Thanks for the clarification; I have other policy suggestions that address that. see Restricting Cross-Border Data Transfer and Storage of User Data OR Proposal to Affirm the Right to Privacy as Including the Right to Anonymity
but you’re right, due to our existing structure, just about anyone in the world can start a data brokerage company in the US and send it all back to their country. We can’t stop the formation of companies; but we can keep our data on shore. To me, offshoring data and gov’t purchases are separate topics, so I’ve created separate suggestions.