H.R. 1877 — Protecting Americans’ Social Security Data Act

This section prohibits political appointees (i.e., as defined in sec. 4(a) of the Edward ‘Ted’ Kaufman and Michael Leavitt Presidential Transitions Improvements Act of 2015) and special government employees (i.e., as defined in 18 U.S.C. 202(a)) from accessing any Social Security Administration beneficiary data system, notwithstanding other provisions of the section. A beneficiary data system includes SSA systems that (A) issue or record Social Security account numbers, (B) determine eligibility for or (C) pay benefits under the Social Security Act, or (D) contain personally identifiable information on benefit applicants or recipients (e.g., Numident, Master Beneficiary Record, Supplemental Security Income Record, National Disability Determination Services File, Earnings Recording and Self-Employment Income System), including any accessible through the Enterprise Data Warehouse.

This section establishes civil liability for negligent unauthorized disclosure or access of an individual's information in violation of Social Security Act disclosure restrictions in subsections (a) or (h) of Section 1106. It (1) authorizes the affected individual to sue the United States (for officer/employee violations) or the responsible person in federal district court; (2) provides exceptions for good faith erroneous interpretations or individual-requested disclosures; (3) requires damages equal to the greater of $5,000 per violation or actual damages (plus punitive damages for willful or grossly negligent violations), plus costs and reasonable attorneys' fees (awardable against the United States only if the plaintiff prevails); (4) sets a two-year statute of limitations from the plaintiff's discovery of the violation; and (5) directs the Social Security Commissioner to notify the individual of any related criminal charges or proposed administrative disciplinary actions (including the violation date and the individual's rights).

This section requires the Inspector General of the Social Security Administration to investigate each disclosure in violation of subsection (a) or unauthorized access to a beneficiary data system in violation of subsection (h) of section 1106 of the Social Security Act (42 U.S.C. 1306), treating a series of such violations as a single violation if appropriate. Not later than 30 days after becoming aware of a violation, the Inspector General must report to Congress on (1) a detailed description of the violation, (2) a risk assessment of any threat to individual privacy, national security, cybersecurity, or system integrity, and (3) a description of any stopped payments during the unauthorized use or access.

This section directs the Comptroller General of the United States to submit to the Senate Committee on Finance and the House Committee on Ways and Means (1) interim reports on specified information, including the status of a study on the effects of changes made to section 1106 of the Social Security Act (SSA) by this Act and subsequent Acts, beginning not later than one month after enactment and monthly thereafter; and (2) a final report not later than one year after enactment containing the study's results, a summary of investigations under SSA section 1106(i), convictions under SSA section 1106(a), and civil actions (including results) under SSA section 1106(j). (As background, SSA section 1106 authorizes federal payments to states for services related to the Old-Age, Survivors, and Disability Insurance and Supplemental Security Income programs and includes fraud prevention and enforcement provisions.)