data Privacy and Security - Amends the federal criminal code to make fraud in connection with the unauthorized access of personally identifiable information (in electronic or digital form) a predicate for instituting a prosecution for racketeering.

Imposes a prison term of up to five years and/or a fine on any individual who has knowledge of and intentionally and willfully conceals a security breach and such breach results in economic harm of $1,000 or more to any individual. Grants the Secret Service and the Federal Bureau of Investigation (FBI) authority to investigate criminal concealments of security breaches.

Increases penalties for fraud and related activity, and imposes criminal penalties for attempts and conspiracies to commit fraud and related activity, in connection with computers.

Expands the prohibition against trafficking in passwords to include trafficking through any means by which a protected computer may be accessed without authorization.

Modifies criminal and civil forfeiture provisions, including requiring certain civil forfeiture seizures and forfeitures to be performed by persons designated for that purpose by the Secretary of Homeland Security (DHS) or the Attorney General (DOJ).

Prohibits civil actions involving unauthorized use of a protected computer if a violation of a contractual obligation or agreement constitutes the sole basis for determining that access to the computer is unauthorized.

Directs the Attorney General to report the number of criminal cases that involve: (1) unauthorized access to a nongovernmental computer, and (2) conduct in which the sole basis for such a determination was that the defendant violated a contractual obligation or agreement with a service provider or employer.

Prohibits, during and in relation to a felony violation of provisions regarding fraud and related activity in connection with computers, intentionally causing or attempting to cause damage to a critical infrastructure computer if such damage results or would have resulted in the substantial impairment of the operation of that computer or associated critical infrastructure.

Excludes from the definition of "exceeds authorized access" for purposes of the prohibition against fraudulent use of computers, access in violation of a contractual obligation or agreement with an Internet service provider, Internet website, or nongovernment employer, if such violation constitutes the sole basis for determining that access to a protected computer is unauthorized.

Title II: Privacy and Security of Personally Identifiable Information - Subjects a business entity engaging in interstate commerce that involves collecting, accessing, transmitting, using, storing, or disposing of sensitive information in electronic or digital form on 10,000 or more U.S. persons to the requirements for the data privacy and security program established by this title. Excepts: (1) financial institutions subject to the data security requirements and standards under the Gramm-Leach-Bliley Act; (2) specified entities subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA); (3) service providers for any electronic communication by a third-party to the extent that such provider is exclusively engaged in the transmission, routing, or temporary, intermediate, or transient storage of that communication; and (4) public records not otherwise subject to a confidentiality or nondisclosure requirement.

Deems a business entity to be in compliance with such requirements if the entity complies with or provides protection equal to industry standards or standards widely accepted as an effective industry practice that are applicable to the type of sensitive information involved in the ordinary course of business.

Requires a business entity subject to this title to: (1) comply with specified safeguards identified by the FTC in a rulemaking process for the protection of sensitive personally identifiable information; and (2) implement a comprehensive personal data privacy and security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the entity and the nature and scope of its activities. Requires such program to be designed to: (1) ensure the privacy, security, and confidentiality of sensitive information; (2) protect against any anticipated vulnerabilities; and (3) protect against unauthorized access to use of such information that could create a significant risk of harm or fraud to any individual.

Requires such a business entity to: (1) identify reasonably foreseeable vulnerabilities that could result in unauthorized access, disclosure, use, or alteration of sensitive information or systems containing such information; (2) assess the likelihood of and potential damage from unauthorized access to, or disclosure, use, or alteration of, sensitive information; (3) assess the sufficiency of its policies, technologies, and safeguards to control and minimize risks from unauthorized access, disclosure, use, or alteration of sensitive information; (4) assess the vulnerability of sensitive information during destruction and disposal of such information; (5) design its personal data privacy and security program to control risks; (6) adopt measures commensurate with the sensitivity of the data as well as the size, complexity, and scope of activities of the entity that control access to systems and facilities containing sensitive information; (7) establish a plan and procedures for minimizing the amount of sensitive information maintained; and (8) take steps to ensure appropriate employee training and regular testing of key controls, systems, and procedures of the entity's personal data privacy and security program.

Prescribes penalties for violations of such requirements. Allows an injunction against a business entity to stop continuing violations of the requirements of this subtitle.

Grants authority to the FTC to enforce such requirements. Authorizes state attorneys general and law enforcement agencies to bring civil actions to protect state residents against business entities that are violating such requirements. Preempts state laws relating to administrative, technical, and physical safeguards for the protection of personal information.

Requires any agency or business entity engaged in interstate commerce that uses, accesses, transmits, stores, disposes of, or collects sensitive personally identifiable information to notify any U.S. resident whose information has been accessed or acquired without unreasonable delay after the discovery of a security breach.

 Excepts: (1) financial institutions subject to the data security requirements and standards under the Gramm-Leach-Bliley Act, and (2) specified entities subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Allows exemptions if: (1) the Secret Service or the FBI determines that notification of the security breach could be expected to reveal sensitive sources and methods or similarly impede the government's ability to conduct law enforcement investigations, or (2) the FBI determines that notification of the breach could be expected to damage national security.

Provides that an agency or business entity shall be exempt from notice requirements if: (1) a risk assessment concludes that there is no significant risk that a security breach has resulted in, or will result in, identity theft, economic loss or harm, or physical harm to the individuals whose sensitive information was subject to the breach; (2) without unreasonable delay but not later than 45 days after the discovery of the breach, the agency or entity notifies the FTC of the results of the risk assessment and its decision to invoke the exemption; and (3) the FTC does not indicate, within 10 business days from receipt of the decision, that notice should be given.

Provides that a business entity will be exempt from notice requirements if it utilizes or participates in a security program that: (1) effectively blocks the use of the sensitive information to initiate unauthorized financial transactions before they are charged to the individual's account, and (2) provides for notice to affected individuals after a security breach that has resulted in fraud or unauthorized transactions.

Provides for individual notice by mail, telephone, and e-mail of a security breach and for notice to major media outlets serving a state or jurisdiction if a security breach involves more than 5,000 individuals. Specifies the required content of a security breach  notification. Requires an agency or business entity that is required to provide notification of a breach involving more than 5,000 individuals to also provide notification to credit reporting agencies.

Directs the DHS Secretary to designate a federal entity to receive the notices. Requires business entities and federal agencies to report data security breaches to the designated entity if the breach involves: (1) more than 5,000 individuals, (2) a database that contains information about more than 500,000 individuals, (3) a federal government database, or (4) individuals known to be federal employees or contractors involved in national security or law enforcement. Requires the designated agency to report information it receives about security breaches to the Secret Service, FBI, and FTC for civil law enforcement purposes as promptly as possible, but either 72 hours before notice of a breach is required to be provided to an individual or not later than 10 days after the breach is discovered, whichever occurs first.

Authorizes the Attorney General and the FTC to bring civil and administrative actions against business entities for violations of this subtitle and to seek injunctive relief or civil penalties.

Authorizes state attorneys general or state or local law enforcement agencies to bring a civil action on behalf of state residents who have been threatened or adversely affected by a business entity violating provisions of this title and to obtain injunctive relief or civil penalties. Requires a state attorney general bringing a civil action to provide written notice to the Attorney General who may then move to stay the action, move to consolidate all pending actions, intervene, and file petitions for appeal.

Directs the FTC to report on the number and nature of the security breaches described in notices filed by business entities invoking the risk assessment exemption and their response to such notices.

Directs the Secret Service and FBI to report on the number and nature of security breaches subject to the national security and law enforcement exemptions.

Title III: Compliance with Statutory Pay-As-You-Go Act - Provides that the budgetary effects of this Act, for the purpose of complying with the Statutory Pay-As-You-Go Act of 2010, shall be determined by reference to the latest statement titled "Budgetary Effects of PAYGO Legislation" for this Act, provided that such statement has been submitted prior to the vote on passage.

defines sensitive personally identifiable information include specified combinations data elements electronic digital form individual home address telephone number mother maiden date birth non truncated social security number driver license number passport number government issued unique identification number unique biometric data unique account identifier security code access code password secure code generate codes passwords title enhancing punishment identity theft violations data privacy security amends federal criminal code fraud connection unauthorized access personally identifiable information electronic digital form predicate instituting prosecution racketeering imposes prison term years fine individual knowledge intentionally willfully conceals security breach breach results economic harm individual federal_bureau_of_investigation fbi authority investigate criminal security breaches increases penalties fraud related activity imposes criminal penalties attempts conspiracies commit fraud related activity connection computers expands prohibition trafficking passwords include trafficking means protected computer accessed authorization modifies criminal civil forfeiture provisions including requiring certain civil forfeiture seizures forfeitures performed persons designated purpose secretary homeland_security dhs attorney general doj prohibits civil actions involving unauthorized use protected computer violation contractual obligation agreement constitutes sole basis determining access computer unauthorized directs attorney general report number criminal cases involve unauthorized access nongovernmental computer conduct sole basis determination defendant violated contractual obligation agreement service provider employer prohibits relation felony violation provisions fraud related activity connection computers intentionally causing attempting cause damage critical infrastructure computer damage results resulted substantial impairment operation computer associated critical infrastructure excludes definition exceeds authorized access purposes prohibition fraudulent use computers access violation contractual obligation agreement internet service provider internet website nongovernment employer violation constitutes sole basis determining access protected computer unauthorized title privacy security personally identifiable information subjects business entity engaging interstate commerce involves collecting accessing transmitting storing disposing sensitive information electronic digital form persons requirements data privacy security program established title excepts financial institutions subject data security requirements standards gramm leach bliley act specified entities subject health_insurance_portability_and_accountability_act hipaa service providers electronic communication party extent provider exclusively engaged transmission routing temporary intermediate transient storage communication public records subject confidentiality nondisclosure requirement deems business entity compliance requirements entity complies provides protection equal industry standards standards widely accepted effective industry practice applicable type sensitive information involved ordinary course business requires business entity subject title comply specified safeguards identified ftc rulemaking process protection sensitive personally identifiable information implement comprehensive personal data privacy security program includes administrative technical physical safeguards appropriate size complexity entity nature scope activities requires program designed ensure privacy security confidentiality sensitive information protect anticipated vulnerabilities protect unauthorized access use information create significant risk harm fraud individual requires business entity identify reasonably foreseeable vulnerabilities result unauthorized access disclosure use alteration sensitive information systems containing information assess likelihood potential damage unauthorized access disclosure use alteration sensitive information assess sufficiency policies technologies safeguards control minimize risks unauthorized access disclosure use alteration sensitive information assess vulnerability sensitive information destruction disposal information design personal data privacy security program control risks adopt measures commensurate sensitivity data size complexity scope activities entity control access systems facilities containing sensitive information establish plan procedures minimizing sensitive information maintained steps ensure appropriate employee training regular testing key controls systems procedures entity personal data privacy security program prescribes penalties violations requirements allows injunction business entity stop continuing violations requirements subtitle grants authority ftc enforce requirements authorizes state attorneys general law enforcement agencies bring civil actions protect state residents business entities violating requirements preempts state laws relating administrative technical physical safeguards protection personal information requires agency business entity engaged interstate commerce uses accesses transmits stores disposes collects sensitive personally identifiable information notify resident information accessed acquired unreasonable delay discovery security breach excepts financial institutions subject data security requirements standards gramm leach bliley act specified entities subject health_insurance_portability_and_accountability_act hipaa allows exemptions secret_service fbi determines notification security breach expected reveal sensitive sources methods similarly impede government ability conduct law enforcement investigations fbi determines notification breach expected damage national security provides agency business entity shall exempt notice requirements risk assessment concludes significant risk security breach resulted result identity theft economic loss harm physical harm individuals sensitive information subject breach unreasonable delay later days discovery breach agency entity notifies ftc results risk assessment decision exemption ftc indicate business days receipt decision notice given provides business entity exempt notice requirements utilizes participates security program effectively blocks use sensitive information initiate unauthorized financial transactions charged individual account provides notice affected individuals security breach resulted fraud unauthorized transactions provides individual notice mail telephone mail security breach notice major media outlets serving state jurisdiction security breach involves individuals specifies required content security breach notification requires agency business entity required provide notification breach involving individuals provide notification credit reporting agencies directs dhs secretary designate federal entity receive notices requires business entities federal agencies report data security breaches designated entity breach involves individuals database contains information individuals federal government database individuals known federal employees contractors involved national security law enforcement requires designated agency report information receives security breaches secret_service fbi ftc civil law enforcement purposes promptly possible hours notice breach required provided individual later days breach discovered whichever occurs authorizes attorney general ftc bring civil administrative actions business entities violations subtitle seek injunctive relief civil penalties authorizes state attorneys general state local law enforcement agencies bring civil action behalf state residents threatened adversely affected business entity violating provisions title obtain injunctive relief civil penalties requires state attorney general bringing civil action provide written notice attorney general stay action consolidate pending actions intervene file petitions appeal directs ftc report number nature security breaches described notices filed business entities invoking risk assessment exemption response notices directs secret_service fbi report number nature security breaches subject national security law enforcement exemptions title iii compliance statutory pay act provides budgetary effects act purpose complying statutory pay act shall determined reference latest statement titled budgetary effects paygo legislation act provided statement submitted prior vote passage


Summary: Health Exchange Security and Transparency Act of 2014 - Requires the Secretary of Health and Human Services (HHS) to notify an individual within two business days after discovery of any breach of security of any system maintained by a health care exchange established under the Patient Protection and Affordable Care Act which is known to have resulted in the theft of or unlawful access to the individual's personally identifiable information.

transparency_act requires secretary health_and_human_services hhs notify individual business days discovery breach security system maintained health care exchange established patient_protection affordable care act known resulted theft unlawful access individual personally identifiable information


Summary:
Driver Privacy Act - Declares that any data retained by a motor vehicle's event data recorder (as defined in Department of Transportation [DOT] regulations) is the property of the owner or lessee of the motor vehicle in which the recorder is installed, regardless of when the vehicle was manufactured.

Prohibits a person, other than the owner or lessee of the motor vehicle, from accessing data recorded or transmitted by such a recorder unless: (1) a court or other judicial or administrative authority authorizes the retrieval of such data subject to admissibility of evidence standards; (2) an owner or lessee provides written or electronic consent to such retrieval for any purpose, including vehicle diagnosis, service, or repair; (3) the data is retrieved pursuant to certain authorized investigations or inspections of the National Transportation Safety Board (NTSB) or DOT; (4) the data is retrieved to determine the appropriate emergency medical response to a motor vehicle crash; or (5) the data is retrieved for traffic safety research.

Prohibits, when data is retrieved in connection with traffic safety research or an NTSB or DOT investigation or inspection, the disclosure of: (1) personally identifiable information of the vehicle owner or lessee, and (2) the vehicle identification number (VIN). Provides an exemption from such prohibition to allow disclosure of VINs to certifying manufacturers.

Directs the National Highway Traffic Safety Administration (NHTSA), after completing a study and submitting a report to Congress, to promulgate regulations concerning the amount of time event data recorders installed in passenger motor vehicles should capture and record vehicle-related data in conjunction with an event in order to provide sufficient information to investigate the cause of crashes.

driver privacy act declares data retained motor vehicle event data recorder defined department_of_transportation dot regulations property owner lessee motor vehicle recorder installed regardless vehicle manufactured prohibits person owner lessee motor vehicle accessing data recorded transmitted recorder court judicial administrative authority authorizes retrieval data subject admissibility evidence standards owner lessee provides written electronic consent retrieval purpose including vehicle diagnosis service repair data retrieved pursuant certain authorized investigations inspections national_transportation_safety_board ntsb dot data retrieved determine appropriate emergency medical response motor vehicle crash data retrieved traffic safety research prohibits data retrieved connection traffic safety research ntsb dot investigation inspection disclosure personally identifiable information vehicle owner lessee vehicle identification number provides exemption prohibition allow disclosure certifying manufacturers directs national_highway_traffic_safety_administration nhtsa completing study submitting report congress promulgate regulations concerning time event data recorders installed passenger motor vehicles capture record vehicle related data conjunction event order provide sufficient information investigate cause crashes


Summary:
Data Security and Breach Notification Act of 2014 - Requires the Federal Trade Commission (FTC) to promulgate regulations requiring each covered entity (proprietorships, partnerships, estates, trusts, cooperatives, and nonprofit and for-profit corporations) that owns or possesses data containing personal information to implement policies and procedures regarding information security practices for the treatment and protection of such information.

Establishes procedures to be followed in the event of an information security breach. Requires a covered entity that discovers a breach to notify the FTC (unless the covered entity has already notified a federal entity designated by the Department of Homeland Security [DHS] to receive such information) and affected individuals. Sets forth requirements concerning such notification, including methods of notification and timeliness requirements. Allows an exemption from notification requirements if such entity reasonably concludes that there is no reasonable risk of identity theft, fraud, or other unlawful conduct. Establishes a presumption that there is no such risk for encrypted data.

Directs DHS to designate a federal entity that covered entities would be required to notify if a security breach involves: (1) the personal information of more than 10,000 individuals, (2) a database containing the personal information of more than 1 million individuals, (3) federal government databases, or (4) the personal information of federal employees or contractors known to be involved in national security or law enforcement.

Requires the designated entity to provide each notice it receives to:

 the U.S. Secret Service; the Federal Bureau of Investigation (FBI); the FTC; the U.S. Postal Inspection Service, if mail fraud is involved; attorneys general of affected states; and appropriate federal agencies for law enforcement, national security, or data security purposes. Sets forth enforcement provisions for the FTC, state attorneys general, and the Attorney General (DOJ).

Establishes criminal penalties of a fine, imprisonment for up to five years, or both, for concealment of a security breach that results in economic harm of at least $1,000 to an individual.

data_security breach notification act requires federal_trade_commission ftc promulgate regulations requiring covered entity partnerships estates trusts cooperatives nonprofit profit corporations owns possesses data containing personal information implement policies procedures information security practices treatment protection information establishes procedures followed event information security breach requires covered entity discovers breach notify ftc covered entity notified federal entity designated department_of_homeland_security dhs receive information affected individuals sets forth requirements concerning notification including methods notification timeliness requirements allows exemption notification requirements entity reasonably concludes reasonable risk identity theft fraud unlawful conduct establishes presumption risk encrypted data directs dhs designate federal entity covered entities required notify security breach involves personal information individuals database containing personal information million individuals federal government databases personal information federal employees contractors known involved national security law enforcement requires designated entity provide notice receives federal_bureau_of_investigation fbi ftc mail fraud involved attorneys general affected states appropriate federal agencies law enforcement national security data security purposes sets forth enforcement provisions ftc state attorneys general attorney general doj establishes criminal penalties fine imprisonment years concealment security breach results economic harm individual


Summary:
Smartphone Theft Prevention Act - Amends the Communications Act of 1934 to require commercial mobile service providers to make available on mobile devices a function that an account holder may use remotely to: (1) delete or render inaccessible all information relating to the account holder that has been placed on the device; (2) render the device inoperable on the global networks of such service providers, even if the device is turned off or has the data storage medium removed; (3) prevent the device from being reactivated or reprogrammed without a passcode or similar authorization after the device has been rendered inoperable or has been subject to an unauthorized factory reset; and (4) reverse any such actions if the device is recovered by the account holder.

Prohibits a mobile device from being manufactured in the United States or imported into the United States for sale or resale to the public, unless the device is configured in such a manner that a service provider may make such remote deletion and inoperability functions available on the device.

Allows the Federal Communications Commission (FCC) to waive such requirements with respect to any low-cost mobile device that: (1) is intended primarily for voice-only mobile service, and (2) may have limited data consumption functions focused on text messaging or short message service.

Prohibits service providers from charging a fee for making such remote deletion and inoperability functions available.

require commercial mobile service providers available mobile devices function account holder use remotely delete render inaccessible information relating account holder placed device render device inoperable global networks service providers device turned data storage medium removed prevent device reprogrammed similar authorization device rendered inoperable subject unauthorized factory reset reverse actions device recovered account holder prohibits mobile device manufactured united_states imported united_states sale resale public device configured manner service provider remote deletion functions available device allows federal_communications_commission fcc waive requirements respect low cost mobile device intended primarily voice mobile service limited data consumption functions focused text messaging short message service prohibits service providers charging fee making remote deletion functions available


Summary:
Location Privacy Protection Act of 2014 - Amends the federal criminal code to prohibit a covered entity (nongovernmental individual or entity) from knowingly collecting or disclosing to another covered entity geolocation information from an electronic communications device without the consent of the individual using the device. Specifies exceptions, including for collection or disclosure: (1) for the provision of fire, medical, public safety, or other emergency services; or (2) pursuant to a court order or a request by a law enforcement agency.

Defines "geolocation information" as specified information that is not the contents of a communication, is generated by or derived from the operation or use of such a device, is sufficient to identify the street and city or town in which the device is located, and does not include the Internet protocol address or the home, business, or billing address of the individual. Defines "consent" as affirmative express consent after receiving clear, prominent, and accurate notice that: (1) informs the individual that his or her geolocation information will be collected, (2) identifies the categories of covered entities to which the information may be disclosed, and (3) provides the individual easy access to the collecting agency's geolocation information website.

Requires a covered entity that initially collects geolocation information from such a device in a manner that it has reason to believe is imperceptible to the individual using the device, in addition to obtaining consent, to provide clear, prominent, and accurate notice to the individual, not earlier than 24 hours nor later than 7 days after the initial collection, that geolocation information is being collected

Requires a covered entity that collects the geolocation information of more than 1,000 electronic communications devices in a year to maintain a publicly accessible Internet website that includes: (1) the nature of the information collected; (2) the purposes for which the covered entity collects, uses, and discloses the information; (3) the specific covered entities to which the collecting entity discloses geolocation information; and (4) how an individual may electronically revoke consent for the collection and disclosure of such information.

Requires the Attorney General to issue regulations to implement such requirements. Authorizes civil actions by the Attorney General and aggrieved individuals for violations of this Act, subject to specified limitations.

Prohibits: (1) the unauthorized disclosure of geolocation information in aid of interstate domestic violence or stalking; (2) the fraudulent collection of geolocation records information obtained by a geolocation information service; and (3) the manufacture, distribution, possession, and advertising of geolocation information intercepting devices. Provides for the forfeiture of such devices. Establishes in the Treasury an Anti-Stalking Fund: (1) into which shall be deposited an amount equal to the value of any such device and related proceeds forfeited, and (2) which the Attorney General shall use for training on investigating and prosecuting stalking crimes and for support of help line and emergency response efforts for such crimes.

Directs the Attorney General to include as part of each National Crime Victimization Survey, and the Director of the Center for Disease Control and Prevention (CDC) to include as part of each National Intimate Partner and Sexual Violence Survey, questions examining the role that various new technologies that use geolocation information may have in the facilitation of domestic violence, dating violence, sexual assault, or stalking.

Requires the Attorney General to direct the Internet Crime Complaint Center to provide education and awareness information to the public and law enforcement and register complaints regarding the abuse of geolocation information to commit domestic violence, dating violence, sexual assault, stalking, or other related crimes. Authorizes the Director of the Office on Violence Against Women to make grants to develop and provide training relating to investigating and prosecuting the misuse of geolocation information in the commission of such crimes.

amends federal criminal code prohibit covered entity nongovernmental individual entity knowingly collecting disclosing covered entity geolocation information electronic communications device consent individual device specifies exceptions including collection disclosure provision fire medical public safety emergency services pursuant court order request law enforcement agency defines geolocation information specified information contents communication generated derived operation use device sufficient identify street city town device located include internet protocol address home business billing address individual defines consent affirmative express consent receiving clear prominent accurate notice informs individual geolocation information collected identifies categories covered entities information disclosed provides individual easy access collecting agency geolocation information website requires covered entity initially collects geolocation information device manner reason believe individual device addition obtaining consent provide clear prominent accurate notice individual earlier hours later days initial collection geolocation information collected requires covered entity collects geolocation information electronic communications devices year maintain publicly accessible internet website includes nature information collected purposes covered entity collects uses discloses information specific covered entities collecting entity discloses geolocation information individual electronically revoke consent collection disclosure information requires attorney general issue regulations implement requirements authorizes civil actions attorney general aggrieved individuals violations act subject specified limitations prohibits unauthorized disclosure geolocation information aid interstate domestic violence stalking fraudulent collection geolocation records information obtained geolocation information service manufacture distribution possession advertising geolocation information intercepting devices provides forfeiture devices establishes treasury shall deposited equal value device related proceeds forfeited attorney general shall use training investigating prosecuting stalking crimes support help line emergency response efforts crimes directs attorney general include director cdc include sexual violence survey questions examining role new technologies use geolocation information facilitation domestic violence dating violence sexual assault stalking requires attorney general direct internet crime complaint center provide education awareness information public law enforcement register complaints abuse geolocation information commit domestic violence dating violence sexual assault stalking related crimes authorizes director office_on_violence_against_women grants develop provide training relating investigating prosecuting misuse geolocation information commission crimes


Summary:
Commonsense Reporting Act of 2014 - Amends the Internal Revenue Code, with respect to reporting of health care coverage information, to: (1) allow identification of dependents of the primary insured by name and date of birth, instead of taxpayer identification number, if the employer or health insurance issuer does not collect or maintain tax identification numbers for such dependents; and (2) allow an individual to refuse consent to receive tax information statements relating to health insurance coverage in electronic form.

Directs the Department of the Treasury to report to Congress on the processes necessary to develop a reporting system allowing employers to voluntarily provide information on health care coverage offered by such employers.

commonsense reporting act amends internal revenue code respect reporting health care coverage information allow identification dependents primary insured date birth instead taxpayer identification number employer health insurance issuer collect maintain tax identification numbers dependents allow individual refuse consent receive tax information statements relating health insurance coverage electronic form directs department_of_the_treasury report congress processes necessary develop reporting system allowing employers voluntarily provide information health care coverage offered employers


Summary:
Peace Corps Equity Act of 2014 - Amends the Peace Corps Act to subject abortion service coverage by the Peace Corps for volunteers to the same limitations that apply to Peace Corps employees regarding coverage of abortion services.

States that such restriction shall not be construed to limit medical evacuation coverage.

peace corps equity act amends peace corps act subject abortion service coverage peace_corps volunteers limitations apply peace_corps employees coverage abortion services states restriction shall construed limit medical evacuation coverage