15 U.S.C. § 9901 — Prohibition on transfer of personally

Page 2622 TITLE 15—COMMERCE AND TRADE § 9804 (3) facilitating sports and recreation events and activities in the United States. (e) Recovery strategies (1) In general Not later than 1 year after amounts are ap- propriated to the Department of Commerce to accomplish the purposes of this section, the Assistant Secretary, in consultation with the entities referred to in subsection (a)(3), shall develop recovery strategies for the travel and tourism industry in response to the economic impacts of the COVID–19 pandemic and in an- ticipation of other unpredictable catastrophic events that would significantly affect the travel and tourism industry, such as hurri- canes, floods, tsunamis, tornadoes, wildfires, terrorist attacks, and pandemics. (2) Cost-benefit analysis In developing the recovery strategies under paragraph (1), the Assistant Secretary shall conduct cost-benefit analyses that take into account the health and economic effects of public health mitigation measures on the travel and tourism industry. (f) Reporting requirements (1) Assistant Secretary The Assistant Secretary, subject to the availability of appropriations, shall produce an annual forecasting report on the travel and tourism industry, which shall include current and anticipated— (A) domestic employment needs; (B) international inbound volume and spending, taking into account the lasting ef- fects of the COVID–19 public health emer- gency and the impact of the recovery strat- egy implemented pursuant to subsection (e)(1); and (C) domestic volume and spending, includ- ing Federal and State public land travel and tourism data. (2) Bureau of Economic Analysis The Director of the Bureau of Economic Analysis, subject to the availability of appro- priations and to the extent feasible, should make quarterly updates to the Travel and Tourism Satellite Accounts, including— (A) State-level travel and tourism spend- ing data; (B) travel and tourism workforce data for full-time and part-time employment; and (C) Federal and State public lands outdoor recreational activity and tourism spending data. (3) National Travel and Tourism Office The Director of the National Travel and Tourism Office— (A) in partnership with the Bureau of Eco- nomic Analysis and other relevant Federal agencies, shall provide a monthly report on international arrival and spending data to— (i) the Travel and Tourism Advisory Board; and (ii) the public through a publicly acces- sible website; and (B) shall include questions in the Survey of International Air Travelers regarding wait-times, visits to public lands, and State data, to the extent applicable. (Pub. L. 117–328, div. BB, title VI, § 605, Dec. 29, 2022, 136 Stat. 5567.) § 9804. Travel and tourism strategy Not less frequently than once every 10 years, the Secretary of Commerce, in consultation with the United States Travel and Tourism Ad- visory Board, the Tourism Policy Council, the Secretary of State, and the Secretary of Home- land Security, shall develop and submit to Con- gress a 10-year travel and tourism strategy, which shall include— (1) the establishment of goals with respect to the number of annual international visitors to the United States and the annual amount of travel and tourism commerce in the United States during such 10-year period; (2) the resources needed to achieve the goals established pursuant to paragraph (1); and (3) recommendations for statutory or regu- latory changes that would be necessary to achieve such goals. (Pub. L. 117–328, div. BB, title VI, § 606, Dec. 29, 2022, 136 Stat. 5569.) § 9805. Data on domestic travel and tourism The Assistant Secretary of Commerce for Travel and Tourism, subject to the availability of appropriations, shall collect and make public aggregate data on domestic travel and tourism trends. (Pub. L. 117–328, div. BB, title VI, § 608, Dec. 29, 2022, 136 Stat. 5570.) CHAPTER 123—PROTECTING AMERICANS’ DATA FROM FOREIGN ADVERSARIES Sec. 9901. Prohibition on transfer of personally identifi- able sensitive data of United States individ- uals to foreign adversaries. § 9901. Prohibition on transfer of personally identifiable sensitive data of United States individuals to foreign adversaries (a) Prohibition It shall be unlawful for a data broker to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available personally identifiable sensitive data of a United States individual to— (1) any foreign adversary country; or (2) any entity that is controlled by a foreign adversary. (b) Enforcement by Federal Trade Commission (1) Unfair or deceptive acts or practices A violation of this section shall be treated as a violation of a rule defining an unfair or a deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). (2) Powers of Commission (A) In general The Commission shall enforce this section in the same manner, by the same means, and Page 2623 TITLE 15—COMMERCE AND TRADE § 9901 with the same jurisdiction, powers, and du- ties as though all applicable terms and pro- visions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section. (B) Privileges and immunities Any person who violates this section shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act. (3) Authority preserved Nothing in this section may be construed to limit the authority of the Commission under any other provision of law. (c) Definitions In this section: (1) Commission The term ‘‘Commission’’ means the Federal Trade Commission. (2) Controlled by a foreign adversary The term ‘‘controlled by a foreign adver- sary’’ means, with respect to an individual or entity, that such individual or entity is— (A) a foreign person that is domiciled in, is headquartered in, has its principal place of business in, or is organized under the laws of a foreign adversary country; (B) an entity with respect to which a for- eign person or combination of foreign per- sons described in subparagraph (A) directly or indirectly own at least a 20 percent stake; or (C) a person subject to the direction or control of a foreign person or entity de- scribed in subparagraph (A) or (B). (3) Data broker (A) In general The term ‘‘data broker’’ means an entity that, for valuable consideration, sells, li- censes, rents, trades, transfers, releases, dis- closes, provides access to, or otherwise makes available data of United States indi- viduals that the entity did not collect di- rectly from such individuals to another enti- ty that is not acting as a service provider. (B) Exclusion The term ‘‘data broker’’ does not include an entity to the extent such entity— (i) is transmitting data of a United States individual, including communica- tions of such an individual, at the request or direction of such individual; (ii) is providing, maintaining, or offering a product or service with respect to which personally identifiable sensitive data, or access to such data, is not the product or service; (iii) is reporting or publishing news or information that concerns local, national, or international events or other matters of public interest; (iv) is reporting, publishing, or otherwise making available news or information that is available to the general public— (I) including information from— (aa) a book, magazine, telephone book, or online directory; (bb) a motion picture; (cc) a television, internet, or radio program; (dd) the news media; or (ee) an internet site that is available to the general public on an unre- stricted basis; and (II) not including an obscene visual de- piction (as such term is used in section 1460 of title 18); or (v) is acting as a service provider. (4) Foreign adversary country The term ‘‘foreign adversary country’’ means a country specified in section 4872(d)(2) of title 10. (5) Personally identifiable sensitive data The term ‘‘personally identifiable sensitive data’’ means any sensitive data that identifies or is linked or reasonably linkable, alone or in combination with other data, to an individual or a device that identifies or is linked or rea- sonably linkable to an individual. (6) Precise geolocation information The term ‘‘precise geolocation information’’ means information that— (A) is derived from a device or technology of an individual; and (B) reveals the past or present physical lo- cation of an individual or device that identi- fies or is linked or reasonably linkable to 1 or more individuals, with sufficient preci- sion to identify street level location infor- mation of an individual or device or the lo- cation of an individual or device within a range of 1,850 feet or less. (7) Sensitive data The term ‘‘sensitive data’’ includes the fol- lowing: (A) A government-issued identifier, such as a Social Security number, passport num- ber, or driver’s license number. (B) Any information that describes or re- veals the past, present, or future physical health, mental health, disability, diagnosis, or healthcare condition or treatment of an individual. (C) A financial account number, debit card number, credit card number, or information that describes or reveals the income level or bank account balances of an individual. (D) Biometric information. (E) Genetic information. (F) Precise geolocation information. (G) An individual’s private communica- tions such as voicemails, emails, texts, di- rect messages, mail, voice communications, and video communications, or information identifying the parties to such communica- tions or pertaining to the transmission of such communications, including telephone numbers called, telephone numbers from which calls were placed, the time calls were made, call duration, and location informa- tion of the parties to the call. (H) Account or device log-in credentials, or security or access codes for an account or device. Page 2624 TITLE 15—COMMERCE AND TRADE § 9901 (I) Information identifying the sexual be- havior of an individual. (J) Calendar information, address book in- formation, phone or text logs, photos, audio recordings, or videos, maintained for private use by an individual, regardless of whether such information is stored on the individ- ual’s device or is accessible from that device and is backed up in a separate location. (K) A photograph, film, video recording, or other similar medium that shows the naked or undergarment-clad private area of an in- dividual. (L) Information revealing the video con- tent requested or selected by an individual. (M) Information about an individual under the age of 17. (N) An individual’s race, color, ethnicity, or religion. (O) Information identifying an individual’s online activities over time and across websites or online services. (P) Information that reveals the status of an individual as a member of the Armed Forces. (Q) Any other data that a data broker sells, licenses, rents, trades, transfers, re- leases, discloses, provides access to, or oth- erwise makes available to a foreign adver- sary country, or entity that is controlled by a foreign adversary, for the purpose of iden- tifying the types of data listed in subpara- graphs (A) through (P). (8) Service provider The term ‘‘service provider’’ means an enti- ty that— (A) collects, processes, or transfers data on behalf of, and at the direction of— (i) an individual or entity that is not a foreign adversary country or controlled by a foreign adversary; or (ii) a Federal, State, Tribal, territorial, or local government entity; and (B) receives data from or on behalf of an individual or entity described in subpara- graph (A)(i) or a Federal, State, Tribal, ter- ritorial, or local government entity. (9) United States individual The term ‘‘United States individual’’ means a natural person residing in the United States. (d) Effective date This section shall take effect on the date that is 60 days after April 24, 2024. (Pub. L. 118–50, div. I, § 2, Apr. 24, 2024, 138 Stat. 960.) Editorial Notes REFERENCES IN TEXT The Federal Trade Commission Act, referred to in subsec. (b)(2), is act Sept. 26, 1914, ch. 311, 38 Stat. 717, which is classified generally to subchapter I (§ 41 et seq.) of chapter 2 of this title. For complete classifica- tion of this Act to the Code, see section 58 of this title and Tables. Statutory Notes and Related Subsidiaries SHORT TITLE Pub. L. 118–50, div. I, § 1, Apr. 24, 2024, 138 Stat. 960, provided that: ‘‘This division [enacting this chapter] may be cited as the ‘Protecting Americans’ Data from Foreign Adversaries Act of 2024’.’’ PROTECTING AMERICANS FROM FOREIGN ADVERSARY CONTROLLED APPLICATIONS Pub. L. 118–50, div. H, Apr. 24, 2024, 138 Stat. 955, pro- vided that: ‘‘SEC. 1. SHORT TITLE. ‘‘This division may be cited as the ‘Protecting Ameri- cans from Foreign Adversary Controlled Applications Act’. ‘‘SEC. 2. PROHIBITION OF FOREIGN ADVERSARY CONTROLLED APPLICATIONS. ‘‘(a) IN GENERAL.— ‘‘(1) PROHIBITION OF FOREIGN ADVERSARY CON- TROLLED APPLICATIONS.—It shall be unlawful for an entity to distribute, maintain, or update (or enable the distribution, maintenance, or updating of) a for- eign adversary controlled application by carrying out, within the land or maritime borders of the United States, any of the following: ‘‘(A) Providing services to distribute, maintain, or update such foreign adversary controlled appli- cation (including any source code of such applica- tion) by means of a marketplace (including an on- line mobile application store) through which users within the land or maritime borders of the United States may access, maintain, or update such appli- cation. ‘‘(B) Providing internet hosting services to enable the distribution, maintenance, or updating of such foreign adversary controlled application for users within the land or maritime borders of the United States. ‘‘(2) APPLICABILITY.—Subject to paragraph (3), this subsection shall apply— ‘‘(A) in the case of an application that satisfies the definition of a foreign adversary controlled ap- plication pursuant to subsection (g)(3)(A), begin- ning on the date that is 270 days after the date of the enactment of this division [Apr. 24, 2024]; and ‘‘(B) in the case of an application that satisfies the definition of a foreign adversary controlled ap- plication pursuant to subsection (g)(3)(B), begin- ning on the date that is 270 days after the date of the relevant determination of the President under such subsection. ‘‘(3) EXTENSION.—With respect to a foreign adver- sary controlled application, the President may grant a 1-time extension of not more than 90 days with re- spect to the date on which this subsection would oth- erwise apply to such application pursuant to para- graph (2), if the President certifies to Congress that— ‘‘(A) a path to executing a qualified divestiture has been identified with respect to such applica- tion; ‘‘(B) evidence of significant progress toward exe- cuting such qualified divestiture has been produced with respect to such application; and ‘‘(C) there are in place the relevant binding legal agreements to enable execution of such qualified di- vestiture during the period of such extension. ‘‘(b) DATA AND INFORMATION PORTABILITY TO ALTER- NATIVE APPLICATIONS.—Before the date on which a pro- hibition under subsection (a) applies to a foreign adver- sary controlled application, the entity that owns or controls such application shall provide, upon request by a user of such application within the land or mari- time borders of United States, to such user all the available data related to the account of such user with respect to such application. Such data shall be provided in a machine readable format and shall include any data maintained by such application with respect to the account of such user, including content (including posts, photos, and videos) and all other account infor- mation. ‘‘(c) EXEMPTIONS.— ‘‘(1) EXEMPTIONS FOR QUALIFIED DIVESTITURES.—Sub- section (a)— Page 2625 TITLE 15—COMMERCE AND TRADE § 9901 ‘‘(A) does not apply to a foreign adversary con- trolled application with respect to which a quali- fied divestiture is executed before the date on which a prohibition under subsection (a) would begin to apply to such application; and ‘‘(B) shall cease to apply in the case of a foreign adversary controlled application with respect to which a qualified divestiture is executed after the date on which a prohibition under subsection (a) ap- plies to such application. ‘‘(2) EXEMPTIONS FOR CERTAIN NECESSARY SERV- ICES.—Subsections (a) and (b) do not apply to services provided with respect to a foreign adversary con- trolled application that are necessary for an entity to attain compliance with such subsections. ‘‘(d) ENFORCEMENT.— ‘‘(1) CIVIL PENALTIES.— ‘‘(A) FOREIGN ADVERSARY CONTROLLED APPLICA- TION VIOLATIONS.—An entity that violates sub- section (a) shall be subject to pay a civil penalty in an amount not to exceed the amount that results from multiplying $5,000 by the number of users within the land or maritime borders of the United States determined to have accessed, maintained, or updated a foreign adversary controlled application as a result of such violation. ‘‘(B) DATA AND INFORMATION VIOLATIONS.—An enti- ty that violates subsection (b) shall be subject to pay a civil penalty in an amount not to exceed the amount that results from multiplying $500 by the number of users within the land or maritime bor- ders of the United States affected by such violation. ‘‘(2) ACTIONS BY ATTORNEY GENERAL.—The Attorney General— ‘‘(A) shall conduct investigations related to po- tential violations of subsection (a) or (b), and, if such an investigation results in a determination that a violation has occurred, the Attorney General shall pursue enforcement under paragraph (1); and ‘‘(B) may bring an action in an appropriate dis- trict court of the United States for appropriate re- lief, including civil penalties under paragraph (1) or declaratory and injunctive relief. ‘‘(e) SEVERABILITY.— ‘‘(1) IN GENERAL.—If any provision of this section or the application of this section to any person or cir- cumstance is held invalid, the invalidity shall not af- fect the other provisions or applications of this sec- tion that can be given effect without the invalid pro- vision or application. ‘‘(2) SUBSEQUENT DETERMINATIONS.—If the applica- tion of any provision of this section is held invalid with respect to a foreign adversary controlled appli- cation that satisfies the definition of such term pur- suant to subsection (g)(3)(A), such invalidity shall not affect or preclude the application of the same provision of this section to such foreign adversary controlled application by means of a subsequent de- termination pursuant to subsection (g)(3)(B). ‘‘(f) RULE OF CONSTRUCTION.—Nothing in this division may be construed— ‘‘(1) to authorize the Attorney General to pursue enforcement, under this section, other than enforce- ment of subsection (a) or (b); ‘‘(2) to authorize the Attorney General to pursue enforcement, under this section, against an indi- vidual user of a foreign adversary controlled applica- tion; or ‘‘(3) except as expressly provided herein, to alter or affect any other authority provided by or established under another provision of Federal law. ‘‘(g) DEFINITIONS.—In this section: ‘‘(1) CONTROLLED BY A FOREIGN ADVERSARY.—The term ‘controlled by a foreign adversary’ means, with respect to a covered company or other entity, that such company or other entity is— ‘‘(A) a foreign person that is domiciled in, is headquartered in, has its principal place of business in, or is organized under the laws of a foreign adver- sary country; ‘‘(B) an entity with respect to which a foreign person or combination of foreign persons described in subparagraph (A) directly or indirectly own at least a 20 percent stake; or ‘‘(C) a person subject to the direction or control of a foreign person or entity described in subpara- graph (A) or (B). ‘‘(2) COVERED COMPANY.— ‘‘(A) IN GENERAL.—The term ‘covered company’ means an entity that operates, directly or indi- rectly (including through a parent company, sub- sidiary, or affiliate), a website, desktop application, mobile application, or augmented or immersive technology application that— ‘‘(i) permits a user to create an account or pro- file to generate, share, and view text, images, vid- eos, real-time communications, or similar con- tent; ‘‘(ii) has more than 1,000,000 monthly active users with respect to at least 2 of the 3 months preceding the date on which a relevant deter- mination of the President is made pursuant to paragraph (3)(B); ‘‘(iii) enables 1 or more users to generate or dis- tribute content that can be viewed by other users of the website, desktop application, mobile appli- cation, or augmented or immersive technology application; and ‘‘(iv) enables 1 or more users to view content generated by other users of the website, desktop application, mobile application, or augmented or immersive technology application. ‘‘(B) EXCLUSION.—The term ‘covered company’ does not include an entity that operates a website, desktop application, mobile application, or aug- mented or immersive technology application whose primary purpose is to allow users to post product reviews, business reviews, or travel information and reviews. ‘‘(3) FOREIGN ADVERSARY CONTROLLED APPLICA- TION.—The term ‘foreign adversary controlled appli- cation’ means a website, desktop application, mobile application, or augmented or immersive technology application that is operated, directly or indirectly (including through a parent company, subsidiary, or affiliate), by— ‘‘(A) any of— ‘‘(i) ByteDance, Ltd.; ‘‘(ii) TikTok; ‘‘(iii) a subsidiary of or a successor to an entity identified in clause (i) or (ii) that is controlled by a foreign adversary; or ‘‘(iv) an entity owned or controlled, directly or indirectly, by an entity identified in clause (i), (ii), or (iii); or ‘‘(B) a covered company that— ‘‘(i) is controlled by a foreign adversary; and ‘‘(ii) that is determined by the President to present a significant threat to the national secu- rity of the United States following the issuance of— ‘‘(I) a public notice proposing such determina- tion; and ‘‘(II) a public report to Congress, submitted not less than 30 days before such determination, describing the specific national security con- cern involved and containing a classified annex and a description of what assets would need to be divested to execute a qualified divestiture. ‘‘(4) FOREIGN ADVERSARY COUNTRY.—The term ‘for- eign adversary country’ means a country specified in section 4872(d)(2) of title 10, United States Code. ‘‘(5) INTERNET HOSTING SERVICE.—The term ‘internet hosting service’ means a service through which stor- age and computing resources are provided to an indi- vidual or organization for the accommodation and maintenance of 1 or more websites or online services, and which may include file hosting, domain name server hosting, cloud hosting, and virtual private server hosting. Page 2626 TITLE 15—COMMERCE AND TRADE § 9901 ‘‘(6) QUALIFIED DIVESTITURE.—The term ‘qualified divestiture’ means a divestiture or similar trans- action that— ‘‘(A) the President determines, through an inter- agency process, would result in the relevant foreign adversary controlled application no longer being controlled by a foreign adversary; and ‘‘(B) the President determines, through an inter- agency process, precludes the establishment or maintenance of any operational relationship be- tween the United States operations of the relevant foreign adversary controlled application and any formerly affiliated entities that are controlled by a foreign adversary, including any cooperation with respect to the operation of a content recommenda- tion algorithm or an agreement with respect to data sharing. ‘‘(7) SOURCE CODE.—The term ‘source code’ means the combination of text and other characters com- prising the content, both viewable and nonviewable, of a software application, including any publishing language, programming language, protocol, or func- tional content, as well as any successor languages or protocols. ‘‘(8) UNITED STATES.—The term ‘United States’ in- cludes the territories of the United States. ‘‘SEC. 3. JUDICIAL REVIEW. ‘‘(a) RIGHT OF ACTION.—A petition for review chal- lenging this division or any action, finding, or deter- mination under this division may be filed only in the United States Court of Appeals for the District of Co- lumbia Circuit. ‘‘(b) EXCLUSIVE JURISDICTION.—The United States Court of Appeals for the District of Columbia Circuit shall have exclusive jurisdiction over any challenge to this division or any action, finding, or determination under this division. ‘‘(c) STATUTE OF LIMITATIONS.—A challenge may only be brought— ‘‘(1) in the case of a challenge to this division, not later than 165 days after the date of the enactment of this division [Apr. 24, 2024]; and ‘‘(2) in the case of a challenge to any action, find- ing, or determination under this division, not later than 90 days after the date of such action, finding, or determination.’’ Executive Documents DELEGATION OF AUTHORITY UNDER THE PROTECTING AMERICANS FROM FOREIGN ADVERSARY CONTROLLED APPLICATIONS ACT Memorandum of President of the United States, July 24, 2024, 89 F.R. 60793, provided: Memorandum for the Secretary of State[,] the Sec- retary of the Treasury[,] the Secretary of Defense[,] the Attorney General[,] the Secretary of Commerce[,] the Secretary of Homeland Security[, and] the Director of National Intelligence By the authority vested in me as President by the Constitution and the laws of the United States of America, including section 301 of title 3, United States Code, I hereby order as follows: SECTION 1. (a) I hereby delegate to the Attorney Gen- eral, in consultation with the Secretary of the Treas- ury, the Secretary of Commerce, and the Secretary of Homeland Security, all authorities vested in the Presi- dent by the Protecting Americans from Foreign Adver- sary Controlled Applications Act (Division H of Public Law 118–50) [set out as a note above]. (b) In exercising the authorities delegated in sub- section (a) of this section, the Attorney General may, as appropriate, consult with the Director of National Intelligence and the heads of other relevant executive departments and agencies (agencies). SEC. 2. (a) There is established a Committee for the Review of Foreign Adversary Controlled Applications (Committee), composed of the Secretary of State, the Secretary of the Treasury, the Secretary of Defense, the Attorney General, the Secretary of Commerce, the Secretary of Homeland Security, and the Director of National Intelligence. Not later than 180 days after the date of this memorandum [July 24, 2024], the members of the Committee, through a process convened by Na- tional Security Council staff consistent with National Security Memorandum 2 of February 4, 2021 (Renewing the National Security Council System), shall deter- mine rules and procedures sufficient for the Committee to exercise the authorities delegated to the Attorney General under section 1 of this memorandum. Upon conclusion of the 180-day period, the Committee shall exercise those authorities in accordance with such rules and procedures. (b) The Director of National Intelligence and the heads of other relevant agencies, as the Attorney Gen- eral under section 1 of this memorandum or the Com- mittee under section 2 of this memorandum determines appropriate, shall provide assessments of the threat to national security posed by foreign adversary controlled applications in connection with the discharge of the re- sponsibilities, respectively, of the Attorney General or the Committee. In providing such assessments, the Di- rector of National Intelligence shall solicit and incor- porate the views of the Intelligence Community, as ap- propriate. SEC. 3. The Attorney General is authorized and di- rected to publish this memorandum in the Federal Reg- ister. J.R. BIDEN, JR.