,,ii  #aafth ,,congress  #ast ,session  
,s4 #bhhi  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,november #ah1 
#bjai,mr4 ,hawley 7for himself1 ,mr4    
,cotton1 and ,mr4 ,rubio7 introduced the
 following bill2 which was read twice   
and referred to the ,committee on       
,commerce1 ,science1 and ,transportation
  ,a ,,bill  ,to safeguard data of      
,americans from foreign governments that
 pose risks to national security by     
imposing data security requirements and 
strengthening review of foreign         
investments1 and for other purposes4    
#a4 ,short title ,this ,act may be cited
 as the ,national ,security and         
,personal ,data ,protection ,act of     
#bjai4  #b4 ,definitions ,in this ,act3 
7#a7 ,commission ,the term ,commission  
means the ,federal ,trade ,commission4  
7#b7 ,country of concern  7,a7 ,in      
general ,subject to subparagraph        
7,b77iii71 the term country of concern  
means-- 7i7 the ,people's ,republic of  
,china2  7ii7 the ,russian ,federation2 

and  7iii7 any other country designated 
by the ,secretary of ,state as being of 
concern with respect to the protection  
of data privacy and security4  7,b7     
,designation of countries of concern    
,not later than #a year after the date  
of enactment of this ,act1 and annually 
thereafter1 the ,secretary of ,state    
shall--  7i7 review the status of data  
privacy and security requirements       
7including by reviewing laws1 policies1 
practices1 and regulations related to   
data privacy and security7 in each      
foreign country to determine--  7,i7    
whether it would pose a substantial risk
 to the national security of the ,united
 ,states if the government of such      
country gained access to the user data  
of citizens and residents of the ,united
 ,states2 and  7,,ii7 whether there is a
 substantial risk that the government of
 such country will1 in a manner that    
fails to afford similar respect for     
civil liberties and privacy as the      
,constitution and laws of the ,united   

,states1 obtain user data from companies
 that collect user data2  7ii7 designate
 each country that meets the criteria of
 clause 7i7 as a country of concern2 and
  7iii7 remove the designation from any 
country that was previously designated a
 country of concern 7regardless of      
whether such designation was pursuant to
 clause 7i7 or 7ii7 of subparagraph 7,a7
 or was made by the ,secretary of ,state
 pursuant to clause 7iii7 of such       
subparagraph7 if the country--  7,i7 no 
longer meets the criteria of clause 7i72
 and  7,,ii7 is not at substantial risk 
of meeting such criteria4  7,c7         
,regulations ,not later than #ij days   
after the date of the enactment of this 
,act1 the ,secretary of ,state shall    
prescribe regulations--  7i7            
establishing a process for a covered    
technology company or country of concern
 to petition the ,secretary to remove   
the country of concern designation from 
a country that was designated as such   
pursuant to subparagraph 7,b77ii72 and  

7ii7 setting forth the procedures and   
criteria the ,secretary will use in     
identifying or removing countries under 
subparagraphs 7,a77iii7 or 7,b77iii74   
7#c7 ,covered technology company ,the   
term covered technology company means an
 entity that provides an online         
data-based service such as a website or 
internet application in or affecting    
interstate or foreign commerce and--    
7,a7 is organized under the laws of a   
country of concern2  7,b7 in which      
foreign persons that are nationals of1  
or companies that are organized under   
the laws of1 countries of concern have a
 plurality or controlling equity        
interest2  7,c7 is a subsidiary company 
of an entity described in subparagraph  
7,a7 or 7,b72 or  7,d7 is otherwise     
subject to the jurisdiction of a country
 of concern in a manner that allows the 
country of concern to obtain the user   
data of citizens and residents of the   
,united ,states without similar respect 
for civil liberties and privacy as      

provided under the ,constitution and    
laws of the ,united ,states4  7#d7      
,facial recognition technology ,the term
 facial recognition technology means    
technology that analyzes facial features
 in still or video images and is used to
 identify1 or facilitate identification 
of1 an individual using facial physical 
characteristics4  7#e7 ,targeted        
advertising  7,a7 ,in general ,the term 
targeted advertising means a form of    
advertising where advertisements are    
displayed to a user based on the user's 
traits1 information from a profile about
 the user that is created for the       
purpose of selling advertisements1 or   
the user's previous online or offline   
behavior4  7,b7 ,limitation ,such term  
shall not include advertising chosen    
because of the context of the internet  
service1 such as--  7i7 advertising that
 is directed to a user based on the     
content of the website1 online service1 
online application1 or mobile           
application that the user is connected  

to2 or  7ii7 advertising that is        
directed to a user by the operator of a 
website1 online service1 online         
application1 or mobile application based
 on the search terms that the user used 
to arrive at such website1 service1 or  
application4  7#f7 ,user data ,the term 
user data means any information obtained
 by an entity that provides a data-based
 service such as a website or internet  
application that identifies1 relates to1
 describes1 is capable of being         
associated with1 or could reasonably be 
linked with an individual who is a      
citizen or resident of the ,united      
,states without regard to whether such  
information is directly submitted by the
 individual to the entity1 is derived by
 the entity from the observed activity  
of the individual1 or is obtained by the
 entity by any other means4  #c4 ,data  
security requirements for covered       
technology companies  7a7 ,in general   
,the following requirements shall apply 
to a covered technology company3 7#a7   

,minimal collection of data ,the company
 shall not collect any more user data   
than is necessary for the operation of  
the website1 service1 or application of 
the company4  7#b7 ,prohibition on      
secondary uses ,the company shall not   
use any user data collected under       
paragraph 7#a7 for any purpose that is  
secondary to the operation of the       
website1 service1 or application of the 
company1 including providing targeted   
advertising1 unnecessarily sharing such 
data with a third party1 or             
unnecessarily facilitating facial       
recognition technology4  7#c7 ,right to 
view and delete data ,the company shall 
allow an individual to-- 7,a7 view any  
user data held by the company that      
relates to the individual2 and  7,b7    
permanently delete any user data held by
 the company that has been collected1   
directly or indirectly1 from the        
individual4  7#d7 ,prohibition on       
transfer to countries of concern ,the   
company shall not transfer any user data

 or information needed to decipher that 
data1 such as encryption keys1 to any   
country of concern 7including indirectly
 through a third country that is not a  
country of concern74  7#e7 ,data storage
 requirement ,the company shall not     
store any user data collected from      
citizens or residents of the ,united    
,states or information needed to        
decipher that data1 such as encryption  
keys1 on a server or other data storage 
device that is located outside of the   
,united ,states or a country that       
maintains an agreement with the ,united 
,states to share data with law          
enforcement agencies through a process  
established by law4  7#f7 ,reporting    
requirement ,not less frequently than   
annually1 the chief executive officer or
 equivalent officer of the company shall
 submit1 under penalty of perjury1 a    
report to the ,commission1 the ,attorney
 ,general of the ,united ,states1 and   
the ,attorney ,general of each ,state   
certifying compliance with the          

requirements of this section4  7b7      
,exceptions  7#a7 ,exception for law    
enforcement and military ,the           
requirements of paragraphs 7#a7 through 
7#d7 of subsection 7a7 shall not apply  
where data is collected1 used1 retained1
 stored1 or shared by a covered         
technology company solely for the       
purpose of assisting a law enforcement  
or military agency that is not          
affiliated with a country of concern4   
7#b7 ,transfer of shared content ,the   
requirements of paragraph 7#d7 and 7#e7 
of subsection 7a7 shall not apply to    
user data that is content produced by a 
user for the purpose of sharing with    
other users 7such as social media posts1
 emails1 or data related to a           
transaction involving the user7 or      
information needed to decipher that data
 provided that the transfer and any     
storage necessary to enact the transfer 
is conducted solely to carry out the    
user's intent to share such data with   
individual users in other countries and 

that necessary storage occurs only on   
the intended recipient's individual     
device4  7c7 ,effective date ,the       
requirements of this section shall take 
effect #ij days after the date of       
enactment of this ,act4  #d4 ,data      
security requirements for other         
technology companies  7a7 ,in general   
,the following requirements shall apply 
to any company operating in or affecting
 interstate or foreign commerce that    
provides a data-based service such as a 
website or internet application but is  
not a covered technology company3  7#a7 
,prohibition on transfer to countries of
 concern ,the company shall not transfer
 any user data collected from an        
individual in the ,united ,states or    
information needed to decipher that     
data1 such as encryption keys1 to any   
country of concern 7including indirectly
 through a third country that is not a  
country of concern74  7#b7 ,prohibition 
on storing data in countries of concern 
,the company shall not store any user   

data collected from an individual in the
 ,united ,states or information needed  
to decipher that data1 such as          
encryption keys1 on a server or other   
data storage device that is located in  
any country of concern4  7b7 ,exceptions
  7#a7 ,exception for law enforcement   
and military ,the requirements of       
subsection 7a7 shall not apply where    
data is collected1 used1 retained1      
stored1 or shared by a covered          
technology company solely for the       
purpose of assisting a law enforcement  
or military agency that is not          
affiliated with a country of concern4   
7#b7 ,transfer of shared content ,the   
requirements of subsection 7a7 shall not
 apply to user data that is content     
produced by a user for the purpose of   
sharing with other users 7such as social
 media posts1 emails1 or data related to
 a transaction involving the user7 or   
information needed to decipher that data
 provided that the transfer and any     
storage necessary to enact the transfer 

is conducted solely to carry out the    
user's intent to share such data with   
individual users in other countries and 
that necessary storage occurs only on   
the intended recipient's individual     
device4  7c7 ,effective date ,the       
requirements of this section shall take 
effect #ij days after the date of       
enactment of this ,act4  #e4            
,enforcement of data security           
requirements  7a7 ,enforcement by the   
,commission  7#a7 ,in general ,except as
 otherwise provided1 sections #c and #d 
shall be enforced by the ,commission    
under the ,federal ,trade ,commission   
,act 7#ae ,u4,s4,c4 #da et seq474  7#b7 
,unfair or deceptive acts or practices  
,a violation of section #c or #d shall  
be treated as a violation of a rule     
defining an unfair or deceptive act or  
practice prescribed under section       
#ah7;a77#a77;,b7 of the ,federal ,trade 
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77#a77;,b774  7#c7 ,actions by   
the ,commission ,except as otherwise    

provided1 the ,commission shall prevent 
any person from violating section #c or 
#d in the same manner1 by the same      
means1 and with the same jurisdiction1  
powers1 and duties as though all        
applicable terms and provisions of the  
,federal ,trade ,commission ,act 7#ae   
,u4,s4,c4 #da et seq47 were incorporated
 into and made a part of this ,act1 and 
any person who violates such section    
shall be subject to the penalties and   
entitled to the privileges and          
immunities provided in the ,federal     
,trade ,commission ,act4  7#d7          
,authority preserved ,nothing in this   
,act shall be construed to limit the    
authority of the ,commission under any  
other provision of law4  7b7 ,criminal  
penalty  7#a7 ,offense ,it shall be     
unlawful to knowingly cause a technology
 company to violate a requirement of    
section #c or #d4  7#b7 ,penalty ,any   
person who violates paragraph 7#a7 shall
 be imprisoned for not more than #e     
years1 fined under title #ah1 ,united   

,states ,code1 or both4  7c7            
,enforcement by ,state attorneys general
  7#a7 ,in general  7,a7 ,civil actions 
,in any case in which the attorney      
general of a ,state has reason to       
believe that an interest of the         
residents of that ,state has been or is 
threatened or adversely affected by the 
engagement of any person in a practice  
that violates section #c or #d1 the     
,state1 as parens patriae1 may bring a  
civil action on behalf of the residents 
of the ,state in a district court of the
 ,united ,states or a ,state court of   
appropriate jurisdiction to--  7i7      
enjoin that practice2  7ii7 enforce     
compliance with such section2  7iii7 on 
behalf of residents of the ,state1      
obtain damages1 statutory damages1      
restitution1 or other compensation1 each
 of which shall be distributed in       
accordance with ,state law2 or  7iv7    
obtain such other relief as the court   
may consider to be appropriate4  7,b7   
,notice  7i7 ,in general ,before filing 

an action under subparagraph 7,a71 the  
attorney general of the ,state involved 
shall provide to the ,commission--  7,i7
 written notice of that action2 and     
7,,ii7 a copy of the complaint for that 
action4  7ii7 ,exemption  7,i7 ,in      
general ,clause 7i7 shall not apply with
 respect to the filing of an action by  
an attorney general of a ,state under   
this paragraph if the attorney general  
of the ,state determines that it is not 
feasible to provide the notice described
 in that clause before the filing of the
 action4  7,,ii7 ,notification ,in an   
action described in subclause 7,i71 the 
attorney general of a ,state shall      
provide notice and a copy of the        
complaint to the ,commission at the same
 time as the attorney general files the 
action4  7#b7 ,intervention  7,a7 ,in   
general ,on receiving notice under      
paragraph 7#a77;,b71 the ,commission    
shall have the right to intervene in the
 action that is the subject of the      
notice4  7,b7 ,effect of intervention   

,if the ,commission intervenes in an    
action under paragraph 7#a71 it shall   
have the right-- 7i7 to be heard with   
respect to any matter that arises in    
that action2 and  7ii7 to file a        
petition for appeal4  7#c7 ,construction
 ,for purposes of bringing any civil    
action under paragraph 7#a71 nothing in 
this ,act shall be construed to prevent 
an attorney general of a ,state from    
exercising the powers conferred on the  
attorney general by the laws of that    
,state to--  7,a7 conduct               
investigations2  7,b7 administer oaths  
or affirmations2 or  7,c7 compel the    
attendance of witnesses or the          
production of documentary and other     
evidence4  7#d7 ,actions by the         
,commission ,in any case in which an    
action is instituted by or on behalf of 
the ,commission for violation of section
 #c or #d1 no ,state may1 during the    
pendency of that action1 institute an   
action under paragraph 7#a7 against any 
defendant named in the complaint in the 

action instituted by or on behalf of the
 ,commission for that violation4  7#e7  
,venue2 service of process  7,a7 ,venue 
,any action brought under paragraph 7#a7
 may be brought in-- 7i7 the district   
court of the ,united ,states that meets 
applicable requirements relating to     
venue under section #acia of title #bh1 
,united ,states ,code2 or  7ii7 a ,state
 court of competent jurisdiction4  7,b7 
,service of process ,in an action       
brought under paragraph 7#a7 in a       
district court of the ,united ,states1  
process may be served wherever          
defendant--  7i7 is an inhabitant2 or   
7ii7 may be found4  7d7 ,private right  
of action  7#a7 ,in general ,any        
individual who suffers injury as a      
result of an act1 practice1 or omission 
of a covered technology company that    
violates section #c may bring a civil   
action against such company in any court
 of competent jurisdiction4  7#b7       
,relief ,in a civil action brought under
 paragraph 7#a7 in which the plaintiff  

prevails1 the court may award such      
plaintiff up to #a1jjj for each day that
 such plaintiff was affected by a       
violation of section #c 7up to a maximum
 of #ae1jjj per each such violation per 
plaintiff74  #f4 ,requirement for       
approval of ,committee on ,foreign      
,investment in the ,united ,states of   
certain transactions ,section #gba7;b7  
of the ,defense ,production ,act of     
#aiej 7#ej ,u4,s4,c4 #defe7;b77 is      
amended by adding at the end the        
following3  7#i7 ,approval required for 
certain transactions  7,a7 ,in general  
,a covered transaction described in     
subparagraph 7,c7 is prohibited unless  
the ,committee-- 7i7 reviews the        
transaction under this subsection2 and  
7ii7 determines that the transaction    
does not pose a risk to the national    
security of the ,united ,states4  7,b7  
,mitigation ,the ,committee1 or a lead  
agency on behalf of the ,committee1 may 
negotiate1 enter into or impose1 and    
enforce an agreement or condition under 

subsection 7l77#c7 with any party to a  
covered transaction described in        
subparagraph 7,c7 to mitigate any risk  
to the national security of the ,united 
,states that arises as a result of the  
covered transaction4  7,c7 ,covered     
transaction described ,a covered        
transaction described in this           
subparagraph is a transaction that could
 result in foreign control of a ,united 
,states company--  7i7 that collects1   
sells1 buys1 or processes user data 7as 
defined in section #b of the ,national  
,security and ,personal ,data           
,protection ,act of #bjai7 and whose    
business consists substantially more of 
transferring data than manufacturing1   
delivering1 repairing1 or servicing     
physical goods or providing physical    
services2 or  7ii7 that operates a      
social media platform or website4  4