Wyden, Lummis, Whitehouse, Hagerty, Heinrich and Rubio Introduce Bipartisan Bill to Protect Americans’ Data from Unfriendly Foreign Nations, Bar TikTok Employees in China From Accessing U.S. Information

Washington, D.C. – U.S. Senator Ron Wyden, D-Ore., and Sen. Cynthia Lummis, R-Wyo., today introduced legislation to protect Americans’ data from being exploited by unfriendly foreign nations, and apply tough criminal and civil penalties to prevent employees of foreign corporations like TikTok from accessing U.S. data from abroad…

The Protecting Americans’ Data From Foreign Surveillance Act of 2023 updates the previously introduced bill to include new protections against foreign-owned companies like TikTok accessing U.S. data from abroad, or sending data to unfriendly foreign nations. This bill:

• Directs the Secretary of Commerce, in consultation with other key agencies, to identify categories of personal data that, if exported, could harm U.S. national security.
• Directs the Secretary of Commerce to compile a list of low-risk countries, where data can be shared without restrictions, a list of high-risk countries where exports of sensitive data will be blocked, and create a system to issue licenses for data exports to nations not on either list. The risk status of countries will be determined based on:
  • the adequacy and enforcement of the country’s privacy and export control laws
  • the circumstances under which the foreign government can compel, coerce, or pay a person in that country to disclose personal data
  • whether that foreign government has conducted hostile foreign intelligence operations against the United States.
• In addition to regulating bulk exports, the bill also regulates all exports of personal data by data brokers and firms like TikTok directly to restricted foreign governments, to parent companies in restricted foreign countries and to persons designated on the Bureau of Industry and Security’s Entity List. 
• Exempts from the new export rules data encrypted with NIST-approved technology.
• Ensures the export rules do not apply to journalism and other First Amendment protected speech. 
• Applies export control penalties to senior executives who knew or should have known that employees below them were directed to illegally export Americans’ personal data.

The bill has been endorsed by the Electronic Privacy Information Center, the R Street Institute and Justin Sherman, senior fellow and data brokerage research lead, and David Hoffman, professor of cybersecurity policy, Duke University Sanford School of Public Policy, experts on the sale and exploitation of Americans’ data.

Read the full bill here.