,,ii #aagth ,,congress #b;d ,session ,s4 #ddie ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #bc1 #bjbb,mr4 ,wyden 7for himself1 ,ms4 ,lummis1 ,mr4 ,whitehouse1 ,mr4 ,rubio1 and ,mr4 ,hagerty7 introduced the following bill2 which was read twice and referred to the ,committee on ,banking1 ,housing1 and ,urban ,affairs ,a ,,bill ,to amend the ,export ,control ,reform ,act of #bjah to require export controls with respect to certain personal data of ,united ,states nationals and individuals in the ,united ,states1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,protecting ,americans' ,data ,from ,foreign ,surveillance ,act of #bjbb4 #b4 ,sense of ,congress ,it is the sense of ,congress that-- 7#a7 accelerating technological trends have made sensitive personal data an especially valuable input to activities that adversaries of the ,united ,states undertake to threaten both the national security of the ,united ,states and the individual privacy that the people of the ,united ,states cherish2 7#b7 it is therefore essential to the safety of the ,united ,states and the people of the ,united ,states to ensure that the ,united ,states ,government makes every effort to prevent sensitive personal data from falling into the hands of malign foreign actors2 and 7#c7 because allies of the ,united ,states face similar challenges1 in implementing this ,act1 the ,united ,states ,government should explore the establishment of a shared zone of mutual trust with respect to sensitive personal data4 #c4 ,requirement to control the export of certain personal data of ,united ,states nationals and individuals in the ,united ,states 7a7 ,in general ,part ,i of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhaa et seq47 is amended by inserting after section #ageh the following3 #ageh;,a4 ,requirement to control the export of certain personal data of ,united ,states nationals and individuals in the ,united ,states 7a7 ,identification of categories of personal data 7#a7 ,in general ,the ,secretary shall1 in coordination with the heads of the appropriate ,federal agencies1 identify categories of personal data of covered individuals that could-- 7,a7 be exploited by foreign governments2 and 7,b7 if exported1 reexported1 or in-country transferred in a quantity that exceeds the threshold established under paragraph 7#c71 harm the national security of the ,united ,states4 7#b7 ,list required ,in identifying categories of personal data of covered individuals under paragraph 7#a71 the ,secretary1 in coordination with the heads of the appropriate ,federal agencies1 shall-- 7,a7 identify an initial list of such categories not later than one year after the date of the enactment of the ,protecting ,americans' ,data ,from ,foreign ,surveillance ,act of #bjbb2 and 7,b7 as appropriate thereafter and not less frequently than every #e years1 add categories to1 remove categories from1 or modify categories on1 that list4 7#c7 ,establishment of threshold 7,a7 ,establishment ,not later than one year after the date of the enactment of the ,protecting ,americans' ,data ,from ,foreign ,surveillance ,act of #bjbb1 the ,secretary1 in coordination with the heads of the appropriate ,federal agencies1 shall establish a threshold for determining when the export1 reexport1 or in-country transfer 7in the aggregate7 of the personal data of covered individuals by one person to or in a restricted country could harm the national security of the ,united ,states4 7,b7 ,number of covered individuals affected ,the threshold established under subparagraph 7,a7 shall be the export1 reexport1 or in-country transfer 7in the aggregate7 by one person to or in a restricted country during a calendar year of the personal data of not less than #aj1jjj covered individuals and not more than #a1jjj1jjj covered individuals4 7,c7 ,category thresholds ,the ,secretary1 in coordination with the heads of the appropriate ,federal agencies1 may establish a threshold under subparagraph 7,a7 for each category of personal data identified under paragraph 7#a74 7,d7 ,updates ,the ,secretary1 in coordination with the heads of the appropriate ,federal agencies-- 7i7 may update the threshold established under subparagraph 7,a7 as appropriate2 and 7ii7 shall reevaluate the threshold not less frequently than every #e years4 7,e7 ,treatment of persons under common ownership as one person ,for purposes of determining whether a threshold established under subparagraph 7,a7 has been met-- 7i7 all exports1 reexports1 or in-country transfers involving personal data conducted by persons under the ownership or control of the same person shall be aggregated to that person2 and 7ii7 that person shall be liable for any export1 reexport1 or in-country transfer in violation of this section4 7,f7 ,considerations ,in establishing a threshold under subparagraph 7,a71 the ,secretary1 in coordination with the heads of the appropriate ,federal agencies1 shall seek to balance the need to protect personal data from exploitation by foreign governments against the likelihood of-- 7i7 impacting legitimate business activities1 research activities1 and other activities that do not harm the national security of the ,united ,states2 or 7ii7 chilling speech protected by the ,first ,amendment to the ,constitution of the ,united ,states4 7#d7 ,determination of period for protection ,the ,secretary1 in coordination with the heads of the appropriate ,federal agencies1 shall determine1 for each category of personal data identified under paragraph 7#a71 the period of time for which encryption technology described in subsection 7b77#d77;,a77iii7 is required to be able to protect that category of data from decryption to prevent the exploitation of the data by a foreign government from harming the national security of the ,united ,states4 7#e7 ,use of information2 considerations ,in carrying out this subsection 7including with respect to the list required under paragraph 7#b771 the ,secretary1 in coordination with the heads of the appropriate ,federal agencies1 shall-- 7,a7 use multiple sources of information1 including-- 7i7 publicly available information2 7ii7 classified information1 including relevant information provided by the ,director of ,national ,intelligence2 7iii7 information relating to reviews and investigations of transactions by the ,committee on ,foreign ,investment in the ,united ,states under section #gba of the ,defense ,production ,act of #aiej 7#ej ,u4,s4,c4 #defe72 7iv7 the categories of sensitive personal data described in paragraphs 7#a77;ii7 and 7#b7 of section #hjj4bda7;a7 of title #ca1 ,code of ,federal ,regulations1 as in effect on the day before the date of the enactment of the ,protecting ,americans' ,data ,from ,foreign ,surveillance ,act of #bjbb1 and any categories of sensitive personal data added to such section after such date of enactment2 7v7 information provided by the advisory committee established pursuant to paragraph 7#g72 and 7vi7 the recommendations 7which the ,secretary shall request7 of-- 7,i7 privacy experts identified by the ,national ,academy of ,sciences2 and 7,,ii7 experts on the ,first ,amendment to the ,constitution of the ,united ,states identified by the ,american ,bar ,association2 and 7,b7 take into account-- 7i7 the significant quantity of personal data of covered individuals that has already been stolen or acquired by foreign governments2 7ii7 the harm to ,united ,states national security caused by the theft or acquisition of that personal data2 7iii7 the potential for further harm to ,united ,states national security if that personal data were combined with additional sources of personal data2 7iv7 the fact that non-sensitive personal data1 when analyzed in the aggregate1 can reveal sensitive personal data2 and 7v7 the commercial availability of inferred and derived data4 7#f7 ,notice and comment period ,the ,secretary shall provide for a public notice and comment period after the publication in the ,federal ,register of a proposed rule1 and before the publication of a final rule-- 7,a7 identifying the initial list of categories of personal data under subparagraph 7,a7 of paragraph 7#b72 7,b7 adding categories to1 removing categories from1 or modifying categories on1 that list under subparagraph 7,b7 of that paragraph2 7,c7 establishing or updating the threshold under paragraph 7#c72 or 7,d7 setting forth the period of time for which encryption technology described in subsection 7b77#d77;,a77iii7 is required under paragraph 7#d7 to be able to protect such a category of data from decryption4 7#g7 ,advisory committee 7,a7 ,in general ,the ,secretary shall establish an advisory committee to advise the ,secretary with respect to privacy and sensitive personal data4 7,b7 ,membership ,the committee established pursuant to subparagraph 7,a7 shall include the following members selected by the ,secretary3 7i7 ,experts on privacy and cybersecurity4 7ii7 ,representatives of private sector companies and industry associations4 7iii7 ,representatives of civil society groups4 7,c7 ,applicability of ,federal advisory committee ,act ,subsections 7a77#a71 7a77#c71 and 7b7 of section #aj and sections #aa1 #ac1 and #ad of the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 shall not apply to the advisory committee established pursuant to subparagraph 7,a74 7#h7 ,treatment of anonymized personal data 7,a7 ,in general ,in carrying out this subsection1 the ,secretary may not treat anonymized personal data differently than identifiable personal data if the individuals to which the anonymized personal data relates could reasonably be identified using other sources of data4 7,b7 ,guidance ,the ,under ,secretary of ,commerce for ,standards and ,technology shall issue guidance to the public with respect to methods for anonymizing data and how to determine if individuals to which the anonymized personal data relates can be reasonably identified using other sources of data4 7#i7 ,sense of ,congress on identification of categories of personal data ,it is the sense of ,congress that1 in identifying categories of personal data of covered individuals under paragraph 7#a71 the ,secretary should1 to the extent reasonably possible and in coordination with the ,secretary of the ,treasury1 harmonize those categories with the categories of sensitive personal data described in paragraph 7#e77;,a77iv74 7b7 ,commerce controls 7#a7 ,controls required ,beginning #ah months after the date of the enactment of the ,protecting ,americans' ,data ,from ,foreign ,surveillance ,act of #bjbb1 the ,secretary shall impose appropriate controls under the ,export ,administration ,regulations on the export or reexport to1 or in-country transfer in1 all countries 7other than countries on the list required by paragraph 7#b77;,d77 of covered personal data in a manner that exceeds the applicable threshold established under subsection 7a77#c71 including through interim controls 7such as by informing a person that a license is required for export1 reexport1 or in-country transfer of covered personal data71 as appropriate1 or by publishing additional regulations4 7#b7 ,levels of control 7,a7 ,in general ,except as provided in subparagraph 7,c7 or 7,d71 the ,secretary shall-- 7i7 require a license or other authorization for the export1 reexport1 or in-country transfer of covered personal data in a manner that exceeds the applicable threshold established under subsection 7a77#c72 7ii7 determine whether that export1 reexport1 or in-country transfer is likely to harm the national security of the ,united ,states-- 7,i7 after consideration of the matters described in subparagraph 7,b72 and 7,,ii7 in coordination with the heads of the appropriate ,federal agencies2 and 7iii7 if the ,secretary determines under clause 7ii7 that the export1 reexport1 or in-country transfer is likely to harm the national security of the ,united ,states1 deny the application for the license or other authorization for the export1 reexport1 or in-country transfer4 7,b7 ,considerations ,in determining under clause 7ii7 of subparagraph 7,a7 whether an export1 reexport1 or in-country transfer of covered personal data described in clause 7i7 of that subparagraph is likely to harm the national security of the ,united ,states1 the ,secretary1 in coordination with the heads of the appropriate ,federal agencies1 shall take into account-- 7i7 the adequacy and enforcement of data protection1 surveillance1 and export control laws in the foreign country to which the covered personal data would be exported or reexported1 or in which the covered personal data would be transferred1 in order to determine whether such laws1 and the enforcement of such laws1 are sufficient to-- 7,i7 protect the covered personal data from accidental loss1 theft1 and unauthorized or unlawful processing2 7,,ii7 ensure that the covered personal data is not exploited for intelligence purposes by foreign governments to the detriment of the national security of the ,united ,states2 and 7,,iii7 prevent the reexport of the covered personal data to a third country for which a license would be required for such data to be exported directly from the ,united ,states2 7ii7 the circumstances under which the government of the foreign country can compel1 coerce1 or pay a person in or national of that country to disclose the covered personal data2 and 7iii7 whether that government has conducted hostile foreign intelligence operations1 including information operations1 against the ,united ,states4 7,c7 ,license requirement and presumption of denial for certain countries 7i7 ,in general ,the ,secretary shall-- 7,i7 require a license or other authorization for the export or reexport to1 or in-country transfer in1 a country on the list required by clause 7ii7 of covered personal data in a manner that exceeds the threshold established under subsection 7a77#c72 and 7,,ii7 deny an application for such a license or other authorization unless the person seeking the license or authorization demonstrates to the satisfaction of the ,secretary that the export1 reexport1 or in-country transfer will not harm the national security of the ,united ,states4 7ii7 ,list required 7,i7 ,in general ,not later than one year after the date of the enactment of the ,protecting ,americans' ,data ,from ,foreign ,surveillance ,act of #bjbb1 the ,secretary shall1 in consultation with the heads of the appropriate ,federal agencies and based on the considerations described in subparagraph 7,b71 establish a list of each country with respect to which the ,secretary determines that the export or reexport to1 or in-country transfer in1 the country of covered personal data in a manner that exceeds the applicable threshold established under subsection 7a77#c7 will be likely to harm the national security of the ,united ,states4 7,,ii7 ,modifications to list ,the ,secretary1 in consultation with the heads of the appropriate ,federal agencies-- 7aa7 may add a country to or remove a country from the list required by subclause 7,i7 at any time2 and 7bb7 shall review that list not less frequently than every #e years4 7,d7 ,no license requirement for certain countries 7i7 ,in general ,the ,secretary may not require a license or other authorization for the export or reexport to1 or in-country transfer in1 a country on the list required by clause 7ii7 of covered personal data1 without regard to the applicable threshold established under subsection 7a77#c74 7ii7 ,list required 7,i7 ,in general ,not later than one year after the date of the enactment of the ,protecting ,americans' ,data ,from ,foreign ,surveillance ,act of #bjbb1 the ,secretary shall1 in consultation with the heads of the appropriate ,federal agencies and based on the considerations described in subparagraph 7,b7 and subject to clause 7iii71 establish a list of each country with respect to which the ,secretary determines that the export or reexport to1 or in-country transfer in1 the country of covered personal data 7without regard to any threshold established under subsection 7a77#c77 will not harm the national security of the ,united ,states4 7,,ii7 ,modifications to list ,the ,secretary1 in consultation with the heads of the appropriate ,federal agencies-- 7aa7 may add a country to or remove a country from the list required by subclause 7,i7 at any time2 and 7bb7 shall review that list not less frequently than every #e years4 7iii7 ,congressional review 7,i7 ,in general ,the list required by clause 7ii7 and any updates to that list adding or removing countries shall take effect1 for purposes of clause 7i71 on the date that is #ahj days after the ,secretary submits to the appropriate congressional committees a proposal for the list or update unless there is enacted into law1 before that date1 a joint resolution of disapproval pursuant to subclause 7,,ii74 7,,ii7 ,joint resolution of disapproval 7aa7 ,joint resolution of disapproval defined ,in this clause1 the term joint resolution of disapproval means a joint resolution the matter after the resolving clause of which is as follows3 ,that ,congress does not approve of the proposal of the ,secretary with respect to the list required by section #ageh;,a7b77#b77;,d77ii7 submitted to ,congress on 41 with the blank space being filled with the appropriate date4 7bb7 ,procedures ,the procedures set forth in paragraphs 7#d77;,c71 7#e71 7#f71 and 7#g7 of section #bebc7;d7 of title #ah1 ,united ,states ,code1 apply with respect to a joint resolution of disapproval under this clause to the same extent and in the same manner as such procedures apply to a joint resolution of disapproval under such section #bebc7;d71 except that paragraph 7#f7 of such section shall be applied and administered by substituting the ,committee on ,banking1 ,housing1 and ,urban ,affairs for the ,committee on the ,judiciary each place it appears4 7,,iii7 ,rules of house of representatives and senate ,this clause is enacted by ,congress-- 7aa7 as an exercise of the rulemaking power of the ,senate and the ,house of ,representatives1 respectively1 and as such is deemed a part of the rules of each ,house1 respectively1 and supersedes other rules only to the extent that it is inconsistent with such rules2 and 7bb7 with full recognition of the constitutional right of either ,house to change the rules 7so far as relating to the procedure of that ,house7 at any time1 in the same manner1 and to the same extent as in the case of any other rule of that ,house4 7#c7 ,review of license applications 7,a7 ,in general ,the ,secretary shall1 consistent with the provisions of section #agef and in coordination with the heads of the appropriate ,federal agencies-- 7i7 review applications for a license or other authorization for the export or reexport to1 or in-country transfer in1 a restricted country of covered personal data in a manner that exceeds the applicable threshold established under subsection 7a77#c72 and 7ii7 establish procedures for conducting the review of such applications4 7,b7 ,disclosures relating to collaborative arrangements ,in the case of an application for a license or other authorization for an export1 reexport1 or in-country transfer described in subparagraph 7,a77i7 submitted by or on behalf of a joint venture1 joint development agreement1 or similar collaborative arrangement1 the ,secretary may require the applicant to identify1 in addition to any foreign person participating in the arrangement1 any foreign person with significant ownership interest in a foreign person participating in the arrangement4 7#d7 ,exceptions 7,a7 ,in general ,the ,secretary shall not impose under paragraph 7#a7 a requirement for a license or other authorization with respect to the export1 reexport1 or in-country transfer of covered personal data pursuant to any of the following transactions3 7i7 ,the export1 reexport1 or in-country transfer by an individual of covered personal data that specifically pertains to that individual4 7ii7 ,the export1 reexport1 or in-country transfer of the personal data of one or more individuals by a person performing a service for those individuals if the service could not possibly be performed 7as defined by the ,secretary in regulations7 without the export1 reexport1 or in-country transfer of that personal data4 7iii7 ,the export1 reexport1 or in-country transfer of personal data that is encrypted if-- 7,i7 the encryption key or other information necessary to decrypt the data is not exported1 reexported1 or transferred to a restricted country or 7except as provided in subparagraph 7,b77 a national of a restricted country2 and 7,,ii7 the encryption technology used to protect the data against decryption is certified by the ,national ,institute of ,standards and ,technology as capable of protecting data for the period of time determined under subsection 7a77#d7 to be sufficient to prevent the exploitation of the data by a foreign government from harming the national security of the ,united ,states4 7iv7 ,the export1 reexport1 or in-country transfer of personal data that is ordered by an appropriate court of the ,united ,states4 7,b7 ,exception for certain nationals of restricted countries ,subparagraph 7,a77iii77,i7 does not apply with respect to an individual who is a national of a restricted country if the individual is also a citizen of the ,united ,states or a noncitizen described in subsection 7k77#e77;,c74 7c7 ,requirements for identification of categories and determination of appropriate controls ,in identifying categories of personal data under subsection 7a77#a7 and imposing appropriate controls under subsection 7b71 the ,secretary1 in coordination with the heads of the appropriate ,federal agencies1 as appropriate-- 7#a7 may not regulate or restrict the publication or sharing of-- 7,a7 personal data that is a matter of public record1 such as a court record or other government record that is generally available to the public1 including information about an individual made public by that individual or by the news media2 7,b7 information about a matter of public interest2 or 7,c7 consistent with the goal of protecting the national security of the ,united ,states1 any other information the publication of which is protected by the ,first ,amendment to the ,constitution of the ,united ,states2 and 7#b7 shall consult with the appropriate congressional committees4 7d7 ,penalties 7#a7 ,liable persons 7,a7 ,in general ,in addition to any person that commits an unlawful act described in subsection 7a7 of section #agfj1 an officer or employee of an organization has committed an unlawful act subject to penalties under that section if the officer or employee knew or should have known that another employee of the organization who reports1 directly or indirectly1 to the officer or employee was directed to export1 reexport1 or in-country transfer covered personal data in violation of this section and subsequently did export1 reexport1 or in-country transfer such data4 7,b7 ,exceptions and clarifications 7i7 ,intermediaries not liable ,an intermediate consignee 7as defined in section #ggb4a of the ,export ,administration ,regulations 7or any successor regulation77 or other intermediary is not liable for the export1 reexport1 or in-country transfer of covered personal data in violation of this section when acting as an intermediate consignee or other intermediary for another person4 7ii7 ,special rule for certain applications ,in a case in which an application installed on an electronic device transmits or causes the transmission of covered personal data without being directed to do so by the owner or user of the device who installed the application1 the developer of the application1 and not the owner or user of the device1 is liable for any violation of this section4 7#b7 ,criminal penalties ,in determining an appropriate term of imprisonment under section #agfj7;b77#b7 with respect to a person for a violation of this section1 the court shall consider-- 7,a7 how many covered individuals had their covered personal data exported1 reexported1 or in-country transferred in violation of this section2 7,b7 any harm that resulted from the violation2 and 7,c7 the intent of the person in committing the violation4 7e7 ,report to ,congress 7#a7 ,in general ,not less frequently than annually1 the ,secretary1 in coordination with the heads of the appropriate ,federal agencies1 shall submit to the appropriate congressional committees a report on the results of actions taken pursuant to this section4 7#b7 ,inclusions ,each report required by paragraph 7#a7 shall include a description of the determinations made under subsection 7b77#b77;,a77ii7 during the preceding year4 7#c7 ,form ,each report required by paragraph 7#a7 shall be submitted in unclassified form but may include a classified annex4 7f7 ,disclosure of certain license information 7#a7 ,in general ,not less frequently than every #ij days1 the ,secretary shall publish on a publicly accessible website of the ,department of ,commerce1 including in a machine-readable format1 the information specified in paragraph 7#b71 with respect to each application-- 7,a7 for a license for the export or reexport to1 or in-country transfer in1 a restricted country of covered personal data in a manner that exceeds the applicable threshold established under subsection 7a77#c72 and 7,b7 with respect to which the ,secretary made a decision in the preceding #ij-;day period4 7#b7 ,information specified ,the information specified in this paragraph with respect to an application described in paragraph 7#a7 is the following3 7,a7 ,the name of the applicant4 7,b7 ,the date of the application4 7,c7 ,the name of the foreign party to which the applicant sought to export1 reexport1 or transfer the data4 7,d7 ,the categories of covered personal data the applicant sought to export1 reexport1 or transfer4 7,e7 ,the number of covered individuals whose information the applicant sought to export1 reexport1 or transfer4 7,f7 ,whether the application was approved or denied4 7g7 ,news media protections ,a person that is engaged in journalism is not subject to restrictions imposed under this section to the extent that those restrictions directly infringe on the journalism practices of that person4 7h7 ,citizenship determinations by persons providing services to end-,users not required ,this section does not require a person that provides products or services to an individual to determine the citizenship or immigration status of the individual1 but once the person becomes aware that the individual is a covered individual1 the person shall treat covered personal data of that individual as is required by this section4 7i7 ,fees 7#a7 ,in general ,notwithstanding section #agef7;c71 the ,secretary may1 to the extent provided in advance in appropriations ,acts1 assess and collect a fee1 in an amount determined by the ,secretary in regulations1 with respect to each application for a license submitted under subsection 7b74 7#b7 ,deposit and availability of fees ,notwithstanding section #ccjb of title #ca1 ,united ,states ,code1 fees collected under paragraph 7#a7 shall-- 7,a7 be credited as offsetting collections to the account providing appropriations for activities carried out under this section2 7,b7 be available1 to the extent and in the amounts provided in advance in appropriations ,acts1 to the ,secretary solely for use in carrying out activities under this section2 and 7,c7 remain available until expended4 7j7 ,regulations ,the ,secretary may prescribe such regulations as are necessary to carry out this section4 7k7 ,authorization of appropriations ,there are authorized to be appropriated to the ,secretary and to the head of each of the appropriate ,federal agencies participating in carrying out this section such sums as may be necessary to carry out this section1 including to hire additional employees with expertise in privacy4 7l7 ,definitions ,in this section3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,banking1 ,housing1 and ,urban ,affairs1 the ,committee on ,foreign ,relations1 the ,committee on ,finance1 and the ,select ,committee on ,intelligence of the ,senate2 and 7,b7 the ,committee on ,foreign ,affairs1 the ,committee on ,ways and ,means1 and the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives4 7#b7 ,appropriate ,federal agencies ,the term appropriate ,federal agencies means the following3 7,a7 ,the ,department of ,defense4 7,b7 ,the ,department of ,state4 7,c7 ,the ,department of ,justice4 7,d7 ,the ,department of the ,treasury4 7,e7 ,the ,office of the ,director of ,national ,intelligence4 7,f7 ,the ,cybersecurity and ,infrastructure ,security ,agency4 7,g7 ,the ,consumer ,financial ,protection ,bureau4 7,h7 ,the ,federal ,trade ,commission4 7,i7 ,the ,federal ,communications ,commission4 7,j7 ,the ,department of ,health and ,human ,services4 7,k7 ,such other ,federal agencies as the ,secretary considers appropriate4 7#c7 ,covered individual ,the term covered individual1 with respect to personal data1 means an individual who1 at the time the data is acquired-- 7,a7 is located in the ,united ,states2 or 7,b7 is-- 7i7 located outside the ,united ,states or whose location cannot be determined2 and 7ii7 a citizen of the ,united ,states or a noncitizen lawfully admitted for permanent residence4 7#d7 ,covered personal data ,the term covered personal data means the categories of personal data of covered individuals identified pursuant to subsection 7a74 7#e7 ,export 7,a7 ,in general ,the term export1 with respect to covered personal data1 includes-- 7i7 subject to subparagraph 7,d71 the shipment or transmission of the data out of the ,united ,states1 including the sending or taking of the data out of the ,united ,states1 in any manner1 if the shipment or transmission is intentional1 without regard to whether the shipment or transmission was intended to go out of the ,united ,states2 or 7ii7 the release or transfer of the data to any noncitizen 7other than a noncitizen described in subparagraph 7,c771 if the release or transfer is intentional1 without regard to whether the release or transfer was intended to be to a noncitizen4 7,b7 ,exceptions ,the term export does not include-- 7i7 the publication of covered personal data on the internet in a manner that makes the data discoverable by and accessible to any member of the general public2 or 7ii7 any activity protected by the speech or debate clause of the ,constitution of the ,united ,states4 7,c7 ,noncitizens described ,a noncitizen described in this subparagraph is a noncitizen who is authorized to be employed in the ,united ,states4 7,d7 ,transmissions through restricted countries 7i7 ,in general ,on and after the date that is #e years after the date of the enactment of the ,protecting ,americans' ,data ,from ,foreign ,surveillance ,act of #bjbb1 and except as provided in clause 7iii71 the term export includes the transmission of data through a restricted country1 without regard to whether the person originating the transmission had knowledge of or control over the path of the transmission4 7ii7 ,exceptions ,clause 7i7 does not apply with respect to a transmission of data through a restricted country if-- 7,i7 the data is encrypted as described in subsection 7b77#d77;,a77iii72 or 7,,ii7 the person that originated the transmission received a representation from the party delivering the data for the person stating that the data will not transit through a restricted country4 7iii7 ,false representations ,if a party delivering covered personal data as described in clause 7ii77,,ii7 transmits the data directly or indirectly through a restricted country despite making the representation described in clause 7ii77,,ii71 that party shall be liable for violating this section4 7#f7 ,in-country transfer2 reexport ,the terms in-country transfer and reexport1 with respect to personal data1 shall have the meanings given those terms in regulations prescribed by the ,secretary4 7#g7 ,lawfully admitted for permanent residence2 national ,the terms lawfully admitted for permanent residence and national have the meanings given those terms in section #aja7;a7 of the ,immigration and ,nationality ,act 7#h ,u4,s4,c4 #aaja7;a774 7#h7 ,noncitizen ,the term noncitizen means an individual who is not a citizen or national of the ,united ,states4 7#i7 ,restricted country ,the term restricted country means a country for which a license or other authorization is required under subsection 7b7 for the export or reexport to1 or in-country transfer in1 that country of covered personal data in a manner that exceeds the applicable threshold established under subsection 7a77#c74 4 7b7 ,statement of policy ,section #ageb of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhaa7 is amended-- 7#a7 in paragraph 7#a7-- 7,a7 in subparagraph 7,a71 by striking 2 and and inserting a semicolon2 7,b7 in subparagraph 7,b71 by striking the period at the end and inserting 2 and2 and 7,c7 by adding at the end the following3 7,c7 to restrict1 notwithstanding section #bjc7;b7 of the ,international ,emergency ,economic ,powers ,act 7#ej ,u4,s4,c4 #agjb7;b771 the export of personal data of ,united ,states citizens and other covered individuals 7as defined in section #ageh;,a7l77 in a quantity and a manner that could harm the national security of the ,united ,states4 2 and 7#b7 in paragraph 7#b71 by adding at the end the following3 7,h7 ,to prevent the exploitation of personal data of ,united ,states citizens and other covered individuals 7as defined in section #ageh;,a7l77 in a quantity and a manner that could harm the national security of the ,united ,states4 4 7c7 ,limitation on authority ,to make exceptions to licensing requirements ,section #aged of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhac7 is amended-- 7#a7 in subsection 7a77#ad71 by inserting and subject to subsection 7g7 after as warranted2 and 7#b7 by adding at the end the following3 7g7 ,limitation on authority ,to make exceptions to licensing requirements ,the ,secretary may create under subsection 7a77#ad7 exceptions to licensing requirements under section #ageh;,a only for the export1 reexport1 or in-country transfer of covered personal data 7as defined in subsection 7l7 of that section7 by a ,federal department or agency4 4 7d7 ,relationship to ,international ,emergency ,economic ,powers ,act ,section #aged7;b7 of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhac7;b77 is amended by inserting 7other than section #ageh;,a7 after this part4