Bottom line: Selling data to *anyone* means it is not only possible but highly likely that foreign adversaries can easily obtain the data.

The reason why should be obvious. Because there is no reasonable way to maintain control over the data once it is sold. And no KYC requirement for buyers. The brokers probably really don't know (and may not care) who the buyer is.

This registry for data brokers is ineffective and meaningless.