Privacy & Information Security Law Blog

On October 21, 2024, the U.S. Department of Justice National Security Division (“NSD”) issued a Notice of Proposed Rulemaking (“NPRM”) implementing Executive Order 14117, Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern (“the EO”). President Biden signed the EO in February 2024, which focused on the ability of foreign powers and state-sponsored threat actors to access Americans’ sensitive personal data for intelligence collection and economic espionage, especially through the use of AI to target such data. The DOJ accordingly published an Advance Notice of Proposed Rulemaking (“ANPRM”) on March 5, 2024. See our previous coverage here. The NPRM addresses public comments that the DOJ received on the ANPRM and proposes a rule to implement the EO and establish a new national security program that would “limit or prohibit U.S. persons from engaging in certain classes of transactions that pose an unacceptable risk of giving countries of concern or covered persons access to Americans’ government-related data or bulk sensitive personal data.” The DOJ issued a press release announcing the NPRM along with a Fact Sheet that summarizes the NPRM’s content.

The NPRM identifies six “countries of concern” as posing a significant risk of exploiting bulk sensitive personal data: China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba and Venezuela. The NPRM regulates the transfer of U.S. persons’ data to “covered persons,” which are defined by reference to these countries of concern. Covered persons include “(1) foreign entities that are 50 percent or more owned by a country of concern, organized under the laws of a country of concern, or has its principal place of business in a country of concern; (2) foreign entities that are 50 percent or more owned by a covered person; (3) foreign employees or contractors of countries of concern or entities that are covered persons; and (4) foreign individuals primarily resident in countries of concern.” Additionally, the DOJ retains the authority to supplement these categories with a public list of designated entities and individuals. The DOJ can designate any person it believes to have been controlled by a covered person or country of concern to be part of this list.

The NPRM also identifies six categories of personal data to be regulated, which include:

• covered personal identifiers (specifically listed categories of personally identifiable information, including full or truncated social security numbers, advertising identifiers, contact data and more);
• precise geolocation data (data that identifies the physical location of an individual or device up to 1,000 meters);
• biometric identifiers (including facial images, voice prints, keyboard usage patterns and more);
• human genomic data (nucleic acid sequences that constitute the whole or part of a person’s genetic sequence);
• personal health data (including information that relates to that past, present, or future physical or mental health of an individual); and
• personal finance data (including information about an individual’s purchases and payment history).

For each of these categories, the NPRM defines bulk thresholds, which represent the maximum amount of covered data that can be transferred during a given 12-month period, whether through one or multiple transactions. However, such bulk thresholds do not apply to government-related data, where transfers are regulated regardless of volume.

The NPRM excludes public or nonpublic data that does not relate to an individual, including trade secrets and proprietary information, and publicly available information. It further defines classes of exempt transactions, including certain personal communications, corporate group transactions, financial or telecommunications services data, investment agreements subject to action by the Committee on Foreign Investment in the United States (“CFIUS”), and more. In its

The U.S. Attorney General would retain the authority to issue licenses authorizing transactions that would otherwise be prohibited or restricted, but the DOJ  anticipates that such licenses will only be issued in rare circumstances. The DOJ also would have the authority to issue general guidance and advisory opinions.

In response to comments, the DOJ generally declined to incorporate aspects of international or state privacy laws into the proposed rule, explaining that privacy protections and national security measures overlap but generally focus on different challenges associated with sensitive personal data. However, the DOJ noted that the NPRM’s prohibitions and restrictions are consistent with similar restrictions in other contexts, such as transactions reviewed by CFIUS and Team Telecom. The NPRM also will require entities to comply with the security requirements proposed by the Department of Homeland Security’s Cybersecurity and Infrastructure Agency (CISA) in coordination with DOJ, pursuant to the EO.

The NPRM will have a 30-day comment period.