National Security and Personal Data Protection Act of 2019
The source supplies the latest action, but no lifecycle stage.
Latest action (18 Nov 2019): Read twice and referred to the Committee on Commerce, Science, and Transportation.
What this bill does
This bill, S. 2889, proposes new rules for how technology companies handle user data, aiming to protect Americans' information from foreign governments deemed a national security risk. It would require the Department of State to identify "countries of concern," initially including China and Russia, based on their data privacy and security practices. Technology companies subject to these countries' jurisdictions would face restrictions on collecting unnecessary data, transferring or storing data in countries of concern, and would have to allow users to view and delete their data. Other companies would also be prohibited from transferring or storing user data in these designated countries.
The Federal Trade Commission would be responsible for enforcing these regulations. Additionally, individuals or state attorneys general could bring civil lawsuits to stop violations. The bill also includes provisions for reviewing certain foreign investments in U.S. technology companies that handle user data or operate social media platforms, to ensure they don't pose a national security risk.
S. 2889 was introduced in the Senate in November 2019 and is currently in the "Introduced" status. It was referred to the Committee on Commerce, Science, and Transportation. For the bill to become law, it would need to pass through the committee process, be approved by the Senate, and then be passed by the House of Representatives. If both chambers pass identical versions, it would then be sent to the President for signature.
Plain-English summary generated by Bill100 AI from the official record. Always verify against the source below.
Official summary
National Security and Personal Data Protection Act of 2019
This bill prohibits the transfer of data to, and storage of data within, foreign countries that threaten U.S. national security.
Specifically, the bill requires the Department of State to designate as a country of concern any country, including the People's Republic of China and the Russian Federation, whose data privacy and security requirements pose a substantial risk to U.S. national security.
A technology company that is subject to the jurisdiction of a country of concern and that provides a website or internet application operating in interstate or foreign commerce shall
• not collect unnecessary user data or use any user data for a purpose that is secondary to the operation of the website, service, or application;
• not transfer user data or information to a country of concern;
• not store user data on a server outside either the United States or a country that has agreed to share data with U.S. law enforcement agencies; and
• allow individuals to view and delete their individual user data.
Timeline
18 Nov 2019
Read twice and referred to the Committee on Commerce, Science, and Transportation.
Common questions
- What does S. 2889 do?
- This bill, S. 2889, proposes new rules for how technology companies handle user data, aiming to protect Americans' information from foreign governments deemed a national security risk. It would require the Department of State to identify "countries of concern," initially including China and Russia, based on their data privacy and security practices. Technology companies subject to these countries' jurisdictions would face restrictions on collecting unnecessary data, transferring or storing data in countries of concern, and would have to allow users to view and delete their data. Other companies would also be prohibited from transferring or storing user data in these designated countries. The Federal Trade Commission would be responsible for enforcing these regulations. Additionally, individuals or state attorneys general could bring civil lawsuits to stop violations. The bill also includes provisions for reviewing certain foreign investments in U.S. technology companies that handle user data or operate social media platforms, to ensure they don't pose a national security risk. S. 2889 was introduced in the Senate in November 2019 and is currently in the "Introduced" status. It was referred to the Committee on Commerce, Science, and Transportation. For the bill to become law, it would need to pass through the committee process, be approved by the Senate, and then be passed by the House of Representatives. If both chambers pass identical versions, it would then be sent to the President for signature.
- Has S. 2889 become law?
- The source does not supply a confirmed lifecycle stage for S. 2889. Check the latest action and official source below.
- Who sponsored S. 2889?
- S. 2889 was sponsored by Sen. Hawley, Josh [R-MO] (R-MO), with 2 cosponsors.
- What's the latest action on S. 2889?
- Read twice and referred to the Committee on Commerce, Science, and Transportation. (18 Nov 2019).
Related bills in Science, Technology, Communications
Accelerating Broadband Permits Act of 2026
Disaster Communications Coordination and Preparedness Act
Mystic Alerts Act
Bots Research Act
More bills from Sen. Hawley, Josh [R-MO]
No Bonuses for Bad Service Act
AI-Related Job Impacts Clarity Act
GUARD Act
Keep SNAP Funded Act of 2025
Bill100 mirrors the public U.S. legislative record from Congress.gov and GovTrack and adds plain-English AI summaries. It is an information tool, not legal, compliance or lobbying advice, and it is not affiliated with the U.S. Congress or any government agency. AI summaries can simplify or omit detail — every bill links to the official source; verify there before you rely on it.