; and (II) the encryption technology used to protect the data against decryption is certified by the National Institute of Standards and Technology as capable of protecting data for the period of time determined under subsection (a)(4) to be sufficient to prevent the exploitation of the data by a foreign government or foreign adversary from harming the national security of the United States. (iv) The export, reexport, or in-country transfer of personal data that is ordered by an appropriate court of the United States. (B) Exception for certain nationals of restricted countries Subparagraph (A)(iii)(I) does not apply with respect to an individual who is a national of a restricted country if the individual is also a citizen of the United States or a noncitizen described in subsection (l)(5)(C). (c) Requirements for identification of categories and determination of appropriate controls In identifying categories of personal data under subsection (a)(1) and imposing appropriate controls under subsection (b), the Secretary, in coordination with the heads of the appropriate Federal agencies, as appropriate— (1) may not regulate or restrict the publication or sharing of— (A) personal data that is a matter of public record, such as a court record or other government record that is generally available to the public, including information about an individual made public by that individual or by the news media; (B) information about a matter of public interest; or (C) any other information the publication or sharing of which is protected by the First Amendment to the Constitution of the United States