The U.S. Division of Justice (DoJ) has issued a ultimate rule finishing up Govt Order (EO) 14117, which prevents mass switch of residents’ private information to international locations of concern reminiscent of China (together with Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela.
“This final rule is a crucial step forward in addressing the extraordinary national security threat posed of our adversaries exploiting Americans’ most sensitive personal data,” mentioned Assistant Lawyer Common Matthew G. Olsen of the Justice Division’s Nationwide Safety Division.
“This powerful new national-security program is designed to ensure that Americans’ personal data is no longer permitted to be sold to hostile foreign powers, whether through outright purchase or other means of commercial access.”
Again in February 2024, U.S. President Joe Biden signed an govt order to handle the nationwide threat posed by unauthorized entry to Individuals’ delicate private and government-related information for malicious actions, reminiscent of espionage, affect, kinetic, or cyber operations.
Moreover, the order famous that the international locations of concern can leverage their entry to bulk information to develop or refine synthetic intelligence and different superior applied sciences, in addition to buy such info from business information brokers and different firms.
“Countries of concern and covered persons can also exploit this data to collect information on activists, academics, journalists, dissidents, political opponents, or members of nongovernmental organizations or marginalized communities to intimidate them; curb political opposition; limit freedoms of expression, peaceful assembly, or association; or enable other forms of suppression of civil liberties,” the DoJ mentioned.
The rule issued by the DoJ is predicted to change into efficient in 90 days. It identifies sure lessons of prohibited, restricted, and exempt transactions; units bulk thresholds for triggering the rule’s prohibitions and restrictions on coated information transactions involving bulk delicate private information; and establishes enforcement mechanisms reminiscent of civil and prison penalties.
This covers information spanning six classes: private identifiers (e.g., Social Safety numbers, driver’s license and many others.), exact geolocation information, biometric identifiers, human ‘omic (genomic, epigenomic, proteomic, and transcriptomic) information, private well being information, and private monetary information.
Nonetheless, it bears noting that the rule neither imposes information localization necessities, nor does it prohibit U.S. residents from conducting medical, scientific, or different analysis in international locations of concern.
“The final rule also does not broadly prohibit U.S. persons from engaging in commercial transactions, including exchanging financial and other data as part of the sale of commercial goods and services with countries of concern or covered persons, or impose measures aimed at a broader decoupling of the substantial consumer, economic, scientific, and trade relationships that the United States has with other countries,” the DoJ mentioned.
