S.Amdt. 1882

SA 1882. Mr. LEE submitted an amendment intended to be proposed by
him to the bill H.R. 815, to amend title 38, United States Code, to
make certain improvements relating to the eligibility of veterans to
receive reimbursement for emergency treatment furnished through the
Veterans Community Care program, and for other purposes; which was
ordered to lie on the table; as follows:

At the appropriate place, insert the following:

SEC. ___. PROHIBITION ON TRANSFER OF SENSITIVE DATA OF UNITED
STATES CITIZENS TO FOREIGN ADVERSARIES.

(a) Prohibition.--Subject to subsection (b), it shall be
unlawful for an individual or business operating in the
United States to sell, license, rent, trade, transfer,
release, disclose, provide access to, or otherwise make
available the sensitive data of another United States citizen
to--
(1) any foreign adversary; or
(2) any entity that is beholden to a foreign adversary.
(b) Exclusion.--The prohibition under subsection (a) shall
not apply to the extent that an individual or business--
(1) is transmitting data, or is providing or maintaining a
specific platform or service to transfer data, at the express
direction and consent of an individual (or such individual's
next of kin in the event that such an individual is
incapacitated) between such individual and 1 or more
individuals;
(2) is reporting, publishing, or otherwise making available
news or information that is available to the general public,
including information from a telephone book or online
directory, a television, internet, or radio program, the news
media, or an internet site that is available to the general
public on an unrestricted basis, but not including an obscene
visual depiction (as such term is used in section 1460 of
title 18, United States Code);
(3) is participating in research or research and
development activities (as defined in section 9 of the Small
Business Act (15 U.S.C. 638)) in a foreign country, unless
such country is a foreign country of concern (as defined in
section 9901 of the William M. (Mac) Thornberry National
Defense Authorization Act for Fiscal Year 2021 (15 U.S.C.
4651); or
(4) is an individual operating in a non-commercial context.
(c) Enforcement .--
(1) By the commission.--
(A) Unfair or deceptive acts or practices.--A violation of
this section shall be treated as a violation of a rule
defining an unfair or a deceptive act or practice under
section 18(a)(1)(B) of the Federal Trade Commission Act (15
U.S.C. 57a(a)(1)(B)).
(B) Powers of the commission.--
(i) In general.--The Commission shall enforce this section
in the same manner, by the same means, and with the same
jurisdiction, powers, and duties as though all applicable
terms and provisions of the Federal Trade Commission Act (15
U.S.C. 41 et seq.) were incorporated into and made a part of
this section.
(ii) Privileges and immunities.--Any person who violates
this section shall be subject to the penalties and entitled
to the privileges and immunities provided in the Federal
Trade Commission Act.
(iii) Authority preserved.--Nothing in this section may be
construed to limit the authority of the Commission under any
other provision of law.
(2) By states.--
(A) In general.--In any case in which the attorney general
of a State has reason to believe that an interest of the
residents of the State has been or is threatened or adversely
affected by the engagement of any person in a practice that
violates this section, the attorney general of the State may,
as parens patriae, bring a civil action on behalf of the
residents of the State in an appropriate district court of
the United States--
(i) to enjoin further violation of such section by such
person;
(ii) to compel compliance with such section; and
(iii) to obtain damages, restitution, or other compensation
on behalf of such residents.
(B) Investigatory powers.--Nothing in this paragraph may be
construed to prevent the attorney general of a State from
exercising the powers conferred on the attorney general by
the laws of the State to conduct investigations, to
administer oaths or affirmations, or to compel the attendance
of witnesses or the production of documentary or other
evidence.
(C) Venue; service of process.--
(i) Venue.--Any action brought under subparagraph (A) may
be brought in--

(I) the district court of the United States that meets
applicable requirements relating to venue under section 1391
of title 28, United States Code; or
(II) another court of competent jurisdiction.

(ii) Service of process.--In an action brought under
subparagraph (A), process may be served in any district in
which the defendant--

(I) is an inhabitant; or
(II) may be found.

[[Page S3034]]

(d) Inapplicability of National Emergency Requirement.--The
requirements of section 202 of the International Emergency
Economic Powers Act (50 U.S.C. 1701) shall not apply for
purposes of this section.
(e) Definitions.--In this section:
(1) Beholden to a foreign adversary.--The term ``beholden
to a foreign adversary'' means, with respect to an individual
or business, that--
(A) such individual or business acts as a representative,
employee, or servant of a foreign adversary or of a person
whose activities are directly or indirectly supervised,
directed, financed, or subsidized in whole or in major part
by a foreign adversary; or
(B) such individual is a member of a foreign political
party.
(2) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(3) Express direction and consent.--The term ``express
direction and consent''--
(A) means, with the respect to the disclosure of sensitive
data, the informed, opt-in, voluntary, specific, and
unambiguous written consent (which may include written
consent provided by electronic means) to the disclosure of
such data by the individual to whom the data pertains; and
(B) does not include--
(i) consent secured without first providing to the
individual a clear and conspicuous disclosure, apart from any
privacy policy, terms of service, terms of use, general
release, user agreement, or other similar document, of all
information material to the provision of consent;
(ii) consent secured by the individual hovering over,
muting, pausing, or closing a given piece of content; or
(iii) an agreement obtained through the use of a user
interface designed or manipulated with the substantial effect
of subverting or impairing user autonomy, decision making, or
choice.
(4) Foreign adversary.--The term ``foreign adversary''
means a country specified in section 4872(d)(2) of title 10,
United States Code.
(5) Foreign political party.--The term ``foreign political
party'' includes any organization or any other combination of
individuals in a foreign adversary, or any unit or branch
thereof, having for an aim or purpose, or which is engaged in
any activity devoted in whole or in part to, the
establishment, administration, control, or acquisition of
administration or control, of a government of a foreign
adversary or a subdivision thereof.
(6) Precise geolocation information.--The term ``precise
geolocation information'' means information that--
(A) is derived from a device or technology; and
(B) reveals the past, present, or historical physical
location of an individual or device that identifies or is
linked or reasonably linkable to 1 or more individuals, with
sufficient precision to identify street level location
information of an individual or device or the location of an
individual or device within a range of 1,850 feet or less.
(7) Sensitive data.--The term ``sensitive data'' includes
the following:
(A) A government-issued identifier, such as a Social
Security number, passport number, or driver's license number.
(B) Any information that describes or reveals the past,
present, or future physical health, mental health,
disability, diagnosis, or healthcare condition or treatment
of an individual.
(C) A financial account number, debit card number, credit
card number, or information that describes or reveals the
income level or bank account balances of an individual.
(D) Biometric information.
(E) Genetic information.
(F) Precise geolocation information.
(G) An individual's private communications such as
voicemails, emails, texts, direct messages, mail, voice
communications, and video communications, or information
identifying the parties to such communications or pertaining
to the transmission of such communications, including
telephone numbers called, telephone numbers from which calls
were placed, the time calls were made, call duration, and
location information of the parties to the call.
(H) Account or device log-in credentials, or security or
access codes for an account or device.
(I) Information identifying the sexual behavior of an
individual.
(J) Calendar information, address book information, phone
or text logs, photos, audio recordings, or videos, maintained
for private use by an individual, regardless of whether such
information is stored on the individual's device or is
accessible from that device and is backed up in a separate
location.
(K) A photograph, film, video recording, or other similar
medium that shows the naked or undergarment-clad private area
of an individual.
(L) Information revealing the video content requested or
selected by an individual.
(M) Information about an individual under the age of 18.
(N) An individual's race, color, ethnicity, or religion.
(O) Information identifying an individual's online
activities over time and across websites or online services.
(P) Information that reveals the status of an individual as
a member of the Armed Forces.
(Q) Any other data that an individual or business operating
in the United States sells, licenses, rents, trades,
transfers, releases, discloses, provides access to, or
otherwise makes available to a foreign government, or
individual or business that is beholden to a foreign
adversary, for the purpose of identifying the types of data
listed in subparagraphs (A) through (P).
(f) Rules of Construction.--
(1) National security.--Nothing in this Act may be
construed to prevent legal country-to-country data transfer
between the United States and allies of the United States if
such transfer is in direct support of the national security
missions and objectives of the United States government.
(2) Criminal investigation compliance.--Nothing in this Act
may be construed to prevent any individual or business
operating in the United States from fully complying with any
lawful criminal investigation.
(3) Emergency transfer of personal data.--Nothing in this
Act may be construed to prevent an individual from providing
their own sensitive data, or that of a dependent, at the
express direction and consent of the individual in the event
of a medical emergency.
(g) Non-preemption of State Law.--
(1) In general.--Nothing in this Act, or a regulation
promulgated under this Act, shall be construed to preempt,
displace, or supplant any State law, expect to the extent
that a provision of State law conflicts with a provision of
this Act, or a regulation promulgated under this Act, and
then only to the extent of the conflict.
(2) State law conflict meaning.--For the purposes of this
subsection, a provision of State law does not conflict with a
provision of this Act, or a regulation promulgated under this
Act, if such provision of State law provides greater privacy
protection than the privacy protection provided by such
provision of this Act or such regulation.
(h) Effective Date.--This section shall take effect on the
date that is 60 days after the date of the enactment of this
Act.
______