Brandon Pugh, director of cybersecurity and emerging threats at the R Street Institute, a right-leaning think tank, told CyberScoop that the new proposed regulations represent a “partial solution” to the problem of foreign countries gathering Americans’ personal data, but noted that current laws and regulations around data privacy in the United States still offer numerous pathways to accomplish the same goal.

“There are definitely ways that adversaries … are going to access this data, and this is not going to address them all,” Pugh said. “They can steal it, they can rely on data in breaches — or cause the breaches themselves.”