H.R. 1101 — Taxpayer Data Protection Act

This section provides the short title of the Act as the “Taxpayer Data Protection Act.”

This section limits access to Department of the Treasury public money receipt and payment systems, including Bureau of the Fiscal Service payment systems, by prohibiting the Secretary from allowing any individual to use, exercise administrative control over, or otherwise access such systems or data unless the individual meets specified eligibility, security, ethics, and service requirements. For Treasury officers, employees, and contractors, access is allowed only if the individual is otherwise eligible to access the system or data, received a most recent performance rating of fully successful or higher, and has served in a civil service position or under a Treasury contract for at least 1 year. For other individuals, access is allowed only if the individual holds an appropriate security clearance granted under section 801 of the National Security Act of 1947, the access does not violate 18 U.S.C. § 208, the individual is not a special Government employee, the individual has at least 1 year of continuous civil service, the individual has completed required privacy, cybersecurity, and national security training or compliance procedures, and the individual has signed a written ethics agreement with Treasury or the Office of Government Ethics. The section also provides that any nonexecutive-branch individual who accesses such a system or data is treated as an executive branch employee for purposes of 18 U.S.C. § 208. It further specifies that exercising administrative control over, or stopping, canceling, adjusting, holding, rejecting, changing, or otherwise affecting, any payment or data in such a system constitutes personal and substantial participation in a particular matter under that conflict-of-interest statute. Finally, this section directs the Treasury Inspector General to investigate each instance of unauthorized use or access of a covered payment system and submit a report to Congress within 30 days. Each report must include a detailed description of the unauthorized activity, a risk assessment addressing privacy, national security, cybersecurity, and system integrity, and a description of any payments stopped during the unauthorized access.