Biden EO orders regulations restricting access to Americans’ bulk data
President Biden has signed an Executive Order (‘EO’) directing the Department of Justice (‘DOJ’) to draw up regulations restricting access to the bulk data of Americans by ‘adversarial’ countries such as China, Russia, and Iran.
US companies and individuals ‘would be expected to develop and implement compliance programs based on their individualized risk profiles, which may vary depending on a range of factors such as their size and sophistication, products and services, customers and counterparties, and geographic locations,’ the DOJ said in a fact sheet published concurrently with the EO, signed 28 February.
‘It is the policy of the United States to restrict access by countries of concern to Americans’ bulk sensitive personal data and United States Government-related data when such access would pose an unacceptable risk to the national security of the United States,’ Biden said in his EO.
The DOJ said it is directed by the presidential order to ‘issue regulations addressing transactions that involve U.S. persons’ bulk sensitive personal data or U.S. Government-related data, that pose an unacceptable risk of access by countries of concern or covered persons subject to their jurisdiction, and that meet other criteria.’ It said it will work closely with other agencies in ‘a whole-of government effort to ensure that the program is carefully calibrated to address the most serious national security risks.’ In particular, the EO will give important roles to the Departments of State, Commerce, the Treasury, Homeland Security, and other agencies ‘through robust interagency consultation requirements, including on rulemakings, licensing decisions, identifying countries of concern, and designating covered persons,’ according to the fact sheet.
The DOJ will issue an Advance Notice of Proposed Rulemaking (‘ANPRM’) to provide additional details on the proposed rules and to give notice and solicit comments from the public. The ANPRM ‘will contemplate identifying six countries of concern: China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela,’ it said. The restrictions would apply to personal financial data and other sensitive information, geolocation data as well as people’s genomic, biometric and personal health data.
‘If a violation occurs, the Department would consider the adequacy of the compliance program in any enforcement action,’ according to the fact sheet.
