I 
118TH CONGRESS 
1ST SESSION H. R. 4108 
To amend the Export Control Reform Act of 2018 to require export controls 
with respect to certain personal data of United States nationals and 
individuals in the United States, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 14, 2023 
Mr. DAVIDSON (for himself and Ms. ESHOO) introduced the following bill; 
which was referred to the Committee on Foreign Affairs, and in addition 
to the Committee on Rules, for a period to be subsequently determined 
by the Speaker, in each case for consideration of such provisions as fall 
within the jurisdiction of the committee concerned 
A BILL 
To amend the Export Control Reform Act of 2018 to require 
export controls with respect to certain personal data 
of United States nationals and individuals in the United 
States, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Protecting Americans’ 
Data From Foreign Surveillance Act of 2023’’. 
SEC. 2. SENSE OF CONGRESS. 
It is the sense of Congress that— 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
(1) accelerating technological trends have made 
sensitive personal data an especially valuable input 
to activities that foreign adversaries of the United 
States undertake to threaten both the national secu-
rity of the United States and the privacy that the 
people of the United States cherish; 
(2) it is therefore essential to the safety of the 
United States and the people of the United States 
to ensure that the United States Government makes 
every effort to prevent sensitive personal data from 
falling into the hands of malign foreign actors; and 
(3) because allies of the United States face 
similar challenges, in implementing this Act, the 
United States Government should explore the estab-
lishment of a shared zone of mutual trust with re-
spect to sensitive personal data. 
SEC. 3. REQUIREMENT TO CONTROL THE EXPORT OF CER-
TAIN PERSONAL DATA OF UNITED STATES 
NATIONALS 
AND 
INDIVIDUALS 
IN 
THE 
UNITED STATES. 
(a) IN GENERAL.—Part I of the Export Control Re-
form Act of 2018 (50 U.S.C. 4811 et seq.) is amended 
by inserting after section 1758 the following: 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘SEC. 1758A. REQUIREMENT TO CONTROL THE EXPORT OF 
CERTAIN 
PERSONAL 
DATA 
OF 
UNITED 
STATES NATIONALS AND INDIVIDUALS IN 
THE UNITED STATES. 
‘‘(a) IDENTIFICATION OF CATEGORIES OF PERSONAL 
DATA.— 
‘‘(1) IN GENERAL.—The Secretary shall, in co-
ordination with the heads of the appropriate Federal 
agencies, identify categories of personal data of cov-
ered individuals that could— 
‘‘(A) be exploited by foreign governments 
or foreign adversaries; and 
‘‘(B) if exported, reexported, or in-country 
transferred in a quantity that exceeds the 
threshold established under paragraph (3), 
harm the national security of the United States. 
‘‘(2) LIST REQUIRED.—In identifying categories 
of personal data of covered individuals under para-
graph (1), the Secretary, in coordination with the 
heads of the appropriate Federal agencies, shall— 
‘‘(A) identify an initial list of such cat-
egories not later than one year after the date 
of the enactment of the Protecting Americans’ 
Data From Foreign Surveillance Act of 2023; 
and 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) as appropriate thereafter and not less 
frequently than every 5 years, add categories to, 
remove categories from, or modify categories 
on, that list. 
‘‘(3) ESTABLISHMENT OF THRESHOLD.— 
‘‘(A) ESTABLISHMENT.—Not later than 
one year after the date of the enactment of the 
Protecting Americans’ Data From Foreign Sur-
veillance Act of 2023, the Secretary, in coordi-
nation with the heads of the appropriate Fed-
eral agencies, shall establish a threshold for de-
termining when the export, reexport, or in- 
country transfer (in the aggregate) of the per-
sonal data of covered individuals by one person 
to or in a restricted country could harm the na-
tional security of the United States. 
‘‘(B) NUMBER OF COVERED INDIVIDUALS 
AFFECTED.— 
‘‘(i) IN
GENERAL.—Except as pro-
vided by clause (ii), the Secretary shall es-
tablish the threshold under subparagraph 
(A) so that the threshold is— 
‘‘(I) not lower than the export, 
reexport, or in-country transfer (in 
the aggregate) by one person to or in 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
a restricted country during a calendar 
year of the personal data of 10,000 
covered individuals; and 
‘‘(II) not higher than the export, 
reexport, or in-country transfer (in 
the aggregate) by one person to or in 
a restricted country during a calendar 
year of the personal data of 1,000,000 
covered individuals. 
‘‘(ii) EXPORTS BY CERTAIN FOREIGN 
PERSONS.—In the case of a person that 
possesses the data of more than 1,000,000 
covered individuals, the threshold estab-
lished under subparagraph (A) shall be one 
export, reexport, or in-country transfer of 
personal data to or in a restricted country 
by that person during a calendar year if 
the export, reexport, or in-country transfer 
is to— 
‘‘(I) the government of a re-
stricted country; 
‘‘(II) a foreign person that owns 
or controls the person conducting the 
export, reexport, or in-country trans-
fer and that person knows, or should 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
know, that the export, reexport, or in- 
country transfer of the personal data 
was requested by the foreign person 
to comply with a request from the 
government of a restricted country; or 
‘‘(III) an entity on the Entity 
List maintained by the Bureau of In-
dustry and Security of the Depart-
ment of Commerce and set forth in 
Supplement No. 4 to part 744 of the 
Export Administration Regulations. 
‘‘(C) CATEGORY THRESHOLDS.—The Sec-
retary, in coordination with the heads of the ap-
propriate Federal agencies, may establish a 
threshold under subparagraph (A) for each cat-
egory (or combination of categories) of personal 
data identified under paragraph (1). 
‘‘(D) UPDATES.—The Secretary, in coordi-
nation with the heads of the appropriate Fed-
eral agencies— 
‘‘(i) may update a threshold estab-
lished under subparagraph (A) as appro-
priate; and 
‘‘(ii) shall reevaluate the threshold not 
less frequently than every 5 years. 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(E) TREATMENT
OF
PERSONS
UNDER 
COMMON
OWNERSHIP
AS
ONE
PERSON.—For 
purposes of determining whether a threshold es-
tablished under subparagraph (A) has been 
met— 
‘‘(i) all exports, reexports, or in-coun-
try transfers involving personal data con-
ducted by persons under the ownership or 
control of the same person shall be aggre-
gated to that person; and 
‘‘(ii) that person shall be liable for 
any export, reexport, or in-country transfer 
in violation of this section. 
‘‘(F) CONSIDERATIONS.—In establishing a 
threshold under subparagraph (A), the Sec-
retary, in coordination with the heads of the ap-
propriate Federal agencies, shall seek to bal-
ance the need to protect personal data from ex-
ploitation by foreign governments and foreign 
adversaries against the likelihood of— 
‘‘(i) impacting legitimate business ac-
tivities, research activities, and other ac-
tivities that do not harm the national secu-
rity of the United States; or 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ii) chilling speech protected by the 
First Amendment to the Constitution of 
the United States. 
‘‘(4) DETERMINATION OF PERIOD FOR PROTEC-
TION.—The Secretary, in coordination with the 
heads of the appropriate Federal agencies, shall de-
termine, for each category (or combination of cat-
egories) of personal data identified under paragraph 
(1), the period of time for which encryption tech-
nology described in subsection (b)(4)(A)(iii) is re-
quired to be able to protect that category (or com-
bination of categories) of data from decryption to 
prevent the exploitation of the data by a foreign gov-
ernment or foreign adversary from harming the na-
tional security of the United States. 
‘‘(5) 
USE
OF
INFORMATION; 
CONSIDER-
ATIONS.—In carrying out this subsection (including 
with respect to the list required under paragraph 
(2)), the Secretary, in coordination with the heads of 
the appropriate Federal agencies, shall— 
‘‘(A) use multiple sources of information, 
including— 
‘‘(i) publicly available information; 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ii) classified information, including 
relevant information provided by the Direc-
tor of National Intelligence; 
‘‘(iii) information relating to reviews 
and investigations of transactions by the 
Committee on Foreign Investment in the 
United States under section 721 of the De-
fense Production Act of 1950 (50 U.S.C. 
4565); 
‘‘(iv) the categories of sensitive per-
sonal data described in paragraphs (1)(ii) 
and (2) of section 800.241(a) of title 31, 
Code of Federal Regulations, as in effect 
on the day before the date of the enact-
ment of the Protecting Americans’ Data 
From Foreign Surveillance Act of 2023, 
and any categories of sensitive personal 
data added to such section after such date 
of enactment; 
‘‘(v) information provided by the advi-
sory committee established pursuant to 
paragraph (7); and 
‘‘(vi) the recommendations (which the 
Secretary shall request) of— 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(I) experts in privacy, civil 
rights, and civil liberties, identified by 
the National Academy of Sciences; 
and 
‘‘(II) 
experts 
on 
the 
First 
Amendment to the Constitution of the 
United States identified by the Amer-
ican Bar Association; and 
‘‘(B) take into account— 
‘‘(i) the significant quantity of per-
sonal data of covered individuals that is 
publicly available by law or has already 
been stolen or acquired by foreign govern-
ments or foreign adversaries; 
‘‘(ii) the harm to United States na-
tional security caused by the theft or ac-
quisition of that personal data; 
‘‘(iii) the potential for further harm to 
United States national security if that per-
sonal data were combined with additional 
sources of personal data; 
‘‘(iv) the fact that non-sensitive per-
sonal data, when analyzed in the aggre-
gate, can reveal sensitive personal data; 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(v) the commercial availability of in-
ferred and derived data; and 
‘‘(vi) the potential for especially sig-
nificant harm from data and inferences re-
lated to sensitive domains, such as health, 
work, education, criminal justice, and fi-
nance. 
‘‘(6) NOTICE
AND
COMMENT
PERIOD.—The 
Secretary shall provide for a public notice and com-
ment period after the publication in the Federal 
Register of a proposed rule, and before the publica-
tion of a final rule— 
‘‘(A) identifying the initial list of cat-
egories of personal data under subparagraph 
(A) of paragraph (2); 
‘‘(B) adding categories to, removing cat-
egories from, or modifying categories on, that 
list under subparagraph (B) of that paragraph; 
‘‘(C) establishing or updating the threshold 
under paragraph (3); or 
‘‘(D) setting forth the period of time for 
which encryption technology described in sub-
section (b)(4)(A)(iii) is required under para-
graph (4) to be able to protect such a category 
of data from decryption. 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(7) ADVISORY COMMITTEE.— 
‘‘(A) IN
GENERAL.—The Secretary shall 
establish an advisory committee to advise the 
Secretary with respect to privacy and sensitive 
personal data. 
‘‘(B) MEMBERSHIP.—The committee es-
tablished pursuant to subparagraph (A) shall 
include the following members selected by the 
Secretary: 
‘‘(i) Experts on privacy and cyberse-
curity. 
‘‘(ii) Representatives of United States 
private sector companies, industry associa-
tions, and scholarly societies. 
‘‘(iii) Representatives of civil society 
groups, including such groups focused on 
protecting civil rights and civil liberties. 
‘‘(C) APPLICABILITY
OF
FEDERAL
ADVI-
SORY
COMMITTEE
ACT.—Subsections (a)(1), 
(a)(3), and (b) of section 10 and sections 11, 
13, and 14 of the Federal Advisory Committee 
Act (5 U.S.C. App.) shall not apply to the advi-
sory committee established pursuant to sub-
paragraph (A). 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(8) TREATMENT OF ANONYMIZED PERSONAL 
DATA.— 
‘‘(A) IN GENERAL.—In carrying out this 
subsection, 
the 
Secretary 
may 
not 
treat 
anonymized personal data differently than iden-
tifiable personal data unless the Secretary is 
confident, 
based 
on 
the 
method 
of 
anonymization used and the period of time de-
termined under paragraph (4) for protection of 
the category of personal data involved, it will 
not be possible for well-resourced adversaries, 
including foreign governments, to re-identify 
the individuals to which the anonymized per-
sonal data relates, such as by using other 
sources of data, including non-public data ob-
tained through hacking and espionage, and rea-
sonably anticipated advances in technology. 
‘‘(B) GUIDANCE.—The Under Secretary of 
Commerce for Standards and Technology shall 
issue guidance to the public with respect to 
methods for anonymizing data and how to de-
termine if individuals to which the anonymized 
personal data relates can be, or are likely in the 
future to be, reasonably identified, such as by 
using other sources of data. 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(9) SENSE OF CONGRESS ON IDENTIFICATION 
OF
CATEGORIES
OF
PERSONAL
DATA.—It is the 
sense of Congress that, in identifying categories of 
personal data of covered individuals under para-
graph (1), the Secretary should, to the extent rea-
sonably possible and in coordination with the Sec-
retary of the Treasury and the Director of the Office 
of Management and Budget, harmonize those cat-
egories with the categories of sensitive personal data 
described in paragraph (5)(A)(iv). 
‘‘(b) COMMERCE CONTROLS.— 
‘‘(1) CONTROLS
REQUIRED.—Beginning 18 
months after the date of the enactment of the Pro-
tecting Americans’ Data From Foreign Surveillance 
Act of 2023, the Secretary shall impose appropriate 
controls under the Export Administration Regula-
tions on the export or reexport to, or in-country 
transfer in, all countries (other than countries on 
the list required by paragraph (2)(D)) of covered 
personal data in a manner that exceeds the applica-
ble threshold established under subsection (a)(3), in-
cluding through interim controls (such as by inform-
ing a person that a license is required for export, re-
export, or in-country transfer of covered personal 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
data), as appropriate, or by publishing additional 
regulations. 
‘‘(2) LEVELS OF CONTROL.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (C) or (D), the Secretary shall— 
‘‘(i) require a license or other author-
ization for the export, reexport, or in-coun-
try transfer of covered personal data in a 
manner that exceeds the applicable thresh-
old established under subsection (a)(3); 
‘‘(ii) determine whether that export, 
reexport, or in-country transfer is likely to 
harm the national security of the United 
States— 
‘‘(I) after consideration of the 
matters described in subparagraph 
(B); and 
‘‘(II) in coordination with the 
heads of the appropriate Federal 
agencies; and 
‘‘(iii) if the Secretary determines 
under clause (ii) that the export, reexport, 
or in-country transfer is likely to harm the 
national security of the United States, 
deny the application for the license or 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
other authorization for the export, reex-
port, or in-country transfer. 
‘‘(B) CONSIDERATIONS.—In determining 
under clause (ii) of subparagraph (A) whether 
an export, reexport, or in-country transfer of 
covered personal data described in clause (i) of 
that subparagraph is likely to harm the na-
tional security of the United States, the Sec-
retary, in coordination with the heads of the ap-
propriate Federal agencies, shall take into ac-
count— 
‘‘(i) the adequacy and enforcement of 
data protection, surveillance, and export 
control laws in the foreign country to 
which the covered personal data would be 
exported or reexported, or in which the 
covered personal data would be trans-
ferred, in order to determine whether such 
laws, and the enforcement of such laws, 
are sufficient to— 
‘‘(I) protect the covered personal 
data from accidental loss, theft, and 
unauthorized or unlawful processing; 
‘‘(II) ensure that the covered per-
sonal data is not exploited for intel-
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
ligence purposes by foreign govern-
ments to the detriment of the national 
security of the United States; and 
‘‘(III) prevent the reexport of the 
covered personal data to a third coun-
try for which a license would be re-
quired for such data to be exported 
directly from the United States; 
‘‘(ii) the circumstances under which 
the government of the foreign country can 
compel, coerce, or pay a person in or na-
tional of that country to disclose the cov-
ered personal data; and 
‘‘(iii) whether that government has 
conducted hostile foreign intelligence oper-
ations, including information operations, 
against the United States. 
‘‘(C) LICENSE
REQUIREMENT
AND
PRE-
SUMPTION
OF
DENIAL
FOR
CERTAIN
COUN-
TRIES.— 
‘‘(i) IN
GENERAL.—The Secretary 
shall— 
‘‘(I) require a license or other au-
thorization for the export or reexport 
to, or in-country transfer in, a coun-
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
try on the list required by clause (ii) 
of covered personal data in a manner 
that exceeds the threshold established 
under subsection (a)(3); and 
‘‘(II) deny an application for 
such a license or other authorization 
unless the person seeking the license 
or authorization demonstrates to the 
satisfaction of the Secretary that the 
export, reexport, or in-country trans-
fer will not harm the national security 
of the United States. 
‘‘(ii) LIST REQUIRED.— 
‘‘(I) IN
GENERAL.—Not later 
than one year after the date of the en-
actment of the Protecting Americans’ 
Data From Foreign Surveillance Act 
of 2023, the Secretary shall (subject 
to subclause (III)) establish a list of 
each country with respect to which the 
Secretary determines that the export 
or reexport to, or in-country transfer 
in, the country of covered personal 
data in a manner that exceeds the ap-
plicable threshold established under 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(cc) based on the consider-
ations described in subparagraph 
(B). 
‘‘(D) NO
LICENSE
REQUIREMENT
FOR 
CERTAIN COUNTRIES.— 
‘‘(i) IN
GENERAL.—The Secretary 
may not require a license or other author-
ization for the export or reexport to, or in- 
country transfer in, a country on the list 
required by clause (ii) of covered personal 
data, without regard to the applicable 
threshold established under subsection 
(a)(3). 
‘‘(ii) LIST REQUIRED.— 
‘‘(I) IN
GENERAL.—Not later 
than one year after the date of the en-
actment of the Protecting Americans’ 
Data From Foreign Surveillance Act 
of 2023, the Secretary shall (subject 
to clause (iii) and subclause (III)), es-
tablish a list of each country with re-
spect to which the Secretary deter-
mines that the export or reexport to, 
or in-country transfer in, the country 
of covered personal data (without re-
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
gard to any threshold established 
under subsection (a)(3)) will not harm 
the national security of the United 
States. 
‘‘(II) MODIFICATIONS TO LIST.— 
The Secretary (subject to clause (iii) 
and subclause (III))— 
‘‘(aa) may add a country to 
or remove a country from the list 
required by subclause (I) at any 
time; and 
‘‘(bb) shall review that list 
not less frequently than every 5 
years. 
‘‘(III) 
CONCURRENCE; 
CON-
SULTATIONS; CONSIDERATIONS.—The 
Secretary shall establish the list re-
quired by subclause (I) and add a 
country to or remove a country from 
that list under subclause (II)— 
‘‘(aa) with the concurrence 
of the Secretary of State; 
‘‘(bb) in consultation with 
the heads of the appropriate Fed-
eral agencies; and 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(cc) based on the consider-
ations described in subparagraph 
(B). 
‘‘(iii) CONGRESSIONAL REVIEW.— 
‘‘(I) IN GENERAL.—The list re-
quired by clause (ii) and any updates 
to that list adding or removing coun-
tries shall take effect, for purposes of 
clause (i), on the date that is 180 
days after the Secretary submits to 
the appropriate congressional commit-
tees a proposal for the list or update 
unless there is enacted into law, be-
fore that date, a joint resolution of 
disapproval pursuant to subclause 
(II). 
‘‘(II) JOINT RESOLUTION OF DIS-
APPROVAL.— 
‘‘(aa) JOINT
RESOLUTION 
OF
DISAPPROVAL
DEFINED.—In 
this clause, the term ‘joint reso-
lution of disapproval’ means a 
joint resolution the matter after 
the resolving clause of which is 
as follows: ‘That Congress does 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
not approve of the proposal of 
the Secretary with respect to the 
list 
required 
by 
section 
1758A(b)(2)(D)(ii) submitted to 
Congress on lll.’, with the 
blank space being filled with the 
appropriate date. 
‘‘(bb) 
PROCEDURES.—The 
procedures set forth in para-
graphs (4)(C), (5), (6), and (7) 
of section 2523(d) of title 18, 
United States Code, apply with 
respect to a joint resolution of 
disapproval under this clause to 
the same extent and in the same 
manner as such procedures apply 
to a joint resolution of dis-
approval 
under 
such 
section 
2523(d), except that paragraph 
(6) of such section shall be ap-
plied and administered by sub-
stituting 
‘the 
Committee 
on 
Banking, Housing, and Urban 
Affairs’ for ‘the Committee on 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
the Judiciary’ each place it ap-
pears. 
‘‘(III) RULES OF HOUSE OF REP-
RESENTATIVES
AND
SENATE.—This 
clause is enacted by Congress— 
‘‘(aa) as an exercise of the 
rulemaking power of the Senate 
and the House of Representa-
tives, respectively, and as such is 
deemed a part of the rules of 
each House, respectively, and su-
persedes other rules only to the 
extent that it is inconsistent with 
such rules; and 
‘‘(bb) with full recognition of 
the constitutional right of either 
House to change the rules (so far 
as relating to the procedure of 
that House) at any time, in the 
same manner, and to the same 
extent as in the case of any other 
rule of that House. 
‘‘(3) REVIEW OF LICENSE APPLICATIONS.— 
‘‘(A) IN GENERAL.—The Secretary shall, 
consistent with the provisions of section 1756 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
and in coordination with the heads of the ap-
propriate Federal agencies— 
‘‘(i) review applications for a license 
or other authorization for the export or re-
export to, or in-country transfer in, a re-
stricted country of covered personal data 
in a manner that exceeds the applicable 
threshold established under subsection 
(a)(3); and 
‘‘(ii) establish procedures for con-
ducting the review of such applications. 
‘‘(B) DISCLOSURES
RELATING
TO
COL-
LABORATIVE ARRANGEMENTS.—In the case of 
an application for a license or other authoriza-
tion for an export, reexport, or in-country 
transfer described in subparagraph (A)(i) sub-
mitted by or on behalf of a joint venture, joint 
development agreement, or similar collaborative 
arrangement, the Secretary may require the ap-
plicant to identify, in addition to any foreign 
person participating in the arrangement, any 
foreign person with significant ownership inter-
est in a foreign person participating in the ar-
rangement. 
‘‘(4) EXCEPTIONS.— 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(A) IN
GENERAL.—The Secretary shall 
not impose under paragraph (1) a requirement 
for a license or other authorization with respect 
to the export, reexport, or in-country transfer of 
covered personal data pursuant to any of the 
following transactions: 
‘‘(i) The export, reexport, or in-coun-
try transfer by an individual of covered 
personal data that specifically pertains to 
that individual. 
‘‘(ii) The export, reexport, or in-coun-
try transfer of the personal data of one or 
more individuals by a person performing a 
service for those individuals if the service 
could not possibly be performed (as defined 
by the Secretary in regulations) without 
the export, reexport, or in-country transfer 
of that personal data. 
‘‘(iii) The export, reexport, or in-coun-
try transfer of personal data that is 
encrypted if— 
‘‘(I) the encryption key or other 
information necessary to decrypt the 
data is not, at the time of the export, 
reexport, or in-country transfer of the 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
personal data or any other time, ex-
ported, reexported, or transferred to a 
restricted country or (except as pro-
vided in subparagraph (B)) a national 
of a restricted country; and 
‘‘(II) the encryption technology 
used to protect the data against 
decryption is certified by the National 
Institute of Standards and Tech-
nology as capable of protecting data 
for the period of time determined 
under subsection (a)(4) to be suffi-
cient to prevent the exploitation of the 
data by a foreign government or for-
eign adversary from harming the na-
tional security of the United States. 
‘‘(iv) The export, reexport, or in-coun-
try transfer of personal data that is or-
dered by an appropriate court of the 
United States. 
‘‘(B) EXCEPTION FOR CERTAIN NATIONALS 
OF
RESTRICTED
COUNTRIES.—Subparagraph 
(A)(iii)(I) does not apply with respect to an in-
dividual who is a national of a restricted coun-
try if the individual is also a citizen of the 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
United States or a noncitizen described in sub-
section (l)(5)(C). 
‘‘(c) REQUIREMENTS FOR IDENTIFICATION OF CAT-
EGORIES AND DETERMINATION OF APPROPRIATE CON-
TROLS.—In identifying categories of personal data under 
subsection (a)(1) and imposing appropriate controls under 
subsection (b), the Secretary, in coordination with the 
heads of the appropriate Federal agencies, as appro-
priate— 
‘‘(1) may not regulate or restrict the publica-
tion or sharing of— 
‘‘(A) personal data that is a matter of pub-
lic record, such as a court record or other gov-
ernment record that is generally available to the 
public, including information about an indi-
vidual made public by that individual or by the 
news media; 
‘‘(B) information about a matter of public 
interest; or 
‘‘(C) any other information the publication 
or sharing of which is protected by the First 
Amendment to the Constitution of the United 
States; and 
‘‘(2) shall consult with the appropriate congres-
sional committees. 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(d) PENALTIES.— 
‘‘(1) LIABLE PERSONS.— 
‘‘(A) IN
GENERAL.—In addition to any 
person that commits an unlawful act described 
in subsection (a) of section 1760, an officer or 
employee of an organization has committed an 
unlawful act subject to penalties under that sec-
tion if the officer or employee knew or should 
have known that another employee of the orga-
nization who reports, directly or indirectly, to 
the officer or employee was directed to export, 
reexport, or in-country transfer covered per-
sonal data in violation of this section and subse-
quently did export, reexport, or in-country 
transfer such data. 
‘‘(B) EXCEPTIONS AND CLARIFICATIONS.— 
‘‘(i) INTERMEDIARIES NOT LIABLE.— 
An intermediate consignee (as defined in 
section 772.1 of the Export Administration 
Regulations (or any successor regulation)) 
or other intermediary is not liable for the 
export, reexport, or in-country transfer of 
covered personal data in violation of this 
section when acting as an intermediate 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
consignee or other intermediary for an-
other person. 
‘‘(ii) SPECIAL RULE FOR CERTAIN AP-
PLICATIONS.—In a case in which an appli-
cation installed on an electronic device 
transmits or causes the transmission of 
covered personal data without being di-
rected to do so by the owner or user of the 
device who installed the application, the 
developer of the application, and not the 
owner or user of the device, is liable for 
any violation of this section. 
‘‘(2) CRIMINAL PENALTIES.—In determining an 
appropriate term of imprisonment under section 
1760(b)(2) with respect to a person for a violation 
of this section, the court shall consider— 
‘‘(A) how many covered individuals had 
their covered personal data exported, reex-
ported, or in-country transferred in violation of 
this section; 
‘‘(B) any harm that resulted from the vio-
lation; and 
‘‘(C) the intent of the person in commit-
ting the violation. 
‘‘(e) REPORT TO CONGRESS.— 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) IN GENERAL.—Not less frequently than 
annually, the Secretary, in coordination with the 
heads of the appropriate Federal agencies, shall sub-
mit to the appropriate congressional committees a 
report on the results of actions taken pursuant to 
this section. 
‘‘(2) INCLUSIONS.—Each report required by 
paragraph (1) shall include a description of the de-
terminations made under subsection (b)(2)(A)(ii) 
during the preceding year. 
‘‘(3) FORM.—Each report required by para-
graph (1) shall be submitted in unclassified form but 
may include a classified annex. 
‘‘(f) DISCLOSURE OF CERTAIN LICENSE INFORMA-
TION.— 
‘‘(1) IN GENERAL.—Not less frequently than 
every 90 days, the Secretary shall publish on a pub-
licly accessible website of the Department of Com-
merce, including in a machine-readable format, the 
information specified in paragraph (2), with respect 
to each application— 
‘‘(A) for a license for the export or reex-
port to, or in-country transfer in, a restricted 
country of covered personal data in a manner 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
that exceeds the applicable threshold established 
under subsection (a)(3); and 
‘‘(B) with respect to which the Secretary 
made a decision in the preceding 90-day period. 
‘‘(2) INFORMATION SPECIFIED.—The informa-
tion specified in this paragraph with respect to an 
application described in paragraph (1) is the fol-
lowing: 
‘‘(A) The name of the applicant. 
‘‘(B) The date of the application. 
‘‘(C) The name of the foreign party to 
which the applicant sought to export, reexport, 
or transfer the data. 
‘‘(D) The categories of covered personal 
data the applicant sought to export, reexport, 
or transfer. 
‘‘(E) The number of covered individuals 
whose information the applicant sought to ex-
port, reexport, or transfer. 
‘‘(F) Whether the application was ap-
proved or denied. 
‘‘(g) NEWS MEDIA PROTECTIONS.—A person that is 
engaged in journalism is not subject to restrictions im-
posed under this section to the extent that those restric-
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
tions directly infringe on the journalism practices of that 
person. 
‘‘(h) CITIZENSHIP DETERMINATIONS BY PERSONS 
PROVIDING SERVICES TO END-USERS NOT REQUIRED.— 
This section does not require a person that provides prod-
ucts or services to an individual to determine the citizen-
ship or immigration status of the individual, but once the 
person becomes aware that the individual is a covered indi-
vidual, the person shall treat covered personal data of that 
individual as is required by this section. 
‘‘(i) FEES.— 
‘‘(1) IN
GENERAL.—Notwithstanding section 
1756(c), the Secretary may, to the extent provided 
in advance in appropriations Acts, assess and collect 
a fee, in an amount determined by the Secretary in 
regulations, with respect to each application for a li-
cense submitted under subsection (b). 
‘‘(2) DEPOSIT AND AVAILABILITY OF FEES.— 
Notwithstanding section 3302 of title 31, United 
States Code, fees collected under paragraph (1) 
shall— 
‘‘(A) be credited as offsetting collections to 
the account providing appropriations for activi-
ties carried out under this section; 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) be available, to the extent and in the 
amounts provided in advance in appropriations 
Acts, to the Secretary solely for use in carrying 
out activities under this section; and 
‘‘(C) remain available until expended. 
‘‘(j) REGULATIONS.—The Secretary may prescribe 
such regulations as are necessary to carry out this section. 
‘‘(k) AUTHORIZATION OF APPROPRIATIONS.—There 
are authorized to be appropriated to the Secretary and 
to the head of each of the appropriate Federal agencies 
participating in carrying out this section such sums as 
may be necessary to carry out this section, including to 
hire additional employees with expertise in privacy. 
‘‘(l) DEFINITIONS.—In this section: 
‘‘(1) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘appropriate congressional com-
mittees’ means— 
‘‘(A) the Committee on Banking, Housing, 
and Urban Affairs, the Committee on Foreign 
Relations, the Committee on Finance, and the 
Select Committee on Intelligence of the Senate; 
and 
‘‘(B) the Committee on Foreign Affairs, 
the Committee on Ways and Means, and the 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
Permanent Select Committee on Intelligence of 
the House of Representatives. 
‘‘(2) APPROPRIATE FEDERAL AGENCIES.—The 
term ‘appropriate Federal agencies’ means the fol-
lowing: 
‘‘(A) The Department of Defense. 
‘‘(B) The Department of State. 
‘‘(C) The Department of Justice. 
‘‘(D) The Department of the Treasury. 
‘‘(E) The Office of the Director of Na-
tional Intelligence. 
‘‘(F) The Office of Science and Technology 
Policy. 
‘‘(G) The Department of Homeland Secu-
rity. 
‘‘(H) The Consumer Financial Protection 
Bureau. 
‘‘(I) The Federal Trade Commission. 
‘‘(J) The Federal Communications Com-
mission. 
‘‘(K) The Department of Health and 
Human Services. 
‘‘(L) Such other Federal agencies as the 
Secretary considers appropriate. 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(3) COVERED
INDIVIDUAL.—The term ‘cov-
ered individual’, with respect to personal data, 
means an individual who, at the time the data is ac-
quired— 
‘‘(A) is located in the United States; or 
‘‘(B) is— 
‘‘(i) located outside the United States 
or whose location cannot be determined; 
and 
‘‘(ii) a citizen of the United States or 
a noncitizen lawfully admitted for perma-
nent residence. 
‘‘(4) COVERED
PERSONAL
DATA.—The term 
‘covered personal data’ means the categories of per-
sonal data of covered individuals identified pursuant 
to subsection (a). 
‘‘(5) EXPORT.— 
‘‘(A) IN
GENERAL.—The term ‘export’, 
with respect to covered personal data, in-
cludes— 
‘‘(i) subject to subparagraph (D), the 
shipment or transmission of the data out 
of the United States, including the sending 
or taking of the data out of the United 
States, in any manner, if the shipment or 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
transmission is intentional, without regard 
to whether the shipment or transmission 
was intended to go out of the United 
States; or 
‘‘(ii) the release or transfer of the 
data to any noncitizen (other than a non-
citizen described in subparagraph (C)), if 
the release or transfer is intentional, with-
out regard to whether the release or trans-
fer was intended to be to a noncitizen. 
‘‘(B) EXCEPTIONS.—The term ‘export’ 
does not include— 
‘‘(i) the publication of covered per-
sonal data on the internet in a manner 
that makes the data discoverable by and 
accessible to any member of the general 
public; or 
‘‘(ii) any activity protected by the 
speech or debate clause of the Constitution 
of the United States. 
‘‘(C) NONCITIZENS DESCRIBED.—A noncit-
izen described in this subparagraph is a noncit-
izen who is authorized to be employed in the 
United States. 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(D) 
TRANSMISSIONS
THROUGH
RE-
STRICTED COUNTRIES.— 
‘‘(i) IN GENERAL.—On and after the 
date that is 5 years after the date of the 
enactment of the Protecting Americans’ 
Data From Foreign Surveillance Act of 
2023, and except as provided in clause 
(iii), the term ‘export’ includes the trans-
mission of data through a restricted coun-
try, without regard to whether the person 
originating the transmission had knowl-
edge of or control over the path of the 
transmission. 
‘‘(ii) EXCEPTIONS.—Clause (i) does 
not apply with respect to a transmission of 
data through a restricted country if— 
‘‘(I) the data is encrypted as de-
scribed in subsection (b)(4)(A)(iii); or 
‘‘(II) the person that originated 
the transmission received a represen-
tation from the party delivering the 
data for the person stating that the 
data will not transit through a re-
stricted country. 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(iii) FALSE
REPRESENTATIONS.—If 
a party delivering covered personal data as 
described in clause (ii)(II) transmits the 
data directly or indirectly through a re-
stricted country despite making the rep-
resentation described in clause (ii)(II), that 
party shall be liable for violating this sec-
tion. 
‘‘(6) FOREIGN ADVERSARY.—The term ‘foreign 
adversary’ has the meaning given that term in sec-
tion 8(c)(2) of the Secure and Trusted Communica-
tions Networks Act of 2019 (47 U.S.C. 1607(c)(2)). 
‘‘(7) IN-COUNTRY TRANSFER; REEXPORT.—The 
terms ‘in-country transfer’ and ‘reexport’, with re-
spect to personal data, shall have the meanings 
given those terms in regulations prescribed by the 
Secretary. 
‘‘(8) LAWFULLY
ADMITTED
FOR
PERMANENT 
RESIDENCE; NATIONAL.—The terms ‘lawfully admit-
ted for permanent residence’ and ‘national’ have the 
meanings given those terms in section 101(a) of the 
Immigration 
and 
Nationality 
Act 
(8 
U.S.C. 
1101(a)). 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
‘‘(9) 
NONCITIZEN.—The 
term 
‘noncitizen’ 
means an individual who is not a citizen or national 
of the United States. 
‘‘(10) RESTRICTED COUNTRY.—The term ‘re-
stricted country’ means a country for which a license 
or other authorization is required under subsection 
(b) for the export or reexport to, or in-country 
transfer in, that country of covered personal data in 
a manner that exceeds the applicable threshold es-
tablished under subsection (a)(3).’’. 
(b) STATEMENT OF POLICY.—Section 1752 of the 
Export Control Reform Act of 2018 (50 U.S.C. 4811) is 
amended— 
(1) in paragraph (1)— 
(A) in subparagraph (A), by striking ‘‘; 
and’’ and inserting a semicolon; 
(B) in subparagraph (B), by striking the 
period at the end and inserting ‘‘; and’’; and 
(C) by adding at the end the following: 
‘‘(C) to restrict, notwithstanding section 
203(b) of the International Emergency Eco-
nomic Powers Act (50 U.S.C. 1702(b)), the ex-
port of personal data of United States citizens 
and other covered individuals (as defined in sec-
tion 1758A(l)) in a quantity and a manner that 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
could harm the national security of the United 
States.’’; and 
(2) in paragraph (2), by adding at the end the 
following: 
‘‘(H) To prevent the exploitation of per-
sonal data of United States citizens and other 
covered individuals (as defined in section 
1758A(l)) in a quantity and a manner that 
could harm the national security of the United 
States.’’. 
(c) LIMITATION ON AUTHORITY TO MAKE EXCEP-
TIONS TO LICENSING REQUIREMENTS.—Section 1754 of 
the Export Control Reform Act of 2018 (50 U.S.C. 4813) 
is amended— 
(1) in subsection (a)(14), by inserting ‘‘and 
subject to subsection (g)’’ after ‘‘as warranted’’; and 
(2) by adding at the end the following: 
‘‘(g) LIMITATION ON AUTHORITY TO MAKE EXCEP-
TIONS
TO LICENSING REQUIREMENTS.—The Secretary 
may create under subsection (a)(14) exceptions to licens-
ing requirements under section 1758A only for the export, 
reexport, or in-country transfer of covered personal data 
(as defined in subsection (l) of that section) by or for a 
Federal department or agency.’’. 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS
(d) RELATIONSHIP TO INTERNATIONAL EMERGENCY 
ECONOMIC POWERS ACT.—Section 1754(b) of the Export 
Control Reform Act of 2018 (50 U.S.C. 4813(b)) is 
amended by inserting ‘‘(other than section 1758A)’’ after 
‘‘this part’’. 
SEC. 4. SEVERABILITY. 
If any provision of or any amendment made by this 
Act, or the application of any such provision or amend-
ment to any person or circumstance, is held to be uncon-
stitutional, the remainder of the provisions of and amend-
ments made by this Act, and the application of such provi-
sions and amendments to any other person or cir-
cumstance, shall not be affected. 
Æ 
VerDate Sep 11 2014 
23:26 Jul 07, 2023
Jkt 039200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6301
E:\BILLS\H4108.IH
H4108
kjohnson on DSK79L0C42PROD with BILLS