Lee Licata and Devin DeBacker, both attorneys from the DOJ’s National Security Division, dive deep into the looming data security challenges posed by foreign adversaries. They discuss the DOJ’s proposed rule aimed at safeguarding American citizens’ data and how public feedback has influenced its evolution. The duo breaks down the complexities of compliance and enforcement while emphasizing the balance between privacy rights and national security needs. Their insights shed light on the necessary collaboration between corporations and regulatory bodies to enhance our data security landscape.
The DOJ's proposed rule on data security aims to prevent foreign adversaries from exploiting sensitive personal data and enhance national security.
Public feedback significantly shaped the proposed rule, leading to adjustments that emphasize practical applicability and potential economic impacts.
Deep dives
Overview of Data Security Risks
The discussion centers on the national security risks posed by foreign adversaries accessing sensitive personal data of Americans. These risks arise when entities exploit gathered data, particularly through commercial transactions, which may include geolocation, health, or financial information of individuals. Such exploitation enables adversaries to track, surveil, and potentially manipulate U.S. citizens, thereby threatening national security interests. The proposed rule aims to close loopholes in data access, especially considering data being available on the open market.
Prohibitions and Restrictions in Data Transactions
The proposed rule outlines specific prohibited transactions involving U.S. persons and covered persons from countries of concern, primarily restricting data brokerage and transfers of sensitive genomic data. Additionally, it stipulates certain restrictions on vendor, employment, and investment agreements that require enhanced security measures to protect the data involved. These measures may include organizational and system-level security protocols, emphasizing the need for robust safeguards like encryption and access controls. The rule aims to ensure that sensitive data does not fall into the wrong hands by tightly regulating who can access and manipulate such data.
Compliance and Enforcement Mechanisms
A comprehensive compliance and enforcement regime is established to ensure adherence to the new data security regulations. Companies are expected to maintain thorough records, submit annual reports, and disclose any rejected data transfer transactions involving covered persons. The DOJ intends to prioritize compliance, insisting that companies incorporate risk assessment into their business processes and develop internal compliance frameworks tailored to their operations. In the event of violations, the DOJ retains significant enforcement capabilities, including potential criminal prosecutions and civil penalties, emphasizing the serious nature of compliance.
Stakeholder Engagement and Impact Assessment
The rule's conception was significantly influenced by feedback from a diverse array of stakeholders, leading to adjustments aimed at ensuring practical applicability. The DOJ welcomed input from various organizations, which helped refine the proposed thresholds for bulk data and introduced exemptions for certain data transfer scenarios, including telecommunications and clinical trials. Economic impact assessments were conducted to gauge the potential cost of compliance, aiming to avoid unintended consequences on the economy. The feedback process not only aided in clarifying the rule but also indicated a general acknowledgment of the national security risks associated with data access.
To discuss the Department of Justice’s new proposed rule on data security, we interviewed two brilliant guests from the ChinaTalk Hall of Fame — DOJ National Security Division attorneys Lee Licata and Devin DeBacker.
Before DOJ, Lee was an attorney at DHS and then CBP, while Devin was a partner at Kirkland & Ellis and then worked with the Office of White House Counsel. Today we’ll be discussing the DOJ’s new proposed rule on data security.
We get into…
DOJ’s plan to protect your data from foreign adversaries,
How public comments have shaped the proposed rule since the last time we interviewed Lee and Devin,
DOJ’s tools for enforcing corporate compliance,
The differences between data security regulations, privacy laws, and export controls,
Why some public comments get accepted and some get rejected,
The DOJ playbook for assembling a dream team of talented bureaucrats.
Thanks to Nicholas Welch for hosting this interview!
Outtro music: Bad Boys (Theme from Cops) (Youtube link) + Everybody Loves the Sunshine (Takuya Kuroda) (YouTube)