New Executive Order Seeks to Protect Americans Sensitive Personal Data

Introduction

On February 28, 2024, President Biden signed Executive Order 14117, titled “Preventing Access to Americans’ Bulk Sensitive Data and United States Government-Related Data by Countries of Concern” (EO), marking a significant step in safeguarding national security and personal privacy. This executive action responds to the urgent need to protect Americans’ sensitive personal data and U.S. government-related information from exploitation by certain nations deemed as “countries of concern.” By expanding existing authorities and addressing gaps in regulatory frameworks, the EO seeks to mitigate the growing threats posed by unauthorized access to biometric, financial, genomic, geolocation, and health data, thereby safeguarding against cyber-enabled activities, espionage, and other nefarious acts.

Background and purpose

President Biden’s issuance of the Executive Order on Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern (EO) reflects a strategic response to the evolving landscape of cyber threats and data vulnerabilities. Recognizing a critical deficiency in current national security measures, the EO expands upon previous executive orders, including EO 13873 issued by former President Trump in May 2019 and EO 14034 issued by President Biden in June 2021. These prior directives laid the groundwork for securing information and communications technology and services supply chains and protecting Americans’ sensitive data from foreign adversaries, respectively. However, the escalating risk of certain countries accessing sensitive personal data through commercial relationships necessitated a more comprehensive approach.

Grounded in the authority of the International Emergency Economic Powers Act (IEEPA), the EO augments the scope of the national emergency declared in EO 13873, further addressing the perceived threat posed by countries of concern. 

Specifically, the EO aims to mitigate risks stemming from sales, licensing, vendor engagements, employment, and investments that could facilitate unauthorized access to Americans’ sensitive personal data and U.S. government-related information. Such access, fueled by advancements in artificial intelligence and data analytics, poses significant risks, including cyber-enabled activities, espionage, tracking of military personnel, and blackmail.

While legislative efforts, such as the Foreign Investment Risk Review Modernization Act of 2018 and President Biden’s 2022 Executive Order 14083, have acknowledged the national security implications of accessing sensitive personal data, existing laws fall short of addressing the comprehensive regulatory framework needed to safeguard against emerging threats. Consequently, the EO seeks to fill this regulatory gap by holistically regulating transactions involving U.S. persons’ sensitive personal data, thereby bolstering national security in the face of evolving cyber threats.

Program summary 

The U.S. Department of Justice (DOJ) has clarified in explicit terms that the Advance Notice of Proposed Rulemaking (ANPRM) does not comprehensively outline all potential approaches for finalizing regulations in line with the Executive Order (EO). Nonetheless, the ANPRM offers detailed insights into crucial considerations, outlining specific parameters. In broad terms, it highlights prohibited categories of transactions involving substantial amounts of sensitive personal data, as well as restricted transaction categories that may proceed if they adhere to predefined security requirements. It is noteworthy that the DOJ does not plan to undertake a case-by-case assessment akin to CFIUS or Team Telecom. 

Country of concern 

In the realm of safeguarding national security, the recent Executive Order (EO) has cast its net wide, honing in on the transfer of sensitive personal data to what it deems “countries of concern.” 

These nations under scrutiny, as per the Department of Justice (DOJ)’s deliberations, may encompass China (encompassing Hong Kong and Macau), Russia, Cuba, Iran, Venezuela, and North Korea. But the scope doesn’t end there; the DOJ contemplates an expansive interpretation of “covered persons,” extending to individuals and entities subject to the jurisdiction of a “country of concern,” including foreign employees and contractors associated with said entities. To mitigate the risk of data ‘re-export’ to these countries, the DOJ is pondering requirements for foreign persons not falling under the covered persons category to refrain from reselling or providing access to restricted data to either a “country of concern” or a “covered person.”

Covered persons 

The EO meticulously defines “covered persons,” enveloping various entities and individuals within its ambit:

1. Entities Under Scrutiny: Any entity owned by, controlled by, or subject to the jurisdiction or direction of a country flagged as a concern, which the DOJ contemplates defining as those predominantly owned by, controlled by, or with their principal place of business in such a country.
2. Foreign Personnel Ties: Foreign individuals who serve as employees or contractors for the aforementioned scrutinized entities.
3. Affiliation with Concerned Countries: Foreign individuals engaged as employees or contractors directly under a country of concern’s banner.
4. Territorial Residence: Foreign individuals primarily residing within the territorial jurisdiction of a country of concern.
5. DOJ Designations: Lastly, any foreign individual or entity branded by the DOJ as a covered person, whether due to being controlled by an identified covered person or for knowingly instigating or orchestrating a violation of the EO. In the case of item (5), the DOJ anticipates the establishment and upkeep of a roster of covered persons akin to the Office of Foreign Assets Control (OFAC) listings, ensuring transparency and accountability in enforcement.

Layers of covered sensitive personal data 

Expounding upon these terms, the Advance Notice of Proposed Rulemaking (ANPRM) delves into the nuances, particularly proposing an expansive definition for “covered personal identifiers.” This broad interpretation may encompass classes of personally identifiable data reasonably linked to an individual, whether in combination with each other, with other sensitive data, or with data disclosed by a transacting party. The proposed roster of identifiers under scrutiny spans a spectrum, including but not limited to:

1. Full or truncated social security numbers.
2. Financial account numbers.
3. Device-based or hardware-based identifiers.
4. Demographic or contact data (excluding data solely linked to other demographic or contact data).
5. Advertising identifiers such as Google Advertising IDs.
6. Authentication data such as account usernames.
7. Network-based identifiers such as IP addresses (excluding data solely linked to other network-based identifiers).

However, notably absent from this list is web-browsing history, indicative of the delineation and prioritization of sensitive data types.

Bulk threshold

Government data unveiled 

At the heart of the Executive Order (EO) lies the meticulous definition of “U.S. Government-related data,” a term that holds significant implications for national security. 

The EO intricately defines this category to encompass sensitive personal data deemed by the Attorney General to present an elevated risk of exploitation by countries of concern, with the intent to undermine United States national security.

This data, irrespective of volume, carries the potential to:

1. Identify Government Personnel: Data capable of identifying current or recent former U.S. government employees or contractors, as well as former senior officials, including military personnel. 
2. Linked to Sensitive Government Locations: Data associated with locations of strategic importance to the U.S. government.

The Advance Notice of Proposed Rulemaking (ANPRM) further elucidates this definition by contemplating its expansion to include: