[Congressional Record Volume 170, Number 71 (Tuesday, April 23, 2024)]
[Senate]
[Pages S3033-S3034]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 1882. Mr. LEE submitted an amendment intended to be proposed by 
him to the bill H.R. 815, to amend title 38, United States Code, to 
make certain improvements relating to the eligibility of veterans to 
receive reimbursement for emergency treatment furnished through the 
Veterans Community Care program, and for other purposes; which was 
ordered to lie on the table; as follows:

       At the appropriate place, insert the following:

     SEC. ___. PROHIBITION ON TRANSFER OF SENSITIVE DATA OF UNITED 
                   STATES CITIZENS TO FOREIGN ADVERSARIES.

       (a) Prohibition.--Subject to subsection (b), it shall be 
     unlawful for an individual or business operating in the 
     United States to sell, license, rent, trade, transfer, 
     release, disclose, provide access to, or otherwise make 
     available the sensitive data of another United States citizen 
     to--
       (1) any foreign adversary; or
       (2) any entity that is beholden to a foreign adversary.
       (b) Exclusion.--The prohibition under subsection (a) shall 
     not apply to the extent that an individual or business--
       (1) is transmitting data, or is providing or maintaining a 
     specific platform or service to transfer data, at the express 
     direction and consent of an individual (or such individual's 
     next of kin in the event that such an individual is 
     incapacitated) between such individual and 1 or more 
     individuals;
       (2) is reporting, publishing, or otherwise making available 
     news or information that is available to the general public, 
     including information from a telephone book or online 
     directory, a television, internet, or radio program, the news 
     media, or an internet site that is available to the general 
     public on an unrestricted basis, but not including an obscene 
     visual depiction (as such term is used in section 1460 of 
     title 18, United States Code);
       (3) is participating in research or research and 
     development activities (as defined in section 9 of the Small 
     Business Act (15 U.S.C. 638)) in a foreign country, unless 
     such country is a foreign country of concern (as defined in 
     section 9901 of the William M. (Mac) Thornberry National 
     Defense Authorization Act for Fiscal Year 2021 (15 U.S.C. 
     4651); or
       (4) is an individual operating in a non-commercial context.
       (c) Enforcement .--
       (1) By the commission.--
       (A) Unfair or deceptive acts or practices.--A violation of 
     this section shall be treated as a violation of a rule 
     defining an unfair or a deceptive act or practice under 
     section 18(a)(1)(B) of the Federal Trade Commission Act (15 
     U.S.C. 57a(a)(1)(B)).
       (B) Powers of the commission.--
       (i) In general.--The Commission shall enforce this section 
     in the same manner, by the same means, and with the same 
     jurisdiction, powers, and duties as though all applicable 
     terms and provisions of the Federal Trade Commission Act (15 
     U.S.C. 41 et seq.) were incorporated into and made a part of 
     this section.
       (ii) Privileges and immunities.--Any person who violates 
     this section shall be subject to the penalties and entitled 
     to the privileges and immunities provided in the Federal 
     Trade Commission Act.
       (iii) Authority preserved.--Nothing in this section may be 
     construed to limit the authority of the Commission under any 
     other provision of law.
       (2) By states.--
       (A) In general.--In any case in which the attorney general 
     of a State has reason to believe that an interest of the 
     residents of the State has been or is threatened or adversely 
     affected by the engagement of any person in a practice that 
     violates this section, the attorney general of the State may, 
     as parens patriae, bring a civil action on behalf of the 
     residents of the State in an appropriate district court of 
     the United States--
       (i) to enjoin further violation of such section by such 
     person;
       (ii) to compel compliance with such section; and
       (iii) to obtain damages, restitution, or other compensation 
     on behalf of such residents.
       (B) Investigatory powers.--Nothing in this paragraph may be 
     construed to prevent the attorney general of a State from 
     exercising the powers conferred on the attorney general by 
     the laws of the State to conduct investigations, to 
     administer oaths or affirmations, or to compel the attendance 
     of witnesses or the production of documentary or other 
     evidence.
       (C) Venue; service of process.--
       (i) Venue.--Any action brought under subparagraph (A) may 
     be brought in--

       (I) the district court of the United States that meets 
     applicable requirements relating to venue under section 1391 
     of title 28, United States Code; or
       (II) another court of competent jurisdiction.

       (ii) Service of process.--In an action brought under 
     subparagraph (A), process may be served in any district in 
     which the defendant--

       (I) is an inhabitant; or
       (II) may be found.

[[Page S3034]]

       (d) Inapplicability of National Emergency Requirement.--The 
     requirements of section 202 of the International Emergency 
     Economic Powers Act (50 U.S.C. 1701) shall not apply for 
     purposes of this section.
       (e) Definitions.--In this section:
       (1) Beholden to a foreign adversary.--The term ``beholden 
     to a foreign adversary'' means, with respect to an individual 
     or business, that--
       (A) such individual or business acts as a representative, 
     employee, or servant of a foreign adversary or of a person 
     whose activities are directly or indirectly supervised, 
     directed, financed, or subsidized in whole or in major part 
     by a foreign adversary; or
       (B) such individual is a member of a foreign political 
     party.
       (2) Commission.--The term ``Commission'' means the Federal 
     Trade Commission.
       (3) Express direction and consent.--The term ``express 
     direction and consent''--
       (A) means, with the respect to the disclosure of sensitive 
     data, the informed, opt-in, voluntary, specific, and 
     unambiguous written consent (which may include written 
     consent provided by electronic means) to the disclosure of 
     such data by the individual to whom the data pertains; and
       (B) does not include--
       (i) consent secured without first providing to the 
     individual a clear and conspicuous disclosure, apart from any 
     privacy policy, terms of service, terms of use, general 
     release, user agreement, or other similar document, of all 
     information material to the provision of consent;
       (ii) consent secured by the individual hovering over, 
     muting, pausing, or closing a given piece of content; or
       (iii) an agreement obtained through the use of a user 
     interface designed or manipulated with the substantial effect 
     of subverting or impairing user autonomy, decision making, or 
     choice.
       (4) Foreign adversary.--The term ``foreign adversary'' 
     means a country specified in section 4872(d)(2) of title 10, 
     United States Code.
       (5) Foreign political party.--The term ``foreign political 
     party'' includes any organization or any other combination of 
     individuals in a foreign adversary, or any unit or branch 
     thereof, having for an aim or purpose, or which is engaged in 
     any activity devoted in whole or in part to, the 
     establishment, administration, control, or acquisition of 
     administration or control, of a government of a foreign 
     adversary or a subdivision thereof.
       (6) Precise geolocation information.--The term ``precise 
     geolocation information'' means information that--
       (A) is derived from a device or technology; and
       (B) reveals the past, present, or historical physical 
     location of an individual or device that identifies or is 
     linked or reasonably linkable to 1 or more individuals, with 
     sufficient precision to identify street level location 
     information of an individual or device or the location of an 
     individual or device within a range of 1,850 feet or less.
       (7) Sensitive data.--The term ``sensitive data'' includes 
     the following:
       (A) A government-issued identifier, such as a Social 
     Security number, passport number, or driver's license number.
       (B) Any information that describes or reveals the past, 
     present, or future physical health, mental health, 
     disability, diagnosis, or healthcare condition or treatment 
     of an individual.
       (C) A financial account number, debit card number, credit 
     card number, or information that describes or reveals the 
     income level or bank account balances of an individual.
       (D) Biometric information.
       (E) Genetic information.
       (F) Precise geolocation information.
       (G) An individual's private communications such as 
     voicemails, emails, texts, direct messages, mail, voice 
     communications, and video communications, or information 
     identifying the parties to such communications or pertaining 
     to the transmission of such communications, including 
     telephone numbers called, telephone numbers from which calls 
     were placed, the time calls were made, call duration, and 
     location information of the parties to the call.
       (H) Account or device log-in credentials, or security or 
     access codes for an account or device.
       (I) Information identifying the sexual behavior of an 
     individual.
       (J) Calendar information, address book information, phone 
     or text logs, photos, audio recordings, or videos, maintained 
     for private use by an individual, regardless of whether such 
     information is stored on the individual's device or is 
     accessible from that device and is backed up in a separate 
     location.
       (K) A photograph, film, video recording, or other similar 
     medium that shows the naked or undergarment-clad private area 
     of an individual.
       (L) Information revealing the video content requested or 
     selected by an individual.
       (M) Information about an individual under the age of 18.
       (N) An individual's race, color, ethnicity, or religion.
       (O) Information identifying an individual's online 
     activities over time and across websites or online services.
       (P) Information that reveals the status of an individual as 
     a member of the Armed Forces.
       (Q) Any other data that an individual or business operating 
     in the United States sells, licenses, rents, trades, 
     transfers, releases, discloses, provides access to, or 
     otherwise makes available to a foreign government, or 
     individual or business that is beholden to a foreign 
     adversary, for the purpose of identifying the types of data 
     listed in subparagraphs (A) through (P).
       (f) Rules of Construction.--
       (1) National security.--Nothing in this Act may be 
     construed to prevent legal country-to-country data transfer 
     between the United States and allies of the United States if 
     such transfer is in direct support of the national security 
     missions and objectives of the United States government.
       (2) Criminal investigation compliance.--Nothing in this Act 
     may be construed to prevent any individual or business 
     operating in the United States from fully complying with any 
     lawful criminal investigation.
       (3) Emergency transfer of personal data.--Nothing in this 
     Act may be construed to prevent an individual from providing 
     their own sensitive data, or that of a dependent, at the 
     express direction and consent of the individual in the event 
     of a medical emergency.
       (g) Non-preemption of State Law.--
       (1) In general.--Nothing in this Act, or a regulation 
     promulgated under this Act, shall be construed to preempt, 
     displace, or supplant any State law, expect to the extent 
     that a provision of State law conflicts with a provision of 
     this Act, or a regulation promulgated under this Act, and 
     then only to the extent of the conflict.
       (2) State law conflict meaning.--For the purposes of this 
     subsection, a provision of State law does not conflict with a 
     provision of this Act, or a regulation promulgated under this 
     Act, if such provision of State law provides greater privacy 
     protection than the privacy protection provided by such 
     provision of this Act or such regulation.
       (h) Effective Date.--This section shall take effect on the 
     date that is 60 days after the date of the enactment of this 
     Act.
                                 ______