46 U.S.C. § 51325

(a) Information Management System.— (1) In general .— Not later than January 1, 2023 , the Maritime Administrator shall establish within the United States Merchant Marine Academy Sexual Assault prevention and Response Program, an information management system to track and maintain, in such a manner that patterns can be reasonably identified, information regarding claims and incidents involving cadets that are reportable pursuant to subsection (d) of section 51318 of this chapter. (2) Information maintained in the system .— Information maintained in the system established under paragraph (1) shall include the following information, to the extent that information is available: (A) The overall number of sexual assault or sexual harassment incidents per fiscal year. (B) The location of each such incident, including vessel name and the name of the company operating the vessel, if applicable. (C) The standardized job title or position of the individuals involved in each such incident. (D) The general nature of each such incident, to include copies of any associated reports completed on the incidents. (E) The type of inquiry made into each such incident. (F) A record of whether each such incident was substantiated by the relevant investigative process. (3) Past information included .— The information management system under this section shall include the relevant data listed in this subsection related to sexual assault and sexual harassment that the Maritime Administrator possesses, and shall not be limited to data collected after January 1, 2023 . (4) Privacy protections .— The Maritime Administrator and the Chief Information Officer of the Department of Transportation shall coordinate to ensure that the information management system under this section shall— (A) be established and maintained in a secure fashion to ensure the protection of the privacy of any individuals whose information is entered in such system; and (B) be free of personally identifiable information and maintain only the data required to satisfy the statistical purpose of such system. (5) Cybersecurity audit .— Ninety days after the implementation of the information management system, the Office of Inspector General of the Department of Transportation shall commence an audit of the cybersecurity of the system and shall submit a report containing the results of that audit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Transportation and Infrastructure of the House of Representatives. (6) Correcting records .— In establishing the information management system, the Maritime Administrator shall create a process to ensure that if any incident report results in a final agency action or final judgement that acquits an individual of wrongdoing, all personally identifiable information about the acquitted individual is removed from that incident report in the system. (b) Sea Year Program .— The Maritime Administrator shall provide for the establishment of in-person and virtual confidential exit interviews, to be conducted by personnel who are not involved in the assignment of the midshipmen to a Sea Year vessel, for midshipmen from the Academy upon completion of Sea Year and following completion by the midshipmen of the survey under section 51322(d). 1 1 See References in Text note below. (c) Data-informed Decisionmaking .— The data maintained in the data management system under subsection (a) and through the exit interviews under subsection (b) shall be affirmatively referenced and used to inform the creation of new policy or regulation, or changes to any existing policy or regulation, in the areas of sexual harassment, dating violence, domestic violence, sexual assault, and stalking.