1. Short title
This Act may be cited as the “National Security and Personal Data Protection Act of 2019”.
National Security and Personal Data Protection Act of 2019
A BILL
To safeguard data of Americans from foreign governments that pose risks to national security by imposing data security requirements and strengthening review of foreign investments, and for other purposes.
2. Definitions
In this Act:
Commission— The term Commission means the Federal Trade Commission.
Country of concern—
In general— Subject to subparagraph (B)(iii), the term country of concern means—
the People's Republic of China;
the Russian Federation; and
any other country designated by the Secretary of State as being of concern with respect to the protection of data privacy and security.
Designation of countries of concern— Not later than 1 year after the date of enactment of this Act, and annually thereafter, the Secretary of State shall—
review the status of data privacy and security requirements (including by reviewing laws, policies, practices, and regulations related to data privacy and security) in each foreign country to determine—
whether it would pose a substantial risk to the national security of the United States if the government of such country gained access to the user data of citizens and residents of the United States; and
whether there is a substantial risk that the government of such country will, in a manner that fails to afford similar respect for civil liberties and privacy as the Constitution and laws of the United States, obtain user data from companies that collect user data;
designate each country that meets the criteria of clause (i) as a country of concern; and
remove the designation from any country that was previously designated a country of concern (regardless of whether such designation was pursuant to clause (i) or (ii) of subparagraph (A) or was made by the Secretary of State pursuant to clause (iii) of such subparagraph) if the country—
no longer meets the criteria of clause (i); and
is not at substantial risk of meeting such criteria.
Regulations— Not later than 90 days after the date of the enactment of this Act, the Secretary of State shall prescribe regulations—
establishing a process for a covered technology company or country of concern to petition the Secretary to remove the country of concern designation from a country that was designated as such pursuant to subparagraph (B)(ii); and
setting forth the procedures and criteria the Secretary will use in identifying or removing countries under subparagraphs (A)(iii) or (B)(iii).
Covered technology company— The term covered technology company means an entity that provides an online data-based service such as a website or internet application in or affecting interstate or foreign commerce and—
is organized under the laws of a country of concern;
in which foreign persons that are nationals of, or companies that are organized under the laws of, countries of concern have a plurality or controlling equity interest;
is a subsidiary company of an entity described in subparagraph (A) or (B); or
is otherwise subject to the jurisdiction of a country of concern in a manner that allows the country of concern to obtain the user data of citizens and residents of the United States without similar respect for civil liberties and privacy as provided under the Constitution and laws of the United States.
Facial recognition technology— The term facial recognition technology means technology that analyzes facial features in still or video images and is used to identify, or facilitate identification of, an individual using facial physical characteristics.
Targeted advertising—
In general— The term targeted advertising means a form of advertising where advertisements are displayed to a user based on the user’s traits, information from a profile about the user that is created for the purpose of selling advertisements, or the user’s previous online or offline behavior.
Limitation— Such term shall not include advertising chosen because of the context of the internet service, such as—
advertising that is directed to a user based on the content of the website, online service, online application, or mobile application that the user is connected to; or
advertising that is directed to a user by the operator of a website, online service, online application, or mobile application based on the search terms that the user used to arrive at such website, service, or application.
User data— The term user data means any information obtained by an entity that provides a data-based service such as a website or internet application that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked with an individual who is a citizen or resident of the United States without regard to whether such information is directly submitted by the individual to the entity, is derived by the entity from the observed activity of the individual, or is obtained by the entity by any other means.
3. Data security requirements for covered technology companies
In general— The following requirements shall apply to a covered technology company:
Minimal collection of data— The company shall not collect any more user data than is necessary for the operation of the website, service, or application of the company.
Prohibition on secondary uses— The company shall not use any user data collected under paragraph (1) for any purpose that is secondary to the operation of the website, service, or application of the company, including providing targeted advertising, unnecessarily sharing such data with a third party, or unnecessarily facilitating facial recognition technology.
Right to view and delete data— The company shall allow an individual to—
view any user data held by the company that relates to the individual; and
permanently delete any user data held by the company that has been collected, directly or indirectly, from the individual.
Prohibition on transfer to countries of concern— The company shall not transfer any user data or information needed to decipher that data, such as encryption keys, to any country of concern (including indirectly through a third country that is not a country of concern).
Data storage requirement— The company shall not store any user data collected from citizens or residents of the United States or information needed to decipher that data, such as encryption keys, on a server or other data storage device that is located outside of the United States or a country that maintains an agreement with the United States to share data with law enforcement agencies through a process established by law.
Reporting requirement— Not less frequently than annually, the chief executive officer or equivalent officer of the company shall submit, under penalty of perjury, a report to the Commission, the Attorney General of the United States, and the Attorney General of each State certifying compliance with the requirements of this section.
Exceptions—
Exception for law enforcement and military— The requirements of paragraphs (1) through (4) of subsection (a) shall not apply where data is collected, used, retained, stored, or shared by a covered technology company solely for the purpose of assisting a law enforcement or military agency that is not affiliated with a country of concern.
Transfer of shared content— The requirements of paragraph (4) and (5) of subsection (a) shall not apply to user data that is content produced by a user for the purpose of sharing with other users (such as social media posts, emails, or data related to a transaction involving the user) or information needed to decipher that data provided that the transfer and any storage necessary to enact the transfer is conducted solely to carry out the user’s intent to share such data with individual users in other countries and that necessary storage occurs only on the intended recipient's individual device.
Effective date— The requirements of this section shall take effect 90 days after the date of enactment of this Act.
4. Data security requirements for other technology companies
In general— The following requirements shall apply to any company operating in or affecting interstate or foreign commerce that provides a data-based service such as a website or internet application but is not a covered technology company:
Prohibition on transfer to countries of concern— The company shall not transfer any user data collected from an individual in the United States or information needed to decipher that data, such as encryption keys, to any country of concern (including indirectly through a third country that is not a country of concern).
Prohibition on storing data in countries of concern— The company shall not store any user data collected from an individual in the United States or information needed to decipher that data, such as encryption keys, on a server or other data storage device that is located in any country of concern.
Exceptions—
Exception for law enforcement and military— The requirements of subsection (a) shall not apply where data is collected, used, retained, stored, or shared by a covered technology company solely for the purpose of assisting a law enforcement or military agency that is not affiliated with a country of concern.
Transfer of shared content— The requirements of subsection (a) shall not apply to user data that is content produced by a user for the purpose of sharing with other users (such as social media posts, emails, or data related to a transaction involving the user) or information needed to decipher that data provided that the transfer and any storage necessary to enact the transfer is conducted solely to carry out the user’s intent to share such data with individual users in other countries and that necessary storage occurs only on the intended recipient's individual device.
Effective date— The requirements of this section shall take effect 90 days after the date of enactment of this Act.
5. Enforcement of data security requirements
Enforcement by the Commission—
In general— Except as otherwise provided, sections 3 and 4 shall be enforced by the Commission under the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
Unfair or deceptive acts or practices— A violation of section 3 or 4 shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Actions by the Commission— Except as otherwise provided, the Commission shall prevent any person from violating section 3 or 4 in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act, and any person who violates such section shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.
Authority preserved— Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law.
Criminal penalty—
Offense— It shall be unlawful to knowingly cause a technology company to violate a requirement of section 3 or 4.
Penalty— Any person who violates paragraph (1) shall be imprisoned for not more than 5 years, fined under title 18, United States Code, or both.
Enforcement by State attorneys general—
In general—
Civil actions— In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that violates section 3 or 4, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States or a State court of appropriate jurisdiction to—
enjoin that practice;
enforce compliance with such section;
on behalf of residents of the State, obtain damages, statutory damages, restitution, or other compensation, each of which shall be distributed in accordance with State law; or
obtain such other relief as the court may consider to be appropriate.
Notice—
In general— Before filing an action under subparagraph (A), the attorney general of the State involved shall provide to the Commission—
written notice of that action; and
a copy of the complaint for that action.
Exemption—
In general— Clause (i) shall not apply with respect to the filing of an action by an attorney general of a State under this paragraph if the attorney general of the State determines that it is not feasible to provide the notice described in that clause before the filing of the action.
Notification— In an action described in subclause (I), the attorney general of a State shall provide notice and a copy of the complaint to the Commission at the same time as the attorney general files the action.
Intervention—
In general— On receiving notice under paragraph (1)(B), the Commission shall have the right to intervene in the action that is the subject of the notice.
Effect of intervention— If the Commission intervenes in an action under paragraph (1), it shall have the right—
to be heard with respect to any matter that arises in that action; and
to file a petition for appeal.
Construction— For purposes of bringing any civil action under paragraph (1), nothing in this Act shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State to—
conduct investigations;
administer oaths or affirmations; or
compel the attendance of witnesses or the production of documentary and other evidence.
Actions by the Commission— In any case in which an action is instituted by or on behalf of the Commission for violation of section 3 or 4, no State may, during the pendency of that action, institute an action under paragraph (1) against any defendant named in the complaint in the action instituted by or on behalf of the Commission for that violation.
Venue; service of process—
Venue— Any action brought under paragraph (1) may be brought in—
the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or
a State court of competent jurisdiction.
Service of process— In an action brought under paragraph (1) in a district court of the United States, process may be served wherever defendant—
is an inhabitant; or
may be found.
Private right of action—
In general— Any individual who suffers injury as a result of an act, practice, or omission of a covered technology company that violates section 3 may bring a civil action against such company in any court of competent jurisdiction.
Relief— In a civil action brought under paragraph (1) in which the plaintiff prevails, the court may award such plaintiff up to $1,000 for each day that such plaintiff was affected by a violation of section 3 (up to a maximum of $15,000 per each such violation per plaintiff).
6. Requirement for approval of Committee on Foreign Investment in the United States of certain transactions
Section 721(b) of the Defense Production Act of 1950 (50 U.S.C. 4565(b)) is amended by adding at the end the following:
“(9) Approval required for certain transactions
“(A) In general—A covered transaction described in subparagraph (C) is prohibited unless the Committee—
“(i) reviews the transaction under this subsection; and
“(ii) determines that the transaction does not pose a risk to the national security of the United States.
“(B) Mitigation—The Committee, or a lead agency on behalf of the Committee, may negotiate, enter into or impose, and enforce an agreement or condition under subsection (l)(3) with any party to a covered transaction described in subparagraph (C) to mitigate any risk to the national security of the United States that arises as a result of the covered transaction.
“(C) Covered transaction described—A covered transaction described in this subparagraph is a transaction that could result in foreign control of a United States company—
“(i) that collects, sells, buys, or processes user data (as defined in section 2 of the National Security and Personal Data Protection Act of 2019) and whose business consists substantially more of transferring data than manufacturing, delivering, repairing, or servicing physical goods or providing physical services; or
“(ii) that operates a social media platform or website.”