(a) shall not apply to user data that is content produced by a user for the purpose of sharing with other users (such as social media posts, emails, or data related to a transaction involving the user) or information needed to decipher that data provided that the transfer and any storage necessary to enact the transfer is conducted solely to carry out the user’s intent to share such data with individual users in other countries and that necessary storage occurs only on the intended recipient's individual device. (c) Effective date The requirements of this section shall take effect 90 days after the date of enactment of this Act. 5. Enforcement of data security requirements (a) Enforcement by the Commission (1) In general Except as otherwise provided, sections 3 and 4 shall be enforced by the Commission under the Federal Trade Commission Act ( 15 U.S.C. 41 et seq.). (2) Unfair or deceptive acts or practices A violation of section 3 or 4 shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) ). (3) Actions by the Commission Except as otherwise provided, the Commission shall prevent any person from violating section 3 or 4 in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act, and any person who violates such section shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act. (4) Authority preserved Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law. (b) Criminal penalty (1) Offense It shall be unlawful to knowingly cause a technology company to violate a requirement of section 3 or 4. (2) Penalty Any person who violates paragraph (1) shall be imprisoned for not more