Under the Radar: DOJ's Data Security Rules and Their Impact on Payments Companies

In this episode of Payments Pros, Carlin McCrory is joined by Pete Jeydel, a partner in the firm's White Collar Litigation + Investigations Practice Group, to discuss the new Department of Justice (DOJ) Data Security Program (DSP), which took effect earlier this year. The DSP, administered by the DOJ's National Security Division, aims to enhance protection for sensitive personal data linked to U.S. persons for activity involving countries of concern like China and Russia. Pete explains that this regulatory framework is distinct from traditional data privacy laws, emphasizing national security over individual consent and contractual protections. The program emerged rapidly following an executive order from President Biden in February 2024, reflecting long-standing concerns about foreign data access.

As the episode concludes, Pete emphasizes the critical need for companies to understand the scope and impact of the DOJ's new data security rules. These rules include broad exemptions, including for financial services, but they are complex and require careful interpretation. Noncompliance could result in substantial civil and criminal penalties, making it essential for companies to establish a robust compliance strategy. The DOJ rules necessitate a focus on high-risk areas and a risk-based approach to compliance. Companies are encouraged to proactively assess their data security practices to align with DOJ objectives and effectively mitigate potential risks.