President Biden has recently issued Executive Order 14117 titled “Preventing Access to
Americans’ Bulk Sensitive Data and United States Government-Related Data by Countries of
Concern” (the “Order”), which directs the Department of Justice (DOJ) and multiple other
federal departments and agencies to promulgate new rules and regulations to restrict the large-
scale transfer of sensitive personal data and United States Government-related data to “countries
of concern.”
 

The Order states that data brokerages, third-party vendor agreements, employment agreements,
investment agreements, and other such arrangements can provide direct and unfettered access to
Americans’ bulk sensitive data and thus pose unacceptable risks to US national security. Covered
“sensitive” data types would include a substantial array of digital identifiers, geolocation data,
biometric and health data, and personal financial data. 
 

Pursuant to the Order, DOJ concurrently issued an Advance Notice of Proposed Rulemaking
(ANPRM). ANPRM would require compliance with government cybersecurity standards before
engaging in vendor or data brokering transactions involving bulk sensitive personal data and
certain U.S. government-related data to entities and individuals based in (or controlled by
persons based in) countries of concern, initially proposed to be China (including Hong Kong and
Macau), Russia, Iran, North Korea, Cuba, and Venezuela. Perhaps more significantly, the
ANPRM would also condition or prohibit U.S. companies holding bulk sensitive data from
accepting any investment (including noncontrolling investments, other than passive investment
in publicly traded securities) from entities of concern. These restrictions apply even to
transactions where the Committee on Foreign Investment in the United States would not have
jurisdiction.
 

The 45-day public comment period on the ANPRM will conclude on April 15, 2024. The Order
directs the DOJ to publish a proposed rule by August 26, 2024; once that happens, there will be a
second comment period on the proposed rule. 
 

Given its sweeping scope, the Order, once implemented, will have a material impact on a broad
spectrum of companies across industries. Companies that are potentially affected should follow
the rulemaking process closely and proactively take steps in preparation for the ultimate
implementation of the Order.