On February 28, President Biden issued a major new executive order (E.O.) titled, “Preventing Access to Americans' Bulk Sensitive Personal Data and U.S. Government-Related Data by Countries of Concern.”
The E.O. directs the Attorney General to issue regulations within 180 days that prohibit or restrict U.S. persons from engaging in transactions with “countries of concern” involving the transfer of Americans' bulk sensitive data or U.S. government-related data. The E.O. does not identify “countries of concern,” but the U.S. Department of Justice (DOJ) has already indicated that it intends to designate the following countries: China, Russia, Iran, North Korea, Venezuela, and Cuba.
According to the E.O., this new national security program is necessary because “countries of concern” are trying to access Americans' sensitive personal data and U.S. government-related data. The E.O. further notes that “countries of concern” can use this data to engage in malicious activities (e.g., espionage, blackmail, and tracking of political dissidents). The E.O. instructs the Attorney General to ensure that the new regulations are “carefully calibrated” to minimize the risks associated with the transfer of sensitive data to “countries of concern” while minimizing the disruption to commercial activity.
The key takeaway is that companies will soon have yet another national security regime to navigate when engaging in cross-border transactions involving China. The U.S. Department of the Treasury is currently working on regulations that will restrict outbound foreign investments made in Chinese companies that are working on certain types of cutting-edge technologies. Now, the DOJ is working on another set of regulations that will prevent the large-scale transfer of Americans' sensitive personal data to China.
The same day that President Biden issued the new E.O., the DOJ issued an Advance Notice of Proposed Rulemaking (ANPRM) providing additional details on the intended scope of the new national security program. We will provide a detailed summary of the ANPRM in a future blog post.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
