Taxpayer Data Protection Act

This Act may be cited as the “Taxpayer Data Protection Act”.

Section 321 of title 31, United States Code, is amended by adding at the end the following:

“(e)

(1) The Secretary may not allow any individual to use, exercise administrative control over, or otherwise access any Department of the Treasury public money receipt or payment system (including any payment system of the Bureau of the Fiscal Service (or any successor thereof)), or any data from any such system, unless—

(A) such individual is an officer, employee, or contractor of the Department of the Treasury—

(i) who is otherwise eligible to access such system or data;

(ii) whose most recent performance rating was at the fully successful level or higher (or the equivalent thereof); and

(iii) who, as of the date of such access, with respect to such an officer or employee has occupied a position in the civil service (as that term is defined in section 2101 of title 5), or with respect to such a contractor has been performing under a contract with the Department, for a period of at least one year; or

(B) in the case of an individual not described in subparagraph (A)—

(i) such individual holds a security clearance at the appropriate level with respect to such system or data and such clearance was granted pursuant to the procedures established under section 801 of the National Security Act of 1947 (50 U.S.C. 3161));

(ii) such individual’s access to such system or data, or use thereof, does not constitute a violation of section 208 of title 18 (determined after the application of paragraph (2));

(iii) such individual is not a special Government employee (as defined in section 202 of title 18);

(iv) such individual’s current continuous service in the civil service (as that term is defined in section 2101 of title 5) as of the date of such access is for a period of at least 1 year;

(v) such individual has completed any required training or compliance procedures with respect to privacy laws and cybersecurity and national security regulations and best practices; and

(vi) has signed a written ethics agreement with either the Department of the Treasury or the Office of Government Ethics.

(2)

(A) Any individual who accesses any system or data described in paragraph (1) who is not otherwise an officer or employee of the executive branch of the United States Government shall be treated as an employee of the executive branch of the United States Government for purposes of section 208 of title 18.

(B) For purposes of such section 208, exercise of administrative control or stopping, canceling, adjusting, holding, rejecting, changing, or otherwise impacting any payment or data in any Department of the Treasury public money receipt or payment system (including any payment system of the Bureau of the Fiscal Service (or any successor thereof)), shall be considered personal and substantial participation as a Government officer or employee in a particular matter.

(3) The Inspector General of the Department of the Treasury shall investigate, and submit a report to Congress on such investigation, each instance of unauthorized use or other access of any payment system described in paragraph (1). Any such report shall be submitted not later than 30 days after any such instance and shall include—

(A) a detailed description of the unauthorized use or access, including any actions the individual carried out;

(B) a risk assessment of any threat to privacy, national security, cybersecurity, or the integrity of the applicable system as a result of such unauthorized use or access; and

(C) a detailed description of any stopped payments during the unauthorized use or access.”.