; (ii) the circumstances under which the government of the foreign country can compel, coerce, or pay a person in or national of that country to disclose the covered personal data; and (iii) whether that government has conducted hostile foreign intelligence operations, including information operations, against the United States. (C) License requirement and presumption of denial for certain countries (i) In general The Secretary shall— (I) require a license or other authorization for the export or reexport to, or in-country transfer in, a country on the list required by clause (ii) of covered personal data in a manner that exceeds the threshold established under subsection (a)(3); and (II) deny an application for such a license or other authorization unless the person seeking the license or authorization demonstrates to the satisfaction of the Secretary that the export, reexport, or in-country transfer will not harm the national security of the United States. (ii) List required (I) In general Not later than one year after the date of the enactment of the Protecting Americans' Data From Foreign Surveillance Act of 2023 , the Secretary shall (subject to subclause (III)) establish a list of each country with respect to which the Secretary determines that the export or reexport to, or in-country transfer in, the country of covered personal data in a manner that exceeds the applicable threshold established under subsection (a)(3) will be likely to harm the national security of the United States. (II) Modifications to list The Secretary (subject to subclause (III))— (aa) may add a country to or remove a country from the list required by subclause (I) at any time; and (bb) shall review that list not less frequently than every 5 years. (III) Concurrence; consultations; considerations The Secretary shall establish the list required by subclause (I) and add a country to or remove a country from that list under subclause (II)— (aa) with the concurrence of the Secretary of State