A bipartisan bill introduced by U.S. Senators Ron Wyden (D-OR) and Cynthia Lummis (R-WY) aims to protect Americans’ data from being exported abroad and exploited by “high-risk” foreign countries. The legislation proposes criminal and civil penalties for companies that illegally export digital information, with six legislators from both the Senate and the House of Representatives co-sponsoring the bill.
The bill seeks to address the sale of Americans’ sensitive information to buyers in countries like China and Russia, aiming to restrict data flow to unfriendly nations while strengthening relationships with countries that prioritize privacy protections.
The bill focuses on safeguarding various types of sensitive information, including health-care records, geolocation data, and web-browsing activity, from potential adversaries. Senator Martin Heinrich (D-N.M.), a co-sponsor of the bill, emphasized the increasing value of data and the need to treat it with appropriate care.
The Director of National Intelligence, Avril Haines, has consistently raised concerns about the risks associated with unrestricted commercial data sales and has expressed commitment to reducing such possibilities.
This legislation builds upon a previous version and directs the secretary of Commerce to identify categories of personal data that could pose a threat to national security if sent abroad.
It aims to prevent high-risk countries from receiving sensitive data and proposes a program to license data exports to countries not classified as low- or high-risk. Determinations of risk will be based on factors such as the privacy and export control laws of a country and whether the foreign government has engaged in hostile foreign intelligence operations against the United States.
The bill also includes export control penalties specifically targeting senior executives of corporations who knew or should have known about the illegal export of Americans’ personal data by employees below them. It aims to regulate the export of personal data by data brokers and platforms like TikTok.
However, the bill exempts data encrypted with technology approved by the National Institute of Standards and Technology, and it does not apply export rules to activities protected by the First Amendment, such as journalism and other speech-related endeavors.
