,,ii  #aaf? ,,congress  #a/ ,session    
,s4 #bhhi  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,novemb] #ah1 #bjai,mr4
 ,hawley 7= himself1 ,mr4 ,cotton1 &    
,mr4 ,rubio7 introduc$ ! foll[+ bill2   
:i* 0 read twice & ref]r$ to !          
,committee on ,comm]ce1 ,sci5ce1 &      
,transportation  ,a ,,bill  ,to safegu>d
 data ( ,am]icans f =eign gov]nm5ts t   
pose risks to national security by      
impos+ data security requirem5ts &      
/r5g!n+ review ( =eign inve/m5ts1 & =   
o!r purposes4  #a4 ,%ort title ,?is ,act
 may be cit$ z ! ,national ,security &  
,p]sonal ,data ,protection ,act ( #bjai4
  #b4 ,def9itions ,9 ?is ,act3 7#a7     
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#b7 ,c\ntry
 ( conc]n  7,a7 ,9 g5]al ,subject to    
subp>agraph 7,b77iii71 ! t]m c\ntry (   
conc]n means-- 7i7 ! ,p's ,republic (   
,*9a2  7ii7 ! ,russian ,f$]ation2 &     
7iii7 any o!r c\ntry designat$ by !     
,secret>y ( ,/ate z be+ ( conc]n )      
respect to ! protection ( data privacy &

 security4  7,b7 ,designation ( c\ntries
 ( conc]n ,n lat] ?an #a ye> aft] ! date
 ( enactm5t ( ?is ,act1 & annually      
!reaft]1 ! ,secret>y ( ,/ate %all--  7i7
 review ! /atus ( data privacy &        
security requirem5ts 7includ+ by review+
 laws1 policies1 practices1 &           
regulations relat$ to data privacy &    
security7 9 ea* =eign c\ntry to         
det]m9e--  7,i7 :e!r x w\ld pose a      
sub/antial risk to ! national security (
 ! ,unit$ ,/ates if ! gov]nm5t ( su*    
c\ntry ga9$ access to ! us] data (      
citiz5s & resid5ts ( ! ,unit$ ,/ates2 & 
7,,ii7 :e!r !re is a sub/antial risk t !
 gov]nm5t ( su* c\ntry w1 9 a mann] t   
fails to af=d simil> respect = civil    
lib]ties & privacy z ! ,con/itution &   
laws ( ! ,unit$ ,/ates1 obta9 us] data f
 companies t collect us] data2  7ii7    
designate ea* c\ntry t meets ! crit]ia (
 clause 7i7 z a c\ntry ( conc]n2 &      
7iii7 remove ! designation f any c\ntry 
t 0 previ\sly designat$ a c\ntry (      
conc]n 7reg>dless ( :e!r su* designation

 0 pursuant to clause 7i7 or 7ii7 (     
subp>agraph 7,a7 or 0 made by !         
,secret>y ( ,/ate pursuant to clause    
7iii7 ( su* subp>agraph7 if ! c\ntry--  
7,i7 no long] meets ! crit]ia ( clause  
7i72 &  7,,ii7 is n at sub/antial risk (
 meet+ su* crit]ia4  7,c7 ,regulations  
,n lat] ?an #ij days aft] ! date ( !    
enactm5t ( ?is ,act1 ! ,secret>y ( ,/ate
 %all prescribe regulations--  7i7      
e/abli%+ a process = a cov]$ te*nology  
company or c\ntry ( conc]n to petition !
 ,secret>y to remove ! c\ntry ( conc]n  
designation f a c\ntry t 0 designat$ z  
su* pursuant to subp>agraph 7,b77ii72 & 
7ii7 sett+ =? ! proc$ures & crit]ia !   
,secret>y w use 9 id5tify+ or remov+    
c\ntries "u subp>agraphs 7,a77iii7 or   
7,b77iii74  7#c7 ,cov]$ te*nology       
company ,! t]m cov]$ te*nology company  
means an entity t provides an onl9e     
data-bas$ s]vice su* z a website or     
int]net application 9 or affect+        
int]/ate or =eign comm]ce &--  7,a7 is  
organiz$ "u ! laws ( a c\ntry ( conc]n2 

7,b7 9 :i* =eign p]sons t are nationals 
(1 or companies t are organiz$ "u ! laws
 (1 c\ntries ( conc]n h a plurality or  
controll+ equity int]e/2  7,c7 is a     
subsidi>y company ( an entity describ$ 9
 subp>agraph 7,a7 or 7,b72 or  7,d7 is  
o!rwise subject to ! jurisdiction ( a   
c\ntry ( conc]n 9 a mann] t all[s !     
c\ntry ( conc]n to obta9 ! us] data (   
citiz5s & resid5ts ( ! ,unit$ ,/ates )\t
 simil> respect = civil lib]ties &      
privacy z provid$ "u ! ,con/itution &   
laws ( ! ,unit$ ,/ates4  7#d7 ,facial   
recognition te*nology ,! t]m facial     
recognition te*nology means te*nology t 
analyzes facial features 9 /ill or video
 images & is us$ to id5tify1 or         
facilitate id5tification (1 an          
individual us+ facial physical          
*>act]i/ics4  7#e7 ,t>get$ adv]tis+     
7,a7 ,9 g5]al ,! t]m t>get$ adv]tis+    
means a =m ( adv]tis+ :]e adv]tisem5ts  
are display$ to a us] bas$ on ! us]'s   
traits1 in=mation f a pr(ile ab\t ! us] 
t is creat$ = ! purpose ( sell+         

adv]tisem5ts1 or ! us]'s previ\s onl9e  
or (fl9e behavior4  7,b7 ,limitation    
,su* t]m %all n include adv]tis+ *os5   
because ( ! context ( ! int]net s]vice1 
su* z--  7i7 adv]tis+ t is direct$ to a 
us] bas$ on ! cont5t ( ! website1 onl9e 
s]vice1 onl9e application1 or mobile    
application t ! us] is connect$ to2 or  
7ii7 adv]tis+ t is direct$ to a us] by !
 op]ator ( a website1 onl9e s]vice1     
onl9e application1 or mobile application
 bas$ on ! se>* t]ms t ! us] us$ to     
arrive at su* website1 s]vice1 or       
application4  7#f7 ,us] data ,! t]m us] 
data means any in=mation obta9$ by an   
entity t provides a data-bas$ s]vice su*
 z a website or int]net application t   
id5tifies1 relates to1 describes1 is    
capable ( be+ associat$ )1 or c\ld      
reasonably be l9k$ ) an individual :o is
 a citiz5 or resid5t ( ! ,unit$ ,/ates  
)\t reg>d to :e!r su* in=mation is      
directly submitt$ by ! individual to !  
entity1 is d]iv$ by ! entity f ! obs]v$ 
activity ( ! individual1 or is obta9$ by

 ! entity by any o!r means4  #c4 ,data  
security requirem5ts = cov]$ te*nology  
companies  7a7 ,9 g5]al ,! foll[+       
requirem5ts %all apply to a cov]$       
te*nology company3 7#a7 ,m9imal         
collection ( data ,! company %all n     
collect any m us] data ?an is necess>y =
 ! op]ation ( ! website1 s]vice1 or     
application ( ! company4  7#b7          
,prohibition on second>y uses ,! company
 %all n use any us] data collect$ "u    
p>agraph 7#a7 = any purpose t is        
second>y to ! op]ation ( ! website1     
s]vice1 or application ( ! company1     
includ+ provid+ t>get$ adv]tis+1        
unnecess>ily %>+ su* data ) a ?ird p>ty1
 or unnecess>ily facilitat+ facial      
recognition te*nology4  7#c7 ,"r to view
 & delete data ,! company %all all[ an  
individual to-- 7,a7 view any us] data  
held by ! company t relates to !        
individual2 &  7,b7 p]man5tly delete any
 us] data held by ! company t has be5   
collect$1 directly or indirectly1 f !   
individual4  7#d7 ,prohibition on       

transf] to c\ntries ( conc]n ,! company 
%all n transf] any us] data or in=mation
 ne$$ to deciph] t data1 su* z          
encryption keys1 to any c\ntry ( conc]n 
7includ+ indirectly ?r\gh a ?ird c\ntry 
t is n a c\ntry ( conc]n74  7#e7 ,data  
/orage requirem5t ,! company %all n /ore
 any us] data collect$ f citiz5s or     
resid5ts ( ! ,unit$ ,/ates or in=mation 
ne$$ to deciph] t data1 su* z encryption
 keys1 on a s]v] or o!r data /orage     
device t is locat$ outside ( ! ,unit$   
,/ates or a c\ntry t ma9ta9s an agreem5t
 ) ! ,unit$ ,/ates to %>e data ) law    
en=cem5t ag5cies ?r\gh a process        
e/abli%$ by law4  7#f7 ,report+         
requirem5t ,n less frequ5tly ?an        
annually1 ! *ief executive (fic] or     
equival5t (fic] ( ! company %all submit1
 "u p5alty ( p]jury1 a report to !      
,commission1 ! ,attorney ,g5]al ( !     
,unit$ ,/ates1 & ! ,attorney ,g5]al (   
ea* ,/ate c]tify+ compliance ) !        
requirem5ts ( ?is section4  7b7         
,exceptions  7#a7 ,exception = law      

en=cem5t & milit>y ,! requirem5ts (     
p>agraphs 7#a7 ?r\gh 7#d7 ( subsection  
7a7 %all n apply :]e data is collect$1  
us$1 reta9$1 /or$1 or %>$ by a cov]$    
te*nology company solely = ! purpose (  
assi/+ a law en=cem5t or milit>y ag5cy t
 is n affiliat$ ) a c\ntry ( conc]n4    
7#b7 ,transf] ( %>$ cont5t ,!           
requirem5ts ( p>agraph 7#d7 & 7#e7 (    
subsection 7a7 %all n apply to us] data 
t is cont5t produc$ by a us] = ! purpose
 ( %>+ ) o!r us]s 7su* z social m$ia    
po/s1 emails1 or data relat$ to a       
transaction involv+ ! us]7 or in=mation 
ne$$ to deciph] t data provid$ t !      
transf] & any /orage necess>y to enact !
 transf] is conduct$ solely to c>ry out 
! us]'s int5t to %>e su* data )         
individual us]s 9 o!r c\ntries & t      
necess>y /orage occurs only on ! int5d$ 
recipi5t's individual device4  7c7      
,effective date ,! requirem5ts ( ?is    
section %all take effect #ij days aft] !
 date ( enactm5t ( ?is ,act4  #d4 ,data 
security requirem5ts = o!r te*nology    

companies  7a7 ,9 g5]al ,! foll[+       
requirem5ts %all apply to any company   
op]at+ 9 or affect+ int]/ate or =eign   
comm]ce t provides a data-bas$ s]vice   
su* z a website or int]net application b
 is n a cov]$ te*nology company3  7#a7  
,prohibition on transf] to c\ntries (   
conc]n ,! company %all n transf] any us]
 data collect$ f an individual 9 !      
,unit$ ,/ates or in=mation ne$$ to      
deciph] t data1 su* z encryption keys1  
to any c\ntry ( conc]n 7includ+         
indirectly ?r\gh a ?ird c\ntry t is n a 
c\ntry ( conc]n74  7#b7 ,prohibition on 
/or+ data 9 c\ntries ( conc]n ,! company
 %all n /ore any us] data collect$ f an 
individual 9 ! ,unit$ ,/ates or         
in=mation ne$$ to deciph] t data1 su* z 
encryption keys1 on a s]v] or o!r data  
/orage device t is locat$ 9 any c\ntry (
 conc]n4  7b7 ,exceptions  7#a7         
,exception = law en=cem5t & milit>y ,!  
requirem5ts ( subsection 7a7 %all n     
apply :]e data is collect$1 us$1 reta9$1
 /or$1 or %>$ by a cov]$ te*nology      

company solely = ! purpose ( assi/+ a   
law en=cem5t or milit>y ag5cy t is n    
affiliat$ ) a c\ntry ( conc]n4  7#b7    
,transf] ( %>$ cont5t ,! requirem5ts (  
subsection 7a7 %all n apply to us] data 
t is cont5t produc$ by a us] = ! purpose
 ( %>+ ) o!r us]s 7su* z social m$ia    
po/s1 emails1 or data relat$ to a       
transaction involv+ ! us]7 or in=mation 
ne$$ to deciph] t data provid$ t !      
transf] & any /orage necess>y to enact !
 transf] is conduct$ solely to c>ry out 
! us]'s int5t to %>e su* data )         
individual us]s 9 o!r c\ntries & t      
necess>y /orage occurs only on ! int5d$ 
recipi5t's individual device4  7c7      
,effective date ,! requirem5ts ( ?is    
section %all take effect #ij days aft] !
 date ( enactm5t ( ?is ,act4  #e4       
,en=cem5t ( data security requirem5ts   
7a7 ,en=cem5t by ! ,commission  7#a7 ,9 
g5]al ,except z o!rwise provid$1        
sections #c & #d %all be en=c$ by !     
,commission "u ! ,f$]al ,trade          
,commission ,act 7#ae ,u4,s4,c4 #da et  

seq474  7#b7 ,unfair or deceptive acts  
or practices ,a violation ( section #c  
or #d %all be treat$ z a violation ( a  
rule def9+ an unfair or deceptive act or
 practice prescrib$ "u section          
#ah7;a77#a77;,b7 ( ! ,f$]al ,trade      
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77#a77;,b774  7#c7 ,actions by ! 
,commission ,except z o!rwise provid$1 !
 ,commission %all prev5t any p]son f    
violat+ section #c or #d 9 ! same mann]1
 by ! same means1 & ) ! same            
jurisdiction1 p[]s1 & duties z ?\gh all 
applicable t]ms & provisions ( ! ,f$]al 
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq47 7 incorporat$ into & made a
 "p ( ?is ,act1 & any p]son :o violates 
su* section %all be subject to !        
p5alties & entitl$ to ! privileges &    
immunities provid$ 9 ! ,f$]al ,trade    
,commission ,act4  7#d7 ,au?ority       
pres]v$ ,no?+ 9 ?is ,act %all be con/ru$
 to limit ! au?ority ( ! ,commission "u 
any o!r provision ( law4  7b7 ,crim9al  
p5alty  7#a7 ,(f5se ,x %all be unlawful 

to kn[+ly cause a te*nology company to  
violate a requirem5t ( section #c or #d4
  7#b7 ,p5alty ,any p]son :o violates   
p>agraph 7#a7 %all be imprison$ = n m   
?an #e ye>s1 f9$ "u title #ah1 ,unit$   
,/ates ,code1 or bo?4  7c7 ,en=cem5t by 
,/ate attorneys g5]al  7#a7 ,9 g5]al    
7,a7 ,civil actions ,9 any case 9 :i* ! 
attorney g5]al ( a ,/ate has reason to  
believe t an int]e/ ( ! resid5ts ( t    
,/ate has be5 or is ?reat5$ or adv]sely 
affect$ by ! engagem5t ( any p]son 9 a  
practice t violates section #c or #d1 ! 
,/ate1 z p>5s patriae1 may br+ a civil  
action on behalf ( ! resid5ts ( ! ,/ate 
9 a di/rict c\rt ( ! ,unit$ ,/ates or a 
,/ate c\rt ( appropriate jurisdiction   
to--  7i7 enjo9 t practice2  7ii7 en=ce 
compliance ) su* section2  7iii7 on     
behalf ( resid5ts ( ! ,/ate1 obta9      
damages1 /atutory damages1 re/itution1  
or o!r comp5sation1 ea* ( :i* %all be   
di/ribut$ 9 accordance ) ,/ate law2 or  
7iv7 obta9 su* o!r relief z ! c\rt may  
consid] to be appropriate4  7,b7 ,notice

  7i7 ,9 g5]al ,be=e fil+ an action "u  
subp>agraph 7,a71 ! attorney g5]al ( !  
,/ate involv$ %all provide to !         
,commission--  7,i7 writt5 notice ( t   
action2 &  7,,ii7 a copy ( ! compla9t = 
t action4  7ii7 ,exemption  7,i7 ,9     
g5]al ,clause 7i7 %all n apply ) respect
 to ! fil+ ( an action by an attorney   
g5]al ( a ,/ate "u ?is p>agraph if !    
attorney g5]al ( ! ,/ate det]m9es t x is
 n feasible to provide ! notice describ$
 9 t clause be=e ! fil+ ( ! action4     
7,,ii7 ,notification ,9 an action       
describ$ 9 subclause 7,i71 ! attorney   
g5]al ( a ,/ate %all provide notice & a 
copy ( ! compla9t to ! ,commission at ! 
same "t z ! attorney g5]al files !      
action4  7#b7 ,int]v5tion  7,a7 ,9 g5]al
 ,on receiv+ notice "u p>agraph         
7#a77;,b71 ! ,commission %all h ! "r to 
int]v5e 9 ! action t is ! subject ( !   
notice4  7,b7 ,effect ( int]v5tion ,if !
 ,commission int]v5es 9 an action "u    
p>agraph 7#a71 x %all h ! "r-- 7i7 to be
 he>d ) respect to any matt] t arises 9 

t action2 &  7ii7 to file a petition =  
appeal4  7#c7 ,con/ruction ,= purposes (
 br++ any civil action "u p>agraph 7#a71
 no?+ 9 ?is ,act %all be con/ru$ to     
prev5t an attorney g5]al ( a ,/ate f    
ex]cis+ ! p[]s conf]r$ on ! attorney    
g5]al by ! laws ( t ,/ate to--  7,a7    
conduct inve/igations2  7,b7 adm9i/]    
oa?s or affirmations2 or  7,c7 compel ! 
att5dance ( witnesses or ! production ( 
docum5t>y & o!r evid5ce4  7#d7 ,actions 
by ! ,commission ,9 any case 9 :i* an   
action is in/itut$ by or on behalf ( !  
,commission = violation ( section #c or 
#d1 no ,/ate may1 dur+ ! p5d5cy ( t     
action1 in/itute an action "u p>agraph  
7#a7 aga9/ any def5dant nam$ 9 !        
compla9t 9 ! action in/itut$ by or on   
behalf ( ! ,commission = t violation4   
7#e7 ,v5ue2 s]vice ( process  7,a7 ,v5ue
 ,any action br\ght "u p>agraph 7#a7 may
 be br\ght 9-- 7i7 ! di/rict c\rt ( !   
,unit$ ,/ates t meets applicable        
requirem5ts relat+ to v5ue "u section   
#acia ( title #bh1 ,unit$ ,/ates ,code2 

or  7ii7 a ,/ate c\rt ( compet5t        
jurisdiction4  7,b7 ,s]vice ( process ,9
 an action br\ght "u p>agraph 7#a7 9 a  
di/rict c\rt ( ! ,unit$ ,/ates1 process 
may be s]v$ :]ev] def5dant--  7i7 is an 
inhabitant2 or  7ii7 may be f\nd4  7d7  
,private "r ( action  7#a7 ,9 g5]al ,any
 individual :o suff]s injury z a result 
( an act1 practice1 or omission ( a     
cov]$ te*nology company t violates      
section #c may br+ a civil action aga9/ 
su* company 9 any c\rt ( compet5t       
jurisdiction4  7#b7 ,relief ,9 a civil  
action br\ght "u p>agraph 7#a7 9 :i* !  
pla9tiff prevails1 ! c\rt may aw>d su*  
pla9tiff up to #a1jjj = ea* day t su*   
pla9tiff 0 affect$ by a violation (     
section #c 7up to a maximum ( #ae1jjj p]
 ea* su* violation p] pla9tiff74  #f4   
,requirem5t = approval ( ,committee on  
,=eign ,inve/m5t 9 ! ,unit$ ,/ates (    
c]ta9 transactions ,section #gba7;b7 ( !
 ,def5se ,production ,act ( #aiej 7#ej  
,u4,s4,c4 #defe7;b77 is am5d$ by add+ at
 ! end ! foll[+3  7#i7 ,approval requir$

 = c]ta9 transactions  7,a7 ,9 g5]al ,a 
cov]$ transaction describ$ 9 subp>agraph
 7,c7 is prohibit$ unless ! ,committee--
 7i7 reviews ! transaction "u ?is       
subsection2 &  7ii7 det]m9es t !        
transaction does n pose a risk to !     
national security ( ! ,unit$ ,/ates4    
7,b7 ,mitigation ,! ,committee1 or a    
lead ag5cy on behalf ( ! ,committee1 may
 negotiate1 ent] into or impose1 & en=ce
 an agreem5t or condition "u subsection 
7l77#c7 ) any p>ty to a cov]$           
transaction describ$ 9 subp>agraph 7,c7 
to mitigate any risk to ! national      
security ( ! ,unit$ ,/ates t arises z a 
result ( ! cov]$ transaction4  7,c7     
,cov]$ transaction describ$ ,a cov]$    
transaction describ$ 9 ?is subp>agraph  
is a transaction t c\ld result 9 =eign  
control ( a ,unit$ ,/ates company--  7i7
 t collects1 sells1 buys1 or processes  
us] data 7z def9$ 9 section #b ( !      
,national ,security & ,p]sonal ,data    
,protection ,act ( #bjai7 & ^: bus9ess  
consi/s sub/antially m ( transf]r+ data 

?an manufactur+1 deliv]+1 repair+1 or   
s]vic+ physical goods or provid+        
physical s]vices2 or  7ii7 t op]ates a  
social m$ia plat=m or website4  4