• the extent personally identifiable information is collected under a proposed or final rule, assuring participation by affected individuals in the rulemaking where the agency finds a “significant privacy impact”;
• whether affected individuals can access this information;
• the extent this information is protected from being used for something other than the stated purpose of the rule; and
• how such information is secured.

For each proposed rule (those in development published for public comment), agencies are also to list any alternative possibilities that could minimize privacy impacts while still accomplishing the stated objectives of the rule. For final rules, agencies are to summarize public comments on the initial privacy impact analysis, and describe any steps taken to minimize significant privacy impacts.

An aggrieved individual is entitled to sue over an agency’s final privacy impact analysis, as well as an agency’s decision to waive or delay completion of the analysis for emergency reasons, as allowed by the bill. In granting relief, a court could remand the rule or defer its enforcement against individuals.

Agencies are also to conduct a “periodic review” of each existing rule that has a “significant privacy impact” on individuals to determine any possible changes that could minimize such impacts. Such a review is to occur no later than 10 years after a rule’s adoption, and each year, agencies are to indicate in the Federal Register rules they plan to review.