Wyden Proposes Limits on US Data Exportation

Proposed Legislation to Restrict International Data Sales

Senator Ron Wyden, representing Oregon (D-OR), has introduced a preliminary bill designed to regulate the international sale of personal information by technology companies. The proposed legislation also outlines restrictions on the nations to which this data can be legally transferred.

Concerns Over the Global Data Trade

While the bill’s specifics are broad, it signals a growing awareness at the federal level regarding the complexities of the international data market. Senator Wyden stated, “Data brokers should not profit by selling the private information of American citizens to foreign nations that might exploit it to jeopardize our national security.”

Categorizing Consumer Data

The “Protecting Americans’ Data From Foreign Surveillance Act” would initiate a process to classify and safeguard consumer data as a tradable commodity on a global scale. Currently, there are limited regulations governing the sale of personally identifiable information – such as purchasing patterns, location data, and political affiliations – to international entities.

For example, a U.S.-based data broker could potentially sell the purchasing preferences and residential addresses of millions of Americans to a Chinese financial institution for investment analysis. While some of this exchange may be benign and even beneficial for international trade, determining the threshold between acceptable commerce and potential harm remains a challenge.

Defining Protected Data and Restricted Countries

Currently, there is no established framework defining which data sales are permissible and to whom, similar to the controls placed on intellectual property or weapons exports. The proposed law would task the Secretary of Commerce with identifying sensitive data and the countries posing a risk.

Data deemed potentially harmful to U.S. national security if exported would be subject to restrictions. Sales would be prohibited to nations with insufficient data protection measures, a history of intelligence operations against the U.S., or legal frameworks that compel data disclosure to their governments. This primarily targets countries like China and Russia, although the U.S. itself possesses similar capabilities.

Exceptions and Penalties

The legislation includes exceptions for journalistic activities, speech protected by the First Amendment, and encrypted data – such as storing encrypted communications on servers within targeted countries.

Executives who knowingly or should have known about illegal data exports would face penalties. Furthermore, the bill establishes avenues for individuals harmed or detained abroad due to illegally exported data to seek redress. An example would be the use of American facial recognition technology by a foreign government to identify and apprehend an individual.

A Deliberately Broad Approach

The bill’s intentionally broad scope is designed to allow expert agencies to conduct thorough studies and provide detailed reports to Congress. This legislation represents an initial step in defining the parameters of acceptable data commerce and providing notice that certain practices will soon be unlawful, with a focus on holding company leaders accountable.

Considerations for Existing Data Practices

The legislation must account for existing data storage and processing arrangements utilized by companies for economic and legal reasons. The free flow of data is essential for global businesses that require constant interaction, and imposing excessive regulations or fees could negatively impact certain regions or industries.

These considerations will likely be addressed during the required studies, highlighting the complex and delicate nature of the digital ecosystem this law aims to regulate.

Next Steps in the Legislative Process

As this is an early stage of regulation, and the bill is just beginning its journey through the legislative process, it is anticipated that several months will pass before further developments occur.