In accordance with Executive Order (EO) 14117, the U.S. Department of Justice (DoJ) has released a final regulation that prohibits the wholesale transfer of personal data belonging to people to nations of concern, including China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela.
Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division stated, “This final rule is a vital step forward in tackling the enormous national security threat posed by our adversaries exploiting Americans’ most sensitive personal data.”
Through outright purchase or other commercial access, “this potent new national-security program is aimed to ensure that Americans’ personal data is no longer permitted to be sold to hostile foreign countries.”
In order to address the national risk posed by unauthorized access to Americans’ private and government-related information for malevolent purposes including espionage, influence, kinetic, or cyber operations, U.S. President Joe Biden signed an executive order back in February 2024.
The directive further stated that the countries of concern can buy such data from commercial data brokers and other businesses, as well as use their access to bulk data to create or improve artificial intelligence and other cutting-edge technologies.
The directive further stated that the countries of concern can buy such data from commercial data brokers and other businesses, as well as use their access to bulk data to create or improve artificial intelligence and other cutting-edge technologies.
The Department of Justice stated that “countries of concern and covered persons can also exploit this data to gather information on activists, academics, journalists, dissidents, political opponents, or members of nongovernmental organizations or marginalized communities to intimidate them; curb political opposition; limit freedoms of expression, peaceful assembly, or association; or enable other forms of exclusion of civil liberties.”
The DoJ’s ruling is anticipated to go into effect in ninety days. It identifies specific categories of transactions that are prohibited, restricted, and exempt; establishes thresholds for the prohibitions and restrictions on covered data transactions involving large amounts of sensitive personal data; and creates enforcement tools, including criminal and civil penalties.
Human ‘omic (genomic, epigenomic, proteomic, and transcriptomic) data, biometric identifiers, precise geolocation data, personal identifiers (such as Social Security numbers, driver’s licenses, etc.), personal health data, and personal financial data are the six kinds of data covered here.
It is important to note that the law does not forbid U.S. citizens from performing scientific, medical, or other research in nations of concern, nor does it impose any limitations on data localization.
According to the DoJ, “the final rule also does not impose measures aimed at a broader decoupling of the substantial consumer, economic, scientific, and trade relationships that the United States has with other countries, nor does it prohibit U.S. persons from engaging in commercial transactions, including exchanging financial and other data as part of the sale of commercial goods and services with countries of concern or covered persons.”