[ Personal Data Privacy and Security Act of 2009 ] STATUS: Approved by U.S. Senate Judiciary Committee (NOVEMBER 2009) SUMMARY: Sponsored by Senator Leahy (D-Vermont), this legislation ups the ante for acts of data piracy and also failure to report data breaches. Fraud involving digitized or electronic personally identifiable information (including identify theft) can be considered grounds for racketeering charges, which carry far more significant criminal penalties and sentences. The Act directs the U.S. Sentencing Commission to update its guidelines for fraudulent use of private data and for concealment of security breaches. As written, the new law will also establish an Office of Identity Protection under the FTC umbrella, and impose new standard on GSA contracts. More details: Imposes additional requirements on data brokers, especially the implementation of safeguards for personally identifiable information. It also requires disclosure to individuals of personal electronic records maintained for sharing with third parties, disclose adverse actions by third parties against an individual; and maintain procedures for correcting inaccuracies. Amends the federal bankruptcy code to define "identify theft" and "identify theft victim" for bankruptcy purposes and prohibit the dismissal or conversion of a Chapter 7 bankruptcy case if the debtor is an identity theft victim. Complete listing and links for data security regulations and legislation. Establishes in the Federal Trade Commission (FTC) an Office of Federal Identity Protection. Authorizes the Attorney General and state attorneys general to bring civil actions against business entities for violations of this Act. Requires the Administrator of the General Services Administration (GSA), in considering contract awards totaling more than $500,000, to evaluate: the data privacy and security program of a data broker, program compliance, the extent to which databases and systems have been compromised by security breaches and responses to such breaches. Federal agencies will be required to conduct a privacy impact assessment before purchasing personally identifiable information from a data broker. The Department of Justice will be required to designate a department-wide Chief Privacy Officer. Requires businesses or organizations to notify any individual whose information has been accessed or acquired, as well as all nationwide consumer reporting agencies if an entity is required to notify more than 5,000 such individuals and the U.S. Secret Service if the number of individuals involved exceeds 10,000.