1. Short title This Act may be cited as the National Security and Personal Data Protection Act of 2019 . 2. Definitions In this Act: (1) Commission The term Commission means the Federal Trade Commission. (2) Country of concern (A) In general Subject to subparagraph (B)(iii), the term country of concern means— (i) the People's Republic of China; (ii) the Russian Federation; and (iii) any other country designated by the Secretary of State as being of concern with respect to the protection of data privacy and security. (B) Designation of countries of concern Not later than 1 year after the date of enactment of this Act, and annually thereafter, the Secretary of State shall— (i) review the status of data privacy and security requirements (including by reviewing laws, policies, practices, and regulations related to data privacy and security) in each foreign country to determine— (I) whether it would pose a substantial risk to the national security of the United States if the government of such country gained access to the user data of citizens and residents of the United States; and (II) whether there is a substantial risk that the government of such country will, in a manner that fails to afford similar respect for civil liberties and privacy as the Constitution and laws of the United States, obtain user data from companies that collect user data; (ii) designate each country that meets the criteria of clause (i) as a country of concern; and (iii) remove the designation from any country that was previously designated a country of concern (regardless of whether such designation was pursuant to clause (i) or (ii) of subparagraph (A) or was made by the Secretary of State pursuant to clause (iii) of such subparagraph) if the country— (I) no longer meets the criteria of clause (i)