RECOVER PII Act returns as OPM breach protections approach Sept. 30 cutoff
Norton has introduced versions of this bill in 2018 and 2024; neither passed. The expirations are no longer theoretical.
TL;DR
The RECOVER PII Act, introduced Monday by Sen. Mark Warner and Del. Eleanor Holmes Norton, would replace the expiring 10-year OPM breach identity protection program with lifetime coverage for 22.1 million affected federal employees and contractors. The MyIDCare program's rolling expirations began late last year; the last coverage runs out September 30. This isn't Norton's first attempt. She introduced versions in 2018 and 2024, and neither passed.
The RECOVER PII Act, introduced Monday by Sen. Mark Warner (D-Va.) and Del. Eleanor Holmes Norton (D-D.C.), would replace the 10-year identity protection program with lifetime coverage for the 22.1 million people whose data was exposed in the 2015 OPM breaches. Sens. Tim Kaine of Virginia and Maryland's Angela Alsobrooks and Chris Van Hollen are cosponsors.
The timing isn't theoretical this time. OPM's MyIDCare program began sending expiration notices late last year on a rolling basis. Anyone who enrolled gets exactly 10 years from their signup date, after which the complimentary credit monitoring and identity-theft insurance simply end. The last protections run out September 30, when OPM plans to wind down the program entirely.
The bill retains the existing $5 million identity-theft insurance minimum and adds a new provision allowing agencies to reimburse employees and contractors for privacy tools: services that scrub or limit personal information online. That reimbursement authority wouldn't be limited to OPM breach victims and would come from agency salary-and-expense budgets.
The third try
Norton has been pushing this since 2018. She and then-Rep. Dutch Ruppersberger (D-Md.) introduced H.R. 5765 that year. A 2024 version, H.R. 7236, went nowhere. Each time, the argument was the same: stolen Social Security numbers and background investigation records don't expire, so the protections shouldn't either. Each time, the bill died.
What's different now is that the expiration is happening, not looming. The 2017 appropriations law that established the 10-year program didn't build in a bridge. When coverage ends for an individual, it ends. The GAO has already questioned whether the $5 million insurance level is necessary or market-distorting. But the core problem: 22 million records in the hands of foreign intelligence services, hasn't changed since 2015.
What happens Monday
For the federal employee or contractor whose MyIDCare notice arrives this month, nothing changes yet. The bill hasn't passed, and Congress has shown it can let this deadline slide. The practical advice hasn't changed since 2015 either: freeze your credit and monitor your accounts. Don't assume anyone else will catch the fraud before you do.
Published ·Deep Fathom