On February 28, 2024, President Biden signed Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and U.S. Government-Related Data by Countries of Concern” (the EO), under the authority of the International Emergency Economic Powers Act (IEEPA). Among other things, the EO directs the Department of Justice (DOJ) to issue regulations that prevent the large-scale transfer of certain types of “sensitive personal data” to “countries of concern,” including China and Russia. In tandem with the EO, DOJ released an Advance Notice of Proposed Rulemaking (ANPRM) to outline its plan for these regulations.
Although the White House has asserted that the EO will be implemented consistent with the United States’s “longstanding support for the trusted free flow of data,” DOJ is considering a flat prohibition on two types of transactions between U.S. persons and entities from countries of concern or controlled by nationals of countries of concern: (1) data-brokerage transactions; and (2) transactions involving the transfer of bulk human genomic data. Critically, the ANPRM also contemplates imposing special security requirements and other restrictions on three types of bulk data transactions involving sensitive personal data: (1) vendor agreements involving the provision of goods and services; (2) employment agreements; and (3) investment agreements.
