Devin DeBacker and Lee Licata on the Biden Administration’s New Executive Order on Preventing Access to Americans' Bulk Sensitive Personal Data
Mar 13, 2024
auto_awesome
Exploring the implications of Biden's Executive Order on preventing access to Americans' sensitive data, the podcast discusses the regulatory program under the International Emergency Economic Powers Act. It highlights the importance of protecting personal information online and delves into the exclusion and restriction of certain data transactions. The discussion also covers licensing, advisory opinions, and the rulemaking process in regulatory compliance.
The executive order targets data transactions posing national security risks by restricting access to sensitive personal data from countries of concern.
The rulemaking process under the EO aims to balance national security concerns with maintaining vital cross-border data flows through licenses and exemptions.
Prohibited and restricted data transaction categories aim to safeguard personal data by enforcing security measures while providing exemptions for routine commercial activities.
Deep dives
National Security Focus of Executive Order on Data Regulation
The executive order aims to prevent adversaries from accessing sensitive personal data by targeting data transactions that pose national security risks. The program regulates categories like data brokerage transactions and genomic data transfers, prohibiting the transfer of sensitive data to countries of concern or covered persons. This targeted approach is designed to make it difficult for adversaries to acquire and weaponize personal data by closing the lawful access route.
Rulemaking Process for Proposed Regulations
The proposed regulations under the executive order will be developed through a rulemaking process aimed at addressing national security risks while safeguarding cross-border data flows vital to the economy. The rulemaking includes provisions for licenses, advisory opinions, and exemptions to minimize unintended effects on economic activities. Public input is sought through the rulemaking process to refine and finalize the regulations within a specified timeline.
Data Transactions Regulations and Security Requirements
The program introduces prohibited and restricted data transactions categories, including vendor, employment, and investment agreements with security requirements like cybersecurity posture, physical and logical access measures, data masking, and privacy-enhancing technologies. These regulations are part of a targeted regime to prevent adversaries' access to sensitive data while allowing for licensing and advisory opinions processes.
Exempt Data Transactions and Rationale
Certain categories of data transactions are exempted under the program to minimize impacts on routine commercial activities. Exemptions cover financial services activities, multinational business operations, passive investments, and data transactions mandated by federal law or international agreements. These exemptions aim to distinguish this targeted national security regime from broader privacy regulations and data localization efforts.
Addressing Criticisms and National Security Objectives
Critics have raised concerns about the program's efficacy against determined adversaries and potential impacts on global commerce. The program responds to national security risks posed by adversaries accessing personal data and aims to complement broader privacy legislation efforts. It targets front door access to sensitive data, introduces regulations to safeguard data transactions, and seeks public input through the rulemaking process.
On February 28, the Biden administration issued an Executive Order (EO) entitled “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.” Lawfare Senior Editor Stephanie Pell sat down with Devin DeBacker and Lee Licata, the Chief and one of the Deputy Chiefs of the Foreign Investment Review Section in the National Security Division at the Department of Justice, to talk about this new EO and the ways in which it attempts to prevent certain countries of concern from accessing Americans’ sensitive personal data. They talked about the types of data transactions the EO is intended to regulate, what it is not intended to regulate, and the forthcoming rule-making process that the DOJ will run.