§4662. Prohibition on the transfer of certain data on employees of the Department of Defense to third parties

(a) In General.-Each contract entered into by the Department of Defense on or after the date of the enactment of this section shall include a provision prohibiting the contractor and each subcontractor under such contract from selling, licensing, or otherwise transferring covered individually identifiable Department employee data to any individual or entity other than the Federal Government, except to the extent required to perform such contract or a subcontract under such contract and that would be permissible pursuant to statute or guidance from the Director of the Office of Management and Budget.

(b) Waiver.-The Secretary of Defense may waive the requirements of subsection (a) with respect to a sale, licensing, or other transfer of covered individually identifiable Department employee data if the Secretary determines that such waiver is appropriate.

(c) Definitions.-In this section:

(1) The term "covered individually identifiable Department employee data" means individually identifiable Department employee data obtained by-

(A) a contractor pursuant to the performance of a contract described in subsection (a) by such contractor; or

(B) a subcontractor pursuant to the performance of a subcontract under such a contract by such subcontractor.

(2) The term "individually identifiable Department employee data" means information related to an employee of the Department of Defense, including a member of the Armed Forces, that-

(A) identifies such employee; or

(B) which may be used to infer, by either direct or indirect means, the identity of such an employee to whom the information applies.

(Added Pub. L. 118–31, div. A, title VIII, §803, Dec. 22, 2023, 137 Stat. 312 .)

Editorial Notes

References in Text

The date of the enactment of this section, referred to in subsec. (a), is the date of enactment of Pub. L. 118–31, which was approved Dec. 22, 2023.