DOJ issues proposed rule restricting sensitive data transfers to China and other adversary countries

On October 21, 2024, the Department of Justice (DOJ) issued a notice of proposed rulemaking (Proposed Rule) that, if adopted, would impose data security requirements on or prohibit certain covered data transactions by U.S. persons with foreign persons connected to countries of concern, which the Proposed Rule defines to include China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela. The Proposed Rule is issued pursuant to Executive Order 14117, "Preventing Access to Americans' Bulk Sensitive Data and United States Government-Related Data by Countries of Concern" and follows an advanced notice of proposed rulemaking (ANPRM) issued concurrently with Executive Order 14117 in February 2024. The Proposed Rule generally follows the framework laid out in the DOJ's February 2024 ANPRM, discussed in our previous client update, with some notable changes discussed below.

In conjunction with the Proposed Rule, the Cybersecurity & Infrastructure Security Agency (CISA) has issued a separate request for comment on proposed data security requirements that are incorporated by reference into the Proposed Rule. These are attached as Appendix B.

Comments to both the DOJ and CISA are due by November 29, 2024. Based on public statements from the DOJ staff, DOJ intends to move as quickly as possible and is targeting issuing a final rule in early 2025; the change in administration could in principle introduce some delay, but access to data on U.S. persons by potential foreign adversaries has been a long-standing national security concern across the past several administrations, both Republican and Democratic.

What does the Proposed Rule do?

The Proposed Rule would prohibit U.S. persons and companies from engaging in data brokerage transactions with covered persons located in or owned by residents of countries of concern (China, Russia, Cuba, Iran, North Korea and Venezuela) involving broad categories of bulk U.S. sensitive personal data or government-related data (Restricted Data). It would also prohibit U.S. companies holding any significant quantity of human genomic data from accepting investments (other than small passive investments in publicly traded securities) from covered persons or engaging covered persons in employee or vendor relationships with access to such data.

More significantly, it would also require U.S. persons and companies to meet fairly extensive government-mandated cybersecurity requirements before engaging in a range of ordinary commercial transactions with covered persons. These requirements include meeting cybersecurity standards set by the CISA, adopting formal written cybersecurity policies overseen by a responsible security officer, and conducting cybersecurity audits at least annually, as well as due diligence and recordkeeping requirements. The relevant transactions include any employment agreement or vendor agreement in which a covered person will have access to Restricted Data, including access via the cloud. They also include any investment agreement involving an investment by a person of a country of concern holding any Restricted Data - whether or not the investor will have any access at all to such data - unless the investment is in publicly traded securities of the issuer, amounts to a total of less than 10% of the U.S. business, and is completely passive.

Effectively, U.S. businesses holding Restricted Data will have to adopt cybersecurity plans meeting the standards set out in the Proposed Rule or be barred from using Chinese (and other) employees or vendors to work with Restricted Data or accepting any significant investment from covered persons. With respect to individuals, the rule is based on the location rather than the citizenship of the person (except that U.S. citizens are exempt, even if located in a country of concern); with respect to entities, it is based on organization, location, or control by a country of concern.

Practically speaking, this means that any time a U.S. company holding bulk sensitive U.S. data or government-related data transfers such data to, or enters into an employment, vendor, or investment relationship with, a person or company located in or organized under the laws of China, Cuba, Iran, North Korea, Russia or Venezuela, or a subsidiary, employee or contractor of such a company, it should consider whether the proposed restrictions apply. The Proposed Rule has no pre-clearance or review process; it is an enforcement-based regime. U.S. persons therefore bear the burden of doing sufficient diligence (both on the data they themselves hold and on their potential counterparties) to determine whether the Proposed Rule's restrictions apply.

Mechanics of the Proposed Rule

Foreign persons targeted

The Proposed Rule only applies to transactions that could provide access to sensitive data to covered persons, which are generally defined as any foreign person that is:

• an entity that is 50% or more owned, directly or indirectly, by a country of concern, or that is organized or chartered under the laws of, or has its principal place of business in, a country of concern;
• a foreign individual who is an employee or contractor of a country of concern or of an entity that is covered person;
• a foreign individual who is primarily a resident in the territorial jurisdiction of a country of concern; or
• an entity that is 50% or more owned, directly or indirectly, by any of the foregoing or a designated covered person.

U.S. citizens, U.S. nationals, lawful permanent residents, lawful refugees and asylum grantees, entities organized solely under U.S. law (including foreign branches), and foreign persons or entities physically within the United States are not covered persons. In addition to persons meeting the general rules above, covered persons may be designated by the Attorney General under the Proposed Rule (for example, because they are acting on behalf of covered persons).

Persons required to comply

Only U.S. persons are required to comply with the Proposed Rule. While transactions among non-U.S. persons are therefore generally not covered, the Proposed Rule has certain collateral consequences for transactions even solely among non-U.S. persons:

• U.S. persons may not knowingly direct a foreign person to engage in a transaction that would be a prohibited transaction if the foreign person were a U.S. person. Only persons with authority to make decisions for or on behalf of an entity can direct an entity. Thus, a U.S. person who is an officer or senior manager of a foreign person that engages in a data brokerage transaction with a covered person would violate the Proposed Rule but an employee that processes the payment for the transaction would likely not be in violation.
• If a U.S. person engages in a data brokerage transaction with a foreign person that it knows or should have known is a front for a covered person, the U.S. person will be in violation of the Proposed Rule.
• U.S. persons are also required to impose contractual obligations in data brokerage transactions involving foreign persons that are not covered persons prohibiting the on-selling of data to covered persons.

Restricted data

The Proposed Rule applies to two different types of data: bulk sensitive U.S. personal data and government-related data.

Bulk U.S. sensitive personal data

The Proposed Rule defines "sensitive personal data" to include precise geolocation data, biometric identifiers, human genomic data, personal health data, and personal financial data. The term also encompasses covered personal identifiers, meaning a specific list of commonplace identifiers that includes government ID numbers such as Social Security Numbers, demographic data (such as name, birthdate, telephone number, or e-mail and street addresses), and advertising-related digital identifiers that could be used to identify an individual from a dataset or to link or make a listed identifier linkable across multiple datasets to an individual.

Stand-alone lists of personal identifiers are not bulk U.S. sensitive personal data unless the identifier is linkable[1] to another listed identifier or sensitive personal data based on other data disclosed by a transacting party.[2] For example, if a company sells a list of Media Access Control addresses and tells the recipient those addresses connected to the wifi network of a restaurant in a government building the additional information disclosed about the location of the restaurant, even though in a different format and unstructured, would make the addresses linkable to precise geolocation data of individuals frequenting the same restaurant.[3]

Importantly, for purposes of the Proposed Rule's coverage, it does not matter whether the data is anonymized or encrypted. Compliance with CISA's standards for anonymization and encryption can make a transaction that would otherwise be prohibited permissible, but the use of encryption does not itself remove data from the scope of the Proposed Rule.

The Proposed Rule would only apply restrictions to transactions over a specified "bulk" threshold, which is determined based on the total volume of data transacted over the preceding 12 months. The threshold varies widely depending on the type of data involved. The relevant data volumes and types are set forth on Appendix A.

U.S. government-related data

Government-related data comprises two categories of data:

• Precise geolocation data for any location that is within one of the eight areas listed on the Government-Related Location Data List included in the Proposed Rule. Additional areas may be added by the Attorney General.
• Sensitive personal data, regardless of volume, that is marketed as linked or linkable to current U.S. government employees or contractors, recent former employees or contractors, or former senior officials.[4]

Covered data transactions

The Proposed Rule's restrictions are targeted at transactions, not the collection or use of covered types of data by U.S. persons. However, the categories of transactions covered by the Proposed Rule are defined broadly and cover a number of situations beyond simply selling data to a country of concern or covered person.[5] These include:

• Data brokerage: The sale of data, licensing of access to data, or similar commercial transactions involving the transfer of data to a person who did not collect or process the data directly from the individuals covered by the data. In response to comments on the ANPRM, DOJ clarified that "data brokerage" may include not only stand-alone sales of data, but sales or licensing of data (e.g., customer lists) in connection with bona fide commercial transactions.
• Vendor agreement: Any arrangement, other than an employment agreement, for providing goods or services to another person for consideration, including cloud computing services.
• Employment agreement: Any arrangement for an individual, other than as an independent contractor, to perform work or job functions directly for a person in exchange for consideration.
• Investment agreement: Any arrangement to obtain direct or indirect ownership interests in or rights in relation to (1) real estate located in the United States or (2) a U.S. legal entity in exchange for consideration.
  • Passive investments that provide a covered person with less than 10% total voting and equity interests in a U.S. person, that do not afford any special rights other than standard minority shareholder protections, and which fall into the following three categories are not covered transactions:
    • investments made in publicly traded securities;
    • investments made in SEC-registered index funds, mutual funds or ETFs;
    • investments made as a limited partner in a pooled investment fund so long as certain criteria that would indicate the limited partner has influence over the fund's operations are not met.
  • All three conditions (passivity, publicly traded security or investment through a fund, and less than 10% by vote and value) must be met, so that an investment by a U.S. private equity fund in which a covered person held a completely passive 11% interest would be a covered transaction.
  • The Proposed Rule clarifies by way of examples that any investment agreement not meeting the passive investment exclusion in a company that has access to bulk U.S. sensitive personal data or government-related data would be a covered data transaction even if the investment is noncontrolling and the foreign investor lacks any formal rights of access to data. (It is not entirely clear how this statement interacts with the "covered data transaction" definition above, which requires some access to Restricted Data; however, the Proposed Rule seems to imply that the mere possibility of influence is sufficient and does not mention any showing of actual access.)

Prohibitions and restrictions

Prohibited transactions

The Proposed Rule would prohibit any U.S. person from knowingly engaging in or directing certain categories of covered data transactions with a covered foreign person absent a license. In particular, covered data transactions with covered persons or countries of concern involving data brokerage or involving the bulk transfer of human genomic data (including investment transactions, so that significant investments by covered persons in U.S. companies holding any significant quantity of genomic data would be prohibited) or biospecimens from which data can be derived would be prohibited absent a license.

Restricted transactions

All other covered data transactions with covered persons or countries of concern would be permitted so long as they comply with the cybersecurity program, reporting, and recordkeeping requirements outlined below.

Exemptions

The Proposed Rule would create a number of exemptions from the restrictions and prohibitions described above, including for:

• Personal communications that do not involve the transfer of anything of value.
• Information and informational materials that are imported or exported to/from any country.
• Financial services. Data transactions to the extent they are ordinarily incident to and part of the provision of financial services. Financial services include classic banking activities but also extend to the transfer of personal financial data or covered personal identifiers incidental to the purchase and sale of goods and services and the provision of investment management services.
• Corporate group transactions. Intra-entity transactions between a U.S. person and its subsidiary or affiliate that is a covered person that are ordinarily incident to ancillary business operations (such as HR data).
• CFIUS. Investment agreements with respect to which CFIUS has exercised its jurisdiction to enter into or impose mitigation measures relating to data security that specifically supersede those in the Proposed Rule.[6]
• Telecom. Data transactions, other than those involving data brokerage, are exempt to the extent that they are ordinarily incident to and part of the provision of telecommunications services, including international calling, mobile voice, and data roaming.
• Medical product authorizations. De-identified sensitive personal data that is required to be submitted to a country of concern regulatory entity to obtain or maintain authorization or approval to research or market a drug, biological product, device, or combination product and is reasonably necessary to assess the safety and effectiveness of such product is exempt.
• Clinical investigations. Data transactions ordinarily incident to a Food and Drug Administration (FDA) investigations or an FDA application are exempt. Transactions involving de-identified post-marketing safety and surveillance data necessary to support or maintain authorization an FDA authorization are also exempt.

What does compliance entail?

Knowledge standard

The Proposed Rule would only apply to circumstances where a U.S. person has actual knowledge or reasonably should have known the transaction involved access to bulk sensitive personal data or U.S. government data by a covered person. The level of inquiry a person should make into the circumstances of a transaction is not precisely defined, with the Proposed Rule referring repeatedly to conducting "reasonable" due diligence on data, counterparties, and counterparties' compliance with any contractual restrictions to identify restricted transactions.

Cybersecurity compliance program requirements for restricted transactions

The Proposed Rule requires persons engaged in restricted transactions to adopt a written data compliance program, overseen and certified by an officer, director, or other employee responsible for data compliance. The program must comply with substantive requirements issued in parallel by CISA, which in turn incorporate existing federal standards such as those promulgated by the National Institute of Standards and Technology (NIST). The proposed CISA requirements are attached as Appendix B, but at a high level they require a U.S. company engaged in restricted transactions to adopt a written plan incorporating organizational measures, systems measures, and data-level measures:

• Organizational measures include designating an employee responsible for data security; maintaining updated inventories of IT assets and a topology of relevant networks; implementing approval processes before the connection of new hardware, firmware or software; and responding to incidents and vulnerabilities within specified timeframes.
• Systems measures generally relate to maintaining logical and physical access controls to prevent access to covered data by covered persons or countries of concern. These include implementation of multifactor authentication, maintenance of systems logs related to access and security events, and maintenance of procedures for secure provisioning and timely revocation of access credentials.
• Data-level measures include data retention and deletion policies to minimize data at risk; aggregation, pseudonymization, de-identification or anonymization of data; encryption techniques; and privacy enhancing technologies, such as privacy preserving computation (e.g., homomorphic encryption), or differential privacy techniques (e.g., injecting sufficient noise into processing of data to preclude the reconstruction of covered data from the processed data).

In addition to these measures, the program must provide for:

• Required due diligence procedures for restricted transactions risk-based procedures for verifying data flows, including the types and volumes of data involved in the transactions, the identity of the transaction parties (including ownership and citizenship or residence), the end use of the data, and the method of data transfer.
• Annual audits by an independent auditor are required for U.S. persons engaging in restricted transactions, covering compliance with the data security and other requirements applicable to restricted transactions for every year the person engages in restricted transactions.
• Record retention for 10 years is required for full records of each restricted transaction, due diligence conducted, and the results of each audit.

Reporting requirements

The Proposed Rule would also impose various reporting requirements:

• Persons engaged in restricted data transactions must provide reports to the DOJ upon request.
• U.S. persons that have 25% or more of their equity interests owned, directly or indirectly, by a country of concern or covered person that are engaged in a restricted transaction involving cloud-computing services must submit annual reports on such transaction(s).
• U.S. persons that have received and affirmatively rejected (including automatically) an offer from another person to engage in a prohibited transaction involving data brokerage must report the transaction to the DOJ within 14 days.
• U.S. persons engaged in data brokerage transactions with foreign persons that are not covered persons must report any known or suspected breaches of the required contractual prohibition on on-selling data to covered persons or countries of concern within 14 days of becoming aware of such a breach.

Penalties

Noncompliance with the Proposed Rule, material misstatements or omissions in connection with reporting and other requirements of the Proposed Rule, false certifications or submissions, or other violations would be subject to a civil penalty not to exceed the greater of $368,136 per violation or an amount that is twice the amount of the transaction that is the basis of the violation. Willful violations can result in criminal penalties, such as a fine of up to $1 million or imprisonment of up to 20 years.

How will businesses be affected?

The DOJ staff has stated that it intends to move quickly and issue a final rule in early 2025. A final rule consistent with the Proposed Rule will have significant near-term impacts for both U.S. and foreign businesses, including foreign firms who are not covered persons.

Impacts for U.S. businesses

U.S. businesses that deal in data that could be considered sensitive personal data or government-related data will be affected in a number of ways.

• U.S. businesses that employ covered persons, engage with covered person vendors or receive investment from covered persons will need to track the full inventory and volume of data they hold, collect, or use to determine whether their activities are subject to the rule. This may entail monitoring previously untracked characteristics, such as the nationalities of the persons described by the data.
• U.S. businesses may need to conduct additional diligence on vendors and investors to understand whether they are covered persons. If a U.S. person engages in a data brokerage transaction with a foreign person that it knows or should have known is a front for a covered foreign person, the U.S. person will be in violation of the Proposed Rule.
• U.S. businesses potentially engaged in or intending to engage in restricted transactions will need to ensure that their policies and procedures comply with the cybersecurity program requirements outlined above, as well as audit and reporting requirements.
• U.S. companies selling or licensing bulk data to third parties, either as a stand-alone product or as part of a broader commercial offering, will likely need to suspend and wind down transactions with covered persons unless the DOJ issues a relevant general license or data brokers secure a specific license.
• U.S. businesses with parent companies or other affiliates in countries of concern may need to implement internal data transfer controls to ensure only transfers compliant with the corporate group exemption are made.

Impacts for foreign businesses and their U.S. personnel

While the Proposed Rule only imposes obligations on U.S. persons, there are likely to be collateral consequences for foreign firms that transact in bulk U.S. sensitive personal data or government-related data with covered persons or countries of concern. In particular, U.S. data brokers are required to impose contractual obligations in data brokerage transactions involving foreign persons that are not covered persons prohibiting the on-selling of data to covered persons. Thus, foreign but not covered person firms that are customers of U.S. data brokers may be contractually obligated to refrain from certain dealings with clients from countries of concern.

The Proposed Rule also prohibits U.S. persons from knowingly directing a foreign person to engage in a transaction that would be a prohibited transaction if the foreign person were a U.S. person. Persons with the authority to direct an entity are generally limited to officers, senior executives and persons of similar stature (not ordinary employees). Foreign businesses may need to develop compliance procedures to prevent U.S. person officers or directors from violating this prohibition.

Finally, although the Proposed Rule does not directly apply to non-U.S. persons, the underlying authorizing statute upon which the Proposed Rule relies (the International Emergency Economic Powers Act) prohibits all persons from "conspiring to violate" or "causing a violation" of any regulation issued under the statute. It is possible that these provisions could be used to target foreign persons whose actions result in a U.S. person's violating the Proposed Rule, particularly in cases in which the foreign person deliberately deceived its U.S. counterparty or knowingly participated in a violation.

Impacts on investment

The Proposed Rule may lead to a significant decrease in investment by covered persons in U.S. companies in data-rich sectors. This will be particularly the case with respect to early-stage companies that may not have the resources or expertise to implement the required formal cybersecurity programs prior to closing.

The Proposed Rule could also affect investment by covered persons in pooled investment funds investing in the United States. While fund limited partners typically are already passive investors, for reasons including managing CFIUS risk, funds investing in the United States will need to ensure that no covered person has a greater than 10% indirect interest in the investment in order to avoid triggering the Proposed Rule.

More generally, U.S. companies seeking investment will likely conduct additional diligence on all foreign person investors. Likewise, covered person investors (who will indirectly bear the risk of noncompliance through potential imposition of financial penalties on U.S. businesses they acquire) may conduct additional diligence on data assets and security programs of U.S. targets.

Next steps

Comments on the Proposed Rule are due November 29, 2024. Given DOJ's ambition to issue a final rule quickly, U.S. companies should be prepared for the implementation of a final rule very similar to the Proposed Rule (though if the final rule is not issued before President Biden leaves office, it is possible that the Trump administration could delay or revise the rule). Potentially affected persons may find it prudent to take the following steps:

• Potentially affected persons should review the data they collect or use. The definitions of covered data in the Proposed Rule cover a wide variety of information. Even the workaday aggregation of otherwise innocuous data types, like covered personal identifiers, is effectively standard practice for many companies operating in e-commerce, marketing, business analytics and other data-intensive sectors. A company does not necessarily have to collect data itself. The examples in the Proposed Rule indicate that access can occur in other ways, such as when an analytics firm processes data on behalf of a customer.
• Companies or persons that deal in sensitive data should consider their current and future exposure to covered person counterparties, vendors, employees or investors. Most companies that engage in outright sales of data, i.e., data brokerage, will likely be well-positioned to understand their exposure to covered persons. However, other forms of covered data transactions are less noticeable and U.S. persons will need to be prepared to efficiently analyze HR data, investor details and vendor characteristics, among other things, to understand whether their ordinary course transactions could implicate a final rule. The final rule will not be retroactive, relieving U.S. persons of the obligation to examine current relationships, but analysis of current transactions will be a helpful guide to future situations that may implicate any final rule.
• Data brokers (i.e., any company that licenses or sells bulk sensitive data, including in connection with other products or services) and persons that collect, use or store human genomic data should be especially cognizant of any potential exposure to covered persons and be ready to curtail those relationships, seek a license or identify a relevant exemption.
• U.S. persons that deal in sensitive data and have potential exposure to covered persons should determine whether relevant exemptions apply. If not, such persons may wish to consider seeking a license upon the issuance of a final rule.
• U.S. persons that deal in sensitive data and have potential exposure to covered persons should examine the cybersecurity program requirements and determine the steps to bring existing data security measures in line.

Appendix A: Sensitive Personal Data Categories & Bulk Thresholds

Sensitive personal data sub-types and bulk thresholds
Data type	Definition	Bulk threshold[7]
Human genomic data	Data representing the nucleic acid sequences that constitute the entire set or a subset of the genetic instructions found in a human cell, including the result or results of an individual's "genetic test" (as defined in 42 U.S.C. 300gg-91(d)(17)) and any related human genetic sequencing data.	>100 U.S. persons
Biometric identifiers	Measurable physical characteristics or behaviors used to recognize or verify the identity of an individual, including facial images, voice prints and patterns, retina and iris scans, palm prints and fingerprints, gait, and keyboard usage patterns that are enrolled in a biometric system and the templates created by the system.	>1,000 U.S. persons
Precise geolocations data	Data, whether real-time or historical, that identifies the physical location of an individual or a device with a precision of within 1,000 meters.	>1,000 U.S. persons or devices
Personal health data	Health information that relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual. This term includes basic physical measurements and health attributes (such as bodily functions, height and weight, vital signs, symptoms, and allergies); social, psychological, behavioral, and medical diagnostic, intervention, and treatment history; test results; logs of exercise habits; immunization data; data on reproductive and sexual health; and data on the use or purchase of prescribed medications.	>10,000 U.S. persons
Personal financial data	Data about an individual's credit, charge, or debit card, or bank account, including purchases and payment history; data in a bank, credit, or other financial statement, including assets, liabilities, debts, or trades in a securities portfolio; or data in a credit report or in a "consumer report" (as defined in 15 U.S.C. 1681a(d)).	>10,000 U.S. persons
Covered personal identifiers	Any listed identifier[8]: (1) In combination with any other listed identifier; or (2) In combination with other data that is disclosed by a transacting party pursuant to the transaction such that the listed identifier is linked or linkable to other listed identifiers or to other sensitive personal data. The term covered personal identifiers excludes: (1) Demographic or contact data that is linked only to other demographic or contact data; and (2) A network-based identifier, account-authentication data, or call-detail data that is linked only to other network-based identifier, account-authentication data, or call-detail data as necessary for the provision of telecommunications, networking, or similar service.	>100,000 U.S. persons

Appendix B: CISA Proposed Security Requirements for Restricted Transactions

The following proposed security requirements can be found in their original form on the CISA website at https://www.cisa.gov/resources-tools/resources/proposed-security-requirements-restricted-transactions. We have duplicated them below for your convenience. This is appendix is not an official copy of those requirements and may reflect non-substantive differences in format.

Robert A. Cohen

David I. Feinstein

James W. Haldin

Daniel S. Kahn

Paul D. Marquardt

Paul J. Nathanson

Martin Rogers

Will Schisa

Paul S. Scrivano

Paul Shortell