House advances bill empowering FTC to punish data transfers to foreign rivals

The House on Wednesday unanimously approved a measure that would penalize data brokers who enable the transfer of Americans’ sensitive data to foreign rivals like China.

The Protecting Americans’ Data from Foreign Adversaries Act advanced out of the lower chamber in a 414-0 vote Wednesday. It was introduced in early March by House Energy and Commerce Committee leaders Cathy McMorris Rodgers, R-Wash. and Frank Pallone, Jr., D-N.J. following a recent executive order signed by President Joe Biden that gives multiple agencies enhanced legal power to prevent similar data transfers from going to foreign adversaries.

The bill would give the Federal Trade Commission the authority to seek civil penalties of at least $50,000 when a data broker sells information to foreign adversaries or entities controlled by those foreign adversaries, which include China, Iran, Russia and North Korea, as defined by acquisition restrictions in U.S. code. That list notably excludes Cuba and Venezuela, which were mentioned in the Biden directive.

The measure aims to update the FTC’s language concerning investigations into “unfair or deceptive” acts or practices that harm consumers, lodging foreign rival data transfers into the agency’s code. It now moves to the Senate and, if passed there, will head to President Joe Biden’s desk for signing.

“Data brokers’ sale of Americans’ most sensitive information to our foreign adversaries is wrong and damages our national security,” said Senate Commerce Committee Chairwoman Maria Cantwell, D-Wash. “I’m encouraged by this bipartisan effort by Representatives McMorris Rodgers and Pallone to protect Americans’ personal data — especially that of our servicemembers — from being exploited by foreign adversaries.”  

The vote “sends a clear message that we will not allow our adversaries to undermine American national security and individual privacy by purchasing people’s personally identifiable sensitive information from data brokers,” Rodgers and Pallone said in a joint statement.

Covered data under the bill includes genetic info, biometrics, financial accounts and health records, similar to the categories listed in the White House order. But the executive order differs in that it does not list the FTC as an enforcement agency, instead putting the onus on the departments of Justice, Homeland Security, Health and Human Services and others to craft the measures necessary to enforce it.

Americans’ phone or text logs, photos, audio recordings or videos would also be prohibited for transfer under the legislation. Data brokers already legally obtain, process and sell Americans’ data for commercial purposes, and at times have sold that information to the intelligence community.