Veteran DATA Act
- Sponsor
- Rep. Budzinski, Nikki [D-IL-13]
- Committees
- Veterans' Affairs Committee (primary)
- Last action
- Apr 15, 2026
Bottom line
This bill aims to enhance the privacy and security of veterans' sensitive personal data by preventing its sale or misuse by VA contractors and subcontractors.
What it actually does
H.R. 7280, the "Veteran DATA Act," prohibits the Department of Veterans Affairs (VA) from entering into contracts that allow contractors to sell or disclose for consideration sensitive personal information maintained by the Secretary. It also mandates that existing and future VA contracts handling protected health information or personally identifiable information include clauses preventing its monetization, sale, or misuse, and requires the VA to issue guidance for employees and contractors on identifying such misuse.
Proponents argue
Proponents argue that this bill is a critical step to protect the highly sensitive personal and health information of veterans from exploitation by third-party contractors. They emphasize that veterans have a right to expect their data, entrusted to the VA, will not be sold or misused, and this bill closes potential loopholes that could allow such practices, thereby restoring trust in VA's data handling.
Opponents contend
Opponents might argue that existing federal privacy laws and VA regulations already provide sufficient protections, making this bill redundant or overly prescriptive. They could also contend that overly restrictive contract clauses might limit the VA's ability to partner with innovative private sector entities that could offer valuable services, or increase administrative burdens and costs for the VA and its contractors without significantly enhancing security.
The bill is very short and straightforward, making it highly accessible for any reader to understand its core provisions quickly.
Section 2
Prohibition of Sale of Sensitive Personal Information
This section amends Title 38, United States Code, specifically Section 5725, to explicitly forbid the Secretary of Veterans Affairs from entering into any contract that permits the contractor to sell or otherwise disclose for consideration sensitive personal information to another entity. This creates a direct statutory prohibition against the monetization of veteran data by VA contractors.
Supporters argue
Supporters argue this provision directly addresses a critical vulnerability by explicitly banning the sale of veteran data, ensuring that contractors cannot profit from sensitive information entrusted to the VA. This builds trust and prevents potential exploitation.
Critics contend
Critics might argue that existing privacy laws (like HIPAA and the Privacy Act) already cover much of this, and adding another layer of prohibition could create redundancy or unintended complexities in contract drafting without adding significant new protection.
Tradeoffs
The tension lies between ensuring robust data privacy for veterans and potentially limiting the VA's flexibility in contracting for data-related services, especially if "disclosure for consideration" is interpreted broadly.
Section 3(a)(1)
Contractual Prohibition on Misuse of Covered Information
This provision requires the Secretary of Veterans Affairs, within one year of the Act's enactment, to ensure that all "covered contracts" (both new and existing non-expired contracts) include a clause prohibiting contractors, subcontractors, affiliates, or other non-VA entities from monetizing, selling, or otherwise misusing "covered information." This extends the data protection requirements to all relevant parties in the contracting chain.
Section 3(a)(2)
Guidance for Identifying Data Misuse
This section mandates that the Secretary of Veterans Affairs, within one year, issue a directive or policy providing guidance to Department employees and contractors. This guidance is intended to help them identify the monetization, sale, or misuse of "covered information" to ensure contractors comply with the new contractual clauses.
Defines "covered information" broadly to include protected health information or personally identifiable information, including such information that has been anonymized. It also explicitly references multiple existing laws and regulations (5 U.S.C. 552a, 38 U.S.C. 5701, 7332, 45 CFR parts 160, 161, and 164) and "any other provision of law, as determined by the Secretary."
Section 3(c)(3)
Why it matters:It is standard legislative practice to place definitions at the end. However, the breadth of the definition, particularly the inclusion of anonymized data and the Secretary's discretion, is substantively important and could be easily overlooked.
Case for: Supporters would argue that including anonymized data is essential to prevent sophisticated data monetization schemes that might attempt to de-anonymize data or derive value from aggregated, supposedly anonymous datasets. The broad reference to existing laws ensures comprehensive coverage and allows for future adaptation.
Case against: Critics might argue that including "anonymized" data could be overly broad, as truly anonymized data is generally considered outside the scope of personal information protection. The "any other provision of law" clause grants significant discretion to the Secretary, potentially leading to unpredictable expansion of covered information without further congressional review.
Estimated impact: Significantly expands the scope of data protected under the bill, potentially impacting a wider range of data processing activities by VA contractors, including those dealing with aggregated or de-identified data.