The U.S. Department of Justice has implemented a final rule under Executive Order 14117, aimed at preventing bulk transfers of sensitive personal data to designated countries of concern. These nations include China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela.

The rule, set to take effect in 90 days, addresses critical national security concerns regarding the exploitation of Americans’ personal information. It covers six key data categories:
– Personal identifiers (SSN, driver’s license)
– Precise geolocation data
– Biometric identifiers
– Human ‘omic data
– Personal health information
– Financial data

Assistant Attorney General Matthew G. Olsen emphasized this measure as a crucial step in protecting against national security threats posed by adversaries accessing sensitive personal data. The rule establishes:
– Prohibited and restricted transaction classes
– Bulk data transfer thresholds
– Enforcement mechanisms including civil and criminal penalties

Importantly, the regulation does not:
– Impose data localization requirements
– Prevent U.S. citizens from conducting research in countries of concern
– Prohibit standard commercial transactions
– Restrict legitimate financial data exchange for goods and services

This initiative follows President Biden’s February 2024 executive order addressing risks associated with unauthorized access to sensitive data, including potential misuse for espionage, influence operations, and AI development by foreign powers.