Provisions Pertaining to Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons

Federal RegisterOct 29, 2024

Ask Donna

What actually matters in this document.

Text

DEPARTMENT OF JUSTICE

28 CFR Part 202

[Docket No. NSD 104]

RIN 1124-AA01

Provisions Pertaining to Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons

AGENCY:

National Security Division, Department of Justice.

ACTION:

Proposed rule; request for comments.

SUMMARY:

The Department of Justice proposes a rule to implement Executive Order 14117 of February 28, 2024 (Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern), by prohibiting and restricting certain data transactions with certain countries or persons.

DATES:

Written comments on this notice of proposed rulemaking (NPRM) must be received by November 29, 2024.

ADDRESSES:

You may send comments, identified by Docket No. NSD 104, by either of the following methods:

•

Federal eRulemaking Portal: https://www.regulations.gov.

Follow the instructions for sending comments.

•

Mail:

U.S. Department of Justice, National Security Division, Foreign Investment Review Section, 175 N Street NE, 12th Floor, Washington, DC 20002.

FOR FURTHER INFORMATION CONTACT:

Email (preferred):

NSD.FIRS.datasecurity@usdoj.gov.

Otherwise, please contact: Lee Licata, Deputy Chief for National Security Data Risks, Foreign Investment Review Section, National Security Division, U.S. Department of Justice, 175 N Street NE, Washington, DC 20002; Telephone: 202-514-8648.

SUPPLEMENTARY INFORMATION:

In accordance with 5 U.S.C. 553(b)(4), a plain language summary of the proposed rule is available at

www.regulations.gov.

Public Participation

Instructions:

We encourage comments to be submitted via

https://www.regulations.gov.

Please submit comments only, include your name and company name (if any), and cite “Provisions Pertaining to Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons” in all correspondence. Anyone submitting business confidential information should clearly identify the business confidential portion at the time of submission, file a statement justifying nondisclosure and referring to the specific legal authority claimed, and provide a non-confidential version of the submission. For comments submitted electronically containing business confidential information, the file name of the business confidential version should begin with the characters “BC.” Any page containing business confidential information must be clearly marked “BUSINESS CONFIDENTIAL” at the top of that page. The corresponding non-confidential version of those comments must be clearly marked “PUBLIC.” The file name of the nonconfidential version should begin with the character “P.” Any submissions with file names that do not begin with a “BC” will be assumed to be public and will be posted without change, including any business or personal information provided, such as names, addresses, email addresses, or telephone numbers.

To facilitate an efficient review of submissions, the Department of Justice encourages but does not require commenters to: (1) submit a short executive summary at the beginning of all comments; (2) provide supporting material, including empirical data, findings, and analysis in reports or studies by established organizations or research institutions; (3) describe the relative benefits and costs of the approach contemplated in this NPRM and any alternative approaches; and (4) refer to the specific proposed subpart or defined term to which each comment is addressed. The Department of Justice welcomes interested parties' submissions of written comments discussing relevant experiences, information, and views. Parties wishing to supplement their written comments with a follow-up meeting may request to do so, and the Department of Justice may accommodate such requests as resources permit.

Table of Contents

I. Executive Summary

II. Background

III. Advance Notice of Proposed Rulemaking and Comments

IV. Discussion of the Proposed Rule

A. Subpart C—Prohibited Transactions and Related Activities

1. Section 202.210—Covered Data Transactions

2. Section 202.301—Prohibited Data-Brokerage Transactions

3. Section 202.201—Access

4. Section 202.249—Sensitive Personal Data

5. Section 202.212—Covered Personal Identifiers

6. Section 202.234—Listed Identifier

7. Section 202.242—Precise Geolocation Data

8. Section 202.204—Biometric Identifiers

9. Section 202.224—Human Genomic Data

10. Other Human `Omic Data

11. Section 202.240—Personal Financial Data

12. Section 202.241—Personal Health Data

13. Section 202.206—Bulk U.S. Sensitive Personal Data

14. Section 202.205—Bulk

15. Section 202.222—Government-Related Data

16. Section 202.302—Other Prohibited Data-Brokerage Transactions Involving Potential Onward Transfer to Countries of Concern or Covered Persons

17. Section 202.303—Prohibited Human Genomic Data and Human Biospecimen Transactions

18. Section 202.304—Prohibited Evasions, Attempts, Causing Violations, and Conspiracies

19. Section 202.305—Knowingly Directing Prohibited Transactions

20. Section 202.215—Directing

21. Section 202.230—Knowingly

B. Subpart D—Restricted Transactions

1. Section 202.401—Authorization To Conduct Restricted Transactions; Section 202.402—Incorporation by Reference

2. Section 202.258—Vendor Agreement

3. Section 202.217—Employment Agreement

4. Section 202.228—Investment Agreement

C. Subpart E—Exempt Transactions

1. Section 202.501—Personal Communications; Section 202.502—Information or Informational Materials; and Section 402.503—Travel

2. Section 202.504—Official Business of the United States Government

3. Section 202.505—Financial Services

4. Section 202.506—Corporate Group Transactions

5. Section 202.507—Transactions Required or Authorized by Federal Law or International Agreements, or Necessary for Compliance With Federal Law

6. Section 202.508—Investment Agreements Subject to a CFIUS Action

7. Section 202.509—Telecommunications Services

8. Section 202.510—Drug, Biological Product, and Medical Device Authorizations

9. Section 202.511—Other Clinical Investigations and Post-Marketing Surveillance Data

10. Other Exemptions

D. Subpart F—Determination of Countries of Concern

1. Section 202.601—Determination of Countries of Concern

a. China

b. Cuba

c. Iran

d. North Korea

e. Russia

f. Venezuela

E. Subpart G—Covered Persons

1. Section 202.211—Covered Person

2. Section 202.701—Designation of Covered Persons

F. Subpart H—Licensing

1. Section 202.801—General Licenses

2. Section 202.802—Specific Licenses

3. Conditions on General and Specific Licenses

G. Subpart I—Advisory Opinions

1. Section 202.901—Inquiries Concerning Application of This Part

H. Subpart J—Due Diligence and Audit Requirements

1. Section 202.1001—Due Diligence for Restricted Transactions

2. Section 202.1002—Audits for Restricted Transactions

I. Subpart K—Reporting and Recordkeeping Requirements

1. Section 202.1101—Records and Recordkeeping Requirements

2. Section 202.1102—Reports To Be Furnished on Demand

3. Section 202.1103—Annual Reports

4. Section 202.1104—Reports on Rejected Prohibited Transactions

J. Subpart M—Penalties and Finding of Violation

1. Section 202.1301—Penalties for Violations

2. Section 202.1305—Finding of Violation

K. Coordination With Other Regulatory Regimes

L. Severability

V. Analysis for Proposed Bulk Thresholds

A. Analysis of Sensitivity of Each Category of Sensitive Personal Data

1. Human Genomic Data

2. Biometric Identifiers

3. Precise Geolocation Data

4. Personal Health Data

5. Personal Financial Data

6. Covered Personal Identifiers

B. Grouping the Categories Into Tiers by Similar Sensitivity

C. Proposed Bulk Thresholds for Each Tier

VI. Interpretation of “Information or Informational Materials” in IEEPA

A. The Berman Amendment Is Intended To Protect the Free Exchange of Ideas

B. The Berman Amendment Does Not Reach Transactions Involving Sensitive Personal Data Under This Proposed Rule

C. Exclusion for Materials Already Created and in Existence

VII. Regulatory Requirements

A. Executive Orders 12866 (Regulatory Planning and Review) as Amended by Executive Orders 13563 (Improving Regulation and Regulatory Review) and 14094 (Modernizing Regulatory Review)

1. Executive Summary

2. Introduction

3. Market Sectors Impacted by the Proposed Regulation

a. Sensitive Personal Data and Government-Related Data

i. Personal Financial Data

ii. Personal Health Data

iii. Precise Geolocation Data

iv. Human Genomic and Human `Omic Data

v. Biometric Identifiers

vi. Covered Personal Identifiers

b. The Data-Brokerage Market

i. Companies That May Meet the Definition of Data Brokers for the Purposes of the Proposed Rule

ii. Market Size

iii. Products Sold by Data Brokers

iv. Price Information

v. Customers of Data-Brokerage Products

c. Agreements Affected by the Proposed Regulation

i. Vendor Agreements

ii. Employment Agreements

iii. Investment Agreements

iv. Security Requirements

v. Due Diligence and Recordkeeping

vi. Audits

vii. Licenses

4. Need for Regulatory Action

5. Baseline (Without the Proposed Rule)

a. Baseline National Security and Foreign-Policy Risks by Category of Data

i. Human Genomic and Human `Omic Data

ii. Biometric Identifiers

iii. Precise Geolocation Data

iv. Personal Health Data

v. Personal Financial Data

vi. Covered Personal Identifiers

vii. Government-Related Data

b. Baseline: Total Potential U.S. Population Affected by Risks

c. Summary of Baseline (Without the Proposed Rule)

6. Alternative Approaches

7. Benefits of the Proposed Rule

8. Costs of the Proposed Rule

a. Value of Lost and Forgone Transactions

i. Global Market Value of Genomic, Biometric, and Location Data

ii. U.S. Exports to Relevant Specific Categories and to Countries of Concern

iii. Estimates of U.S. Exports of Genomic, Biometric, and Location Data

iv. Estimates of U.S. Exports of Genomic, Biometric, and Location Data to the Six Countries of Concern

v. Total Estimated Value of Lost and Forgone Transactions

vi. Alternative Methodology for Estimating the Value of Lost and Forgone Transactions

b. Security Costs

i. Similar Security Standards and Frameworks

ii. Current Industry Compliance Level

iii. Costs of Compliance

c. Costs Associated With Compliance Program: Due Diligence, Recordkeeping, and Auditing

i. Due Diligence Costs

ii. Recordkeeping Costs

iii. Executive Order on Modernizing Regulatory Review Recordkeeping and Related Costs

iv. Auditing Costs

v. Estimated Recordkeeping Costs From the Reviewed Literature

vi. Summary of a Compliance Program: Due Diligence, Recordkeeping, and Auditing

9. Summary of Regulatory Analysis

B. Regulatory Flexibility Act

1. Succinct Statement of the Objectives of, and Legal Basis for, the Proposed Rule

2. Description of and, Where Feasible, an Estimate of the Number of Small Entities to Which The Proposed Rule Will Apply

3. Description of the Projected Reporting, Recordkeeping, and Other Compliance Requirements of the Proposed Rule

4. Identification of all Relevant Federal Rules That May Duplicate, Overlap, or Conflict With the Proposed Rule

C. Executive Order 13132 (Federalism)

D. Executive Order 13175 (Consultation and Coordination With Indian Tribal Governments)

E. Executive Order 12988 (Civil Justice Reform)

F. Paperwork Reduction Act

G. Unfunded Mandates Reform Act

I. Executive Summary

Executive Order 14117 of February 28, 2024, “Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern” (“the Order”), directs the Attorney General to issue regulations that prohibit or otherwise restrict United States persons from engaging in any acquisition, holding, use, transfer, transportation, or exportation of, or dealing in, any property in which a foreign country or national thereof has any interest (“transaction”), where the transaction: involves United States Government-related data (“government-related data”) or bulk U.S. sensitive personal data, as defined by final rules implementing the Order; falls within a class of transactions that has been determined by the Attorney General to pose an unacceptable risk to the national security of the United States because it may enable access by countries of concern or covered persons to government-related data or Americans' bulk U.S. sensitive personal data; and meets other criteria specified by the Order. On March 5, 2024, the National Security Division of the Department of Justice (“DOJ” or “the Department”) issued an Advance Notice of Proposed Rulemaking (“ANPRM”) seeking public comment on various topics related to implementation of the Order.

89 FR 15780 (Mar. 5, 2024).

This Notice of Proposed Rulemaking (“NPRM”) addresses the public comments received on the ANPRM, sets forth a proposed rule to implement the Order, and seeks public comment. The proposed rule identifies classes of prohibited and restricted transactions; identifies countries of concern and classes of covered persons with whom the regulations would prohibit or restrict transactions involving government-related data or bulk U.S. sensitive personal data; establishes a process to issue (including to modify or rescind) licenses authorizing otherwise prohibited or restricted transactions and to issue advisory opinions; and addresses recordkeeping and reporting of transactions to inform investigative, enforcement, and regulatory efforts of the Department of Justice.

II. Background

On February 28, 2024, the President issued Executive Order 14117 (Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern) (“the Order”), pursuant to his authority under the Constitution and the laws of the United States, including the International Emergency Economic Powers Act (50 U.S.C. 1701

et seq.

) (“IEEPA”); the National Emergencies Act (50 U.S.C. 1601

et seq.

) (“NEA”); and title 3, section 301 of the United States Code. In the Order, the President expanded the scope of the national emergency declared in Executive Order 13873 of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain), and further addressed with additional measures in Executive Order 14034 of June 9, 2021 (Protecting Americans' Sensitive Data From Foreign Adversaries). The President determined that additional measures are necessary to counter the unusual and extraordinary threat to U.S. national security posed by the continuing efforts of certain countries of concern to access and exploit government-related data or Americans' bulk U.S. sensitive personal data.

The Order directs the Attorney General, pursuant to the President's delegation of his authorities under IEEPA, to issue regulations that prohibit or otherwise restrict United States persons from engaging in certain transactions in which a foreign country of concern or national thereof has an interest. Restricted and prohibited transactions include transactions that involve government-related data or bulk U.S. sensitive personal data, are a member of a class of transactions that the Attorney General has determined poses an unacceptable risk to the national security of the United States because the transactions may enable countries of concern or covered persons to access government-related data or bulk U.S. sensitive personal data, and are not otherwise exempted from the Order or its implementing regulations. The Order directs the Attorney General to issue regulations that identify classes of prohibited and restricted transactions; identify countries of concern and classes of covered persons whose access to government-related data or bulk U.S. sensitive personal data poses the national security risk described in the Order; establish a process to issue (including to modify or rescind) licenses authorizing otherwise prohibited or restricted transactions; further define terms used in the Order; address recordkeeping and reporting of transactions to inform investigative, enforcement, and regulatory efforts of the Department of Justice; and to take whatever additional actions, including promulgating additional regulations, as may be necessary to carry out the purposes of the Order.

The Order and this proposed rule fill an important gap in the United States Government's authorities to address the threat posed by countries of concern accessing government-related data or Americans' bulk U.S. sensitive personal data. As the President determined in the Order, “[a]ccess to Americans' bulk sensitive personal data or United States Government-related data increases the ability of countries of concern to engage in a wide range of malicious activities.” As the ANPRM explained, countries of concern can use their access to government-related data or Americans' bulk U.S. sensitive personal data to engage in malicious cyber-enabled activities and malign foreign influence activities and to track and build profiles on U.S. individuals, including members of the military and other Federal employees and contractors, for illicit purposes such as blackmail and espionage. And countries of concern can exploit their access to government-related data or Americans' bulk U.S. sensitive personal data to collect information on activists, academics, journalists, dissidents, political figures, or members of nongovernmental organizations or marginalized communities to intimidate them; curb political opposition; limit freedoms of expression, peaceful assembly, or association; or enable other forms of suppression of civil liberties.

As the 2024 National Counterintelligence Strategy explains, “as part of a broader focus on data as a strategic resource, our adversaries are interested in personally identifiable information (PII) about U.S. citizens and others, such as biometric and genomic data, health care data, geolocation information, vehicle telemetry information, mobile device information, financial transaction data, and data on individuals' political affiliations and leanings, hobbies, and interests.”

These and other kinds of sensitive personal data “can be especially valuable, providing adversaries not only economic and [research and development] benefits, but also useful [counterintelligence] information, as hostile intelligence services can use vulnerabilities gleaned from such data to target and blackmail individuals.”

Nat'l Counterintel. & Sec. Ctr

., National Counterintelligence Strategy 2024

13 (Aug. 1, 2024),

https://www.dni.gov/files/NCSC/documents/features/NCSC_CI_Strategy-pages-20240730.pdf

[

https://perma.cc/9L2T-VXSU

Id.

Nongovernmental experts have underscored these risks. For example, a recent study by the MITRE Corporation summarized open-source reporting, highlighting the threat of blackmail, coercion, identification of high-risk government personnel and sensitive locations, and improved targeting of offensive cyber operations and network exploitation posed by hostile actors' access to Americans' data derived from advertising technology.

Kirsten Hazelrig, Ser. No. 14,

Intelligence After Next: Surveillance Technologies Are Imbedded Into the Fabric of Modern Life—The Intelligence Community Must Respond,

The MITRE Corporation 2 (Jan. 5, 2023),

https://www.mitre.org/sites/default/files/2023-01/PR-22-4107-INTELLIGENCE-AFTER-NEXT-14-January-2023.pdf

[

https://perma.cc/3WA2-PGM2

The development of artificial intelligence (“AI”), high-performance computing, big-data analytics, and other advanced technological capabilities by countries of concern amplifies the threat posed by these countries' access to government-related data or Americans' bulk U.S. sensitive personal data. For instance, the U.S. National Intelligence Council assessed in 2020 that “access to personal data of other countries' citizens, along with [artificial intelligence]-driven analytics, will enable [the People's Republic of China] to automate the identification of individuals and groups beyond China's borders to target with propaganda or censorship.”

Nat'l Intel. Council,

Assessment: Cyber Operations Enabling Expansive Digital Authoritarianism

4 (Apr. 7, 2020),

https://www.dni.gov/files/ODNI/documents/assessments/NICM-Declassified-Cyber-Operations-Enabling-Expansive-Digital-Authoritarianism-20200407-2022.pdf

[

https://perma.cc/ZKJ4-TBU6

Countries of concern can also exploit their access to government-related data regardless of volume to threaten U.S. national security. One academic study explained that “[f]oreign and malign actors could use location datasets to stalk or track high-profile military or political targets,” revealing “sensitive locations—such as visits to a place of worship, a gambling venue, a health clinic, or a gay bar—which again could be used for profiling, coercion, blackmail, or other purposes.”

The MITRE report further explained that location datasets could reveal “U.S. military bases and undisclosed intelligence sites” or “be used to

estimate military population or troop buildup in specific areas around the world or even identify areas of off-base congregation to target.”

As another example of these data risks and the relative ease with which they can be exploited, journalists were able to commercially acquire from a data broker a continuous stream of 3.6 billion geolocation data points that were lawfully collected on millions of people from advertising IDs.

The journalists were then able to create “movement profiles” for tens of thousands of national security and military officials, and from there, could determine where they lived and worked as well as their names, education levels, family situations, and hobbies.

Justin Sherman et al., Duke Sanford Sch. of Pub. Pol'y,

Data Brokers and the Sale of Data on U.S. Military Personnel

15 (Nov. 2023),

https://techpolicy.sanford.duke.edu/wp-content/uploads/sites/4/2023/11/Sherman-et-al-2023-Data-Brokers-and-the-Sale-of-Data-on-US-Military-Personnel.pdf

[

https://perma.cc/BBJ9-44UH

Id.

Suzanne Smalley,

US Company's Geolocation Data Transaction Draws Intense Scrutiny in Germany,

The Record (July 18, 2024),

https://therecord.media/germany-geolocation-us-data-broker

[

https://perma.cc/ME9F-TAQ7

] (citing joint reporting by the German public broadcaster Bayerische Rundfunk and digital civil rights opinion news site

netzpolitik.org

Id.

The Order and this proposed rule seek to mitigate these and other national security threats that arise from countries of concern accessing government-related data or Americans' bulk U.S. sensitive personal data.

No current Federal legislation or rule categorically prohibits or imposes security requirements to prevent U.S. persons from providing countries of concern or covered persons access to sensitive personal data or government-related data through data brokerage, vendor, employment, or investment agreements. For example, the scope and structure of the Protecting Americans' Data from Foreign Adversaries Act of 2024 (

see

Pub. L. 118-50, div. I, 118th Cong. (2024)) do not create a comprehensive regulatory scheme that adequately and categorically addresses these national security risks, as explained in part IV.K of this preamble. Likewise, the Committee on Foreign Investment in the United States (“CFIUS”) has authority to assess the potential national security risks of certain investments by foreign persons in certain United States businesses that “maintain[] or collect[] sensitive personal data of United States citizens that may be exploited in a manner that threatens national security.”

CFIUS only reviews certain types of investments in U.S. businesses; it does so on a transaction-by-transaction basis, instead of prescribing prospective and categorical rules regulating all such transactions; and its authorities do not extend to other activities that countries of concern may use to gain access to government-related data or Americans' bulk U.S. sensitive personal data, such as through purchases of such data on the commercial market or through vendor or employment agreements.

50 U.S.C. 4565(a)(4)(B)(iii)(III).

See generally

Foreign Investment Risk Review Modernization Act of 2018, Public Law 115-232, tit. XVII, secs. 1701-28, 132 Stat. 1636, 2173.

Similarly, Executive Order 13873 prohibits any acquisition, importation, transfer, installation, dealing in or use of by U.S. persons from acquiring certain information and communication technologies and services (“ICTS”) designed, developed, manufactured, or supplied by foreign adversaries where, among other things, the Secretary of Commerce determines that the transaction poses an “unacceptable risk to the national security of the United States or the security and safety of United States persons.”

In building upon the national emergency declared in Executive Order 13873, the President, in Executive Order 14034, determined that connected software applications operating on U.S. ICTS “can access and capture vast swaths of . . . personal information and proprietary business information,” a practice that “threatens to provide foreign adversaries with access to that information.”

However, as with CFIUS legal authorities, the orders do not broadly empower the United States Government to prohibit or otherwise restrict the sale of government-related data or Americans' bulk U.S. sensitive personal data, and the orders do not broadly restrict other commercial transactions, such as investment, employment, or vendor agreements, that may provide countries of concern access to government-related data or Americans' bulk U.S. sensitive personal data.

E.O. 13873 of May 15, 2019, 84 FR 22689, 22690 (May 15, 2019).

E.O. 14034, 86 FR 31423, 31423 (June 9, 2021).

The proposed rule would complement these statutory and regulatory authorities. It prescribes forward-looking, categorical rules that prevent U.S. persons from providing countries of concern or covered persons access to government-related data or Americans' bulk U.S. sensitive personal data through commercial data-brokerage transactions. The proposed rule also imposes security requirements on other kinds of commercial transactions, such as investment, employment, and vendor agreements, that involve government-related data or Americans' bulk U.S. sensitive personal data to mitigate the risk that a country of concern could access such data. The proposed rule would address risks to government-related data or Americans' bulk U.S. sensitive personal data that current authorities leave vulnerable to access and exploitation by countries of concern and provide predictability and regulatory certainty by prescribing categorical rules regulating certain kinds of data transactions that could give countries of concern or covered persons access to government-related data or Americans' bulk U.S. sensitive personal data.

III. Advance Notice of Proposed Rulemaking and Comments

The National Security Division of the Department published an ANPRM on March 5, 2024 (former RIN: 1105-AB72), soliciting public comment on various topics related to the Order.

The Department received and carefully reviewed 64 timely comments in response to the ANPRM from trade associations, public interest advocacy groups, think tanks, private individuals, and companies, as well as comments from several foreign governments. The Department also received two additional ex parte comments after the comment period closed, which DOJ publicly posted on

regulations.gov.

89 FR 15780 (Mar. 5, 2024).

During the comment period, the Department of Justice, both on its own and with other agencies, met with businesses, trade groups, and other stakeholders potentially interested in or impacted by the contemplated regulations to discuss the ANPRM. For example, the Department discussed the ANPRM with the Consumer Technology Association, the Information Industry Technology Council, Pharmaceutical Research and Manufacturers of America, the Biotechnology Innovation Organization, the Bioeconomy Information Sharing Analysis Center, the U.S. Chamber of Commerce, Tesla, Workday, Anthropic, and the Special Competitive Studies Project, and it provided briefings to the Secretary of Commerce and Industry Trade Advisory Committees 6, 10, and 12 administered by the Office of the U.S. Trade Representative and the Department of Commerce. The Department also discussed the Order and contemplated regulations with stakeholders at events open to the public, including ones hosted by the American Conference Institute, the American Bar Association, the Center for Strategic and International Studies, and the R Street Institute, and through other public engagements such as the Lawfare Podcast, ChinaTalk Podcast, CyberLaw Podcast, and the Center for

Cybersecurity Policy & Law's Distilling Cyber Policy podcast.

After the comment period closed, the Department of Justice, along with the Department of Commerce, followed up with commenters who provided feedback regarding the bulk thresholds to discuss that topic in more detail, including the Council on Government Relations Industry Association, Association of American Medical Colleges, Airlines for America, Bank Policy Institute, the Business Roundtable, Information Technology Industry Council, Centre for Information Policy Leadership, Biotechnology Innovation Organization, Software and Information Industry Association, Cellular Telephone Industries Association, the internet and Television Association, US Telecom, Ford Motor Company, Bioeconomy Information Sharing and Analysis Center, Coalition of Services Industries, Enterprise Cloud Coalition, Electronic Privacy Information Center, Center for Democracy and Technology, Business Software Alliance, Global Data Alliance, Interactive Advertising Bureau, U.S.-China Business Council, IBM, Workday, and individuals Justin Sherman, Mark Febrizio, and Charlie Lorthioir. The Department has also discussed the Order and the ANPRM with foreign partners to ensure that they understood the Order and contemplated program and how they fit into broader national security, economic, and trade policies.

The Department considered each comment submitted, including the ex parte comments that have since been publicly posted. Many of the comments were general in nature and supported the Department's efforts and approach with respect to the proposed rule. Overall, commenters were generally supportive of the intent of the proposed rule. However, several commentators representing industry questioned the effectiveness of the proposed rule as compared to the passage of a holistic federal privacy law, proposed revisions, and highlighted areas where the proposed rule would benefit from further clarity. The Department discusses comments, and any edits or revisions made in response to the comments, in the discussion of the proposed rule in part IV of this preamble.

IV. Discussion of the Proposed Rule

The proposed rule implements the Order through categorical rules that regulate certain data transactions involving government-related data or bulk U.S. sensitive personal data that could give countries of concern or covered persons access or the ability to access such data and present an unacceptable risk to U.S. national security. The proposed rule (1) identifies certain classes of highly sensitive transactions with countries of concern or covered persons that the proposed rule would prohibit in their entirety (“prohibited transactions”) and (2) identifies other classes of transactions that would be prohibited except to the extent they comply with predefined security requirements (“restricted transactions”) to mitigate the risk of access to bulk U.S. sensitive personal data by countries of concern. The Attorney General has determined that the prohibited and restricted transactions set forth in the proposed rule pose an unacceptable risk to the national security of the United States because they may enable countries of concern or covered persons to access and exploit government-related data or bulk U.S. sensitive personal data.

In addition to identifying classes of prohibited and restricted transactions that pose an unacceptable risk to national security, the proposed rule identifies certain classes of transactions that are exempt from the proposed rule. For example, the proposed rule exempts transactions for the conduct of the official business of the United States Government by employees, grantees, or contractors thereof, and transactions conducted pursuant to a grant, contract, or other agreement entered into with the United States Government, including those for outbreak and pandemic prevention, preparedness, and response. The proposed rule also defines relevant terms; identifies countries of concern; defines covered persons; and creates processes for the Department to issue general and specific licenses, to issue advisory opinions, and to designate entities or individuals as covered persons. The proposed rule also establishes a compliance and enforcement regime.

The Department relied upon unclassified and classified sources to support the proposed rule. Although the unclassified record fully and independently supports the proposed rule without the need to rely on the classified record, the classified record provides supplemental information that lends additional support to the proposed rule. The proposed rule would be the same even without the classified record.

Some commenters offered overarching comments. A few commenters made suggestions that addressed issues unrelated to the proposed rule, such as expressing views on U.S. positions in certain international negotiations over digital trade. No change was made in response to these comments. These comments addressed unrelated issues that are not relevant to the scope of the proposed rule and that are directed to other agencies and forums, and they generally did not suggest any specific changes to the contemplated program. To the extent that these comments intended to suggest that the Order's and proposed rule's restrictions on access to sensitive personal data are inconsistent with international commitments by the United States, the Department disagrees.

The proposed rule's prohibitions and restrictions on access to U.S. sensitive personal data and government-related data by countries of concern are consistent with access restrictions on sensitive personal data that have long been imposed in other national security contexts, including for some transactions reviewed by CFIUS and the Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector (“Team Telecom”).

Those access restrictions, in turn, are consistent with or otherwise permissible under trade and other international agreements.

For example, the World Trade Organization's (“WTO”) General Agreement on Trade in Services (“GATS”), like other trade agreements to which the United States is a party, includes an essential security interests exception that states that nothing in the agreement shall be construed to prevent a party to such an agreement from taking any action that it considers necessary for the protection of its essential security interests. As a result, rather than prohibiting such access restrictions, GATS and other relevant international agreements to which the United States is a party explicitly authorize national security-based restrictions on data access and data flows through the longstanding essential security exception. The proposed rule, like conditions restricting access in CFIUS or Team Telecom mitigation

agreements to address identified national security risks, is necessary to protect the essential security interests of the United States and is thus consistent with such international agreements to which the United States is a party.

Notably, consistent with the United States Government's long-standing support of cross-border data flows, the proposed rule does not require data localization or wholly restrict data flows to any specific country. Rather, the proposed rule only limits data transfers in narrow, specifically defined circumstances necessary to safeguard security interests, and it is being developed through a process that enables stakeholder consultation and input. The proposed rule is also consistent with the United States' longstanding support for Data Free Flows Trust (“DFFT”). The categories of prohibited and restricted transactions in the proposed rule identify circumstances that present an unacceptable national security risk of enabling countries of concern to access and exploit Americans' sensitive personal data—circumstances that lack the trust required for free data flows.

See

Foreign Investment Risk Review Modernization Act of 2018, supra note 11 (CFIUS); E.O. 13913, 85 FR 19643 (Apr. 4, 2020) (Team Telecom);

see, e.g.,

FCC, New Pacific Light Cable Network GU Holdings-Google National Security Agreement 20-044 Enclosure 1 (Dec. 16, 2021),

https://licensing.fcc.gov/cgi-bin/ws.exe/prod/ib/forms/reports/related_filing.hts?f_key=-448225&f_number=SCLLIC2020082700038

[

https://perma.cc/PD5E-BYWS

See, e.g.,

Agreement on Trade-Related Aspects of Intellectual Property Rights art. 73, Apr. 15, 1994, amended Jan. 23, 2017, Marrakesh Agreement Establishing the World Trade Organization, Annex 1C, 1869 U.N.T.S. 299,

https://www.wto.org/english/docs_e/legal_e/31bis_trips_09_e.htm

[

https://perma.cc/FSP4-BBZQ

]; General Agreement on Tariffs and Trade art. XXI, Oct. 30, 1947, 61 Stat. A—11, 55 U.N.T.S. 194,

https://www.wto.org/english/docs_e/legal_e/31bis_trips_e.pdf

[

https://perma.cc/LE7M-ZM4F

See

Press Release, Off. of the U.S. Trade Representative,

Statements by the United States at the Meeting of the WTO Dispute Settlement Body

(Jan. 27, 2023),

https://ustr.gov/about-us/policy-offices/press-office/press-releases/2023/january/statements-united-states-meeting-wto-dispute-settlement-body

[

https://perma.cc/CQG5-9AZ5

] (emphasizing the United States' commitment to protect its essential security interests in the context of World Trade Organization disputes); General Agreement on Tariffs and Trade art. XXI,

supra

note 16.

Several commenters suggested various revisions to borrow or incorporate aspects of international or State privacy laws into this proposed rule. The Department generally declines to adopt these suggestions, except on a discrete issue discussed in part IV.A.7 of this preamble. The Department supports privacy measures and national security measures as complementary protections for Americans' sensitive personal data. Despite some overlap, privacy protections and national security measures generally focus on different challenges associated with sensitive personal data. General privacy protections focus on addressing individual rights and preventing individual harm, such as protecting the rights of individuals to control the use of their own data and reducing the potential harm to individuals by minimizing the collection of data on the front end and limiting the permissible uses of that data on the back end. National security measures, by contrast, focus on collective risks and externalities that may result from how individuals and businesses choose to sell and use their data, including in lawful and legitimate ways.

For example, some commenters suggested adding a new exemption for transactions in which a U.S. individual consents to the sale or disclosure of their data to a country of concern or covered person. The proposed rule declines to adopt this exemption. Such a consent-based exemption would leave unaddressed the threat to national security by allowing U.S. individuals and companies to choose to share government-related data or Americans' bulk U.S. sensitive personal data with countries of concern or covered persons. It is precisely those choices that, in aggregate, help create the national security risk of access by countries of concern or covered persons, and the purpose of the Order and the proposed rule is to address the negative externality that is created by individuals' and companies' choices in the market in the first place. It would also be inconsistent with other national security regulations to leave it up to market choices to decide whether to give American technology, capital, or data to a country of concern or covered person. Export controls do not allow U.S. companies to determine whether their sensitive technology can be sent to a foreign adversary, and sanctions do not allow U.S. persons to determine whether their capital and material support can be given to terrorists and other malicious actors. Likewise, the proposed rule would not allow U.S. individuals to determine whether to give countries of concern or covered persons access to their sensitive personal data or government-related data. One of the reasons that the public is not in a position to assess and make decisions about the national security interests of the United States is that the public typically does not have all of the information available to make a fully informed decision about the national security interests of the United States.

Each subpart of the proposed rule, including any relevant comments received on the corresponding part of the ANPRM, is discussed below in the remaining sections of this preamble.

A. Subpart C—Prohibited Transactions and Related Activities

The proposed rule identifies transactions that are categorically prohibited unless the proposed rule otherwise authorizes them pursuant to an exemption or a general or specific license or, for the categories of restricted transactions, in compliance with security requirements and other requirements set forth in the proposed rule.

1. Section 202.210—Covered Data Transactions

The Order authorizes the Attorney General to issue regulations that prohibit or otherwise restrict U.S. persons from engaging in a transaction where, among other things, the Attorney General has determined that a transaction “is a member of a class of transactions . . . [that] pose an unacceptable risk to the national security of the United States because the transactions may enable countries of concern or covered persons to access bulk sensitive personal data or United States Government-related data in a manner that contributes to the national emergency declared in this [O]rder.”

Pursuant to the Order, the proposed rule categorically prohibits or, for the categories of restricted transactions, imposes security and other requirements on certain covered data transactions with U.S. persons and countries of concern or covered persons because the covered data transactions may otherwise enable countries of concern or covered persons to access government-related data or bulk U.S. sensitive personal data to harm U.S. national security.

89 FR 15423.

The proposed rule defines a “covered data transaction” as any transaction that involves any access to any government-related data or bulk U.S. sensitive personal data and that involves: (1) data brokerage, (2) a vendor agreement, (3) an employment agreement, or (4) an investment agreement.

See

§ 202.210. The Department has determined that these categories of covered data transactions pose an unacceptable risk to U.S. national security because they may enable countries of concern or covered persons to access government-related data or bulk U.S. sensitive personal data to engage in malicious cyber-enabled activities, track and build profiles on United States individuals for illicit purposes, including blackmail or espionage, and to intimidate, curb political dissent or political opposition, or otherwise limit civil liberties of U.S. persons opposed to countries of concern, among other harms to U.S. national security. For instance, one study has demonstrated that foreign malign actors can purchase bulk quantities of sensitive personal data about U.S. military personnel from data brokers “for coercion, reputational damage, and blackmail.”

Countries of

concern or covered persons could also exploit vendor, employment, or investment agreements to obtain access to government-related data or bulk U.S. sensitive personal data to harm U.S. national security.

Justin Sherman et al.,

supra

note 6, at 14.

See, e.g.,

Dep't of Commerce, Final Determination: Case No. ICTS-20121-002, Kaspersky Lab, Inc., 89 FR 52434, 52436 (June 24, 2024),

https://www.govinfo.gov/content/pkg/FR-2024-06-24/pdf/2024-13532.pdf

[

https://perma.cc/LAS7-S7HF

] (describing how Kaspersky employees gained access to sensitive U.S. person data through their provision of anti-virus and cybersecurity software);

see generally

OFAC, U.S. Dep't of Treas.,

Guidance on the Democratic People's Republic of Korea Information Technology Workers

(May 16, 2022),

https://ofac.treasury.gov/media/923131/download?inline

[

https://perma.cc/8DTV-Q34S

]; E.O. 14083, 87 FR 57369, 57373 (Sept. 15, 2022).

In response to the ANPRM, commenters asked that the Department clarify when a transaction “involves” government-related data or bulk U.S. sensitive personal data. The Department has responded to those comments by revising the definition of a “covered data transaction” to any transaction that involves any access to the data by the counterparty to a transaction (rather than any transaction that involves government-related data or bulk U.S. sensitive personal data).

2. Section 202.301—Prohibited Data-Brokerage Transactions

The proposed rule prohibits any U.S. person from knowingly engaging in a covered data transaction involving data brokerage with a country of concern or a covered person. The proposed rule defines “data brokerage” as the sale of data, licensing of access to data, or similar commercial transactions involving the transfer of data from any person (“the provider”) to any other person (“the recipient”), where the recipient did not collect or process the data directly from the individuals linked or linkable to the collected or processed data.

See

§ 202.214.

Because the data brokerage prohibition, along with the other prohibitions and restrictions, center around data transactions involving access to government-related data or bulk U.S. sensitive personal data, the Department addresses each of those key terms and related terms in detail in the following discussion.

3. Section 202.201—Access

Adopting the approach contemplated in the ANPRM without change, the proposed rule defines “access” as logical or physical access, including the ability to obtain, read, copy, decrypt, edit, divert, release, affect, alter the state of, or otherwise view or receive, in any form, including through information systems, information technology systems, cloud-computing platforms, networks, security systems, equipment, or software.

One commenter suggested that the Department remove the term “divert” from the definition of “access” to avoid unintentionally capturing activities that do not involve actual access to data and that, according to the commenter, do not pose a risk to national security. The Department declines to do so. The definition of “access” is intentionally broad. It includes the term “divert” to ensure that the proposed rule covers data transactions that would enable a covered person to divert government-related data or bulk U.S. sensitive personal data from an intended recipient to a country of concern or a covered person, either for their own use or for the use of countries of concern or other covered persons, and to prevent countries of concern or covered persons from amassing data (including anonymized, encrypted, aggregated, or pseudonymized data), as discussed in part IV.A.13 of this preamble.

4. Section 202.249—Sensitive Personal Data

As previewed in the ANPRM, the proposed rule builds on the Order by further defining the six categories of “sensitive personal data” that could be exploited by a country of concern to harm U.S. national security if that data is linked or linkable to any identifiable U.S. individual or to a discrete and identifiable group of U.S. persons. These six categories are: (1) covered personal identifiers; (2) precise geolocation data; (3) biometric identifiers; (4) human genomic data; (5) personal health data; and (6) personal financial data. The proposed rule also categorically excludes certain categories of data from the definition of the term “sensitive personal data.” These exclusions include public or nonpublic data that does not relate to an individual, including trade secrets and proprietary information, and data that is, at the time of the transaction, lawfully publicly available from government records or widely distributed media, personal communications as defined in § 202.239, and information or informational materials as defined in § 202.226. Nothing in the proposed rule shall be construed to affect the obligations of U.S. Government departments and agencies under the Foundations for Evidence-Based Policymaking Act of 2018, Public Law 115-435 (2019), 44 U.S.C. 3501

et seq.

5. Section 202.212—Covered Personal Identifiers

The Order defines “covered personal identifiers” as “specifically listed classes of personally identifiable data that are reasonably linked to an individual, and that—whether in combination with each other, with other sensitive personal data, or with other data that is disclosed by a transacting party pursuant to the transaction and that makes the personally identifiable data exploitable by a country of concern—could be used to identify an individual from a data set or link data across multiple data sets to an individual,” subject to certain exclusions.

The ANPRM thus contemplated three subcategories of covered personal identifiers: (1) listed identifiers in combination with any other listed identifier; (2) listed identifiers in combination with other sensitive personal data; and (3) listed identifiers in combination with other data that are disclosed by a transacting party pursuant to the transaction that makes the listed identifier exploitable by a country of concern, if they could be used to identify an individual from a dataset or to link data across multiple datasets to an individual.

The ANPRM also contemplated two exceptions: (1) demographic or contact data that is linked only to other demographic or contact data; and (2) a network-based identifier, account-authentication data, or call-detail data that is linked only to other network-based identifiers, account-authentication data, or call-detail data as necessary for the provision of telecommunications, networking, or similar services. The proposed rule expands the approach described in the ANPRM by making the exceptions applicable to all subcategories of covered personal identifiers, instead of being applicable only to listed identifiers in combination with any other listed identifiers. The listed identifiers are described in more detail in the next section.

E.O. 14117, 89 FR 15421,15428 (Feb 28, 2024).

89 FR 15784-85.

With respect to the first subcategory, listed identifiers in combination with any other listed identifier: The ANPRM contemplated a list-based approach that would identify a comprehensive list of eight classes of data determined by the Attorney General to be reasonably linked to an individual under the Order's definition of “covered personal identifiers.”

Id.

With respect to the second subcategory, listed identifiers in combination with other sensitive

personal data: The ANPRM contemplated treating these combinations as combined data subject to the lowest bulk threshold applicable to the categories of data present.

The proposed rule generally adopts the approach described in the ANPRM, but instead of addressing this category in the definition of “listed identifiers,” the proposed rule incorporates this category as part of the definition of “bulk.”

Id.

at 15785.

With respect to the third subcategory, listed identifiers in combination with other data that are disclosed by a transacting party pursuant to the transaction that makes the listed identifier exploitable by a country of concern: The ANPRM indicated that the Department did not intend to impose an obligation on transacting parties to independently determine whether particular combinations of data would be “exploitable by a country of concern.”

The ANPRM provided several examples intended to be within the scope of this subcategory and several examples intended to be outside the scope of this subcategory and sought comment on ways in which this subcategory could be further defined.

In response, multiple commenters suggested anchoring this subcategory to the reasonable foreseeability that the other data could be used to link the listed identifier to a U.S. individual. As these commenters explained, without the connection to foreseeability, nearly any public data could become covered personal identifiers, because it is possible that the transacting party receiving the data could find some way of linking any public data point to an individual using the listed identifier.

Id.

The proposed rule largely adopts this suggestion. Rather than requiring companies to determine when linkage is reasonably foreseeable on a case-by-case basis, the proposed rule would define a category of data for which the Department believes it is reasonably foreseeable that the other data could be used to link the listed identifier to a U.S. individual: other data that makes the listed identifier linked or linkable to other listed identifiers or to other sensitive personal data. The proposed rule thus narrows the third subcategory to any listed identifier in combination with other data that is disclosed by a transacting party such that the listed identifier is linked or linkable to other listed identifiers or to other sensitive personal data.

See

§ 202.212(a)(2). The proposed rule also incorporates the examples described in the ANPRM and additional examples to illustrate how this subcategory would and would not apply.

6. Section 202.234—Listed Identifier

Adopting the approach contemplated in the ANPRM,

the proposed rule defines a “listed identifier” as any piece of data in any of the following data fields: (1) full or truncated government identification or account number (such as a Social Security Number, driver's license or State identification number, passport number, or Alien Registration Number); (2) full financial account numbers or personal identification numbers associated with a financial institution or financial-services company; (3) device-based or hardware-based identifier (such as International Mobile Equipment Identity (“IMEI”), Media Access Control (“MAC”) address, or Subscriber Identity Module (“SIM”) card number); (4) demographic or contact data (such as first and last name, birth date, birthplace, ZIP code, residential street or postal address, phone number, email address, or similar public account identifiers); (5) advertising identifier (such as Google Advertising ID, Apple ID for Advertisers, or other mobile advertising ID (“MAID”)); (6) account-authentication data (such as account username, account password, or an answer to a security question); (7) network-based identifier (such as internet Protocol (“IP”) address or cookie data); or (8) call-detail data (such as Customer Proprietary Network Information (“CPNI”)).

See

§ 202.234.

Id.

at 15784.

Under this definition, the term “covered personal identifiers” refers to a much narrower set of material than that covered by certain laws and policies aimed generally at protecting personal privacy.

It encompasses only the types of data and combinations thereof that are expressly listed. For example, the proposed rule's definition of “covered personal identifiers” would not include an individual's employment history, educational history, organizational memberships, criminal history, or web-browsing history. Some commenters suggested that the Department adopt a broader definition that aligns with the definition of “personally identifiable information” used in State or European Union (”EU”) privacy laws to ease the burden of compliance. The Department declines to adopt this approach, and the proposed rule retains the definition stated in the ANPRM without change. Although it may be true that “personally identifiable information” is a familiar term in laws and guidance addressing the privacy and security of data held by the private sector and government, it is such a broad term that adopting a definition akin to it would significantly expand the scope of the regulations and therefore require that the Department regulate more commercial transactions or relationships than seem necessary, at least at this time, to mitigate the highest priority national security risks articulated in the Order. Furthermore, the commenters supplied no data to suggest that any cost savings realized from adopting an existing definition would outweigh the added burdens of regulating a larger swath of transactions.

C.f., e.g.,

California Consumer Privacy Act of 2018, Cal. Civ. Code sec. 1798.140(v)(1) (West 2024) (defining “personal information” in the context of a generalized privacy-focused regime); Regulation (EU) 2016/679 of the European Parliament and of the Council of Apr. 27, 2016, On the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC, art. 4(1) (defining “personal data” in the context of a generalized data privacy regime).

Similarly, another commenter suggested broadening the definition of “covered personal identifiers” to add categories of data from State and EU privacy laws, such as web-browsing data and data that identifies or could lead to inferences about membership in protected classes such as race, religion, and national origin. The proposed rule makes no change in response to this comment. As previewed in the ANPRM, the proposed rule's definition of “covered personal identifiers” is tailored to address the national security risks identified in the Order, and the Department is establishing the program by issuing proposed rulemakings in tranches based on priority. Also, the Department intends to regularly monitor the effectiveness and impact of the regulations once they become effective. Absent more specific information from commenters on this topic about the cross-border use of these additional kinds of identifiers by foreign governments in ways that could harm Americans, the proposed rule retains the definition stated in the ANPRM without change at this time.

One commenter suggested that the Department remove basic contact information from the listed identifiers. The proposed rule maintains the approach in the ANPRM without change.

The Order already contains an exception to the definition of “covered personal identifiers” for demographic or contact data that is linked only to other demographic or contact data. The proposed rule implements the exception articulated in the Order and previewed

in the ANPRM, which excludes such data from the definition of “covered personal identifiers.”

89 FR 15784.

Id.

By contrast, another commenter recommended that “covered personal identifiers” be expanded to include demographic or contact data that is linked only to other demographic or contact data, because most Americans believe that information to be deserving of privacy protections. The Department declines to adopt this addition to the definition of “covered personal identifiers.” Such an expansion of the definition would be contrary to the Order, which specifically exempts this kind of data from its scope.

Additionally, as the commenter acknowledges, a significant amount of this information is already publicly available to countries of concern, and therefore country of concern access to this type of information does not carry the same national security risk as access to the other covered personal identifiers identified in these regulations, even if it may raise separate privacy considerations.

89 FR 15428.

A few commenters advocated removing truncated government identification and account numbers from the definition of “listed identifiers,” given their widescale use. One commenter supported the inclusion of these truncated identifiers because they are regularly used to identify individuals. The proposed rule continues to include these truncated identifiers as contemplated in the ANPRM because, as one commenter points out, they could be, and are, “used to identify an individual from a data set or link data across multiple data sets to an individual[.]” They therefore fall within the Order's definition of “covered personal identifiers” when they are combined with certain other categories of data. Although these truncated numbers may be used widely, the proposed rule would not regulate how they are used in most transactions. Specifically, it would not regulate how these truncated numbers are used domestically, a company's internal use of that data (other than with respect to covered persons who are employees), or transactions abroad involving third countries (other than with respect to certain conditions for the data brokerage to address onward sale).

The proposed rule also contains a non-substantive change in language designed to be more technically accurate and to clarify that any piece of data in any of the listed classes of data constitutes a listed identifier.

See

§ 202.234. This change remains consistent with the examples previewed in the ANPRM and in the proposed rule showing that multiple pieces of data (such as account username and account password) in the same data field (account-authentication data) each count as separate listed identifiers.

89 FR 15785.

7. Section 202.242—Precise Geolocation Data

The proposed rule defines “precise geolocation data” as data, whether real-time or historical, that identifies the physical location of an individual or a device with a precision of within 1,000 meters. Examples of “precise geolocation data” include GPS coordinates and IP address geolocation. To help develop this definition, the Department examined the settings available to software developers in Android and iOS, the two most popular mobile device operating systems, for the precision of geolocation readings. Available options included accuracy to within 10 meters, 100 meters, 1,000 meters, 3,000 meters, and 10,000+ meters.

The Department selected 1,000 meters as the option that most carefully balanced the risk that countries of concern or covered persons could exploit U.S. persons' precise geolocation data and current technology practices and standards. The Department also considered State privacy laws, with which companies are already familiar and which provide examples of the level of precision at which a device's location warrants protection.

CLLocationAccuracy,

Apple Developer,

https://developer.apple.com/documentation/corelocation/cllocationaccuracy

[

https://perma.cc/AZ48-VSCP

];

Change Location Settings,

Android Developer,

https://developer.android.com/develop/sensors-and-location/location/change-location-settings

[

https://perma.cc/5BY3-P7L3

See, e.g.,

Cal. Civ. Code sec. 1798.140(w) (which uses a radius of 1,850 feet); Utah Consumer Privacy Act, Utah Code Ann. sec. 13-61-101(33)(a) (West 2024) (which uses a radius of 1,750 feet).

A few commenters suggested that the Department define “precise geolocation data” as that term is defined in the California Privacy Rights Act, which includes a geographic radius of 1,850 feet (approximately 563 meters). The Department did not accept this suggestion because our assessment of the relevant national security interests required a broader geographic area, in part due to the types of United States Government personnel and locations (such as military bases with large surrounding footprints) that are relevant to national security. By contrast, the California standard does not take these national security interests relating to Government personnel into account. One commenter suggested that the Department omit the phrase “based on electronic signals or inertial sensing units,” which was included in the ANPRM definition of “precise geolocation data,” to make the term more technology-neutral as to the method of collection.

The Department has adopted this suggestion and deleted that phrase from the proposed definition.

89 FR 15785.

8. Section 202.204—Biometric Identifiers

Adopting the approach contemplated in the ANPRM without change, the proposed rule defines “biometric identifiers” as measurable physical characteristics or behaviors used to recognize or verify the identity of an individual, including facial images, voice prints and patterns, retina and iris scans, palm prints and fingerprints, gait, and keyboard usage patterns that are enrolled in a biometric system and the templates created by the system.

9. Section 202.224—Human Genomic Data

Adopting the approach contemplated in the ANPRM without change, the proposed rule defines “human genomic data” as data representing the nucleic acid sequences that constitute the entire set or a subset of the genetic instructions found in a human cell, including the result or results of an individual's “genetic test” (as defined in 42 U.S.C. 300gg-91(d)(17)) and any related human genetic sequencing data. The term “human genomic data” does not include non-human data, such as pathogen genetic sequence data, that is derived from or integrated into human genomic data.

10. Other Human ’Omic Data

The Department of Justice is considering regulating, as prohibited or restricted transactions in the final rule, certain transactions in which a U.S. person provides a country of concern (or covered person) with access to bulk human ’omic data, other than human genomic data, as defined in § 202.224. At a high level, the ’omics sciences examine biological processes that contribute to the form and function of cells and tissues.

The categories of ’omic data that the Department is considering regulating could include

human epigenomic data, glycomic data, lipidomic data, metabolomic data, meta-multiomic data, microbiomic data, phenomic data, proteomic data, and transcriptomic data. The Department does not intend the definition of meta-multiomic data to include nonhuman data separated from human data or for the definition of microbiomics data to include data related to individual pathogens, even when derived from human sources. The Department is considering whether to include the following definitions of these terms in the final rule:

See, e.g., Evolution of Translational Omics: Lessons Learned and the Path Forward

23, 33 (Christine M. Micheel et al., eds., 2012),

https://www.ncbi.nlm.nih.gov/books/NBK202168/pdf/Bookshelf_NBK202168.pdf

[

https://perma.cc/Q5YE-7XLM

1. Epigenomic data: data derived from the analysis of human epigenetic modifications, which are changes in gene expression or cellular phenotype that do not involve alterations to the DNA sequence itself. These epigenetic modifications include modifications such as DNA methylation, histone modifications, and non-coding RNA regulation.

2. Glycomic data: data derived from the analysis of the structure, function, and interactions of glycans (complex carbohydrates) within human biological systems. The field of glycomics generally aims to understand the roles of glycans in cell-cell communication, immune responses, and various diseases.

3. Lipidomic data: data derived from a systems-level characterization of lipids from a human or human cell, including their identification, quantification, and characterization in biological systems. Routine clinical measurements of lipids for individualized patient care purposes would not be considered lipidomic data because such measurements would not entail a systems-level analysis of the complete set of lipids found in such a sample.

4. Metabolomic data: data derived from the analysis of metabolites, the small molecules produced during metabolism, that aim to understand disease mechanisms, identify biomarkers for diagnosis, and develop targeted treatments by revealing the dynamic biochemical activities in a living system. This data provides a general snapshot of an organism, tissue, or cell, offering insights into physiological and pathological processes.

5. Meta-multiomic data: The Department is considering the following options for defining meta-multiomic data:

(i) Datasets that include two or more categories of human ’omic data identified in this regulation, which can include data derived from the human genome, proteome, transcriptome, epigenome, or metabolome; or

(ii) Datasets that include two or more categories of human ’omic data identified in this regulation and that include ’omic data from another species.

6. Microbiomic data: data derived from analysis of all the microorganisms of a given community within the human body (including a particular site on the human body). Microbiomic data is implicated in the field of metagenomics, which generally aims to investigate and understand genetic material of entire communities of organisms, including the composition of a microbial community.

7. Phenomic data: data derived from analysis of human phenotypes, including physical traits, physiological parameters, and behavioral characteristics.

8. Proteomic data: data derived from analysis of human proteomes, which refers to the entire set of proteins expressed by a human genome, cell, tissue, or organism. The field of proteomics generally aims to identify and characterize proteins and study their structures, functions, interactions, and post-translational modifications.

9. Transcriptomic data: data derived from analysis of a human transcriptome, which is the complete set of RNA transcripts produced by the human genome under specific conditions or in a specific cell type. The field of transcriptomics generally aims to understand gene expression patterns, alternative splicing, and regulation of RNA molecules.

The Department is considering excluding from the definition of other human ’omic data pathogen-specific data embedded in ’omic data sets.

The Department welcomes input from commenters regarding the potential risks and benefits that may arise from restricting or prohibiting covered data transactions with a country of concern or covered person involving some or all of these categories of other human ’omic data. The Department is particularly interested in comments addressing the health, economic, or scientific impacts of regulating such data transactions, as well as any national security implications. Specifically:

• In what ways, if any, should the Department of Justice elaborate or amend the definitions of these classes of other human ’omic data? If the definitions should be elaborated or amended, why?

• Should bulk data transactions involving these types of other human ’omic data be regulated? If so, which types of human ’omic data—including any not listed—should be regulated, why should they be regulated, and how should they be regulated? Additionally, what bulk thresholds should apply and why?

• To what extent would the regulation of bulk data transactions involving these types of other human ’omic data affect individuals' rights to share their own biological samples (

e.g.,

blood, urine, tissue, etc.) or health, ’omic, and other data?

• What would be the effects of prohibiting or restricting transactions involving these data classes in the final rule, particularly with respect to:

○ health outcomes

○ health supply chain impacts

○ research and administrative costs

○ economic costs due to (1) imposing these regulations, or (2) allowing unregulated bulk access to human ’omic data

○ innovation costs

• What additional risks should be considered if these bulk data transactions are not regulated, specifically as they relate to:

○ risks stemming from exploitable health information

○ manipulation of bulk data for strategic advantage over the United States

○ use of bulk datasets for the creation and refinement of AI or other similar advanced technologies

11. Section 202.240—Personal Financial Data

Adopting the approach contemplated in the ANPRM without change, the proposed rule defines “personal financial data” as data about an individual's credit, charge, or debit card, or bank account, including purchases and payment history; data, including assets liabilities, debts, and transactions in a bank, credit, or other financial statement; or data in a credit report or in a “consumer report” (as defined in 15 U.S.C. 1681a(d)).

One commenter sought clarification that personal financial data does not include inferences based on that data, suggesting, for example, that hotel record transactions may be personal financial data but an ultimate inference that the person is interested in business travel should not be considered personal financial data. As set forth in the Order and previewed in the ANPRM, the proposed rule would prohibit or restrict only certain categories of transactions in government-related data or bulk U.S. sensitive personal data, neither of which include inferences on their own.

89 FR 15783; 89 FR 15428-29.

12. Section 202.241—Personal Health Data

The ANPRM contemplated defining “personal health data” as “individually identifiable health information,” as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), “regardless of whether such information is collected by a `covered entity' or `business associate.' ”

Id.; see

42 U.S.C. 1320d(6); 45 CFR 160, 103.

Several commenters supported defining personal health data as “individually identifiable health information.” That definition is similar to how those terms are defined in HIPAA and its implementing regulations. However, one commenter expressed confusion as to how cross-referencing that definition in this program would relate to “covered entities” or “business associates” under HIPAA. The proposed rule adopts much of the substance of the approach in the ANPRM while providing greater clarity to address this confusion. Instead of defining “personal health information” by cross referencing and incorporating HIPAA, the proposed rule reproduces the relevant substance of the HIPAA definition to provide greater clarity that the definition does not turn on the HIPAA-specific inquiry of whether data is handled by covered entities or business associates. Further, unlike the HIPAA definition, the proposed rule would not define health information in terms of whether the information identifies individuals, because the proposed rule applies regardless of whether data is de-identified.

As a result, the proposed rule defines “personal health data” as health information that relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual. The term includes basic physical measurements and health attributes (such as bodily functions, height and weight, vital signs, symptoms, and allergies); social, psychological, behavioral, and medical diagnostic, intervention, and treatment history; test results; logs of exercise habits; immunization data; data on reproductive and sexual health; and data on the use or purchase of prescribed medications. The proposed rule would operate on a categorical basis and would determine that the category of personal health data generally meets the requirements of being “exploitable by a country of concern to harm United States national security” and “is linked or linkable to any identifiable United States individual or to a discrete and identifiable group of United States individuals” under section 7(l) of the Order. To be sure, it is possible to hypothesize a limited data set of discrete information related to an individual's physical or mental health condition that is not inherently linked or linkable to U.S. individuals (such as a data set of only heights or weights with no identifying information). But based on the information currently available, it does not appear that such limited datasets accurately reflect how personal health data is stored, transmitted, and used in the real world, and thus it does not appear appropriate to adjust the proposed rule to account for this hypothetical at this time. The Department welcomes comments on the extent to which such datasets exist and are the subject of covered data transactions between U.S. persons and countries of concern or covered persons.

13. Section 202.206—Bulk U.S. Sensitive Personal Data

Adopting the approach contemplated in the ANPRM without change, the prohibitions and restrictions apply to “bulk U.S. sensitive personal data,” which the proposed rule defines as a collection or set of sensitive personal data relating to U.S. persons, in any format, regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted. The bulk thresholds of data set by the proposed rule are addressed in detail in part V of this preamble.

Several commenters requested that the Department align the categories of sensitive personal data with State data privacy laws, particularly to exclude encrypted, pseudonymized, de-identified, or aggregated data from the proposed rule's coverage. In contrast, other commenters supported the Department's treatment of pseudonymized, de-identified, or encrypted data, including to prevent the data from being re-identified in the future and to recognize that not all techniques for pseudonymization, de-identification, encryption, or aggregation are equally effective. The Department declines to adjust the proposed rule to exclude anonymized, encrypted, pseudonymized, or de-identified data, and the proposed rule adopts the approach described in the ANPRM without change. As the Order emphasizes, even where types of sensitive personal data are “anonymized, pseudonymized, or de-identified, advances in technology, combined with access by countries of concern to large datasets, increasingly enable countries of concern that access this data to re-identify or de-anonymize data,” which could reveal exploitable sensitive personal information on U.S. persons.

As the Department has recently explained, “[o]pen-source reporting has repeatedly raised concern[s] that supposedly anonymized data is rarely, if ever, truly anonymous.”

As a recent study has explained, for example, “[a]ggregated insights from location data” could be used to damage national security.

Examples abound. Researchers in 2024 used a little more than a year's worth of “raw, `ping'-level data, a year's worth of location data from de-identified smartphones in 26 major metropolitan areas encompassing nearly every SEC office and most public firm headquarters to identify non-public investigations and enforcement actions, and glean insights about how those visits affected financial markets.

In 2018, the publication of a global heatmap of anonymized users' location data collected by a popular fitness app enabled researchers to quickly identify and map the locations of military and government facilities and activities.

Similarly, in 2019,

New York Times

writers were able to combine a single set of bulk location data collected from cell phones and bought and sold by location-data companies—which was anonymized and represented “just one slice of data, sourced from one company, focused on one city, covering less than one year”—with publicly available information to identify, track, and follow “military officials with security clearances as they drove home at night,” “law enforcement officers as they took their kids to school,” and “lawyers (and their guests) as they

traveled from private jets to vacation properties.”

A 2019 research study concluded that “99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes,” thus “suggest[ing] that even heavily sampled anonymized datasets are unlikely to satisfy the modern standards for anonymization set forth by [the EU's General Data Protection Regime] and seriously challenge the technical and legal adequacy of the de-identification release-and-forget model.”

Other studies and reports have reported similar results.

As a result, as the Department recently explained, “[a]dversaries can use these datasets to reverse-engineer anonymized data and identify people, subjects, or devices that were supposedly anonymized.”

89 FR 15426;

see also

Alex Hern,

`Anonymised' Data Can Never Be Totally Anonymous, Says Study,

The Guardian (Jul. 23, 2019),

https://www.theguardian.com/technology/2019/jul/23/anonymised-data-never-be-anonymous-enough-study-finds

[

https://perma.cc/5BF8-745A

See, e.g.,

Alex Hern,

New York Taxi Details Can Be Extracted From Anonymised Data, Researchers Say,

The Guardian (June 27, 2014),

https://www.theguardian.com/technology/2014/jun/27/new-york-taxi-details-anonymised-data-researchers-warn

[

https://perma.cc/6SYK-6ZEG

] (reporting that a researcher “discovered that the anonymous data” of taxi records “was easy to restore to its original, personally identifiable format,” taking a “matter of only minutes to determine which [license] numbers were associated with which pieces of anonymised data” and only an hour to “de-anonymise the entire dataset,” making it possible to “figure out which person drove each trip” and to determine taxi drivers' supposedly anonymous home addresses); Ryan Singel,

Netflix Spilled Your Brokeback Mountain Secret, Lawsuit Claims,

Wired (Dec. 17, 2009),

https://www.wired.com/2009/12/netflix-privacy-lawsuit/

[

https://perma.cc/B96P-AY97

] (reporting on researchers who de-anonymized a Netflix dataset of movie ratings by using publicly available information, which revealed “political leanings and sexual orientation” in some cases, and reporters who “quickly” de-anonymized supposedly anonymous AOL search-engine logs “to track down real people”).

Newman Decl.,

supra

note 40, at Gov't App. 33 ¶ 105.

Similar concerns exist with respect to encrypted data. Countries of concern amass large quantities of encrypted data including by harvesting encrypted data now in order to decrypt it in the future should advances in quantum technologies render current standard public-key cryptographic algorithms ineffective.

Encryption keys can also be stolen, handed over under compulsion, and otherwise obtained for use in decrypting datasets.

David Lague,

U.S. and China Race to Shield Secrets from Quantum Computers,

Reuters (Dec. 14, 2023),

https://www.reuters.com/investigates/special-report/us-china-tech-quantum/

[

https://perma.cc/9HAA-46XA

]; Nat'l Counterintel. & Sec. Ctr.,

Protecting Critical and Emerging U.S. Technologies From Foreign Threats

5 (Oct. 2021),

https://www.dni.gov/files/NCSC/documents/SafeguardingOurFuture/FINAL_NCSC_Emerging%20Technologies_Factsheet_10_22_2021.pdf

[

https://perma.cc/L6ZU-8HU7

]; Nat'l Cybersec. Ctr. of Excellence, NIST SP 1800-38B,

Migration to Post-Quantum Cryptography,

at 1 (drft. Dec. 2023),

https://www.nccoe.nist.gov/sites/default/files/2023-12/pqc-migration-nist-sp-1800-38b-preliminary-draft.pdf

[

https://perma.cc/FXF2-BJ62

Can Encrypted Data be Hacked?,

IT Foundations (Apr. 19, 2021),

https://itfoundations.com/can-encrypted-data-be-hacked/

[

https://perma.cc/E3TN-YAVV

A few commenters suggested that the approach contemplated in the ANPRM would weaken national security by failing to differentiate between data that is encrypted or otherwise protected and data that is not. In their view, encryption is an important tool to secure data from unauthorized access, and treating encrypted and non-encrypted data alike could discourage the use of encryption, weakening the overall security of data. Other commenters, however, supported treating pseudonymized, encrypted, de-identified, and aggregated data as sensitive personal data because of the ability to re-identify such data and the rapid advancements in re-identification techniques. The Department declines to modify the proposed rule in response to these comments. As contemplated in the ANPRM, the proposed rule explicitly recognizes and relies upon the privacy and national security-preserving value of high quality, effective methods of encryption, de-identification, pseudonymization, and aggregation by specifically authorizing certain otherwise prohibited transactions so long as they meet the security requirements described in part IV.B.1 of this preamble, including by using data-level control(s) such as these techniques in combination with other security requirements. At the same time, as contemplated in the ANPRM, the proposed rule also recognizes that ineffective methods of encryption, de-identification, pseudonymization, and aggregation present the same unacceptable national security risk of access by countries of concern and covered persons as the risks posed by such access to identifiable data that is not secured through any of these techniques. The proposed rule thus allows otherwise prohibited employment agreements, vendor agreements, and investment agreements only if they use any combination of the data-level requirements necessary to prevent access to covered data by covered persons or countries of concern, as requirements laid out in the security requirements to be published by the Department of Homeland Security (“DHS”), in addition to organizational- and system-level requirements.

Commenters also requested that the Department use existing State privacy law definitions to define the categories of sensitive personal data, such as personal financial data. Commenters stated that many companies already know how to comply with State privacy laws. The Department has considered these comments. However, as discussed in part IV.A.6 of this preamble, the cited definitions do not necessarily align with the specific national security goals of these regulations. Therefore, the proposed rule adopts the approach described in the ANPRM without change and does not adopt the State privacy law definitions of the terms in the proposed rule.

14. Section 202.205—Bulk

As previewed in the ANPRM, the proposed rule's prohibitions apply to bulk amounts of U.S. sensitive personal data (in addition to the separate category of government-related data). The proposed rule defines “bulk” as any amount of such data that meets or exceeds thresholds during a given 12-month period, whether through one covered data transaction or multiple covered data transactions involving the same U.S. person and the same foreign person or covered person. The proposed rule sets specific thresholds for each category of sensitive personal data.

See

§ 202.205. Certain specified data transactions that exceed those thresholds are “covered data transactions” and thus subject to the proposed rule's prohibitions unless they are otherwise authorized by the proposed rule.

See

§ 202.210. The Department has determined the proposed bulk thresholds based on the analysis previewed in the ANPRM and described in more detail in part V of this preamble.

A few commenters expressed concerns that it would be necessary to decrypt data to determine whether it meets a relevant bulk threshold and suggested discarding the bulk thresholds as a result. They noted that decrypting data is generally less secure and could lead to unauthorized access. The proposed rule makes no change in response to these comments, for several reasons. First, many businesses engaging in the categories of prohibited and restricted transactions generally use

the data in the course of operating their business, rather than merely serving as a pass-through for encrypted data as the comments suggest. While encrypting data in transit and data at rest is and should be a standard security technique, and encrypting data in use is increasingly common, data is routinely decrypted while it is being actively accessed, processed, filtered, sorted, searched, analyzed, displayed, and otherwise used by a business (for example, when an authorized employee or user opens and searches an encrypted file or database). However, nothing in the proposed rule imposes a legal requirement to decrypt data to comply. Instead, the proposed rule requires only that U.S. persons implement a risk-based compliance program tailored to their individual risk profiles. And data may also be encrypted using cryptographic methods that permit some computation and analysis to be performed on cyphertext that ascertains the kinds and volume of data without decrypting the data.

Businesses can map the kinds and volumes of their data to evaluate it against the bulk thresholds in the data life cycle in which it is either decrypted for access or encrypted in use.

Abbas Acar et al.,

A Survey on Homomorphic Encryption Schemes: Theory and Implementation,

51 [No. 4] ACM Computing Survs. 79:1, 79:2 (2018),

https://dl.acm.org/doi/pdf/10.1145/3214303

[

https://perma.cc/AM69-7ZWV

]. In addition, to the extent that businesses use emerging techniques (such as homomorphic encryption) that permit computations to be performed on encrypted data without first decrypting it, these techniques may enable businesses to map their data even if it remains encrypted.

Second, even beyond mapping data in use, companies choosing to engage in these categories of data transactions can and should have some awareness of the volume of data they possess and in which they are transacting. For example, typically data-using entities maintain metrics, such as user statistics, that can help estimate the number of impacted individuals for the purposes of identifying whether a particular transaction meets the bulk threshold.

Given that the bulk thresholds are built around order-of-magnitude evaluations of the quantity of user data, it is reasonable for entities to conduct similar order-of-magnitude-based assessments of their data stores and transactions for the purposes of regulatory compliance. Companies already must understand, categorize, and map the volumes of data they have for other regulatory requirements, such as State laws requiring notification of data breaches of specific kinds of data above certain thresholds.

Justin Ellingwood,

User Data Collection: Balancing Business Needs and User Privacy,

DigitalOcean (Sept. 26, 2017),

https://www.digitalocean.com/community/tutorials/user-data-collection-balancing-business-needs-and-user-privacy

[

https://perma.cc/GCX5-RGSK

]; Jodie Siganto,

Data Tagging: Best Practices, Security & Implementation Tips,

Privacy108 (Nov. 14, 2023),

https://privacy108.com.au/insights/data-tagging-for-security/

[

https://perma.cc/8PQA-89DA

]; National Institutes of Health,

Metrics for Data Repositories and Knowledgebases: Working Group Report

7, (Sept. 15, 2021),

https://datascience.nih.gov/sites/default/files/Metrics-Report-2021-Sep15-508.pdf

[

https://perma.cc/8KBQ-HWRK

See, e.g.,

Del. Code. Ann. tit. 6, sec. 12B—100 to—104 (West 2024); N.M. Stat. Ann. sec. 57-12C-10 (LexisNexis 2024).

Third, this concern appears premised on a scenario in which a U.S. business handles only encrypted data on which no computational functions can be performed to determine the kinds and volume of data, never accesses the decrypted data in its business, does not have other proxies or metrics to determine the kinds and volumes of data in which it is transacting, and must comply with the prohibitions and restrictions in the proposed rule. This scenario appears to be an edge case at best, and the comments do not provide a real-world example of this scenario or its frequency. Indeed, as discussed in some of the examples contained in the proposed rule, if a U.S. entity merely provides a platform for, or transports data between, a U.S. customer and a covered person or country of concern, and thus does not know or reasonably should not know of the kind or volume of data involved, then it generally would not “knowingly” engage in a prohibited transaction if the U.S. customer uses that platform or infrastructure to engage in a prohibited transaction with a covered person. Instead, the U.S. customer would generally be responsible for having “knowingly” engaged in the prohibited transaction, as illustrated in the clarification of the “knowingly” standard and the new examples incorporated into the proposed rule.

See

§ 202.230. Similarly, if a U.S. entity merely stores encrypted data on behalf of a U.S. customer and does not possess the encryption key, and if the U.S. entity does not know or reasonably should not know the kind or volume of data involved, the U.S. entity generally would not meet the “knowingly” standard of the proposed rule.

Fourth, to the extent that there is a U.S. business that handles only encrypted data on which no computational functions can be performed to determine the kinds and volume of data, never accesses the decrypted data in its business, does not have other proxies or metrics to determine the kinds and volumes of data it is transacting, and is subject to the prohibitions and restrictions in the proposed rule, that U.S. business would have choices under the proposed rule. It would be able to engage with the Department and seek an advisory opinion or a specific license tailored to its business. Similarly, it would have choices about how best to comply as part of its individualized, risk-based compliance program. For example, it can choose not to engage in prohibited or restricted transactions with countries of concern or covered persons as part of its individualized risk-based compliance program. If the U.S. business chooses to engage in categories of transactions potentially subject to the proposed rule, it can conduct reasonable due diligence on the source of its encrypted data (such as engaging with and obtaining contractual commitments from its customers) to determine the volume and kinds of data in which it is transacting. Or, if it chooses to engage in restricted transactions with countries of concern or covered persons, it can assume that its transactions involve bulk volumes of sensitive personal data and comply with the security requirements and other applicable conditions out of an abundance of caution.

Even if this hypothetical U.S. business were to choose to engage in categories of transactions potentially subject to the proposed rule, and it voluntarily decided to briefly decrypt the data to determine the kinds and volume of its data as part of its risk-based compliance program, commentors have not provided evidence that such a brief decryption would meaningfully increase the risks of unauthorized access relative to the risks involved in routine decryption for business use. Encryption is one security tool designed to mitigate the risk of unauthorized access to data.

Entities should use encryption as a tool whenever possible, including when data is at rest, in transit, and in use. However, using encryption does not eliminate risk or the requirement to perform appropriate due diligence. If an entity is using data at any point or has access to both encrypted data and the encryption key, that entity has full se into and control over the data on its systems for the

purposes of this regulation.

Entities are responsible for balancing risks within their systems, with encryption serving as one available tool for achieving risk management goals alongside other tools like data governance and data minimization plans, role-based and least-privilege access controls, and identity management through multifactor authentication.

What Is Encryption?,

Cloudflare,

https://www.cloudflare.com/learning/ssl/what-is-encryption/

[

https://perma.cc/T3KT-BURX

]; Cybersec. & Infrastructure Sec. Agency,

Zero Trust Maturity Model

5, 27 (v. 2.0 Apr. 2023),

https://www.cisa.gov/sites/default/files/2023-04/zero_trust_maturity_model_v2_508.pdf

[

https://perma.cc/F9LB-JVL9

Clare Stouffer,

What Is Encryption? How It Works + Types of Encryption,

Norton: Blog (July 18, 2023),

https://us.norton.com/blog/privacy/what-is-encryption

[

https://perma.cc/RC3D-NS95

Nat'l Sec. Agency & Cybersec. & Infrastructure Sec. Agency,

Recommended Best Practices for Administrators: Identity and Access Management

(n.d.),

https://media.defense.gov/2023/Mar/21/2003183448/-1/-1/0/ESF%20identity%20and%20access%20management%20recommended%20best%20practices%20for%20administrators%20pp-23-0248_508c.pdf

[

https://perma.cc/B7VP-4RWF

]; Mohammed Khan,

Data Minimization—A Practical Approach,

ISACA (Mar. 29, 2021),

https://www.isaca.org/resources/news-and-trends/industry-news/2021/data-minimization-a-practical-approach

[

https://perma.cc/8APH-5E5A

]; Cybersec. & Infrastructure Sec. Agency,

Protecting Sensitive and Personal Information From Ransomware-Caused Data Breaches

(n.d.),

https://www.cisa.gov/sites/default/files/publications/CISA_Fact_Sheet-Protecting_Sensitive_and_Personal_Information_from_Ransomware-Caused_Data_Breaches-508C.pdf

[

https://perma.cc/Q7TN-NLR4

It is the responsibility of the regulated entity to manage risk that already exists, which includes making choices about the best way to manage its own particular risk and tradeoffs between various data risk management strategies, including technical measures like encryption, organizational policies, and access management. Other options include altering commercial activities to minimize the size and scope of covered data transactions and utilizing a strong data governance regime to minimize the type and quantity of data collected. If data cannot remain encrypted while in use, the risk of temporarily decrypting data to comply with regulations can be offset by measures such as well-designed data collection, data management, and data security programs. Given these factors, any risk associated with a hypothetical U.S. business' decision to temporarily decrypt data that would otherwise remain encrypted at all times in the business' life cycle would appear to be much more remote and attenuated than the risk that accrues by allowing the U.S. business to engage in a transaction that grants a country of concern or covered person access to encrypted government-related data or bulk U.S. sensitive personal data.

15. Section 202.222—Government-Related Data

As set forth in § 202.222, the proposed rule would not impose any bulk threshold requirements on transactions involving government-related data. The proposed rule defines subcategories of government-related data for locations and personnel, as contemplated in the ANPRM. For the location subcategory, the proposed rule defines “government-related data” as any precise geolocation data, regardless of volume, for any location within any area enumerated on the Government-Related Location Data List in § 202.1401 that the Attorney General has determined poses a heightened risk of being exploited by a country of concern to reveal insights to the detriment of national security about locations controlled by the Federal Government, including insights about facilities, activities, or populations in those locations, because of the nature of those locations or the personnel who work there. The purpose of this list is to prevent countries of concern from exploiting the geolocation data in these locations, such as by using aggregated geolocation data to draw inferences about facilities, activities, or populations located there that could undermine U.S. national security or foreign policy or to conduct intelligence or counterintelligence operations against government employees or contractors, or against government facilities, as discussed in parts II, IV(D) and V(A) of this preamble. As set forth in the proposed rule, the locations that the Department might add to this list may include the worksites or duty stations of Federal Government employees or contractors who occupy national security positions, as that term is defined in 5 CFR 1400.102(a), wherever they are located. The locations may also include military installations, embassies or consulates, or other facilities worldwide that support the Federal Government in achieving its national security, defense, intelligence, law enforcement, or foreign policy missions. The proposed rule thus modifies the definition contemplated in the ANPRM by setting forth more details about the types of locations that will be listed on the Government-Related Location Data List.

89 FR 15787.

The proposed rule also proposes a format for the Government-Related Location Data List and proposes some areas for inclusion on that List.

See

§ 202.1401. This is not yet a comprehensive list of locations. The Department anticipates that the final rule will include additional locations associated with military, other Government, or other sensitive facilities or locations that meet the criteria in the definition. These locations may include, for example, military bases, embassies, or law enforcement facilities.

For the personnel subcategory, the proposed rule adopts the ANPRM's contemplated definition without change by defining “government-related data” as any sensitive personal data, regardless of volume, that a transacting party markets as linked or linkable to current or recent former employees or contractors, or former senior officials, of the United States Government, including the military and intelligence community.

Id.

Commenters were generally supportive of the proposed rule's protections for government-related data. A few commenters requested that the proposed rule provide clarity as to what constitutes a “former senior official” and a “recent former employee.” The proposed rule defines “recent former employees or contractors” as employees or contractors who have worked for or provided services to the United States Government, in a paid or unpaid status, within the 2 years preceding a proposed covered data transaction.

See

§ 202.245. The proposed rule defines a “former senior official” as either a “former senior employee” or “former very senior employee,” as those terms are defined in the ethics regulations pertaining to post-employment conflicts of interest for former Executive Branch or independent agency employees. 5 CFR 2641.104.

See

§ 202.220.

One commenter expressed concern that, with respect to the personnel subcategory, companies will have to ask individuals whether they are former government employees when collecting their data and retain that information to ensure they can comply with the regulations. The commenter argued that this could have the unintended consequence of inadvertently creating a database of sensitive information that bad actors could target. While the Department appreciates that concern and agrees that this unintended consequence should be avoided, the Department has designed the proposed rule to specifically avoid this problem by defining the personnel subcategory based on how the U.S. person markets the data, not on whether a particular dataset contains data on former government employees or contractors. In other words, the personnel subcategory applies only to transactions in which the U.S. person has already identified and described sensitive personal data as being about certain government personnel. This subcategory does not apply on the basis of the presence or absence of data linked to

certain government personnel in the underlying sensitive personal data.

One commenter suggested removing the qualifier that data had to be “marketed” as data about members of the military or intelligence community because certain data can still be “linked or linkable” to members of the military through geolocation without being explicitly marketed as such. As the Order's second category of government-related data confirms, sensitive personal data that is linked to categories of data that could be used to identify current or certain former government personnel can present a national security risk, even if a transacting party does not market it as linked or linkable to those personnel.

The Department is still considering how to address this issue, specifically whether to include, and how to define, this category of information in the proposed rule while minimizing the unintended consequence described above in this section. The Department appreciates any views from the public.

89 FR 15429.

16. Section 202.302—Other Prohibited Data-Brokerage Transactions Involving Potential Onward Transfer to Countries of Concern or Covered Persons

As previewed in the ANPRM, the proposed rule also includes a prohibition specific to data brokerage to address transactions involving the onward transfer or resale of government-related data or bulk U.S. sensitive personal data to countries of concern and covered persons.

See

§ 202.302. The proposed rule defines “data brokerage” as the sale of data, licensing of access to data, or similar commercial transactions involving the transfer of data from any person (“the provider”) to any other person (“the recipient”), where the recipient did not collect or process the data directly from the individuals linked or linkable to the collected or processed data.

See

§ 202.214. The proposed rule prohibits any U.S. person from knowingly engaging in a covered data transaction involving data brokerage with any foreign person that is not a covered person unless the U.S. person contractually requires that the foreign person refrain from engaging in a subsequent covered data transaction involving that data with a country of concern or covered person. This narrow circumstance is the only instance in which the proposed rule's regulation of covered data transactions could impact transactions involving third countries (

i.e.,

U.S. persons' covered data transactions in which a country of concern or covered person is not a party).

89 FR 15792.

Commenters generally supported the feasibility of using contractual requirements to address the resale of data as contemplated in the ANPRM. They noted, however, that it may be difficult for U.S. persons to enforce those requirements or to ensure that the data is not subsequently resold in violation of those provisions. Several aspects of the proposed rule are designed to address these concerns. First, in addition to requiring a contractual commitment from the foreign person not to engage in a subsequent covered data transaction with a country of concern or covered person, as contemplated in the ANPRM, the proposed rule adds a requirement for U.S. persons engaged in such transactions to report any known or suspected violations of the required contractual provision. This requirement creates a mechanism to provide the necessary information for the Department to investigate and take appropriate action to address any violations of the proposed rule. Second, relying on both its own investigations and its investigations of any known or suspected violations reported by private parties, the Department intends to exercise the designation authority under the proposed rule to designate as covered persons, as appropriate, foreign third parties that violate the contractual provisions required by this prohibition.

See

§ 202.701. Third, consistent with the overall approach to compliance and enforcement under the proposed rule, the Department expects U.S. persons engaged in these kinds of data brokerage transactions to take reasonable steps to evaluate whether their foreign counterparties are complying with the contractual provision as part of implementing risk-based compliance programs under the proposed rule. Absent indications of evasion, conspiracy, or knowingly directing prohibited transactions, U.S. persons that conduct adequate due diligence as part of a risk-based compliance program would not have engaged in a prohibited transaction if the foreign counterparty later violates the required contractual provision or if the U.S. person fails to detect such violations. Depending on the circumstances, a U.S. person's failure to conduct adequate due diligence may subject the U.S. person to enforcement actions if that failure would constitute an evasion of the regulations, such as repeatedly knowing of violations by a foreign person and continuing to engage in data-brokerage transactions with that foreign person. The Department welcomes public input on any additional measures that should be considered as part of the final rule. In addition, after the final rule goes into effect, the Department intends to monitor the effectiveness of the measures to address the risk of onward sale and make any appropriate adjustments.

Although not specifically raised by commenters, the Department is considering the specific language used to describe the contractual requirement. As previewed in the ANPRM,

the proposed rule frames the contractual requirement as an obligation to provide that the foreign party “refrain from engaging in a subsequent covered data transaction involving the same data with a country of concern or covered person.”

See

§ 202.302(a)(1). The Department invites public comment on this language, including whether any alternative language (such as inserting “knowingly” before “refrain” or “contractually requires that the foreign person use best efforts not to engage”) would be more appropriate.

Id.

Commenters expressed varying views about the contemplated definition of “data brokerage.” Several commenters expressed concerns about the breadth of the definition of “data brokerage” in the ANPRM.

Some commenters suggested that the proposed term, and in particular the phrase “or similar commercial transactions,” creates uncertainty as to its scope and fails to distinguish between selling data for monetary purposes and transferring data pursuant to normal business operations. Some commenters urged the Department to limit the scope of the proposed rule to “data brokers” by adopting the definition used in existing State privacy laws, such as California's.

Others proposed ways that the Department should narrow the definition, including by requiring that the data be sold in exchange for monetary or other valuable consideration; that the data must be the object of the transaction and not shared incident to the development, testing, or sale of a product or service; or that the data must be knowingly transferred or sold. Other commenters suggested that the Department amend the definition of “sale” to exclude the disclosure of sensitive personal data to service providers processing data on behalf of a U.S. company, to third parties for providing products or services requested by a U.S. company, or for

disclosures or transfers to subsidiaries or affiliates of U.S. companies. Still other commenters supported the approach contemplated by the ANPRM for defining data brokerage by reference to transactions, not the identities of the parties, noting that the ANPRM's approach is stronger than existing State privacy laws, and encouraged the adoption of a broad definition.

See

89 FR 15788.

See

Cal. Civ. Code 1798.99.80 (West 2024).

The Department declines to revise the definition of “data brokerage” in response to these comments. The definition of “data brokerage” in the proposed rule is intentionally designed to address the activity of data brokerage that gives rise to the national security risk, regardless of the kind of entity that engages in it. Both first-party data brokerage (

i.e.,

by the person that directly collected the U.S. person's data) and third-party data brokerage (

i.e.,

by a person that did not directly collect the U.S. person's data, such as a subsequent reseller) present similar national security risks: the outright sale and transfer of sensitive personal data to a country of concern or covered person. For this reason, the proposed definition intentionally regulates data transactions, including transactions that transfer data to entities in countries of concern for product development, an issue raised by numerous commenters, because those transactions give rise to the risks discussed in the Order. In addition, commenters did not provide any specific evidence that the proposed definition of data brokerage would have any measurable economic impact related to product development or testing.

Consequently, the proposed rule maintains the approach described in the ANPRM without change.

See infra

note 418 and accompanying text.

A few commenters expressed concern about how this provision might affect the ability of biomedical and pharmaceutical manufacturers to share clinical trial data with drug and device regulators in countries of concern. Relatedly, a few commenters expressed concerns that the proposed rule's inclusion of aggregated and anonymized data would prohibit companies from using clinical trial data to launch clinical trials in countries of concern or sharing safety and efficacy data obtained from clinical trials in the United States with countries of concern. The proposed rule includes two exemptions responsive to these comments, in sections 202.510 and 202.511. These exemptions allow certain transactions relevant to medical research, marketing, and safety, as explained in more detail below.

17. Section 202.303—Prohibited Human Genomic Data and Human Biospecimen Transactions

As previewed in the ANPRM, the proposed rule includes a prohibition to specifically address the risks posed by covered data transactions involving access by countries of concern to U.S. persons' bulk human genomic data and human biospecimens from which that bulk data can be derived, such as covered data transactions that give access to bulk human genomic data to laboratories owned or operated by covered persons or provide them with human biospecimens from which such data can be derived. The proposed rule prohibits any U.S. person from knowingly engaging in any covered data transaction involving human genomic data that provides a country of concern or covered person with access to bulk U.S. sensitive personal data that consists of human genomic data or human biospecimens from which such data could be derived, where the number of U.S. persons in the dataset is greater than the applicable bulk threshold at any point in the preceding 12 months, whether in a single covered data transaction or aggregated across covered data transactions. This prohibition applies to any of the categories of covered data transactions that involve access to bulk human genomic data or human biospecimens from which bulk human genomic data can be derived, even when the transactions involve an employment, investment, or vendor agreement. In other words, transactions falling within the scope of proposed § 202.303 are never treated as restricted transactions under the proposed rule. Relatedly, and as discussed in more detail with respect to the categories of exempt transactions, the proposed rule exempts (1) transactions for the conduct of the official business of the United States Government by employees, grantees, or contractors thereof, or transactions conducted pursuant to a grant, contract, or other agreement entered into with the United States Government, including those for outbreak and pandemic prevention, preparedness, and response; and (2) data transactions, including the sharing of human biospecimens from which human genomic data may be derived, that are required or authorized by certain specified international arrangements addressing global and pandemic preparedness.

One commenter sought clarification that vendor, employment, and investment agreements involving access to bulk human genomic data, or human biospecimens from which such data could be derived, are prohibited transactions under subpart C of the proposed rule rather than restricted transactions under subpart D of the proposed rule. The commenter suggested that the proposed rule should clarify that such vendor, employment, and investment agreements are prohibited because they present the same policy concerns as other categories of transactions involving access to this kind of data. The Department agrees. As shown by Example 49 in the ANPRM, vendor, employment, and investment agreements involving access to this kind of sensitive personal data are prohibited rather than restricted.

For the avoidance of doubt, § 202.303 of the proposed rule clarifies that the authorization for restricted transactions,

see

§§ 202.401-202.402, does not apply to any transactions involving access to bulk human genomic data or bulk human biospecimens.

89 FR 15794.

18. Section 202.304—Prohibited Evasions, Attempts, Causing Violations, and Conspiracies

Adopting the approach contemplated in the ANPRM without change, the proposed rule prohibits any transactions that have the purpose of evading or avoiding the proposed rule's prohibitions, or that cause a violation of or attempt to violate the proposed rule's prohibitions. The proposed rule also prohibits conspiracies formed to violate the proposed rule's prohibitions.

One commenter suggested expanding the scope of the regulations to prohibit transactions involving algorithms or artificial intelligence models that are trained and developed using bulk U.S. sensitive personal data in certain circumstances. The commenter described a scenario in which the transfer of such an algorithm or model provides a means to evade the prohibitions—for example, where a transaction gives a country of concern or covered person access to the model, and the model makes the underlying bulk U.S. sensitive personal data on which it was trained available to that country of concern or covered person. According to the commenter, this access could occur by querying the model in such a way that results in it sharing all of or a highly relevant component of the underlying data on which it was trained, such as a query that resulted in identification of people with a particular medical condition.

Apart

from concerns over access to the underlying data, a model could also provide insights into counter-intelligence targeting that would not otherwise be observable from the underlying sensitive personal data. The Department shares these concerns. In response to the comment, the proposed rule includes Examples 5 and 6 in § 202.304(b) highlighting how these regulations would apply in certain scenarios where bulk U.S. sensitive personal data would be licensed or sold to support algorithmic development, including cases of evasion, or where sensitive personal data could be extracted from artificial intelligence models. The Department will continue to evaluate the national-security risks in this emerging area as it considers the effectiveness of this regulation. To the extent that there are broader concerns about national-security risks from the export of artificial intelligence models or algorithms regardless of the access they provide to sensitive personal data (such as their ability to provide insights that would not otherwise be observable from the data on which they are trained), the Department believes that other authorities, such as export controls and Executive Order 13859 of February 11, 2019 (Maintaining American Leadership in Artificial Intelligence),

are more appropriate in the first instance to address those concerns.

Tim Johansson & Balder Janryd, Preventing Health Data from Leaking in a Machine Learning System 4-6 (2024) (First Cycle 15 credits, KTH Royal Institute of Technology),

https://kth.diva-

portal.org/smash/get/diva2:1865596/FULLTEXT01.pdf

[

https://perma.cc/S5S8-M3DJ

];

see, e.g.,

Anuj Mudaliar,

ChatGPT Leaks Sensitive User Data, OpenAI Suspects Hack,

Spiceworks (Feb. 1, 2024),

https://www.spiceworks.com/tech/artificial-intelligence/news/chatgpt-leaks-sensitive-user-data-openai-suspects-hack/

[

https://perma.cc/AS5E-FATZ

E.O. 13859, 84 FR 3967 (Feb. 11, 2019).

19. Section 202.305—Knowingly Directing Prohibited Transactions

Adopting the approach contemplated in the ANPRM without change, the proposed rule prohibits U.S. persons from knowingly directing any covered data transaction that would be a prohibited transaction (including restricted transactions that do not comply with the security requirements) if engaged in by a U.S. person.

20. Section 202.215—Directing

Adopting the approach contemplated in the ANPRM without change, the proposed rule defines “directing” to mean that the U.S. person has any authority (individually or as part of a group) to make decisions on behalf of a foreign entity and exercises that authority. For example, a U.S. person would direct a transaction by exercising their authority to order, decide to engage, or approve a transaction that would be prohibited under these regulations if engaged in by a U.S. person.

21. Section 202.230—Knowingly

Adopting the approach contemplated in the ANPRM without change, the proposed rule defines “knowingly” to mean, with respect to conduct, a circumstance, or a result, that the U.S. person had actual knowledge of, or reasonably should have known about, the conduct, circumstance, or result. To determine what an individual or entity reasonably should have known in the context of prohibited transactions, the Department will take into account the relevant facts and circumstances, including the relative sophistication of the individual or entity at issue, the scale and sensitivity of the data involved, and the extent to which the parties to the transaction at issue appear to have been aware of and sought to evade the application of these proposed rules. As a result of the knowledge standard, the regulations incorporating the word “knowingly” do not adopt a strict liability standard.

The “knowingly” language is also not intended to require U.S. persons, in engaging in vendor agreements and other classes of data transactions with foreign persons, to conduct due diligence on the employment practices of those foreign persons to determine whether the foreign persons' employees qualify as covered persons. For instance, as illustrated by Examples 37 and 38 in the ANPRM, which are incorporated into the proposed rule, it would not be a prohibited transaction for a U.S. person to enter into a vendor agreement to have bulk U.S. sensitive personal data processed or stored by a foreign person that is not a covered person, even if that foreign person then employs covered persons and grants them access to the data (absent any indication of evasion or knowing direction).

In those circumstances, the U.S. person would not be expected to conduct due diligence on the foreign person's employment practices as part of its risk-based compliance program.

89 FR 15792.

Several commenters sought clarity about liability where service providers have little or no knowledge of the data that customers keep or transact on their infrastructure. They also requested that the Department distinguish between data controllers and data processers. In response to these comments, the proposed rule has provided additional examples to clarify the function of the “knowingly” standard.

See

§ 202.230(b)(2)-(6). As the examples demonstrate, if a U.S. entity merely provides a software platform or owns or operates infrastructure for a U.S. customer, and thus does not know or reasonably should not know of the kind or volume of data involved, then the U.S. entity generally would not “knowingly” engage in a prohibited transaction if the U.S. customer uses their platform or infrastructure to engage in a prohibited transaction. Instead, the U.S. customer would generally be responsible for having “knowingly” engaged in the prohibited transaction. Likewise, if a U.S. entity merely stores encrypted data on behalf of a U.S. customer and does not have access to the encryption key (or has access only to an emergency backup encryption key usable only at the customer's explicit request), and if the U.S. entity is reasonably unaware of the kind or volume of data involved, the U.S. entity generally would not meet the “knowingly” standard of the proposed rule.

The Department declines, however, to draw a categorical distinction between processors and controllers in the proposed rule. Inserting a categorical distinction based on the kind of entity would be inconsistent with the structure and overall approach of the proposed rule, which addresses activities that present an unacceptable national security risk. In addition, as the new examples illustrate, the same kinds of entities can engage in different kinds of activities, some of which (such as merely providing a software platform) raise different risks than others (such as providing a software platform and services to handle and process the data). The “knowingly” standard provides the requisite flexibility to address the national security risks while providing a basis to distinguish responsibility based on the activities and roles that particular entities may have. The proposed rule thus adopts the approach described in the ANPRM with the additional examples described above in this section to illustrate the “knowingly” standard.

Similarly, one comment sought clarification that the proposed rule would apply only to U.S. persons that have or maintain control over the bulk U.S. sensitive personal data involved in a prohibited or restricted transaction. As the commenter explained, an automobile manufacturer should not have compliance obligations with respect to bulk U.S. sensitive personal data that is transferred via an aftermarket device that was installed in a vehicle fleet by the owner. As

previewed in the ANPRM, the proposed rule imposes prohibitions and restrictions only on U.S. persons that are engaged in covered data transactions that meet certain criteria. In the commenter's example, the U.S. automobile manufacturer has not engaged in a covered data transaction with respect to the aftermarket device. As a result, no change was made to the proposed rule in response to this comment.

B. Subpart D—Restricted Transactions

1. Section 202.401—Authorization To Conduct Restricted Transactions; Section 202.402—Incorporation by Reference

The proposed rule sets forth three classes of transactions (vendor agreements, employment agreements, and investment agreements) that are prohibited unless the U.S. person entering into the transactions complies with the “security requirements” referenced in section 202.248. The goal of the proposed security requirements is to address national security and foreign-policy threats that arise when countries of concern and covered persons access government-related data or bulk U.S. sensitive personal data that may be implicated by the categories of restricted transactions. The security requirements have been developed and proposed by the Cybersecurity and Infrastructure Security Agency (“CISA”) in coordination with the Department. CISA has published the proposed requirements—the CISA Proposed Security Requirements for Restricted Transactions—on its website, as announced via a

Federal Register

notice requesting comment on those proposed security requirements issued concurrently with this proposed rule. The proposed security requirements require U.S. persons engaging in restricted transactions to comply with organizational and system-level requirements, such as ensuring that basic organizational cybersecurity policies, practices, and requirements are in place, as well as data-level requirements, such as data minimization and masking, encryption, or privacy-enhancing techniques. After CISA receives and considers public input, it will revise as appropriate and publish the final security requirements. The Department of Justice will then incorporate by reference the published final security requirements in the final rule that the Department issues. Interested parties can view CISA's proposed security requirements on CISA's website at

https://www.cisa.gov/

and can review CISA's notice requesting comments on the proposed security requirements in the notice docketed as CISA-2024-0029 (October 29, 2024).

The proposed rule also clarifies that restricted transactions are not prohibited only if they comply with the security requirements and other applicable requirements for conducting restricted transactions. The proposed rule includes a new example that makes it clear that U.S. persons engaging in restricted transactions may not, absent a license, use measures other than the security requirements and other applicable conditions to mitigate the risk posed by country-of-concern or covered-person access.

Some commenters provided feedback on the security requirements that would govern restricted transactions. As explained in the ANPRM, CISA will be soliciting comments on the proposed security requirements as part of a separate notice-and-comment process in parallel with this NPRM, and the Department urges commenters to provide any comments on the security requirements through that process.

2. Section 202.258—Vendor Agreement

The proposed rule defines a “vendor agreement” as any agreement or arrangement, other than an employment agreement, in which any person provides goods or services to another person, including cloud-computing services, in exchange for payment or other consideration. The ANPRM contemplated defining the term “cloud-computing services” as that term is defined in NIST Special Publication (“SP”) 800-145.

NIST SP 800-145 describes cloud computing in a way that includes different essential characteristics, deployment models, and service models, such as “Infrastructure as a Service (IaaS),” “Platform as a Service (PaaS),” and “Software as a Service (SaaS).”

Because cloud computing is just one example of several types of services that may be involved in a vendor agreement, it does not appear useful to separately or specially define that term in the proposed rule at this time. The Department may consider issuing guidance in the future that describes cloud computing in reference to the NIST definition.

89 FR 15788.

See

Peter Mell & Timothy Grance,

The NIST Definition of Cloud Computing

(NIST, SP 800-145, Sept. 2011),

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf

[

https://perma.cc/HUJ5-B2JS

3. Section 202.217—Employment Agreement

The proposed rule defines an “employment agreement” as any agreement or arrangement in which an individual, other than as an independent contractor, performs work or performs job functions directly for a person in exchange for payment or other consideration, including employment on a board or committee, executive-level arrangements or services, and employment services at an operational level.

4. Section 202.228—Investment Agreement

The proposed rule defines an “investment agreement” as any agreement or arrangement in which any person, in exchange for payment or other consideration, obtains direct or indirect ownership interests in or rights in relation to (1) real estate located in the United States or (2) a U.S. legal entity. The proposed rule categorically excludes certain passive investments that do not pose an unacceptable risk to national security because they do not give countries of concern or covered persons a controlling ownership interest, rights in substantive decision-making, or influence through a non-controlling interest that could be exploited to access government-related data or bulk U.S. sensitive personal data. Specifically, the proposed rule excludes from “investment agreement” investments (1) in any publicly traded security, in any security offered by any investment company that is registered with the United States Securities and Exchange Commission, such as index funds, mutual funds, exchange-traded funds, or made as limited partners (or equivalent) into a venture capital fund, private equity fund, fund of funds, or other pooled investment fund, if the limited partner's contributions and influence are circumscribed as set forth in the proposed rule; (2) that give the covered person less than 10 percent of total voting and equity interest in a U.S. person; and (3) that do not give a covered person rights beyond those reasonably considered to be standard minority shareholder protections.

With respect to the requirement of a de minimis percentage of total voting and equity interest, the Department is considering a range of different proposals. The proposed rule's definition of “investment agreement” would apply to investments that give a covered person a certain percentage or more of total voting and equity interest in a U.S. person, even where that investment is not accompanied by other

formal rights beyond standard minority shareholder protections. The proposed rule would include this de minimis threshold to account for the unacceptable national security risk posed by otherwise passive investments that may provide investors with meaningful economic leverage or informal influence over access to a company's assets (like sensitive personal data) even when the investors do not obtain formal rights, control, or access beyond standard minority shareholder protections. The proposed rule would tentatively set this threshold number at 10 percent to exclude truly passive investments while also capturing investments that informally may provide covered persons with influence that presents unacceptable national security risks. The Department is also considering de minimis thresholds that are significantly lower and higher than this percentage, such as the 5 percent threshold above which investors must publicly report their direct or indirect beneficial ownership of certain covered securities under the Securities Exchange Act of 1934, 15 U.S.C. 78m(d). As a result, the final figure in the proposed rule could potentially cover passive investments that provide less (or more) than 10-percent voting and equity interests in a U.S. person. The Department invites public comment on the specific de minimis threshold that should be used in this exception for passive investments.

C. Subpart E—Exempt Transactions

As previewed in the ANPRM, the proposed rule exempts several classes of data transactions from the scope of the proposed rule's prohibitions.

1. Section 202.501—Personal Communications; Section 202.502—Information or Informational Materials; and Section 402.503—Travel

The proposed rule exempts three classes of data transactions to the extent that they involve data that is statutorily exempt from regulation under IEEPA: personal communications, information or informational materials, and data that is ordinarily incident to travel to or from another country.

One comment suggested clarifying that the exemption for personal communications that do “not involve a transfer of anything of value” under 50 U.S.C. 1702(b)(1) is “inclusive of business and commercial transactions.” The proposed rule makes no change in response to this comment, as the clarification does not seem necessary at this time, given the scope of the statutory exemption and the proposed rule. Section 1702(b)(1) applies to any “personal communication,” so it would be inappropriate to rely on that statutory language to exempt, as this comment suggests, “business and commercial transactions.” Further, the categories of sensitive personal data encompassed by the proposed rule do not include any personal communications. For example, fingerprints and other biometric identifiers, human genetic testing results, and data about financial assets and liabilities are not “communications” from one person to another. Any clarification of the phrase “a transfer of anything of value,” therefore, does not appear necessary. To the extent the commenters, a group of trade associations representing telecommunications providers, are concerned that personal communications between individuals that do not involve a transfer of anything of value are business transactions from their perspective, as purveyors of telecommunications services, the Department refers the commenters to the qualified exemption for telecommunications services in proposed § 202.509.

The Department discusses the exemption for information or informational materials in part VI of this preamble.

Although not raised by commenters, the proposed rule also adds a separate exemption for data transactions that are ordinarily incident to travel to or from another country, such as arranging travel or importing baggage for personal use. This exemption implements and tracks the statutory exemption in 50 U.S.C. 1702(b)(4).

2. Section 202.504—Official Business of the United States Government

Adopting the approach contemplated in the ANPRM without change, the proposed rule exempts data transactions to the extent that they are for (1) the conduct of the official business of the United States Government by its employees, grantees, or contractors; (2) any authorized activity of any United States Government department or agency (including an activity that is performed by a Federal depository institution or credit union supervisory agency in the capacity of receiver or conservator); or (3) transactions conducted pursuant to a grant, contract, or other agreement entered into with the United States Government. Most notably, this exemption would exempt grantees and contractors of Federal departments and agencies, including the Department of Health and Human Services, the Department of Veterans Affairs, the National Science Foundation, and the Department of Defense, so that those agencies can pursue grant-based and contract-based conditions to address risks that countries of concern can access sensitive personal data in transactions related to their agencies' own grants and contracts, as laid out in section 3(b) of the Order—without subjecting those grantees and contractors to dual regulation.

3. Section 202.505—Financial Services

Section 2(a)(v) of the Order exempts any transaction that is “ordinarily incident to and part of the provision of financial services, including banking, capital markets, and financial insurance services, or required for compliance with any Federal statutory or regulatory requirements, including any regulations, guidance, or orders implementing those requirements.”

The proposed rule defines these exempt transactions in further detail. Notably, the proposed rule exempts the transfer of personal financial data or covered personal identifiers incidental to the purchase and sale of goods and services (such as the purchase, sale, or transfer of consumer products and services through online shopping or e-commerce marketplaces, while still prohibiting these marketplaces from conducting data transactions that involve data brokerage), as well as exempting the transfer of personal financial data or covered personal identifiers for the provision or processing of payments or funds transfers.

89 FR 15423.

Numerous commenters expressed support for the financial-services exemption. Commenters expressed appreciation for the exemption's careful scoping to enable business and commercial transactions. Commenters sought specific edits to the payment-processing part of the exemption to ensure that it covers operations involving payment dispute resolution, payor authentication, tokenization, payment gateway, payment fraud detection, payment resiliency, mitigation and prevention, and payment-related loyalty point program administration. The Department appreciates these suggested clarifications, and the proposed rule incorporates these proposed edits by explicitly adding the provision of services ancillary to processing payments and funds transfers, with the suggested examples, to the list of exempt financial services transactions.

The financial-services exemption aims to identify the low-risk business and

commercial transactions that should continue unimpeded while also ensuring that the Order and its implementing regulations do not serve as a broader economic decoupling from countries of concern. These edits are consistent with that purpose.

89 FR 15794.

Another commenter also suggested that investment-management services be included in the financial-services exemption. The Department does not intend to impede activities that are ordinarily incident to and part of the provision of investment-management services that manage or provide advice on investment portfolios or individual assets for compensation (such as devising strategies and handling financial assets and other investments for clients) or provide services ancillary to investment-management services (such as broker-dealers executing trades within a securities portfolio based upon instructions from an investment advisor). For further clarity, the proposed rule explicitly adds investment-management services to the financial-services exemption set out in §§ 202.505(a)(1) and 202.505(a)(6).

One commenter requested an exemption for cargo-related information containing listed identifiers. The Department believes this comment is focused on scenarios in which bulk personal identifiers are transferred as part of shipping purchased goods internationally. The Department declines to adopt a separate exemption, or an expansion of the scope of the exemption for transfers of data required by or authorized by Federal law or international agreement, for cargo-related information because the proposed rule already exempts the transfer of personal financial data or covered personal identifiers incidental to the purchase and sale of goods and services. This existing exemption appears to adequately address the scenario raised by the commenter. Thus, the proposed rule adopts the approach described in the ANPRM.

Although not raised by any commenters, the Department is also considering whether and how the financial-services exemption should apply to employment and vendor agreements between U.S. financial-services firms and covered persons where the underlying financial services provided do not involve a country of concern. Under this exemption, U.S. persons would be required to evaluate whether a particular data transaction (such as a transaction involving data brokerage or a vendor, employment, or investment agreement) is “ordinarily incident to and part of” the provision of financial services such that it is treated as an exempt transaction.

At one end of the spectrum, and as previewed by Example 53 in the ANPRM, if a U.S. financial institution or financial-services company uses a data center operated by a covered person in a country of concern to facilitate payments to U.S. persons in that country of concern, the proposed rule would treat that vendor agreement as “ordinarily incident to and part of” the facilitation of those payments—and thus exempt.

See

§ 202.505(b)(3). On the other end of the spectrum, and as previewed by Example 27 in the ANPRM, if a U.S. financial institution or financial-services company hires a covered person as a data scientist with access to its U.S. customers' bulk personal financial data to develop a new app that could be sold as a standalone product to the company's customers, the proposed rule would treat this employment agreement as not “ordinarily incident to and part of” the financial services provided by the U.S. company—and thus not exempt.

See

§ 202.217(b)(4).

Cf., e.g.,

31 CFR 560.405(c) (discussing OFAC exemption for transactions “ordinarily incident to a licensed transaction” as applied to scenarios involving the provision of transportation services to or from Iran), 515.533 n.1 (discussing OFAC exemption for transactions “ordinarily incident to” a licensed transaction as applied to scenarios involving the licensed export of items to any person in Cuba); Letter from R. Richard Newcomb, Director, U.S. Dep't of Treas., Off. of Foreign Assets Control,

Re: Iran: Travel Exemption

(Nov. 25, 2003),

https://ofac.treasury.gov/media/7926/download?inline

[

https://perma.cc/3VRL-X886

] (discussing the OFAC exemption for transactions “ordinarily incident to” travel as applied to scenarios involving the use of airline-service providers from a sanctioned jurisdiction).

89 FR 15794.

89 FR 15789.

Between those two ends of the spectrum, the Department is considering whether the transactions in the following new examples should be treated as exempt transactions or as restricted transactions:

•

New example in § 202.505(b)(4).

Same as Example 3 (

see

§ 202.505(b)(3)), but the underlying payments are between U.S. persons in the United States and do not involve a country of concern: A U.S. bank or other financial institution, to facilitate payments that do not involve a covered person or country of concern (

e.g.,

between U.S. persons in the United States), stores and processes the customers' bulk financial data using a data center operated by a third-party service provider in a country of concern, which is a covered person. Should the vendor agreement with the covered person, which is otherwise a restricted transaction, be treated as “ordinarily incident to and part of” the U.S. financial institution's facilitation of payments that do not involve a covered person or country of concern?

•

New example in § 202.505(b)(12).

A U.S. company provides wealth-management services and collects bulk personal financial data on its U.S. clients. The U.S. company appoints a citizen of a country of concern, who is located in a country of concern, to its board of directors. In connection with the board's data security and cybersecurity responsibilities, the director could access the bulk personal financial data. Should the employment agreement with the covered person as a board director, which is otherwise a restricted transaction, be treated as “ordinarily incident to and part of” the U.S. company's provision of wealth-management services to its U.S. clients?

The Department is tentatively considering treating the transactions in both examples as restricted transactions because it does not believe that an employment agreement (including the hiring of board members) or a vendor agreement that gives a covered person access to U.S. persons' bulk sensitive personal data is a reasonable and typical practice in providing the underlying financial services that do not otherwise involve covered persons or a country of concern. These transactions therefore appear to pose the same unacceptable national security risk regardless of the kinds of underlying services provided by the U.S. person. The Department welcomes public comment to inform its resolution of this issue, including the extent to which it is reasonable, necessary, and typical practice for U.S. financial-services firms to hire covered persons as employees or vendors with access to U.S. persons' bulk sensitive personal data as part of providing financial services that do not involve a country of concern; why U.S. financial-services firms hire covered persons instead of non-covered persons in those circumstances; and any additional compliance costs that would be incurred if the transactions in these examples were treated as restricted transactions. In addition, after issuance of the final rule, the Department intends to consult the Department of the Treasury and Federal financial regulatory agencies as part of issuing any guidance or advisory opinions regarding the application of the financial-services exemption.

4. Section 202.506—Corporate Group Transactions

As previewed in the ANPRM, the proposed rule exempts covered data transactions to the extent that they are (1) between a U.S. person and its

subsidiary or affiliate located in (or otherwise subject to the ownership, direction, jurisdiction, or control of) a country of concern; and (2) ordinarily incident to and part of administrative or ancillary business operations (such as sharing employees' covered personal identifiers for human-resources purposes; payroll transactions like the payment of salaries and pensions to overseas employees or contractors; paying business taxes or fees; purchasing business permits or licenses; sharing data with auditors and law firms for regulatory compliance; and risk management). The ANPRM called this exemption “intra-entity transactions.”

For greater clarity and accuracy, the proposed rule revises the name of this exemption to “corporate group transactions.”

89 FR 15794.

Some commenters requested that the Department broaden the corporate group transactions exemption to include routine business activities performed by third-party service providers. Similarly, commenters proposed augmenting the same exemption to include suppliers and other third-party vendors who are contractually bound to maintain privacy requirements and who engage in product and services development, research, and improvement activities for U.S. companies. The Department declines to incorporate these suggestions because they would not adequately mitigate the threats posed by access to government-related data or bulk U.S. sensitive personal data by a country of concern or covered person. Thus, the proposed rule adopts the approach described in the ANPRM without change, permitting restricted transactions involving vendor agreements to proceed as long as they comply with the proposed rule's security requirements designed to mitigate access to the sensitive personal data by countries of concern and covered persons.

One commenter requested clarification that it would not be a prohibited transaction for a U.S. company to provide access to a global company staff directory to its business office and employees located in a country of concern. Consistent with the approach contemplated in the ANPRM, this scenario would not be a prohibited or restricted transaction under the proposed rule for two independent reasons. First, a company directory containing only contact or demographic data linked to other contact or demographic data would not fall within the definition of “covered personal identifiers” and thus would not constitute government-related data or bulk U.S. sensitive personal data. As a result, there would be no covered data transaction in providing such a directory. Second, the U.S. company's sharing of the directory would not be a prohibited or restricted transaction, regardless of whether the business office is a foreign branch or a subsidiary or affiliate: if the business office in the country of concern is a branch of the U.S. company, the branch is part of the same “U.S. person” as the U.S. company, and the U.S. company has not engaged in any transaction with a foreign person in the first place. If, by contrast, the business office is a subsidiary or affiliate of the U.S. company, the sharing is an exempt corporate group transaction because a transaction within a corporate group granting its employees access to a company directory is ordinarily incident to ancillary or administrative business operations. (In different circumstances where that exemption is not applicable, a transaction within a corporate group that gives an employee who is a covered person access to government-related data or bulk U.S. sensitive personal data would generally be a restricted employment agreement.)

5. Section 202.507—Transactions Required or Authorized by Federal Law or International Agreements, or Necessary for Compliance With Federal Law

As previewed in the ANPRM, the proposed rule exempts covered data transactions to the extent that they are required or authorized by Federal law, international agreements or specified global health and pandemic preparedness measures, or necessary for compliance with Federal law.

Some commenters requested clarity about whether the exemption for regulatory compliance (which the ANPRM contemplated as part of the financial-services exemption) applies to compliance with all Federal law, not just financial laws.

The Department acknowledges that this is a correct understanding of this exemption. To improve clarity and reflect this understanding, the proposed rule moves the exemption for compliance with Federal law from the financial-services exemption to a standalone subpart of the exemption for transactions required or authorized by Federal law or international agreements.

89 FR 15794-95.

The proposed rule clarifies that, with respect to international agreements authorizing or requiring data transactions, the exemption applies only to international agreements to which the United States is a party. Some commenters requested a non-exhaustive list of international agreements to which this exemption applies. The proposed rule adds an illustrative list of specific international agreements to which this exemption applies.

One commenter sought clarification on whether transactions required or authorized by international agreements include transactions in accordance with arrangements that facilitate international commercial data flows, such as the Global Cross-Border Privacy Rules (“G-CBPR”) and Global Privacy Recognition for Processors (“G-PRP”) Systems of the Global Cross-Border Privacy Rules Forum (“Global CBPR Forum”) and the Asia-Pacific Economic Cooperation (“APEC”) Cross-Border Privacy Rules (“APEC CBPR”) and APEC Privacy Recognition for Processors Systems. These arrangements are outside the scope of the exemption for international agreements. These arrangements consist of frameworks for coordinating national regulatory measures, and they do not facilitate the sharing of data between the U.S. and a country of concern. Thus, data transactions covered by this proposed rule would not be “pursuant to these arrangements as necessary to meet the definitional requirements of the exemption. The Department further declines to expand the scope of the exemption to incorporate these arrangements, which are designed to address general privacy concerns and other issues rather than the national security risks detailed in the Order. The same commenter also sought clarity as to whether the EU-U.S. Data Privacy Framework (“DPF”) would be such an international agreement. The EU-U.S. DPF is similarly an arrangement that falls outside the scope of the exemption. The EU-U.S. DPF fulfills different objectives than the proposed rule and does not facilitate the sharing of information between a U.S. person and a country of concern or covered person. For example, under the EU-U.S. DPF and pursuant to Executive Order 14086 of October 7, 2022 (Enhancing Safeguards for United States Signals Intelligence Activities), the Attorney General determined that the laws of EU/European Economic Area countries require appropriate safeguards for signals intelligence activities affecting U.S. persons' personal data.

Furthermore, while DPF- and APEC CBPR-certified companies are subject to domestic law, including the Order, no DPF or APEC CBPR countries or jurisdictions are currently designated as countries of concern under this Executive Order. As such, the provisions of the Order would not apply to transfers conducted in reliance on the DPF or APEC CBPR, and any data transactions that the proposed rule does cover would not be “pursuant to” such arrangements as required for this exemption. Therefore, the proposed rule adopts the approach contemplated by the ANPRM without change.

E. O. 14086, 87 FR 62283 (Oct. 7, 2022); Dep't of Just., Attorney General Designations of the European Union, Iceland, Liechtenstein, and Norway as “Qualifying States”, 88 FR 44844 (July 13, 2023).

6. Section 202.508—Investment Agreements Subject to a CFIUS Action

Adopting the approach contemplated by the ANPRM, the proposed rule exempts investment agreements to the extent that they are the subject of a “CFIUS action” as defined in section 202.207 (

i.e.,

CFIUS has suspended a proposed or pending transaction, or entered into or imposed mitigation measures to address a national security risk involving access to sensitive personal data by countries of concern or covered persons). The rationale for this approach is discussed sep

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.