IIRC, if the industry can compete in an interstate market, it falls under the interstate commerce clause — even if the business only operates within a single state. So even forcing data to operate within a single state border would still not protect the bill. At least, that’s the theory behind regulating gun manufacturers that only operate with a single state. IANAL, but I don’t know if this theory has ever been tested at the USSC level.