Commerce for Standards and Technology shall issue guidance to the public with respect to methods for anonymizing data and how to determine if individuals to which the anonymized personal data relates can be, or are likely in the future to be, reasonably identified, such as by using other sources of data. (9) Sense of Congress on identification of categories of personal data It is the sense of Congress that, in identifying categories of personal data of covered individuals under paragraph (1), the Secretary should, to the extent reasonably possible and in coordination with the Secretary of the Treasury and the Director of the Office of Management and Budget, harmonize those categories with the categories of sensitive personal data described in paragraph (5)(A)(iv). (b) Commerce controls (1) Controls required Beginning 18 months after the date of the enactment of the Protecting Americans' Data From Foreign Surveillance Act of 2023 , the Secretary shall impose appropriate controls under the Export Administration Regulations on the export or reexport to, or in-country transfer in, all countries (other than countries on the list required by paragraph (2)(D)) of covered personal data in a manner that exceeds the applicable threshold established under subsection (a)(3), including through interim controls (such as by informing a person that a license is required for export, reexport, or in-country transfer of covered personal data), as appropriate, or by publishing additional regulations. (2) Levels of control (A) In general Except as provided in subparagraph (C) or (D), the Secretary shall— (i) require a license or other authorization for the export, reexport, or in-country transfer of covered personal data in a manner that exceeds the applicable threshold established under subsection (a)(3)