Protecting Americans' Data From Foreign Surveillance Act of 2023

I 118TH CONGRESS 1ST SESSION H. R. 4108 To amend the Export Control Reform Act of 2018 to require export controls with respect to certain personal data of United States nationals and individuals in the United States, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JUNE 14, 2023 Mr. DAVIDSON (for himself and Ms. ESHOO) introduced the following bill; which was referred to the Committee on Foreign Affairs, and in addition to the Committee on Rules, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned A BILL To amend the Export Control Reform Act of 2018 to require export controls with respect to certain personal data of United States nationals and individuals in the United States, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Protecting Americans’ 4 Data From Foreign Surveillance Act of 2023’’. 5 SEC. 2. SENSE OF CONGRESS. 6 It is the sense of Congress that— 7 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 2 •HR 4108 IH (1) accelerating technological trends have made 1 sensitive personal data an especially valuable input 2 to activities that foreign adversaries of the United 3 States undertake to threaten both the national secu- 4 rity of the United States and the privacy that the 5 people of the United States cherish; 6 (2) it is therefore essential to the safety of the 7 United States and the people of the United States 8 to ensure that the United States Government makes 9 every effort to prevent sensitive personal data from 10 falling into the hands of malign foreign actors; and 11 (3) because allies of the United States face 12 similar challenges, in implementing this Act, the 13 United States Government should explore the estab- 14 lishment of a shared zone of mutual trust with re- 15 spect to sensitive personal data. 16 SEC. 3. REQUIREMENT TO CONTROL THE EXPORT OF CER- 17 TAIN PERSONAL DATA OF UNITED STATES 18 NATIONALS AND INDIVIDUALS IN THE 19 UNITED STATES. 20 (a) IN GENERAL.—Part I of the Export Control Re- 21 form Act of 2018 (50 U.S.C. 4811 et seq.) is amended 22 by inserting after section 1758 the following: 23 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 3 •HR 4108 IH ‘‘SEC. 1758A. REQUIREMENT TO CONTROL THE EXPORT OF 1 CERTAIN PERSONAL DATA OF UNITED 2 STATES NATIONALS AND INDIVIDUALS IN 3 THE UNITED STATES. 4 ‘‘(a) IDENTIFICATION OF CATEGORIES OF PERSONAL 5 DATA.— 6 ‘‘(1) IN GENERAL.—The Secretary shall, in co- 7 ordination with the heads of the appropriate Federal 8 agencies, identify categories of personal data of cov- 9 ered individuals that could— 10 ‘‘(A) be exploited by foreign governments 11 or foreign adversaries; and 12 ‘‘(B) if exported, reexported, or in-country 13 transferred in a quantity that exceeds the 14 threshold established under paragraph (3), 15 harm the national security of the United States. 16 ‘‘(2) LIST REQUIRED.—In identifying categories 17 of personal data of covered individuals under para- 18 graph (1), the Secretary, in coordination with the 19 heads of the appropriate Federal agencies, shall— 20 ‘‘(A) identify an initial list of such cat- 21 egories not later than one year after the date 22 of the enactment of the Protecting Americans’ 23 Data From Foreign Surveillance Act of 2023; 24 and 25 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 4 •HR 4108 IH ‘‘(B) as appropriate thereafter and not less 1 frequently than every 5 years, add categories to, 2 remove categories from, or modify categories 3 on, that list. 4 ‘‘(3) ESTABLISHMENT OF THRESHOLD.— 5 ‘‘(A) ESTABLISHMENT.—Not later than 6 one year after the date of the enactment of the 7 Protecting Americans’ Data From Foreign Sur- 8 veillance Act of 2023, the Secretary, in coordi- 9 nation with the heads of the appropriate Fed- 10 eral agencies, shall establish a threshold for de- 11 termining when the export, reexport, or in- 12 country transfer (in the aggregate) of the per- 13 sonal data of covered individuals by one person 14 to or in a restricted country could harm the na- 15 tional security of the United States. 16 ‘‘(B) NUMBER OF COVERED INDIVIDUALS 17 AFFECTED.— 18 ‘‘(i) IN GENERAL.—Except as pro- 19 vided by clause (ii), the Secretary shall es- 20 tablish the threshold under subparagraph 21 (A) so that the threshold is— 22 ‘‘(I) not lower than the export, 23 reexport, or in-country transfer (in 24 the aggregate) by one person to or in 25 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 5 •HR 4108 IH a restricted country during a calendar 1 year of the personal data of 10,000 2 covered individuals; and 3 ‘‘(II) not higher than the export, 4 reexport, or in-country transfer (in 5 the aggregate) by one person to or in 6 a restricted country during a calendar 7 year of the personal data of 1,000,000 8 covered individuals. 9 ‘‘(ii) EXPORTS BY CERTAIN FOREIGN 10 PERSONS.—In the case of a person that 11 possesses the data of more than 1,000,000 12 covered individuals, the threshold estab- 13 lished under subparagraph (A) shall be one 14 export, reexport, or in-country transfer of 15 personal data to or in a restricted country 16 by that person during a calendar year if 17 the export, reexport, or in-country transfer 18 is to— 19 ‘‘(I) the government of a re- 20 stricted country; 21 ‘‘(II) a foreign person that owns 22 or controls the person conducting the 23 export, reexport, or in-country trans- 24 fer and that person knows, or should 25 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 6 •HR 4108 IH know, that the export, reexport, or in- 1 country transfer of the personal data 2 was requested by the foreign person 3 to comply with a request from the 4 government of a restricted country; or 5 ‘‘(III) an entity on the Entity 6 List maintained by the Bureau of In- 7 dustry and Security of the Depart- 8 ment of Commerce and set forth in 9 Supplement No. 4 to part 744 of the 10 Export Administration Regulations. 11 ‘‘(C) CATEGORY THRESHOLDS.—The Sec- 12 retary, in coordination with the heads of the ap- 13 propriate Federal agencies, may establish a 14 threshold under subparagraph (A) for each cat- 15 egory (or combination of categories) of personal 16 data identified under paragraph (1). 17 ‘‘(D) UPDATES.—The Secretary, in coordi- 18 nation with the heads of the appropriate Fed- 19 eral agencies— 20 ‘‘(i) may update a threshold estab- 21 lished under subparagraph (A) as appro- 22 priate; and 23 ‘‘(ii) shall reevaluate the threshold not 24 less frequently than every 5 years. 25 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 7 •HR 4108 IH ‘‘(E) TREATMENT OF PERSONS UNDER 1 COMMON OWNERSHIP AS ONE PERSON.—For 2 purposes of determining whether a threshold es- 3 tablished under subparagraph (A) has been 4 met— 5 ‘‘(i) all exports, reexports, or in-coun- 6 try transfers involving personal data con- 7 ducted by persons under the ownership or 8 control of the same person shall be aggre- 9 gated to that person; and 10 ‘‘(ii) that person shall be liable for 11 any export, reexport, or in-country transfer 12 in violation of this section. 13 ‘‘(F) CONSIDERATIONS.—In establishing a 14 threshold under subparagraph (A), the Sec- 15 retary, in coordination with the heads of the ap- 16 propriate Federal agencies, shall seek to bal- 17 ance the need to protect personal data from ex- 18 ploitation by foreign governments and foreign 19 adversaries against the likelihood of— 20 ‘‘(i) impacting legitimate business ac- 21 tivities, research activities, and other ac- 22 tivities that do not harm the national secu- 23 rity of the United States; or 24 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 8 •HR 4108 IH ‘‘(ii) chilling speech protected by the 1 First Amendment to the Constitution of 2 the United States. 3 ‘‘(4) DETERMINATION OF PERIOD FOR PROTEC- 4 TION.—The Secretary, in coordination with the 5 heads of the appropriate Federal agencies, shall de- 6 termine, for each category (or combination of cat- 7 egories) of personal data identified under paragraph 8 (1), the period of time for which encryption tech- 9 nology described in subsection (b)(4)(A)(iii) is re- 10 quired to be able to protect that category (or com- 11 bination of categories) of data from decryption to 12 prevent the exploitation of the data by a foreign gov- 13 ernment or foreign adversary from harming the na- 14 tional security of the United States. 15 ‘‘(5) USE OF INFORMATION; CONSIDER- 16 ATIONS.—In carrying out this subsection (including 17 with respect to the list required under paragraph 18 (2)), the Secretary, in coordination with the heads of 19 the appropriate Federal agencies, shall— 20 ‘‘(A) use multiple sources of information, 21 including— 22 ‘‘(i) publicly available information; 23 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 9 •HR 4108 IH ‘‘(ii) classified information, including 1 relevant information provided by the Direc- 2 tor of National Intelligence; 3 ‘‘(iii) information relating to reviews 4 and investigations of transactions by the 5 Committee on Foreign Investment in the 6 United States under section 721 of the De- 7 fense Production Act of 1950 (50 U.S.C. 8 4565); 9 ‘‘(iv) the categories of sensitive per- 10 sonal data described in paragraphs (1)(ii) 11 and (2) of section 800.241(a) of title 31, 12 Code of Federal Regulations, as in effect 13 on the day before the date of the enact- 14 ment of the Protecting Americans’ Data 15 From Foreign Surveillance Act of 2023, 16 and any categories of sensitive personal 17 data added to such section after such date 18 of enactment; 19 ‘‘(v) information provided by the advi- 20 sory committee established pursuant to 21 paragraph (7); and 22 ‘‘(vi) the recommendations (which the 23 Secretary shall request) of— 24 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 10 •HR 4108 IH ‘‘(I) experts in privacy, civil 1 rights, and civil liberties, identified by 2 the National Academy of Sciences; 3 and 4 ‘‘(II) experts on the First 5 Amendment to the Constitution of the 6 United States identified by the Amer- 7 ican Bar Association; and 8 ‘‘(B) take into account— 9 ‘‘(i) the significant quantity of per- 10 sonal data of covered individuals that is 11 publicly available by law or has already 12 been stolen or acquired by foreign govern- 13 ments or foreign adversaries; 14 ‘‘(ii) the harm to United States na- 15 tional security caused by the theft or ac- 16 quisition of that personal data; 17 ‘‘(iii) the potential for further harm to 18 United States national security if that per- 19 sonal data were combined with additional 20 sources of personal data; 21 ‘‘(iv) the fact that non-sensitive per- 22 sonal data, when analyzed in the aggre- 23 gate, can reveal sensitive personal data; 24 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 11 •HR 4108 IH ‘‘(v) the commercial availability of in- 1 ferred and derived data; and 2 ‘‘(vi) the potential for especially sig- 3 nificant harm from data and inferences re- 4 lated to sensitive domains, such as health, 5 work, education, criminal justice, and fi- 6 nance. 7 ‘‘(6) NOTICE AND COMMENT PERIOD.—The 8 Secretary shall provide for a public notice and com- 9 ment period after the publication in the Federal 10 Register of a proposed rule, and before the publica- 11 tion of a final rule— 12 ‘‘(A) identifying the initial list of cat- 13 egories of personal data under subparagraph 14 (A) of paragraph (2); 15 ‘‘(B) adding categories to, removing cat- 16 egories from, or modifying categories on, that 17 list under subparagraph (B) of that paragraph; 18 ‘‘(C) establishing or updating the threshold 19 under paragraph (3); or 20 ‘‘(D) setting forth the period of time for 21 which encryption technology described in sub- 22 section (b)(4)(A)(iii) is required under para- 23 graph (4) to be able to protect such a category 24 of data from decryption. 25 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 12 •HR 4108 IH ‘‘(7) ADVISORY COMMITTEE.— 1 ‘‘(A) IN GENERAL.—The Secretary shall 2 establish an advisory committee to advise the 3 Secretary with respect to privacy and sensitive 4 personal data. 5 ‘‘(B) MEMBERSHIP.—The committee es- 6 tablished pursuant to subparagraph (A) shall 7 include the following members selected by the 8 Secretary: 9 ‘‘(i) Experts on privacy and cyberse- 10 curity. 11 ‘‘(ii) Representatives of United States 12 private sector companies, industry associa- 13 tions, and scholarly societies. 14 ‘‘(iii) Representatives of civil society 15 groups, including such groups focused on 16 protecting civil rights and civil liberties. 17 ‘‘(C) APPLICABILITY OF FEDERAL ADVI- 18 SORY COMMITTEE ACT.—Subsections (a)(1), 19 (a)(3), and (b) of section 10 and sections 11, 20 13, and 14 of the Federal Advisory Committee 21 Act (5 U.S.C. App.) shall not apply to the advi- 22 sory committee established pursuant to sub- 23 paragraph (A). 24 VerDate Sep 11 2014 23:26 Jul 07, 2023 Jkt 039200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H4108.IH H4108 kjohnson on DSK79L0C42PROD with BILLS 13 •HR 4108 IH ‘‘(8) TREATMENT OF ANONYMIZED PERSONAL 1 DATA.— 2 ‘‘(A) IN GENERAL.—In carrying out this 3 subsection, the Secretary may not treat 4 anonymized personal data differently than iden- 5 tifiable personal data unless the Secretary is 6 confident, based on the method of 7 anonymization used and the period of time de- 8 termined under paragraph (4) for protection of 9 the category of personal data involved, it will 10 not be possible for well-resourced adversaries, 11 incl [Text truncated for display. Full text available on Congress.gov.]