Missouri Senator Josh Hawley introduced the National Security and Personal Data Protection Act to combat and restrict the flow of personal data to China and other countries that threaten America’s national security.

Under the proposed legislation, American companies would be prohibited from transferring user data or encryption keys to foreign countries that threaten national security, while also prohibiting those companies from storing data in foreign countries.

For more details and the entire release from the Senator Hawley, read below

WASHINGTON — Today U.S. Senator Josh Hawley (R-Mo.) introduced the National Security and Personal Data Protection Act to combat the flow of Americans’ sensitive personal data to China and countries that similarly threaten America’s national security. The introduction of this legislation follows a Senate Judiciary Subcommittee on Crime and Terrorism hearing chaired by Senator Hawley that explored the tech industry’s ties to China. During the hearing, experts testified that Apple’s decision to store iCloud encryption keys in China and TikTok’s ties to the Chinese government pose a threat to America’s national security.

Senator Hawley said, “Current law makes it far too easy for hostile foreign governments like China to access Americans’ sensitive data. Chinese companies with vast amounts of personal data on Americans are required by Chinese law to provide that data to Chinese intelligence services. If your child uses TikTok, there’s a chance the Chinese Communist Party knows where they are, what they look like, what their voices sound like, and what they’re watching. That’s a feature TikTok doesn’t advertise.

“And it’s not just Chinese companies that create this risk. Chinese law allows the Communist Party to seize data from American companies operating in China whenever it wants, for whatever reason it wants. This legislation takes crucial steps to stop Americans’ sensitive data from falling into the hands of hostile foreign governments.”

A one-pager on the bill can be found here and below.

BACKGROUND:

China and countries that similarly threaten America’s national security are taking steps to vacuum up our sensitive data: 

• Today, countries like China can acquire and use personal data in ways that pose a grave threat to America’s national security. As revealed last week, China could use “images of our servicemen and women” obtained from sites like TikTok to train its autonomous weapons.[1] U.S. officials currently are assessing TikTok for national security reasons.[2] China also could build or steal massive profiles on Americans. And China could use aggregate location data from phones to identify bridges or roads to target for sabotage.

Senator Hawley’s bill cuts off the flow of sensitive data to China and countries that similarly threaten America’s national security:

• Some American companies agree to give sensitive data to China in exchange for entering the Chinese market. As FBI Director Christopher Wray testified, Chinese law “compels U.S. companies that are operating in China . . .  to provide whatever information the government wants whenever it wants.”[3] This law means that when American companies store encryption keys in China, China can read the messages those keys protect.

• • Senator Hawley’s bill prohibits American companies from transferring user data or encryption keys to China and other countries that similarly threaten America’s national security.

• • Senator Hawley’s bill prohibits American companies from storing data in China and other countries that similarly threaten America’s national security.

• China can obtain data by inserting its own companies into the United States where those companies then collect data on unsuspecting Americans.
  • For Chinese companies, and companies from other countries that similarly threaten America’s national security, Senator Hawley’s bill:

• • • Prohibits transferring user data or encryption keys to those countries or storing that data in those countries.

• • • Prohibits collecting more data than necessary to provide a service here

• • • Prohibits using collected data for secondary purposes

• China and other countries that similarly threaten America’s national security, can purchase American companies that already have collected information on Americans.
  • Senator Hawley’s bill changes the default rule for mergers of certain companies to block those mergers unless companies obtain pre-approval from CFIUS.