On February 28, 2024, President Biden released an Executive Order (“EO”) “addressing the extraordinary and unusual national security threat posed by the continued effort of certain countries of concern to access Americans’ bulk sensitive personal data and certain U.S. Government-related data.” In tandem with the EO, the Department of Justice’s (“DOJ’s”) National Security Division is set to issue an advance notice of proposed rulemaking (“ANPRM”) pursuant to the EO, which directs the DOJ to “establish, implement and administer new and targeted national security programming” to address the theat. The DOJ regulations will identify specific categories of “data transactions” that are prohibited or restricted due to their “unacceptable risk to national security.” 

The announced EO appears to be concerned with the ability of foreign powers and state-sponsored threat actors to access Americans’ sensitive personal data for intelligence collection and economic espionage, especially through the use of AI to target such data. The ANPRM further notes that sensitive data is easily obtained by countries of concern, through the purchase and access of such data through vendor, employment, investment and other commercial relationships of companies subject to these countries’ jurisdiction. The EO defines “sensitive data” to include biometric, financial, genomic, geolocation, health data and other personal identifiers that are used to understand Americans’ patterns of life, spending and purchase habits, financial troubles, desires, likes and dislikes, and visits to potentially sensitive locations (e.g., places of worship, health clinics). The EO factsheet highlights threat actors’ potential nefarious use of such data to profile and target individuals and engage in a wide range of malicious activity, much of which is based on identifying and targeting people in particular occupations or communities. Such malicious activity ranges from espionage to blackmail.

The EO’s reported objectives include:

• Creating a new program for the DOJ to enforce against the foreign exploitation of U.S. data (though the establishment of generalized data localization requirements are expressly prohibited);
• Identifying countries of concern;
• Regulating transactions with “covered persons,” which will be categorically defined classes of entities or individuals designated as such due to their relationship with a country of concern;
• Defining four categories of “covered persons” (which will not include U.S. individuals);
• Defining six categories of “sensitive personal data” and their exceptions;
• Enhancing existing transaction-specific DOJ authority to address data security risks, including within the areas of telecommunications infrastructure, the health care market, and consumer protection (authorities include the “Team Telecom” review committee, CFIUS review, and supply-chain counterintelligence); and
• Enhancing the role of other agencies to assist, including the Departments of State, Commerce, Treasure, Homeland Security and others.

The ANPRM’s reported objectives include:

• Identifying countries of concern (currently focused on China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba and Venezuela);
• Describing the initial categories of restricted or prohibited transactions involving bulk sensitive personal data or certain U.S. Government-related data (the EO exempts certain categories related to “low-risk economic activity” and other government and law enforcement activities);
• Further defining and refining “sensitive personal data” by regulation;
• Identifying categories of prohibited or restricted covered data transactions (and setting security requirements for the latter) and identifying relevant exemptions;
• Regulating the “re-exportation” of data to countries of concern;
• Considering processes for DOJ licensing and advisory opinions pursuant to the regulations; and
• Establishing penalties for violations under the new program.

The EO is issued under the International Emergency Economic Powers Act and likely to significantly increase the power of the DOJ to enforce data-related issues involving foreign interference. Combined with the FTC’s increased authority to enforce domestic private sector issues, this development reflects the prioritization of data protection by the current administration. The DOJ noted that the EO is targeted to specific countries and concerns, and that its intention is not to disrupt cross-border data flows or international research collaboration. 

The DOJ currently is considering prohibiting data-brokerage transactions and certain genomic-data transactions, and restricting vendor (including cloud-service), employment and investment agreements, which could potentially have a significant impact on companies’ compliance obligations with respect to persons related to identified “countries of concern.” The ANPRM will have a 45-day comment period.