II 

117TH CONGRESS 

2D SESSION S. 4495 

To amend the Export Control Reform Act of 2018 to require export controls 

with respect to certain personal data of United States nationals and 

individuals in the United States, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JUNE 23, 2022 

Mr. WYDEN (for himself, Ms. LUMMIS, Mr. WHITEHOUSE, Mr. RUBIO, and 

Mr. HAGERTY) introduced the following bill; which was read twice and 

referred to the Committee on Banking, Housing, and Urban Affairs 

A BILL 

To amend the Export Control Reform Act of 2018 to require 

export controls with respect to certain personal data 

of United States nationals and individuals in the United 

States, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Protecting Americans’ 

5 Data From Foreign Surveillance Act of 2022’’. 

6 SEC. 2. SENSE OF CONGRESS. 

7 It is the sense of Congress that— 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 4495 IS

1 (1) accelerating technological trends have made 

2 sensitive personal data an especially valuable input 

3 to activities that adversaries of the United States 

4 undertake to threaten both the national security of 

5 the United States and the individual privacy that the 

6 people of the United States cherish; 

7 (2) it is therefore essential to the safety of the 

8 United States and the people of the United States 

9 to ensure that the United States Government makes 

10 every effort to prevent sensitive personal data from 

11 falling into the hands of malign foreign actors; and 

12 (3) because allies of the United States face 

13 similar challenges, in implementing this Act, the 

14 United States Government should explore the estab15 lishment of a shared zone of mutual trust with re16 spect to sensitive personal data. 

17 SEC. 3. REQUIREMENT TO CONTROL THE EXPORT OF CER18 TAIN PERSONAL DATA OF UNITED STATES 

19 NATIONALS AND INDIVIDUALS IN THE 

20 UNITED STATES. 

21 (a) IN GENERAL.—Part I of the Export Control Re22 form Act of 2018 (50 U.S.C. 4811 et seq.) is amended 

23 by inserting after section 1758 the following: 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 4495 IS

1 ‘‘SEC. 1758A. REQUIREMENT TO CONTROL THE EXPORT OF 

2 CERTAIN PERSONAL DATA OF UNITED 

3 STATES NATIONALS AND INDIVIDUALS IN 

4 THE UNITED STATES. 

5 ‘‘(a) IDENTIFICATION OF CATEGORIES OF PERSONAL

6 DATA.— 

7 ‘‘(1) IN GENERAL.—The Secretary shall, in co8 ordination with the heads of the appropriate Federal 

9 agencies, identify categories of personal data of cov10 ered individuals that could— 

11 ‘‘(A) be exploited by foreign governments; 

12 and 

13 ‘‘(B) if exported, reexported, or in-country 

14 transferred in a quantity that exceeds the 

15 threshold established under paragraph (3), 

16 harm the national security of the United States. 

17 ‘‘(2) LIST REQUIRED.—In identifying categories 

18 of personal data of covered individuals under para19 graph (1), the Secretary, in coordination with the 

20 heads of the appropriate Federal agencies, shall— 

21 ‘‘(A) identify an initial list of such cat22 egories not later than one year after the date 

23 of the enactment of the Protecting Americans’ 

24 Data From Foreign Surveillance Act of 2022; 

25 and 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 4495 IS

1 ‘‘(B) as appropriate thereafter and not less 

2 frequently than every 5 years, add categories to, 

3 remove categories from, or modify categories 

4 on, that list. 

5 ‘‘(3) ESTABLISHMENT OF THRESHOLD.— 

6 ‘‘(A) ESTABLISHMENT.—Not later than 

7 one year after the date of the enactment of the 

8 Protecting Americans’ Data From Foreign Sur9 veillance Act of 2022, the Secretary, in coordi10 nation with the heads of the appropriate Fed11 eral agencies, shall establish a threshold for de12 termining when the export, reexport, or in13 country transfer (in the aggregate) of the per14 sonal data of covered individuals by one person 

15 to or in a restricted country could harm the na16 tional security of the United States. 

17 ‘‘(B) NUMBER OF COVERED INDIVIDUALS

18 AFFECTED.—The threshold established under 

19 subparagraph (A) shall be the export, reexport, 

20 or in-country transfer (in the aggregate) by one 

21 person to or in a restricted country during a 

22 calendar year of the personal data of not less 

23 than 10,000 covered individuals and not more 

24 than 1,000,000 covered individuals. 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 4495 IS

1 ‘‘(C) CATEGORY THRESHOLDS.—The Sec2 retary, in coordination with the heads of the ap3 propriate Federal agencies, may establish a 

4 threshold under subparagraph (A) for each cat5 egory of personal data identified under para6 graph (1). 

7 ‘‘(D) UPDATES.—The Secretary, in coordi8 nation with the heads of the appropriate Fed9 eral agencies— 

10 ‘‘(i) may update the threshold estab11 lished under subparagraph (A) as appro12 priate; and 

13 ‘‘(ii) shall reevaluate the threshold not 

14 less frequently than every 5 years. 

15 ‘‘(E) TREATMENT OF PERSONS UNDER

16 COMMON OWNERSHIP AS ONE PERSON.—For 

17 purposes of determining whether a threshold es18 tablished under subparagraph (A) has been 

19 met— 

20 ‘‘(i) all exports, reexports, or in-coun21 try transfers involving personal data con22 ducted by persons under the ownership or 

23 control of the same person shall be aggre24 gated to that person; and 


kjohnson on DSK79L0C42PROD with BILLS
6 

•S 4495 IS

1 ‘‘(ii) that person shall be liable for 

2 any export, reexport, or in-country transfer 

3 in violation of this section. 

4 ‘‘(F) CONSIDERATIONS.—In establishing a 

5 threshold under subparagraph (A), the Sec6 retary, in coordination with the heads of the ap7 propriate Federal agencies, shall seek to bal8 ance the need to protect personal data from ex9 ploitation by foreign governments against the 

10 likelihood of— 

11 ‘‘(i) impacting legitimate business ac12 tivities, research activities, and other ac13 tivities that do not harm the national secu14 rity of the United States; or 

15 ‘‘(ii) chilling speech protected by the 

16 First Amendment to the Constitution of 

17 the United States. 

18 ‘‘(4) DETERMINATION OF PERIOD FOR PROTEC19 TION.—The Secretary, in coordination with the 

20 heads of the appropriate Federal agencies, shall de21 termine, for each category of personal data identified 

22 under paragraph (1), the period of time for which 

23 encryption technology described in subsection 

24 (b)(4)(A)(iii) is required to be able to protect that 

25 category of data from decryption to prevent the exVerDate Sep 11 2014 04:41 Jun 30, 2022 Jkt 029200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK79L0C42PROD with BILLS
7 

•S 4495 IS

1 ploitation of the data by a foreign government from 

2 harming the national security of the United States. 

3 ‘‘(5) USE OF INFORMATION; CONSIDER4 ATIONS.—In carrying out this subsection (including 

5 with respect to the list required under paragraph 

6 (2)), the Secretary, in coordination with the heads of 

7 the appropriate Federal agencies, shall— 

8 ‘‘(A) use multiple sources of information, 

9 including— 

10 ‘‘(i) publicly available information; 

11 ‘‘(ii) classified information, including 

12 relevant information provided by the Direc13 tor of National Intelligence; 

14 ‘‘(iii) information relating to reviews 

15 and investigations of transactions by the 

16 Committee on Foreign Investment in the 

17 United States under section 721 of the De18 fense Production Act of 1950 (50 U.S.C. 

19 4565); 

20 ‘‘(iv) the categories of sensitive per21 sonal data described in paragraphs (1)(ii) 

22 and (2) of section 800.241(a) of title 31, 

23 Code of Federal Regulations, as in effect 

24 on the day before the date of the enact25 ment of the Protecting Americans’ Data 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 4495 IS

1 From Foreign Surveillance Act of 2022, 

2 and any categories of sensitive personal 

3 data added to such section after such date 

4 of enactment; 

5 ‘‘(v) information provided by the advi6 sory committee established pursuant to 

7 paragraph (7); and 

8 ‘‘(vi) the recommendations (which the 

9 Secretary shall request) of— 

10 ‘‘(I) privacy experts identified by 

11 the National Academy of Sciences; 

12 and 

13 ‘‘(II) experts on the First 

14 Amendment to the Constitution of the 

15 United States identified by the Amer16 ican Bar Association; and 

17 ‘‘(B) take into account— 

18 ‘‘(i) the significant quantity of per19 sonal data of covered individuals that has 

20 already been stolen or acquired by foreign 

21 governments; 

22 ‘‘(ii) the harm to United States na23 tional security caused by the theft or ac24 quisition of that personal data; 


kjohnson on DSK79L0C42PROD with BILLS
9 

•S 4495 IS

1 ‘‘(iii) the potential for further harm to 

2 United States national security if that per3 sonal data were combined with additional 

4 sources of personal data; 

5 ‘‘(iv) the fact that non-sensitive per6 sonal data, when analyzed in the aggre7 gate, can reveal sensitive personal data; 

8 and 

9 ‘‘(v) the commercial availability of in10 ferred and derived data. 

11 ‘‘(6) NOTICE AND COMMENT PERIOD.—The 

12 Secretary shall provide for a public notice and com13 ment period after the publication in the Federal 

14 Register of a proposed rule, and before the publica15 tion of a final rule— 

16 ‘‘(A) identifying the initial list of cat17 egories of personal data under subparagraph 

18 (A) of paragraph (2); 

19 ‘‘(B) adding categories to, removing cat20 egories from, or modifying categories on, that 

21 list under subparagraph (B) of that paragraph; 

22 ‘‘(C) establishing or updating the threshold 

23 under paragraph (3); or 

24 ‘‘(D) setting forth the period of time for 

25 which encryption technology described in subVerDate Sep 11 2014 04:41 Jun 30, 2022 Jkt 029200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK79L0C42PROD with BILLS
10 

•S 4495 IS

1 section (b)(4)(A)(iii) is required under para2 graph (4) to be able to protect such a category 

3 of data from decryption. 

4 ‘‘(7) ADVISORY COMMITTEE.— 

5 ‘‘(A) IN GENERAL.—The Secretary shall 

6 establish an advisory committee to advise the 

7 Secretary with respect to privacy and sensitive 

8 personal data. 

9 ‘‘(B) MEMBERSHIP.—The committee es10 tablished pursuant to subparagraph (A) shall 

11 include the following members selected by the 

12 Secretary: 

13 ‘‘(i) Experts on privacy and cyberse14 curity. 

15 ‘‘(ii) Representatives of private sector 

16 companies and industry associations. 

17 ‘‘(iii) Representatives of civil society 

18 groups. 

19 ‘‘(C) APPLICABILITY OF FEDERAL ADVI20 SORY COMMITTEE ACT.—Subsections (a)(1), 

21 (a)(3), and (b) of section 10 and sections 11, 

22 13, and 14 of the Federal Advisory Committee 

23 Act (5 U.S.C. App.) shall not apply to the advi24 sory committee established pursuant to sub25 paragraph (A). 


kjohnson on DSK79L0C42PROD with BILLS
11 

•S 4495 IS

1 ‘‘(8) TREATMENT OF ANONYMIZED PERSONAL

2 DATA.— 

3 ‘‘(A) IN GENERAL.—In carrying out this 

4 subsection, the Secretary may not treat 

5 anonymized personal data differently than iden6 tifiable personal data if the individuals to which 

7 the anonymized personal data relates could rea8 sonably be identified using other sources of 

9 data. 

10 ‘‘(B) GUIDANCE.—The Under Secretary of 

11 Commerce for Standards and Technology shall 

12 issue guidance to the public with respect to 

13 methods for anonymizing data and how to de14 termine if individuals to which the anonymized 

15 personal data relates can be reasonably identi16 fied using other sources of data. 

17 ‘‘(9) SENSE OF CONGRESS ON IDENTIFICATION

18 OF CATEGORIES OF PERSONAL DATA.—It is the 

19 sense of Congress that, in identifying categories of 

20 personal data of covered individuals under para21 graph (1), the Secretary should, to the extent rea22 sonably possible and in coordination with the Sec23 retary of the Treasury, harmonize those categories 

24 with the categories of sensitive personal data de25 scribed in paragraph (5)(A)(iv). 


kjohnson on DSK79L0C42PROD with BILLS
12 

•S 4495 IS

1 ‘‘(b) COMMERCE CONTROLS.— 

2 ‘‘(1) CONTROLS REQUIRED.—Beginning 18 

3 months after the date of the enactment of the Pro4 tecting Americans’ Data From Foreign Surveillance 

5 Act of 2022, the Secretary shall impose appropriate 

6 controls under the Export Administration Regula7 tions on the export or reexport to, or in-country 

8 transfer in, all countries (other than countries on 

9 the list required by paragraph (2)(D)) of covered 

10 personal data in a manner that exceeds the applica11 ble threshold established under subsection (a)(3), in12 cluding through interim controls (such as by inform13 ing a person that a license is required for export, re14 export, or in-country transfer of covered personal 

15 data), as appropriate, or by publishing additional 

16 regulations. 

17 ‘‘(2) LEVELS OF CONTROL.— 

18 ‘‘(A) IN GENERAL.—Except as provided in 

19 subparagraph (C) or (D), the Secretary shall— 

20 ‘‘(i) require a license or other author21 ization for the export, reexport, or in-coun22 try transfer of covered personal data in a 

23 manner that exceeds the applicable thresh24 old established under subsection (a)(3); 


kjohnson on DSK79L0C42PROD with BILLS
13 

•S 4495 IS

1 ‘‘(ii) determine whether that export, 

2 reexport, or in-country transfer is likely to 

3 harm the national security of the United 

4 States— 

5 ‘‘(I) after consideration of the 

6 matters described in subparagraph 

7 (B); and 

8 ‘‘(II) in coordination with the 

9 heads of the appropriate Federal 

10 agencies; and 

11 ‘‘(iii) if the Secretary determines 

12 under clause (ii) that the export, reexport, 

13 or in-country transfer is likely to harm the 

14 national security of the United States, 

15 deny the application for the license or 

16 other authorization for the export, reex17 port, or in-country transfer. 

18 ‘‘(B) CONSIDERATIONS.—In determining 

19 under clause (ii) of subparagraph (A) whether 

20 an export, reexport, or in-country transfer of 

21 covered personal data described in clause (i) of 

22 that subparagraph is likely to harm the na23 tional security of the United States, the Sec24 retary, in coordination with the heads of the apVerDate Sep 11 2014 04:41 Jun 30, 2022 Jkt 029200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK79L0C42PROD with BILLS
14 

•S 4495 IS

1 propriate Federal agencies, shall take into ac2 count— 

3 ‘‘(i) the adequacy and enforcement of 

4 data protection, surveillance, and export 

5 control laws in the foreign country to 

6 which the covered personal data would be 

7 exported or reexported, or in which the 

8 covered personal data would be trans9 ferred, in order to determine whether such 

10 laws, and the enforcement of such laws, 

11 are sufficient to— 

12 ‘‘(I) protect the covered personal 

13 data from accidental loss, theft, and 

14 unauthorized or unlawful processing; 

15 ‘‘(II) ensure that the covered per16 sonal data is not exploited for intel17 ligence purposes by foreign govern18 ments to the detriment of the national 

19 security of the United States; and 

20 ‘‘(III) prevent the reexport of the 

21 covered personal data to a third coun22 try for which a license would be re23 quired for such data to be exported 

24 directly from the United States; 


kjohnson on DSK79L0C42PROD with BILLS
15 

•S 4495 IS

1 ‘‘(ii) the circumstances under which 

2 the government of the foreign country can 

3 compel, coerce, or pay a person in or na4 tional of that country to disclose the cov5 ered personal data; and 

6 ‘‘(iii) whether that government has 

7 conducted hostile foreign intelligence oper8 ations, including information operations, 

9 against the United States. 

10 ‘‘(C) LICENSE REQUIREMENT AND PRE11 SUMPTION OF DENIAL FOR CERTAIN COUN12 TRIES.— 

13 ‘‘(i) IN GENERAL.—The Secretary 

14 shall— 

15 ‘‘(I) require a license or other au16 thorization for the export or reexport 

17 to, or in-country transfer in, a coun18 try on the list required by clause (ii) 

19 of covered personal data in a manner 

20 that exceeds the threshold established 

21 under subsection (a)(3); and 

22 ‘‘(II) deny an application for 

23 such a license or other authorization 

24 unless the person seeking the license 

25 or authorization demonstrates to the 


kjohnson on DSK79L0C42PROD with BILLS
16 

•S 4495 IS

1 satisfaction of the Secretary that the 

2 export, reexport, or in-country trans3 fer will not harm the national security 

4 of the United States. 

5 ‘‘(ii) LIST REQUIRED.— 

6 ‘‘(I) IN GENERAL.—Not later 

7 than one year after the date of the en8 actment of the Protecting Americans’ 

9 Data From Foreign Surveillance Act 

10 of 2022, the Secretary shall, in con11 sultation with the heads of the appro12 priate Federal agencies and based on 

13 the considerations described in sub14 paragraph (B), establish a list of each 

15 country with respect to which the Sec16 retary determines that the export or 

17 reexport to, or in-country transfer in, 

18 the country of covered personal data 

19 in a manner that exceeds the applica20 ble threshold established under sub21 section (a)(3) will be likely to harm 

22 the national security of the United 

23 States. 

24 ‘‘(II) MODIFICATIONS TO LIST.— 

25 The Secretary, in consultation with 


kjohnson on DSK79L0C42PROD with BILLS
17 

•S 4495 IS

1 the heads of the appropriate Federal 

2 agencies— 

3 ‘‘(aa) may add a country to 

4 or remove a country from the list 

5 required by subclause (I) at any 

6 time; and 

7 ‘‘(bb) shall review that list 

8 not less frequently than every 5 

9 years. 

10 ‘‘(D) NO LICENSE REQUIREMENT FOR

11 CERTAIN COUNTRIES.— 

12 ‘‘(i) IN GENERAL.—The Secretary 

13 may not require a license or other author14 ization for the export or reexport to, or in15 country transfer in, a country on the list 

16 required by clause (ii) of covered personal 

17 data, without regard to the applicable 

18 threshold established under subsection 

19 (a)(3). 

20 ‘‘(ii) LIST REQUIRED.— 

21 ‘‘(I) IN GENERAL.—Not later 

22 than one year after the date of the en23 actment of the Protecting Americans’ 

24 Data From Foreign Surveillance Act 

25 of 2022, the Secretary shall, in conVerDate Sep 11 2014 04:41 Jun 30, 2022 Jkt 029200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK79L0C42PROD with BILLS
18 

•S 4495 IS

1 sultation with the heads of the appro2 priate Federal agencies and based on 

3 the considerations described in sub4 paragraph (B) and subject to clause 

5 (iii), establish a list of each country 

6 with respect to which the Secretary 

7 determines that the export or reexport 

8 to, or in-country transfer in, the coun9 try of covered personal data (without 

10 regard to any threshold established 

11 under subsection (a)(3)) will not harm 

12 the national security of the United 

13 States. 

14 ‘‘(II) MODIFICATIONS TO LIST.— 

15 The Secretary, in consultation with 

16 the heads of the appropriate Federal 

17 agencies— 

18 ‘‘(aa) may add a country to 

19 or remove a country from the list 

20 required by subclause (I) at any 

21 time; and 

22 ‘‘(bb) shall review that list 

23 not less frequently than every 5 

24 years. 

25 ‘‘(iii) CONGRESSIONAL REVIEW.— 


kjohnson on DSK79L0C42PROD with BILLS
19 

•S 4495 IS

1 ‘‘(I) IN GENERAL.—The list re2 quired by clause (ii) and any updates 

3 to that list adding or removing coun4 tries shall take effect, for purposes of 

5 clause (i), on the date that is 180 

6 days after the Secretary submits to 

7 the appropriate congressional commit8 tees a proposal for the list or update 

9 unless there is enacted into law, be10 fore that date, a joint resolution of 

11 disapproval pursuant to subclause 

12 (II). 

13 ‘‘(II) JOINT RESOLUTION OF DIS14 APPROVAL.— 

15 ‘‘(aa) JOINT RESOLUTION

16 OF DISAPPROVAL DEFINED.—In 

17 this clause, the term ‘joint reso18 lution of disapproval’ means a 

19 joint resolution the matter after 

20 the resolving clause of which is 

21 as follows: ‘That Congress does 

22 not approve of the proposal of 

23 the Secretary with respect to the 

24 list required by section 

25 1758A(b)(2)(D)(ii) submitted to 


kjohnson on DSK79L0C42PROD with BILLS
20 

•S 4495 IS

1 Congress on lll.’, with the 

2 blank space being filled with the 

3 appropriate date. 

4 ‘‘(bb) PROCEDURES.—The 

5 procedures set forth in para6 graphs (4)(C), (5), (6), and (7) 

7 of section 2523(d) of title 18, 

8 United States Code, apply with 

9 respect to a joint resolution of 

10 disapproval under this clause to 

11 the same extent and in the same 

12 manner as such procedures apply 

13 to a joint resolution of dis14 approval under such section 

15 2523(d), except that paragraph 

16 (6) of such section shall be ap17 plied and administered by sub18 stituting ‘the Committee on 

19 Banking, Housing, and Urban 

20 Affairs’ for ‘the Committee on 

21 the Judiciary’ each place it ap22 pears. 

23 ‘‘(III) RULES OF HOUSE OF REP24 RESENTATIVES AND SENATE.—This 

25 clause is enacted by Congress— 


kjohnson on DSK79L0C42PROD with BILLS
21 

•S 4495 IS

1 ‘‘(aa) as an exercise of the 

2 rulemaking power of the Senate 

3 and the House of Representa4 tives, respectively, and as such is 

5 deemed a part of the rules of 

6 each House, respectively, and su7 persedes other rules only to the 

8 extent that it is inconsistent with 

9 such rules; and 

10 ‘‘(bb) with full recognition of 

11 the constitutional right of either 

12 House to change the rules (so far 

13 as relating to the procedure of 

14 that House) at any time, in the 

15 same manner, and to the same 

16 extent as in the case of any other 

17 rule of that House. 

18 ‘‘(3) REVIEW OF LICENSE APPLICATIONS.— 

19 ‘‘(A) IN GENERAL.—The Secretary shall, 

20 consistent with the provisions of section 1756 

21 and in coordination with the heads of the ap22 propriate Federal agencies— 

23 ‘‘(i) review applications for a license 

24 or other authorization for the export or re25 export to, or in-country transfer in, a reVerDate Sep 11 2014 04:41 Jun 30, 2022 Jkt 029200 PO 00000 Frm 00021 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK79L0C42PROD with BILLS
22 

•S 4495 IS

1 stricted country of covered personal data 

2 in a manner that exceeds the applicable 

3 threshold established under subsection 

4 (a)(3); and 

5 ‘‘(ii) establish procedures for con6 ducting the review of such applications. 

7 ‘‘(B) DISCLOSURES RELATING TO COL8 LABORATIVE ARRANGEMENTS.—In the case of 

9 an application for a license or other authoriza10 tion for an export, reexport, or in-country 

11 transfer described in subparagraph (A)(i) sub12 mitted by or on behalf of a joint venture, joint 

13 development agreement, or similar collaborative 

14 arrangement, the Secretary may require the ap15 plicant to identify, in addition to any foreign 

16 person participating in the arrangement, any 

17 foreign person with significant ownership inter18 est in a foreign person participating in the ar19 rangement. 

20 ‘‘(4) EXCEPTIONS.— 

21 ‘‘(A) IN GENERAL.—The Secretary shall 

22 not impose under paragraph (1) a requirement 

23 for a license or other authorization with respect 

24 to the export, reexport, or in-country transfer of 


kjohnson on DSK79L0C42PROD with BILLS
23 

•S 4495 IS

1 covered personal data pursuant to any of the 

2 following transactions: 

3 ‘‘(i) The export, reexport, or in-coun4 try transfer by an individual of covered 

5 personal data that specifically pertains to 

6 that individual. 

7 ‘‘(ii) The export, reexport, or in-coun8 try transfer of the personal data of one or 

9 more individuals by a person performing a 

10 service for those individuals if the service 

11 could not possibly be performed (as defined 

12 by the Secretary in regulations) without 

13 the export, reexport, or in-country transfer 

14 of that personal data. 

15 ‘‘(iii) The export, reexport, or in-coun16 try transfer of personal data that is 

17 encrypted if— 

18 ‘‘(I) the encryption key or other 

19 information necessary to decrypt the 

20 data is not exported, reexported, or 

21 transferred to a restricted country or 

22 (except as provided in subparagraph 

23 (B)) a national of a restricted coun24 try; and 


kjohnson on DSK79L0C42PROD with BILLS
24 

•S 4495 IS

1 ‘‘(II) the encryption technology 

2 used to protect the data against 

3 decryption is certified by the National 

4 Institute of Standards and Tech5 nology as capable of protecting data 

6 for the period of time determined 

7 under subsection (a)(4) to be suffi8 cient to prevent the exploitation of the 

9 data by a foreign government from 

10 harming the national security of the 

11 United States. 

12 ‘‘(iv) The export, reexport, or in-coun13 try transfer of personal data that is or14 dered by an appropriate court of the 

15 United States. 

16 ‘‘(B) EXCEPTION FOR CERTAIN NATIONALS

17 OF RESTRICTED COUNTRIES.—Subparagraph 

18 (A)(iii)(I) does not apply with respect to an in19 dividual who is a national of a restricted coun20 try if the individual is also a citizen of the 

21 United States or a noncitizen described in sub22 section (k)(5)(C). 

23 ‘‘(c) REQUIREMENTS FOR IDENTIFICATION OF CAT24 EGORIES AND DETERMINATION OF APPROPRIATE CON25 TROLS.—In identifying categories of personal data under 


kjohnson on DSK79L0C42PROD with BILLS
25 

•S 4495 IS

1 subsection (a)(1) and imposing appropriate controls under 

2 subsection (b), the Secretary, in coordination with the 

3 heads of the appropriate Federal agencies, as appro4 priate— 

5 ‘‘(1) may not regulate or restrict the publica6 tion or sharing of— 

7 ‘‘(A) personal data that is a matter of pub8 lic record, such as a court record or other gov9 ernment record that is generally available to the 

10 public, including information about an indi11 vidual made public by that individual or by the 

12 news media; 

13 ‘‘(B) information about a matter of public 

14 interest; or 

15 ‘‘(C) consistent with the goal of protecting 

16 the national security of the United States, any 

17 other information the publication of which is 

18 protected by the First Amendment to the Con19 stitution of the United States; and 

20 ‘‘(2) shall consult with the appropriate congres21 sional committees. 

22 ‘‘(d) PENALTIES.— 

23 ‘‘(1) LIABLE PERSONS.— 

24 ‘‘(A) IN GENERAL.—In addition to any 

25 person that commits an unlawful act described 


kjohnson on DSK79L0C42PROD with BILLS
26 

•S 4495 IS

1 in subsection (a) of section 1760, an officer or 

2 employee of an organization has committed an 

3 unlawful act subject to penalties under that sec4 tion if the officer or employee knew or should 

5 have known that another employee of the orga6 nization who reports, directly or indirectly, to 

7 the officer or employee was directed to export, 

8 reexport, or in-country transfer covered per9 sonal data in violation of this section and subse10 quently did export, reexport, or in-country 

11 transfer such data. 

12 ‘‘(B) EXCEPTIONS AND CLARIFICATIONS.— 

13 ‘‘(i) INTERMEDIARIES NOT LIABLE.— 

14 An intermediate consignee (as defined in 

15 section 772.1 of the Export Administration 

16 Regulations (or any successor regulation)) 

17 or other intermediary is not liable for the 

18 export, reexport, or in-country transfer of 

19 covered personal data in violation of this 

20 section when acting as an intermediate 

21 consignee or other intermediary for an22 other person. 

23 ‘‘(ii) SPECIAL RULE FOR CERTAIN AP24 PLICATIONS.—In a case in which an appli25 cation installed on an electronic device 


kjohnson on DSK79L0C42PROD with BILLS
27 

•S 4495 IS

1 transmits or causes the transmission of 

2 covered personal data without being di3 rected to do so by the owner or user of the 

4 device who installed the application, the 

5 developer of the application, and not the 

6 owner or user of the device, is liable for 

7 any violation of this section. 

8 ‘‘(2) CRIMINAL PENALTIES.—In determining an 

9 appropriate term of imprisonment under section 

10 1760(b)(2) with respect to a person for a violation 

11 of this section, the court shall consider— 

12 ‘‘(A) how many covered individuals had 

13 their covered personal data exported, reex14 ported, or in-country transferred in violation of 

15 this section; 

16 ‘‘(B) any harm that resulted from the vio17 lation; and 

18 ‘‘(C) the intent of the person in commit19 ting the violation. 

20 ‘‘(e) REPORT TO CONGRESS.— 

21 ‘‘(1) IN GENERAL.—Not less frequently than 

22 annually, the Secretary, in coordination with the 

23 heads of the appropriate Federal agencies, shall sub24 mit to the appropriate congressional committees a 


kjohnson on DSK79L0C42PROD with BILLS
28 

•S 4495 IS

1 report on the results of actions taken pursuant to 

2 this section. 

3 ‘‘(2) INCLUSIONS.—Each report required by 

4 paragraph (1) shall include a description of the de5 terminations made under subsection (b)(2)(A)(ii) 

6 during the preceding year. 

7 ‘‘(3) FORM.—Each report required by para8 graph (1) shall be submitted in unclassified form but 

9 may include a classified annex. 

10 ‘‘(f) DISCLOSURE OF CERTAIN LICENSE INFORMA11 TION.— 

12 ‘‘(1) IN GENERAL.—Not less frequently than 

13 every 90 days, the Secretary shall publish on a pub14 licly accessible website of the Department of Com15 merce, including in a machine-readable format, the 

16 information specified in paragraph (2), with respect 

17 to each application— 

18 ‘‘(A) for a license for the export or reex19 port to, or in-country transfer in, a restricted 

20 country of covered personal data in a manner 

21 that exceeds the applicable threshold established 

22 under subsection (a)(3); and 

23 ‘‘(B) with respect to which the Secretary 

24 made a decision in the preceding 90-day period. 


kjohnson on DSK79L0C42PROD with BILLS
29 

•S 4495 IS

1 ‘‘(2) INFORMATION SPECIFIED.—The informa2 tion specified in this paragraph with respect to an 

3 application described in paragraph (1) is the fol4 lowing: 

5 ‘‘(A) The name of the applicant. 

6 ‘‘(B) The date of the application. 

7 ‘‘(C) The name of the foreign party to 

8 which the applicant sought to export, reexport, 

9 or transfer the data. 

10 ‘‘(D) The categories of covered personal 

11 data the applicant sought to export, reexport, 

12 or transfer. 

13 ‘‘(E) The number of covered individuals 

14 whose information the applicant sought to ex15 port, reexport, or transfer. 

16 ‘‘(F) Whether the application was ap17 proved or denied. 

18 ‘‘(g) NEWS MEDIA PROTECTIONS.—A person that is 

19 engaged in journalism is not subject to restrictions im20 posed under this section to the extent that those restric21 tions directly infringe on the journalism practices of that 

22 person. 

23 ‘‘(h) CITIZENSHIP DETERMINATIONS BY PERSONS

24 PROVIDING SERVICES TO END-USERS NOT REQUIRED.— 

25 This section does not require a person that provides prodVerDate Sep 11 2014 01:44 Jul 01, 2022 Jkt 029200 PO 00000 Frm 00029 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK79L0C42PROD with BILLS
30 

•S 4495 IS

1 ucts or services to an individual to determine the citizen2 ship or immigration status of the individual, but once the 

3 person becomes aware that the individual is a covered indi4 vidual, the person shall treat covered personal data of that 

5 individual as is required by this section. 

6 ‘‘(i) FEES.— 

7 ‘‘(1) IN GENERAL.—Notwithstanding section 

8 1756(c), the Secretary may, to the extent provided 

9 in advance in appropriations Acts, assess and collect 

10 a fee, in an amount determined by the Secretary in 

11 regulations, with respect to each application for a li12 cense submitted under subsection (b). 

13 ‘‘(2) DEPOSIT AND AVAILABILITY OF FEES.— 

14 Notwithstanding section 3302 of title 31, United 

15 States Code, fees collected under paragraph (1) 

16 shall— 

17 ‘‘(A) be credited as offsetting collections to 

18 the account providing appropriations for activi19 ties carried out under this section; 

20 ‘‘(B) be available, to the extent and in the 

21 amounts provided in advance in appropriations 

22 Acts, to the Secretary solely for use in carrying 

23 out activities under this section; and 

24 ‘‘(C) remain available until expended. 


kjohnson on DSK79L0C42PROD with BILLS
31 

•S 4495 IS

1 ‘‘(j) REGULATIONS.—The Secretary may prescribe 

2 such regulations as are necessary to carry out this section. 

3 ‘‘(k) AUTHORIZATION OF APPROPRIATIONS.—There 

4 are authorized to be appropriated to the Secretary and 

5 to the head of each of the appropriate Federal agencies 

6 participating in carrying out this section such sums as 

7 may be necessary to carry out this section, including to 

8 hire additional employees with expertise in privacy. 

9 ‘‘(l) DEFINITIONS.—In this section: 

10 ‘‘(1) APPROPRIATE CONGRESSIONAL COMMIT11 TEES.—The term ‘appropriate congressional com12 mittees’ means— 

13 ‘‘(A) the Committee on Banking, Housing, 

14 and Urban Affairs, the Committee on Foreign 

15 Relations, the Committee on Finance, and the 

16 Select Committee on Intelligence of the Senate; 

17 and 

18 ‘‘(B) the Committee on Foreign Affairs, 

19 the Committee on Ways and Means, and the 

20 Permanent Select Committee on Intelligence of 

21 the House of Representatives. 

22 ‘‘(2) APPROPRIATE FEDERAL AGENCIES.—The 

23 term ‘appropriate Federal agencies’ means the fol24 lowing: 

25 ‘‘(A) The Department of Defense. 


kjohnson on DSK79L0C42PROD with BILLS
32 

•S 4495 IS

1 ‘‘(B) The Department of State. 

2 ‘‘(C) The Department of Justice. 

3 ‘‘(D) The Department of the Treasury. 

4 ‘‘(E) The Office of the Director of Na5 tional Intelligence. 

6 ‘‘(F) The Cybersecurity and Infrastructure 

7 Security Agency. 

8 ‘‘(G) The Consumer Financial Protection 

9 Bureau. 

10 ‘‘(H) The Federal Trade Commission. 

11 ‘‘(I) The Federal Communications Com12 mission. 

13 ‘‘(J) The Department of Health and 

14 Human Services. 

15 ‘‘(K) Such other Federal agencies as the 

16 Secretary considers appropriate. 

17 ‘‘(3) COVERED INDIVIDUAL.—The term ‘cov18 ered individual’, with respect to personal data, 

19 means an individual who, at the time the data is ac20 quired— 

21 ‘‘(A) is located in the United States; or 

22 ‘‘(B) is— 

23 ‘‘(i) located outside the United States 

24 or whose location cannot be determined; 

25 and 


kjohnson on DSK79L0C42PROD with BILLS
33 

•S 4495 IS

1 ‘‘(ii) a citizen of the United States or 

2 a noncitizen lawfully admitted for perma3 nent residence. 

4 ‘‘(4) COVERED PERSONAL DATA.—The term 

5 ‘covered personal data’ means the categories of per6 sonal data of covered individuals identified pursuant 

7 to subsection (a). 

8 ‘‘(5) EXPORT.— 

9 ‘‘(A) IN GENERAL.—The term ‘export’, 

10 with respect to covered personal data, in11 cludes— 

12 ‘‘(i) subject to subparagraph (D), the 

13 shipment or transmission of the data out 

14 of the United States, including the sending 

15 or taking of the data out of the United 

16 States, in any manner, if the shipment or 

17 transmission is intentional, without regard 

18 to whether the shipment or transmission 

19 was intended to go out of the United 

20 States; or 

21 ‘‘(ii) the release or transfer of the 

22 data to any noncitizen (other than a non23 citizen described in subparagraph (C)), if 

24 the release or transfer is intentional, withVerDate Sep 11 2014 04:41 Jun 30, 2022 Jkt 029200 PO 00000 Frm 00033 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK79L0C42PROD with BILLS
34 

•S 4495 IS

1 out regard to whether the release or trans2 fer was intended to be to a noncitizen. 

3 ‘‘(B) EXCEPTIONS.—The term ‘export’ 

4 does not include— 

5 ‘‘(i) the publication of covered per6 sonal data on the internet in a manner 

7 that makes the data discoverable by and 

8 accessible to any member of the general 

9 public; or 

10 ‘‘(ii) any activity protected by the 

11 speech or debate clause of the Constitution 

12 of the United States. 

13 ‘‘(C) NONCITIZENS DESCRIBED.—A noncit14 izen described in this subparagraph is a noncit15 izen who is authorized to be employed in the 

16 United States. 

17 ‘‘(D) TRANSMISSIONS THROUGH RE18 STRICTED COUNTRIES.— 

19 ‘‘(i) IN GENERAL.—On and after the 

20 date that is 5 years after the date of the 

21 enactment of the Protecting Americans’ 

22 Data From Foreign Surveillance Act of 

23 2022, and except as provided in clause 

24 (iii), the term ‘export’ includes the trans25 mission of data through a restricted counVerDate Sep 11 2014 04:41 Jun 30, 2022 Jkt 029200 PO 00000 Frm 00034 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK79L0C42PROD with BILLS
35 

•S 4495 IS

1 try, without regard to whether the person 

2 originating the transmission had knowl3 edge of or control over the path of the 

4 transmission. 

5 ‘‘(ii) EXCEPTIONS.—Clause (i) does 

6 not apply with respect to a transmission of 

7 data through a restricted country if— 

8 ‘‘(I) the data is encrypted as de9 scribed in subsection (b)(4)(A)(iii); or 

10 ‘‘(II) the person that originated 

11 the transmission received a represen12 tation from the party delivering the 

13 data for the person stating that the 

14 data will not transit through a re15 stricted country. 

16 ‘‘(iii) FALSE REPRESENTATIONS.—If 

17 a party delivering covered personal data as 

18 described in clause (ii)(II) transmits the 

19 data directly or indirectly through a re20 stricted country despite making the rep21 resentation described in clause (ii)(II), that 

22 party shall be liable for violating this sec23 tion. 

24 ‘‘(6) IN-COUNTRY TRANSFER; REEXPORT.—The 

25 terms ‘in-country transfer’ and ‘reexport’, with reVerDate Sep 11 2014 04:41 Jun 30, 2022 Jkt 029200 PO 00000 Frm 00035 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK79L0C42PROD with BILLS
36 

•S 4495 IS

1 spect to personal data, shall have the meanings 

2 given those terms in regulations prescribed by the 

3 Secretary. 

4 ‘‘(7) LAWFULLY ADMITTED FOR PERMANENT

5 RESIDENCE; NATIONAL.—The terms ‘lawfully admit6 ted for permanent residence’ and ‘national’ have the 

7 meanings given those terms in section 101(a) of the 

8 Immigration and Nationality Act (8 U.S.C. 

9 1101(a)). 

10 ‘‘(8) NONCITIZEN.—The term ‘noncitizen’ 

11 means an individual who is not a citizen or national 

12 of the United States. 

13 ‘‘(9) RESTRICTED COUNTRY.—The term ‘re14 stricted country’ means a country for which a license 

15 or other authorization is required under subsection 

16 (b) for the export or reexport to, or in-country 

17 transfer in, that country of covered personal data in 

18 a manner that exceeds the applicable threshold es19 tablished under subsection (a)(3).’’. 

20 (b) STATEMENT OF POLICY.—Section 1752 of the 

21 Export Control Reform Act of 2018 (50 U.S.C. 4811) is 

22 amended— 

23 (1) in paragraph (1)— 

24 (A) in subparagraph (A), by striking ‘‘; 

25 and’’ and inserting a semicolon; 


kjohnson on DSK79L0C42PROD with BILLS
37 

•S 4495 IS

1 (B) in subparagraph (B), by striking the 

2 period at the end and inserting ‘‘; and’’; and 

3 (C) by adding at the end the following: 

4 ‘‘(C) to restrict, notwithstanding section 

5 203(b) of the International Emergency Eco6 nomic Powers Act (50 U.S.C. 1702(b)), the ex7 port of personal data of United States citizens 

8 and other covered individuals (as defined in sec9 tion 1758A(l)) in a quantity and a manner that 

10 could harm the national security of the United 

11 States.’’; and 

12 (2) in paragraph (2), by adding at the end the 

13 following: 

14 ‘‘(H) To prevent the exploitation of per15 sonal data of United States citizens and other 

16 covered individuals (as defined in section 

17 1758A(l)) in a quantity and a manner that 

18 could harm the national security of the United 

19 States.’’. 

20 (c) LIMITATION ON AUTHORITY TO MAKE EXCEP21 TIONS TO LICENSING REQUIREMENTS.—Section 1754 of 

22 the Export Control Reform Act of 2018 (50 U.S.C. 4813) 

23 is amended— 

24 (1) in subsection (a)(14), by inserting ‘‘and 

25 subject to subsection (g)’’ after ‘‘as warranted’’; and 


kjohnson on DSK79L0C42PROD with BILLS
38 

•S 4495 IS

1 (2) by adding at the end the following: 

2 ‘‘(g) LIMITATION ON AUTHORITY TO MAKE EXCEP3 TIONS TO LICENSING REQUIREMENTS.—The Secretary 

4 may create under subsection (a)(14) exceptions to licens5 ing requirements under section 1758A only for the export, 

6 reexport, or in-country transfer of covered personal data 

7 (as defined in subsection (l) of that section) by a Federal 

8 department or agency.’’. 

9 (d) RELATIONSHIP TO INTERNATIONAL EMERGENCY

10 ECONOMIC POWERS ACT.—Section 1754(b) of the Export 

11 Control Reform Act of 2018 (50 U.S.C. 4813(b)) is 

12 amended by inserting ‘‘(other than section 1758A)’’ after 

13 ‘‘this part’’. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS