Even for US citizen data, there are absolutely ways to prevent PII/CSI from being directly requested/transmitted to the PRC. My company is in the process of being aquired by a Chinese firm and without getting into too many details, it's extremely difficult for us to view a single persons PII/CSI, let alone bulk/aggregate PII/CSI, and there are several layers of monitoring and oversight into this by not only our board but by the federal government as well.