Executive Order on Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern: Implications and Analysis

The White House issued an Executive Order on February 28 that aims to prevent access to Americans’ bulk sensitive personal data and United States government-related data by countries of concern. This order seeks to limit outbound data transfers that pose a risk to national security. The primary impact of this order will be on data brokers, who profit from collecting and selling personal data.

The Executive Order places limitations on data transactions by directing the Department of Justice to issue regulations restricting U.S. companies from transferring large datasets to covered persons in countries of concern. The order focuses on six categories of sensitive data, including geolocation, biometric identifiers, human genomic data, personal health data, personal financial data, and personal identifiers. The DOJ is considering prohibiting transactions of human genomic data and placing conditional limitations on the other categories.

The national security concerns addressed by the Executive Order include the potential misuse of Americans’ personal information by malign actors from countries of concern. The order aims to prevent U.S. data brokers from sharing sensitive personal data with these countries, but it does not restrict them from selling the same information to U.S. buyers. The EO does not address domestic privacy concerns, but it encourages further rulemaking by agencies like the Federal Trade Commission.

The impact of the Executive Order on cross-border data flows and international agreements remains to be seen. While the order does not affect existing commitments to international agreements promoting data flow, it could lead to changes in how U.S. companies transfer data abroad. The broader concerns around data brokers are also being addressed by U.S. policymakers through proposed legislation and regulatory actions.

Overall, the Executive Order on preventing access to Americans’ bulk sensitive personal data by countries of concern is a significant step towards safeguarding national security and addressing the risks associated with data transfers to malign actors. The impact of this order on data flows, international agreements, and broader data privacy concerns will be closely monitored in the coming months.