The U.S. Department of Justice has issued regulations to prevent access to Americans’ bulk sensitive personal data by foreign adversaries.Footnote ¹ The rules prohibit for the first time U.S. persons from entering into certain transactions that could give countries, like China, access to such data. The rules also restrict other transactions absent the implementation of specified security requirements.Footnote ² The rules do not cover U.S. government collection of commercially available information, nor is their purpose to protect privacy interests.Footnote ³ Concerns about foreign access to U.S. personal data, through illicit acts (like hacking) and lawful measures (such as collecting and purchasing publicly available information), have existed for years.Footnote ⁴ Yet, U.S. law and policy have generally opposed the imposition of limits on private sector cross-border data flows. Committee on Foreign Investment in the United States (CFIUS) review and rejection of transactions, like that for TikTok, due to data security concerns have been the exception and are of limited scope.Footnote ⁵ The new regulations, together with other recent rules and governmental actions, signal a change in approach.Footnote ⁶ The shift reflects a fear in U.S. law enforcement and national security agencies that existing rules are insufficient to counter the increasing risk of electronic espionage by China and other countries stemming from the proliferation of data, data collection, data sales, and the development of artificial intelligence technologies and other forms of data analysis.Footnote ⁷

Data flows are a staple of international commerce and communications; they can transmit ideas and norms; they can promote human rights and global health; and they can be misused by private and public actors to impose privacy harms and create national security risks. Despite the harms and risks, U.S. policy, across administrations, has championed the free cross-border flow of information and has sought to establish international norms and mechanisms that limit the regulation of transnational data transfers. The United States initiated and promoted the Declaration on the Future of the Internet, which committed signatories to “[p]romote [their] work to realize the benefits of data free flows.”Footnote ⁸ In the context of the G7, it has supported the Data Free Flow with Trust concept first proposed by Japan.Footnote ⁹ It has backed the Global Cross-Border Privacy Rules Forum, which included as one of its objectives support for the free flow of data.Footnote ¹⁰ In trade agreements and fora, the United States has proposed policies that safeguard cross-border data flows, prohibited data localization requirements, and restricted government access to software source code.Footnote ¹¹

But U.S. support for unrestricted data flows abruptly shifted in late 2023. At a meeting of the World Trade Organization's Joint Statement Initiative on Electronic Commerce, the United States withdrew a proposal, first made in 2019 during the Trump administration,Footnote ¹² that took a strong position in favor of free cross-border data flows and against data localization and software source code review.Footnote ¹³ Announcing the decision, the Office of the U.S. Trade Representative (USTR) stated that “[m]any countries, including the United States, are examining their approaches to data and source code, and the impact of trade rules in these areas. In order to provide enough policy space for those debates to unfold, the United States has removed its support for proposals that might prejudice or hinder those domestic policy consideration.”Footnote ¹⁴ Soon thereafter, USTR also paused Indo-Pacific Economic Framework for Prosperity talks on digital trade.Footnote ¹⁵ USTR's decisions drew protests from the business community, which benefits from open data borders and international restrictions on the domestic regulation of data transfers, and a mixed reception in Congress, where some have argued for a trade policy that reserves leeway for greater domestic digital governance.Footnote ¹⁶

USTR did not provide a full explanation for the announced policy shift, but U.S Trade Representative Katherine Tai offered some insight into the decision in remarks she gave early in 2024.Footnote ¹⁷ Ambassador Tai noted the transformation in the role of data in international transactions over the past two decades from facilitating traditional transactions (in goods) to becoming the subject of the transaction itself. This change, she explained, “give[s] you a sense . . . that there are much, much bigger equities at stake than what we might be doing in our trade negotiations.”Footnote ¹⁸ Before making additional international commitments, she said, the United States needed to give further consideration to “how we regulate data, . . . how we regulate the companies that accumulate, harvest, and trade in this data,” and the relationship between “trade [in data] and national security.”Footnote ¹⁹

Ambassador Tai's comments on data and national security foreshadowed President Biden's issuance, just a couple of weeks later, of an executive order on “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.”Footnote ²⁰ The order directed the attorney general to issue regulations restricting the sale of personal information by data brokers to adversaries “when such access would pose an unacceptable risk to the national security of the United States.”Footnote ²¹ Uncontrolled access to Americans’ personal data constituted, according to the order, an “unusual and extraordinary threat.”Footnote ²² Adversaries could “use access to bulk data sets to fuel the creation and refinement of AI and other advanced technologies, thereby improving their ability to exploit the underlying data.”Footnote ²³ They could use “sensitive personal data linked to populations and locations associated with the Federal Government—including the military— . . . to reveal insights . . . that threaten national security.”Footnote ²⁴ They could use data “to track and build profiles on United States individuals, including Federal employees and contractors, for illicit purposes, including blackmail and espionage.”Footnote ²⁵ And they could use data “to collect information on activists, academics, journalists, dissidents, political figures, or members of non-governmental organizations or marginalized communities in order to intimidate such persons; curb dissent or political opposition; otherwise limit freedoms of expression, peaceful assembly, or association; or enable other forms of suppression of civil liberties.”Footnote ²⁶ “Buying data through data brokers is currently legal in the United States,” a senior administration official commented, “and that reflects a gap in our national security tool kit that we're working to fill.”Footnote ²⁷

The new Department of Justice regulations implementing the order limit commercial transactions involving bulk U.S. sensitive personal data or government-related data.Footnote ²⁸ U.S. persons are prohibited from engaging in data brokerage transactions with a “country of concern” or a “covered person” that involves any access to such data.Footnote ²⁹ “Countries of concern” include China, Cuba, Iran, North Korea, Russia, and Venezuela.Footnote ³⁰ A “covered person” is a non-U.S. individual who is primarily a resident of a country of concern, is an employee or contractor of a covered entity, or is a person designated as such by the attorney general.Footnote ³¹ A “covered person” is also a non-U.S. entity that is organized or has its principal place of business in a country of concern or is more than 50 percent owned by a country of concern or covered persons.Footnote ³² Other transactions—those involving vendor agreements, employment agreements, and investment agreements—are restricted, that is they are prohibited unless the U.S. person complies with U.S. Cybersecurity and Infrastructure Security Agency-issued security requirements and has developed and implemented a data compliance program and conducted an audit.Footnote ³³ Certain types of transactions that might otherwise have been prohibited or restricted are exempted (such as those pertaining to scientific research), and applications for licenses can be made.Footnote ³⁴ Civil and criminal penalties apply to violations.Footnote ³⁵

Sensitive to the significance of these new prohibitions and restrictions on data transactions, the executive order reiterated the United States’ continued commitment to “supporting a vibrant, global economy by promoting cross-border data flows required to enable international commerce and trade; and facilitating open investment.”Footnote ³⁶ The order made clear that it did “not authorize the imposition of generalized data localization requirements.”Footnote ³⁷ It also clarified that it did “not broadly prohibit United States persons from conducting commercial transactions . . . with entities and individuals” from countries of concern or “impose measures aimed at a broader decoupling of the substantial consumer, economic, scientific, and trade relationships that the United States has with other countries.”Footnote ³⁸

Though the new rule is consistent with the new Trump administration's stance on China, its future is unclear.Footnote ³⁹