Servicemember Payment Data Privacy and Security Act
- Sponsor
- Rep. Cline, Ben [R-VA-6]
- Committees
- Armed Services Committee (primary)
- Last action
- May 13, 2026
Bottom line
H.R. 8787 aims to enhance the security of servicemember payment data by eliminating DoD contracts with retailers using payment processing technology linked to adversarial foreign governments.
What it actually does
This bill prohibits the Department of Defense (DoD) from contracting with retailers that use payment processing equipment, systems, or services developed, manufactured, or controlled by entities from "countries of concern" such as China, Russia, Iran, and North Korea. It mandates a review of existing contracts, requires the Secretary of Defense to issue guidance for contract modification or termination, and establishes a future prohibition on new contracts with such retailers starting January 1, 2027. The goal is to safeguard servicemember payment data from potential foreign adversaries.
Proponents argue
Proponents argue that this bill is a critical national security measure, protecting sensitive financial data of military personnel and their families from potential exploitation by foreign adversaries. They contend that relying on payment processing infrastructure from countries of concern poses an unacceptable risk of data breaches, espionage, or disruption, and that this bill proactively mitigates those threats by ensuring secure supply chains for financial transactions involving the DoD.
Opponents contend
Opponents might argue that this bill could create unnecessary bureaucratic hurdles and increase costs for the Department of Defense and its contracted retailers, potentially limiting options for servicemembers. They might also contend that the definition of "covered equipment" is overly broad or difficult to implement, leading to disruptions in essential services without a clear, proportional security benefit, especially if alternative secure options are more expensive or less available.
The bill is very short and clearly written, making it accessible for a quick and informed evaluation.
Section 2(c)
Future Prohibition on New Contracts
Starting January 1, 2027, the Department of Defense is forbidden from entering into new contracts for payment processing equipment, systems, or services with any retailer that utilizes technology deemed "covered equipment, systems, or services." This ensures that future DoD financial transactions avoid reliance on potentially compromised foreign technology.
Supporters argue
Supporters argue this provision is essential for long-term national security, preventing the DoD from inadvertently funding or enabling entities tied to adversarial governments and safeguarding sensitive financial data from the outset in new agreements.
Critics contend
Critics might argue that setting a hard deadline without fully understanding market alternatives could lead to increased costs for the DoD or limit the pool of available contractors, potentially impacting the efficiency or accessibility of services for servicemembers.
Tradeoffs
This provision balances national security concerns over data integrity with potential impacts on contracting flexibility and costs for the DoD and its retail partners.
Section 2(a) and 2(b)
Review of Existing Contracts and Issuance of Guidance
The Secretary of Defense must first review all current retailers under contract to determine if they use payment processing equipment, systems, or services from "countries of concern." Following this review, the Secretary must issue guidance to either modify or terminate existing contracts with non-compliant retailers, unless those retailers cease using the prohibited equipment in a timely manner. This addresses current vulnerabilities.
Section 2(e)(2)
Scope of Prohibited Payment Processing Technology
This section broadly defines what constitutes "covered equipment, system, or service." It includes any payment processing technology where key components (like the application processor, source code, or secure firmware) are developed, manufactured, owned, or controlled by entities from "countries of concern" (e.g., China, Russia, Iran, North Korea) or their subsidiaries. It also covers technology substantially comprised of components from such entities, aiming to prevent circumvention through indirect involvement.
Section 2(e)(1)
Identification of National Security Risk Countries
This provision explicitly lists China, Russia, the Islamic Republic of Iran, and North Korea as "countries of concern." Crucially, it also grants the Secretary of Defense the authority to designate any other country as a "country of concern" if it poses a significant risk to U.S. national security. This allows for flexibility in responding to evolving geopolitical threats.
The bill defines "retailer" by referencing "section 4664 of title 10, United States Code." This means the scope of entities affected by the bill's prohibitions is determined by an external statutory definition.
Section 2(e)(5)
Why it matters:This is standard legislative practice to avoid redundancy and ensure consistency with existing legal frameworks. It's not necessarily evasive but requires additional research for full comprehension.
Case for: Referencing existing definitions streamlines legislation and ensures consistency across federal law, avoiding conflicting interpretations of common terms.
Case against: For a casual reader, it adds a layer of complexity, requiring them to look up external code sections to fully grasp the bill's applicability.
Estimated impact: This reference determines the entire universe of businesses that will be subject to the DoD's new contracting prohibitions, potentially affecting thousands of entities that provide goods and services to servicemembers.