United States. Data localisation / cross-border. Act

PADFAProtecting Americans' Data from Foreign Adversaries Act of 2024 (15 U.S.C. § 9901)

In force

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

Makes it unlawful for data brokers to sell, license or otherwise make available sensitive data of US individuals to foreign adversary countries (China, Russia, Iran, North Korea) or entities they control. Violations are treated as violations of an FTC rule.

Key themes

data brokers
foreign adversaries
sensitive data
national security

Unique features

Very broad 'sensitive data' list (including precise geolocation, health, biometrics, private communications); no volume threshold.

SaaS relevance

Caught if a SaaS business provides US individuals' sensitive data to others for consideration where the recipient is a foreign adversary or controlled entity; ordinary service providers are carved out.

§2Obligations

Extraterritorial: Yes
Breach notification: None
DPO: No
Cross-border transfers: Prohibition on transfers to foreign adversary countries/controlled entities
Maximum penalty: FTC civil penalties as for rule violations ($53,088 per violation)

§3Dates

Key dates

Adopted 24 April 2024
In force 23 June 2024
Enacted as Division I of Pub. L. 118-50; effective 60 days after enactment.

§4Text and authority

Text

Authoritative text congress.gov

Authority

Federal Trade Commission (FTC)

§6Sources and verification

Sources consulted

congress.gov

Verification

Medium confidence.