/>iThough attempts to pass comprehensive federal consumer privacy legislation again stalled in 2024, efforts targeted at addressing national security-related privacy concerns had more success. Along with the Protecting Americans from Foreign Adversary Controlled Applications Act, Congress passed the Protecting Americans’ Data from Foreign Adversaries Act (“PADFA”) as part of a sweeping foreign aid bill, which was subsequently signed into law by President Biden on April 23, 2024. PADFA, which went into effect on June 24, 2024, followed President Biden’s Feb. 2024 Executive Order 14117 “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern” (“EO”), under which the Department of Justice was directed to establish and implement regulations (initially reported by SPB here). The DOJ’s rulemaking process, which began in late fall of last year, culminated in the issuance of a final rule (“Bulk Data Regs”) on December 27, 2024, and publication of the same in the Federal Register on January 4, 2025. The Bulk Data Regs largely become effective 90 days after publication in the Federal Register, on April 4, with certain provisions going into effect 270 days following publication.
Below, we provide a discussion of various key aspects of PADFA and the Bulk Data Regs and key considerations to bear in mind, including with respect to the scope of application, covered data, service provider/vendor transfers, security requirements, downstream transfer and diligence obligations, and important exemptions provided under each. Further below, we provide a table for handy reference with select definitions and information from each legal regime.
At first blush, given their focus on national security and sensitive data, PADFA and the Bulk Data Regs would appear to apply to a limited slice of companies in the U.S. that do business with certain foreign adversaries or countries of concern, or persons or companies related to them. However, upon a deeper look, these regimes provide extremely broad definitions of “sensitive” data and offer potential applicability to any U.S. business transferring data overseas (the Bulk Data Regs in particular), including multi-national companies that transfer data between and among affiliated companies throughout the world. As a result, U.S.-based and multi-national companies that do business or transfer U.S. data overseas, whether to adversarial countries like China and Russia or elsewhere, should carefully review PADFA and the Bulk Data Regs to understand whether and to what extent these legal regimes may apply to their organizations.
If you have any questions, please reach out to the author or your SPB relationship partner.
Scope of Application
PADFA only applies to “data brokers” that transfer “personally identifiable sensitive data” to certain foreign adversaries or persons located in, or controlled by, foreign adversaries, namely China, Russia, Iran, and North Korea. The Bulk Data Regs potentially apply to any U.S. entity that transfers “government-related data” or “bulk” “sensitive personal data” overseas, including other than to countries of concern or “covered persons.” A “covered person” under the Bulk Data Regs includes a foreign entity that is 50% owned, directly or indirectly, by an entity that is organized/chartered under the laws of, or has a principal place of business in, a country of concern. (This definition is broader and more nuanced but squarely covers entities that are majority-owned by individuals/entities in China or other countries of concern. See table below.) The Bulk Data Regs’ countries of concern consist of China (incl. Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela.
Under PADFA, “data broker” is provided a similar definition to those found under U.S. state data broker laws, covering entities that collect and sell or otherwise make available data regarding individuals from whom the entity did not collect directly (see the table below for the definition). On the other hand, the Bulk Data Regs’ concept of “data brokerage” focuses on the lack of a direct relationship between the data subject and the entity receiving the data from the U.S. entity.
Covered Data
Both PADFA and the Bulk Data Regs are incredibly far-reaching when it comes to their respective covered data definitions, providing “sensitive” data terms that are much broader than those found in state consumer privacy laws. As to the Bulk Data Regs’ “sensitive personal data”, certain thresholds must be met (e.g., 1,000 devices for precise geolocation data, 100,000 individuals for “covered identifiers”) to invoke its requirements, which may serve to exclude from its scope companies making incidental transfers of certain sensitive data. However, it is worth noting that the definition of “bulk” is somewhat contrary to the common notion of the term since, for some types of data, the threshold is quite low (e.g., 1,000 data subjects for precise geo, biometric, and human ‘omic data). In any event, the thresholds may not help companies in data-intensive industries such as advertising technology in avoiding the reach of the Bulk Data Regs. The Bulk Data Regs’ thresholds do not apply to “government-related data” such that any transfer of such data to countries of concern or covered persons falls within its scope.
Transfers to Service Providers and Vendors; Security Requirements
PADFA exempts transfers to “service providers” from its scope of restricted transfer. The definition of “service provider” includes entities that would typically qualify as service providers and processors under other legal schemes, namely entities that receive data from or on behalf of a data controller and that collect, process, or transfer data on behalf of, and at the direction of, the data controller (provided that the data controller is not a foreign adversary country or controlled by a foreign adversary country) (see the service provider definition in the “exemptions” section of the table below).
The Bulk Data Regs explicitly prohibit transfers of certain data made pursuant to “vendor agreements,” subject to an exemption where the U.S. entity imposes specific security requirements on the vendor. Notably, this exemption does not apply to transfers of bulk “human ‘omic data”. The security requirements exemption also applies to covered data transactions involving employment agreements and investment agreements. The applicable security requirements were promulgated in parallel by the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”), which is part of the U.S. Department of Homeland Security. PADFA does not require entities to impose security requirements on service providers.
Downstream Transfer and Diligence Obligations
In addition to the restrictions on certain transfers to countries of concern and covered persons, the Bulk Data Regs require U.S. entities to contractually restrict “foreign person”-recipients of covered data in “data brokerage” transactions from transferring such data to countries of concern and covered persons, and to implement a diligence and reporting program for violations of recipients’ obligations. As a result, this aspect of the Bulk Data Regs may impose compliance obligations, including ongoing diligence on overseas data transfers, on a broad swath of U.S. entities, even if they do not do business with countries of concern or covered persons. PADFA does not impose similar obligations.
Exemptions
The Bulk Data Regs provide a number of exemptions for various transactions or transfers, including those related to official business of the U.S. government, transactions “ordinarily incident to and part of the provision of financial services”; corporate group transactions; “Transactions required or authorized by Federal law or international agreements, or necessary for compliance with Federal law”; investment agreements subject to a CFIUS action”; and transactions “ordinarily incident to and part of the provision of telecommunications services”. While many of these exemptions may necessitate a deeper look for various companies, U.S. companies that are subsidiaries of companies in China or other countries of concern, or U.S. companies that otherwise have affiliates in such countries, should carefully consider the corporate group transaction exemption. This provision exempts from much of the regulations’ scope data transactions between U.S. entities and subsidiaries or affiliates located in or otherwise subject to the ownership, direction, jurisdiction, or control of a country of concern and that are ordinarily incident to and part of administrative or ancillary business operations (including HR, payroll and other corporate financial activities, sharing data with advisors for regulatory compliance, business travel, employee benefits, and employee communications).
PADFA does not have similar exemptions, though there are a number of activities that exclude entities from the definition of data broker, including transfers to service providers as discussed above, as well as data-level exemptions such as those for certain publicly available information. These are laid out further in the table below.
Key Concepts and Definitions
| Bulk Data Regs | PADFA | |
| Prohibited Activities | The Bulk Data Regs make it illegal to knowingly engage in a covered data transaction involving data brokerage with a country of concern or covered person.
Covered Data Transaction |
Under PADFA, it is unlawful for a data broker to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available personally identifiable sensitive data of a United States individual to–(1) any foreign adversary country; or (2) any entity that is controlled by a foreign adversary. |
| Data broker definition | “Data brokerage” means the sale of data, licensing of access to data, or similar commercial transactions, excluding an employment agreement, investment agreement, or a vendor agreement, involving the transfer of data from any person (the provider) to any other person (the recipient), where the recipient did not collect or process the data directly from the individuals linked or linkable to the collected or processed data. (There is no definition of “data broker.”) | A “data broker” is defined as an entity that, for valuable consideration, sells, licenses, rents, trades, transfers, releases, discloses, provides access to, or otherwise makes available data of United States individuals that the entity did not collect directly from such individuals to another entity that is not acting as a service provider. |
| Covered Data | The Bulk Data Regs regulate covered transactions involving government-related data and bulk sensitive personal data.
Government-Related Data Sensitive Personal Data Covered Personal Identifiers Listed Identifier Personal Financial Data Personal Health Data Human ‘Omic Data Bulk Exclusions |
(5) Personally identifiable sensitive data -The term `personally identifiable sensitive data” means any sensitive data that identifies or is linked or reasonably linkable, alone or in combination with other data, to an individual or a device that identifies or is linked or reasonably linkable to an individual. This is much broader than the Bulk Data Regs, in part because it does not require a certain volume of data.
(7) Sensitive data. — The term “sensitive data” includes the following: |
| Covered data recipients | The term covered person means: (1) A foreign person that is an entity that is 50% or more owned, directly or indirectly, individually or in the aggregate, by one or more countries of concern or persons described in paragraph (a)(2) of this section; or that is organized or chartered under the laws of, or has its principal place of business in, a country of concern; (2) A foreign person that is an entity that is 50% or more owned, directly or indirectly, individually or in the aggregate, by one or more persons described in paragraphs (a)(1), (3), (4), or (5) of this section; (3) A foreign person that is an individual who is an employee or contractor of a country of concern or of an entity described in paragraphs (a)(1), (2), or (5) of this section; (4) A foreign person that is an individual who is primarily a resident in the territorial jurisdiction of a country of concern; or (5) Any person, wherever located, determined by the Attorney General: (i) To be, to have been, or to be likely to become owned or controlled by or subject to the jurisdiction or direction of a country of concern or covered person; (ii) To act, to have acted or purported to act, or to be likely to act for or on behalf of a country of concern or covered person; or (iii) To have knowingly caused or directed, or to be likely to knowingly cause or direct a violation of this part.
Countries of concern = China (incl. Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela. “Person” means an individual or entity. “Foreign person” means any person that is not a U.S. person. “U.S. person” means any United States citizen, national, or lawful permanent resident; any individual admitted to the United States as a refugee under 8 U.S.C. 1157 or granted asylum under 8 U.S.C. 1158; any entity organized solely under the laws of the United States or any jurisdiction within the United States (including foreign branches); or any person in the United States. |
“Foreign adversary” = China, Russia, Iran, and North Korea.
The term “controlled by a foreign adversary” means, with respect to an individual or entity, that such individual or entity is– (A) a foreign person that is domiciled in, is headquartered in, has its principal place of business in, or is organized under the laws of a foreign adversary country; (B) an entity with respect to which a foreign person or combination of foreign persons described in subparagraph (A) directly or indirectly own at least a 20 percent stake; or (C) a person subject to the direction or control of a foreign person or entity described in subparagraph (A) or (B). |
| Notable Exemptions | The Final Rule provides a number of exemptions: • Personal communications; • Information or informational materials; • Travel; • Official business of the U.S. government; • Transactions “ordinarily incident to and part of the provision of financial services”; • Corporate group transactions; • “Transactions required or authorized by Federal law or international agreements, or necessary for compliance with Federal law”; • Investment agreements subject to a CFIUS action”; • Transactions “ordinarily incident to and part of the provision of telecommunications services”; • “Drug, biological product, and medical device authorizations”; and • “Other clinical investigations and post-marketing surveillance data.” |
(B) Exclusion.–The term “data broker” does not include an entity to the extent such entity–(i) is transmitting data of a United States individual, including communications of such an individual, at the request or direction of such individual, (ii) is providing, maintaining, or offering a product or service with respect to which personally identifiable sensitive data, or access to such data, is not the product or service; (iii) is reporting or publishing news or information that concerns local, national, or international events or other matters of public interest; (iv) is reporting, publishing, or otherwise making available news or information that is available to the general public–(I) including information from–(aa) a book, magazine, telephone book, or online directory; (bb) a motion picture; (cc) a television, internet, or radio program; (dd) the news media; or (ee) an internet site that is available to the general public on an unrestricted basis; and (II) not including an obscene visual depiction (as such term is used in section 1460 of title 18, United States Code); or (v) is acting as a service provider.
(8) Service provider.–The term “service provider” means an entity that– (A) collects, processes, or transfers data on behalf of, and at the direction of– (i) an individual or entity that is not a foreign adversary country or controlled by a foreign adversary; or (ii) a Federal, State, Tribal, territorial, or local government entity; and (B) receives data from or on behalf of an individual or entity described in subparagraph (A)(i) or a Federal, State, Tribal, territorial, or local government entity. |
| Enforcement and Penalties | The Bulk Data Regs are enforced by the Dept. of Justice, and allow for the imposition of both civil and criminal penalties.
Current maximum civil penalties are not to exceed the greater of $368,136 or an amount that is twice the amount of the transaction that is the basis of the violation with respect to which the penalty is imposed. Potential criminal fines and imprisonment are available for willful violations of the regulations. In particular, a maximum of $1,000,000 fine and imprisonment of not more than 20 years, or both, are available in the event of willful violations. |
A violation of [PADFA] shall be treated as a violation of a rule defining an unfair or a deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). The Federal Trade Commission is provided with enforcement authority under PADFA. Remedies for violation of Section 18(a)(1)(B) of the FTC Act include civil penalties of up to $50,120 per violation and various forms of equitable relief (e.g., disgorgement, injunctions, etc.). |
