; and (B) permanently delete any user data held by the company that has been collected, directly or indirectly, from the individual. (4) Prohibition on transfer to countries of concern The company shall not transfer any user data or information needed to decipher that data, such as encryption keys, to any country of concern (including indirectly through a third country that is not a country of concern). (5) Data storage requirement The company shall not store any user data collected from citizens or residents of the United States or information needed to decipher that data, such as encryption keys, on a server or other data storage device that is located outside of the United States or a country that maintains an agreement with the United States to share data with law enforcement agencies through a process established by law. (6) Reporting requirement Not less frequently than annually, the chief executive officer or equivalent officer of the company shall submit, under penalty of perjury, a report to the Commission, the Attorney General of the United States, and the Attorney General of each State certifying compliance with the requirements of this section. (b) Exceptions (1) Exception for law enforcement and military The requirements of paragraphs (1) through (4) of subsection (a) shall not apply where data is collected, used, retained, stored, or shared by a covered technology company solely for the purpose of assisting a law enforcement or military agency that is not affiliated with a country of concern. (2) Transfer of shared content The requirements of paragraph (4) and (5) of subsection (a) shall not apply to user data that is content produced by a user for the purpose of sharing with other users (such as social media posts, emails, or data related to a transaction involving the user) or information needed to decipher that data provided that the transfer and any storage necessary to enact the transfer is conducted solely to carry out the user’s intent to share such data with individual users in other