On October 21, 2024, the U.S. Department of Justice National Security Division (“NSD”) issued a Notice of Proposed Rulemaking (“NPRM”) implementing Executive Order 14117, Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern (“the EO”). President Biden signed the EO in February 2024, which focused on the ability of foreign powers and state-sponsored threat actors to access Americans’ sensitive personal data for intelligence collection and economic espionage, especially through the use of AI to target such data. The DOJ accordingly published an Advance Notice of Proposed Rulemaking (“ANPRM”) on March 5, 2024. See our previous coverage here. The NPRM addresses public comments that the DOJ received on the ANPRM and proposes a rule to implement the EO and establish a new national security program that would “limit or prohibit U.S. persons from engaging in certain classes of transactions that pose an unacceptable risk of giving countries of concern or covered persons access to Americans’ government-related data or bulk sensitive personal data.” The DOJ issued a press release announcing the NPRM along with a Fact Sheet that summarizes the NPRM’s content.
The NPRM identifies six “countries of concern” as posing a significant risk of exploiting bulk sensitive personal data: China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba and Venezuela. The NPRM regulates the transfer of U.S. persons’ data to “covered persons,” which are defined by reference to these countries of concern. Covered persons include “(1) foreign entities that are 50 percent or more owned by a country of concern, organized under the laws of a country of concern, or has its principal place of business in a country of concern; (2) foreign entities that are 50 percent or more owned by a covered person; (3) foreign employees or contractors of countries of concern or entities that are covered persons; and (4) foreign individuals primarily resident in countries of concern.” Additionally, the DOJ retains the authority to supplement these categories with a public list of designated entities and individuals. The DOJ can designate any person it believes to have been controlled by a covered person or country of concern to be part of this list.
The NPRM also identifies six categories of personal data to be regulated, which include:
- covered personal identifiers (specifically listed categories of personally identifiable information, including full or truncated social security numbers, advertising identifiers, contact data and more);
- precise geolocation data (data that identifies the physical location of an individual or device up to 1,000 meters);
- biometric identifiers (including facial images, voice prints, keyboard usage patterns and more);
- human genomic data (nucleic acid sequences that constitute the whole or part of a person’s genetic sequence);
- personal health data (including information that relates to that past, present, or future physical or mental health of an individual); and
- personal finance data (including information about an individual’s purchases and payment history).
For each of these categories, the NPRM defines bulk thresholds, which represent the maximum amount of covered data that can be transferred during a given 12-month period, whether through one or multiple transactions. However, such bulk thresholds do not apply to government-related data, where transfers are regulated regardless of volume.
The NPRM excludes public or nonpublic data that does not relate to an individual, including trade secrets and proprietary information, and publicly available information. It further defines classes of exempt transactions, including certain personal communications, corporate group transactions, financial or telecommunications services data, investment agreements subject to action by the Committee on Foreign Investment in the United States (“CFIUS”), and more. In its
The U.S. Attorney General would retain the authority to issue licenses authorizing transactions that would otherwise be prohibited or restricted, but the DOJ anticipates that such licenses will only be issued in rare circumstances. The DOJ also would have the authority to issue general guidance and advisory opinions.
In response to comments, the DOJ generally declined to incorporate aspects of international or state privacy laws into the proposed rule, explaining that privacy protections and national security measures overlap but generally focus on different challenges associated with sensitive personal data. However, the DOJ noted that the NPRM’s prohibitions and restrictions are consistent with similar restrictions in other contexts, such as transactions reviewed by CFIUS and Team Telecom. The NPRM also will require entities to comply with the security requirements proposed by the Department of Homeland Security’s Cybersecurity and Infrastructure Agency (CISA) in coordination with DOJ, pursuant to the EO.
The NPRM will have a 30-day comment period.
Search
Recent Posts
Categories
- Behavioral Advertising
- Centre for Information Policy Leadership
- Children’s Privacy
- Cyber Insurance
- Cybersecurity
- Enforcement
- European Union
- Events
- FCRA
- Financial Privacy
- General
- Health Privacy
- Identity Theft
- Information Security
- International
- Marketing
- Multimedia Resources
- Online Privacy
- Security Breach
- U.S. Federal Law
- U.S. State Law
- Workplace Privacy
Tags
- Aaron Simpson
- Accountability
- Adequacy
- Advertisement
- Advertising
- American Privacy Rights Act
- Anna Pateraki
- Anonymization
- Anti-terrorism
- APEC
- Apple Inc.
- Argentina
- Arkansas
- Article 29 Working Party
- Artificial Intelligence
- Australia
- Austria
- Automated Decisionmaking
- Baltimore
- Bankruptcy
- Belgium
- Biden Administration
- Big Data
- Binding Corporate Rules
- Biometric Data
- Blockchain
- Bojana Bellamy
- Brazil
- Brexit
- British Columbia
- Brittany Bacon
- Brussels
- Business Associate Agreement
- BYOD
- California
- CAN-SPAM
- Canada
- Cayman Islands
- CCPA
- CCTV
- Chile
- China
- Chinese Taipei
- Christopher Graham
- CIPA
- Class Action
- Clinical Trial
- Cloud
- Cloud Computing
- CNIL
- Colombia
- Colorado
- Commodity Futures Trading Commission
- Compliance
- Computer Fraud and Abuse Act
- Congress
- Connecticut
- Consent
- Consent Order
- Consumer Protection
- Cookies
- COPPA
- Coronavirus/COVID-19
- Council of Europe
- Council of the European Union
- Court of Justice of the European Union
- CPPA
- CPRA
- Credit Monitoring
- Credit Report
- Criminal Law
- Critical Infrastructure
- Croatia
- Cross-Border Data Flow
- Cyber Attack
- Cybersecurity
- Cybersecurity and Infrastructure Security Agency
- Data Brokers
- Data Controller
- Data Localization
- Data Privacy Framework
- Data Processor
- Data Protection Act
- Data Protection Authority
- Data Protection Impact Assessment
- Data Transfer
- David Dumont
- David Vladeck
- Delaware
- Denmark
- Department of Commerce
- Department of Health and Human Services
- Department of Homeland Security
- Department of Justice
- Department of the Treasury
- Disclosure
- District of Columbia
- Do Not Call
- Do Not Track
- Dobbs
- Dodd-Frank Act
- DPIA
- E-Privacy
- E-Privacy Directive
- Ecuador
- Ed Tech
- Edith Ramirez
- Electronic Communications Privacy Act
- Electronic Privacy Information Center
- Elizabeth Denham
- Employee Monitoring
- Encryption
- ENISA
- EU Data Protection Directive
- EU Member States
- European Commission
- European Data Protection Board
- European Data Protection Supervisor
- European Parliament
- Facial Recognition
- Facial Recognition Technology
- FACTA
- Fair Information Practice Principles
- Federal Aviation Administration
- Federal Bureau of Investigation
- Federal Communications Commission
- Federal Data Protection Act
- Federal Trade Commission
- FERC
- FinTech
- Florida
- Food and Drug Administration
- Foreign Intelligence Surveillance Act
- France
- Franchise
- Fred Cate
- Freedom of Information Act
- Freedom of Speech
- Fundamental Rights
- GDPR
- Geofencing
- Geolocation
- Georgia
- Germany
- Global Privacy Assembly
- Global Privacy Enforcement Network
- Gramm Leach Bliley Act
- Hacker
- Hawaii
- Health Data
- Health Information
- HIPAA
- HIPPA
- HITECH Act
- Hong Kong
- House of Representatives
- Hungary
- Illinois
- India
- Indiana
- Indonesia
- Information Commissioners Office
- Information Sharing
- Insurance Provider
- Internal Revenue Service
- International Association of Privacy Professionals
- International Commissioners Office
- Internet
- Internet of Things
- IP Address
- Ireland
- Israel
- Italy
- Jacob Kohnstamm
- Japan
- Jason Beach
- Jay Rockefeller
- Jenna Rode
- Jennifer Stoddart
- Jersey
- Jessica Rich
- John Delionado
- John Edwards
- Kentucky
- Korea
- Latin America
- Laura Leonard
- Law Enforcement
- Lawrence Strickling
- Legislation
- Legislature
- Liability
- Lisa Sotto
- Litigation
- Location-Based Services
- London
- Madrid Resolution
- Maine
- Malaysia
- Markus Heyder
- Maryland
- Massachusetts
- Meta
- Mexico
- Microsoft
- Minnesota
- Mobile App
- Mobile Device
- Montana
- Morocco
- MySpace
- Natascha Gerlach
- National Institute of Standards and Technology
- National Labor Relations Board
- National Science and Technology Council
- National Security
- National Security Agency
- National Telecommunications and Information Administration
- Nebraska
- NEDPA
- Netherlands
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- New Zealand
- Nigeria
- Ninth Circuit
- North Carolina
- Norway
- Obama Administration
- OECD
- Office for Civil Rights
- Office of Foreign Assets Control
- Ohio
- Online Behavioral Advertising
- Opt-In Consent
- Oregon
- Outsourcing
- Pakistan
- Parental Consent
- Paul Tiao
- Payment Card
- PCI DSS
- Penalty
- Pennsylvania
- Personal Data
- Personal Health Information
- Personal Information
- Personally Identifiable Information
- Peru
- Philippines
- Phyllis Marcus
- Poland
- PRISM
- Privacy By Design
- Privacy Policy
- Privacy Rights
- Privacy Rule
- Privacy Shield
- Protected Health Information
- Ransomware
- Record Retention
- Red Flags Rule
- Rhode Island
- Richard Thomas
- Right to Be Forgotten
- Right to Privacy
- Risk-Based Approach
- Rosemary Jay
- Russia
- Safe Harbor
- Sanctions
- Schrems
- Scott Kimpel
- Securities and Exchange Commission
- Security Rule
- Senate
- Serbia
- Service Provider
- Singapore
- Smart Grid
- Smart Metering
- Social Media
- Social Security Number
- South Africa
- South Carolina
- South Korea
- Spain
- Spyware
- Standard Contractual Clauses
- State Attorneys General
- Steven Haas
- Stick With Security Series
- Stored Communications Act
- Student Data
- Supreme Court
- Surveillance
- Sweden
- Switzerland
- Taiwan
- Targeted Advertising
- Telecommunications
- Telemarketing
- Telephone Consumer Protection Act
- Tennessee
- Terry McAuliffe
- Texas
- Text Message
- Thailand
- Transparency
- Transportation Security Administration
- Trump Administration
- United Arab Emirates
- United Kingdom
- United States
- Unmanned Aircraft Systems
- Uruguay
- Utah
- Vermont
- Video Privacy Protection Act
- Video Surveillance
- Virginia
- Viviane Reding
- Washington
- WeProtect Global Alliance
- Whistleblowing
- Wireless Network
- Wiretap
- ZIP Code