The U.S. Department of Justice (DoJ) has implemented a final rule enforcing Executive Order 14117, aimed at curbing the mass transfer of Americans’ personal data to countries of concern, including China, Cuba, Iran, North Korea, Russia, and Venezuela.
Assistant Attorney General Matthew G. Olsen of the Justice Department's National Security Division emphasized the rule's importance, describing it as a critical measure to mitigate national security risks associated with adversaries exploiting sensitive personal data. This initiative seeks to prevent the sale or commercial access of such data to hostile foreign powers.
The rule is rooted in a February 2024 executive order by President Joe Biden, addressing the potential misuse of Americans’ sensitive personal and government-related data for espionage, influence, and cyber operations. The executive order also highlighted concerns over the use of bulk data by foreign adversaries to refine artificial intelligence and advanced technologies. The DoJ underscored the threat to civil liberties, noting that countries of concern might exploit this data to suppress dissent, limit freedoms, and intimidate activists, journalists, and political opponents.
Set to take effect in 90 days, the rule defines prohibited, restricted, and exempt transactions, establishes bulk thresholds for triggering restrictions, and introduces enforcement mechanisms including civil and criminal penalties. The data categories covered include personal identifiers, precise geolocation data, biometric and human omic data, personal health data, and financial information. Despite its stringent measures, the rule does not impose data localization requirements or broadly prohibit U.S. entities from conducting research or commercial activities involving the countries of concern.
The DoJ clarified that the regulation does not aim to sever economic, scientific, or trade relationships between the United States and other nations. U.S. persons may continue engaging in commercial transactions, such as exchanging financial and consumer data as part of trade and services. By balancing national security concerns with economic and scientific interests, the rule seeks to address emerging threats while maintaining essential international relationships.
