; and (II) not higher than the export, reexport, or in-country transfer (in the aggregate) by one person to or in a restricted country during a calendar year of the personal data of 1,000,000 covered individuals. (ii) Exports by certain foreign persons In the case of a person that possesses the data of more than 1,000,000 covered individuals, the threshold established under subparagraph (A) shall be one export, reexport, or in-country transfer of personal data to or in a restricted country by that person during a calendar year if the export, reexport, or in-country transfer is to— (I) the government of a restricted country; (II) a foreign person that owns or controls the person conducting the export, reexport, or in-country transfer and that person knows, or should know, that the export, reexport, or in-country transfer of the personal data was requested by the foreign person to comply with a request from the government of a restricted country; or (III) an entity on the Entity List maintained by the Bureau of Industry and Security of the Department of Commerce and set forth in Supplement No. 4 to part 744 of the Export Administration Regulations. (C) Category thresholds The Secretary, in coordination with the heads of the appropriate Federal agencies, may establish a threshold under subparagraph (A) for each category (or combination of categories) of personal data identified under paragraph (1). (D) Updates The Secretary, in coordination with the heads of the appropriate Federal agencies— (i) may update a threshold established under subparagraph (A) as appropriate; and (ii) shall reevaluate the threshold not less frequently than every 5 years. (E) Treatment of persons under common ownership as one person For purposes of determining whether a threshold established under subparagraph (A) has been met— (i) all exports, reexports, or in-country transfers involving personal data conducted by persons under the ownership or control of the same person shall be aggregated to that person