Recent Executive Order Looks to Protect Americans' Sensitive Personal Data

On February 28, 2024, President Biden issued an executive order related to Americans’ sensitive personal data and United States government-related data by “Countries of Concern.” The executive order details an objective of risk mitigation of national security threats from certain activities that may be feasible from access to Americans’ sensitive personal data and United States Government-related data. This includes but is not limited to leveraging advanced technologies such as artificial intelligence (AI) as well as information from direct and indirect access to sensitive personal data and United States Government-related through various agreements, such as: 

• Data brokerages
• Third-party vendor agreements
• Employment agreements
• Investment agreements or other such arrangements 

Additionally, the United States Department of Justice (DOJ) published an advanced notice of a proposed rulemaking (ANPRM) related to the executive order in the Federal Registrar allowing for comments on the matter. Per the executive order, the DOJ will be the lead United States agency, coordinating with the Departments of State, Commerce, Treasury, and Homeland Security, among others, to assist with implementing the order. 

Key Information from the DOJ Fact Sheet  

The ANPRM indicates the DOJ may adopt the definition of “Countries of Concern” in the Executive Order, which would currently apply to China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela. However, the ANPRM, and applicable DOJ fact sheet includes current or proposed refinement around definitions of several key terms noted in the Executive Order, most notably: 

• Two classes of prohibited data transactions: data brokerage transactions and those that provide access to bulk human genomic data or human biospecimens that can derive human genomic data.
• Three classes of restricted data transactions of the various agreements noted above.
• Six categories of American sensitive personal data as follows: 

1. 1. Personal identifiers
   2. Personal financial data
   3. Personal health data
   4. Precise geolocation data
   5. Biometric identifiers
   6. Human genomic data
   7. Data Security Enhancement 

Data Security Enhancement 

While data thresholds would apply bulk volume thresholds for American sensitive personal data, there will be no thresholds applied to United States Government-related data. 

The fact sheet recognizes that the Committee of Foreign Investment in the United States (CFIUS), and the Committee of Foreign Participation in the United States Telecommunications Services Sector (Team Telecom) - the interagency committee that assists the Federal Communications Committee (FCC) - may include data security risks related to a particular transaction. The executive order aims to address a gap in current regulations, does not contemplate an issue with overlap, and is a complement to existing national security-related regulations.  

It should be noted that it is unclear if the executive order and the ANPRM will cause CFIUS to expand and amend their definition of sensitive personal data, as the executive order and the ANPRM are to include “humanomic” data, which is defined as data generated from humans that characterizes or quantifies human biological molecules of which human genomic data is a subcategory. Biometric data is not currently included in the CFIUS definition of sensitive personal data. 

While the recent executive order looks to protect Americans' sensitive personal data, these adoptions of further protections and restrictions in the U.S. regarding transfers of data to jurisdictions posing an elevated risk of misuse will be seen as a welcomed step in the protection of our most valued information.

This article was first published via Foreign Investment Watch.