New Executive Order on Protecting Personal Data and U.S. Government-Related Data

2024-09-24 10:29:33

President Biden recently signed Executive Order 14117, titled "Preventing Access to Bulk Sensitive Personal Data and Government-Related Data of the United States by Countries of Concern," directing the U.S. Department of Justice (DOJ) and other federal departments and agencies to issue new rules and regulations restricting the large-scale transfer of sensitive personal data and U.S. government-related data to "countries of concern."

Executive Order 14117 highlights that data brokers, third-party vendor agreements, employment agreements, investment agreements, and similar transactions can provide direct and unrestricted access to large volumes of sensitive U.S. personal data, posing an unacceptable risk to national security. The order defines "sensitive" data types to include digital identifiers, geolocation data, biometrics, health data, and personal financial data.

In accordance with Executive Order 14117, the DOJ issued an Advance Notice of Proposed Rulemaking (ANPRM). The ANPRM requires that transactions involving bulk sensitive personal data and certain U.S. government-related data with entities or individuals located in (or controlled by entities in) countries of concern must comply with U.S. government cybersecurity standards. The initial list of countries of concern includes China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela. The ANPRM also restricts or prohibits U.S. companies holding bulk sensitive data from accepting any investments from related entities, including non-controlling investments other than passive investments in publicly traded securities. These restrictions apply even to transactions not under the jurisdiction of the Committee on Foreign Investment in the United States (CFIUS).

The 45-day public comment period for the ANPRM ended on April 15, 2024. Under Executive Order 14117, the DOJ is required to issue proposed rules by August 26, 2024, followed by a public comment period on the proposed rules.

Given the broad scope of Executive Order 14117, the new rules and regulations, once enacted, will significantly impact companies across various industries. Companies likely to be affected should closely monitor the rulemaking process and take proactive steps to prepare for the final implementation of the new rules.