Protecting Americans' Data From Foreign Surveillance Act of 2023

The Protecting Americans' Data From Foreign Surveillance Act of 2023 requires the Secretary of Commerce to establish controls on the export, reexport, and in-country transfer of certain personal data belonging to U.S. citizens and individuals in the U.S. The law mandates identifying sensitive data categories that could be exploited by foreign adversaries, setting thresholds (between 10,000 and 1,000,000 covered individuals) for when data transfers would require licensing, and creating lists of "restricted countries" where licenses would be required. It includes exceptions for encrypted data meeting specific standards, journalism activities, and personal data of the individual themselves. Companies handling this data must obtain licenses for transfers exceeding thresholds to restricted countries, with annual reporting requirements to Congress.