Provisions Pertaining to Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, 86116-86227 [2024-24582]
Download as PDF
86116
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
DEPARTMENT OF JUSTICE
28 CFR Part 202
[Docket No. NSD 104]
RIN 1124–AA01
Provisions Pertaining to Preventing
Access to U.S. Sensitive Personal Data
and Government-Related Data by
Countries of Concern or Covered
Persons
National Security Division,
Department of Justice.
ACTION: Proposed rule; request for
comments.
AGENCY:
The Department of Justice
proposes a rule to implement Executive
Order 14117 of February 28, 2024
(Preventing Access to Americans’ Bulk
Sensitive Personal Data and United
States Government-Related Data by
Countries of Concern), by prohibiting
and restricting certain data transactions
with certain countries or persons.
DATES: Written comments on this notice
of proposed rulemaking (NPRM) must
be received by November 29, 2024.
ADDRESSES: You may send comments,
identified by Docket No. NSD 104, by
either of the following methods:
• Federal eRulemaking Portal:
https://www.regulations.gov. Follow the
instructions for sending comments.
• Mail: U.S. Department of Justice,
National Security Division, Foreign
Investment Review Section, 175 N
Street NE, 12th Floor, Washington, DC
20002.
FOR FURTHER INFORMATION CONTACT:
Email (preferred):
NSD.FIRS.datasecurity@usdoj.gov.
Otherwise, please contact: Lee Licata,
Deputy Chief for National Security Data
Risks, Foreign Investment Review
Section, National Security Division,
U.S. Department of Justice, 175 N Street
NE, Washington, DC 20002; Telephone:
202–514–8648.
SUPPLEMENTARY INFORMATION: In
accordance with 5 U.S.C. 553(b)(4), a
plain language summary of the
proposed rule is available at
www.regulations.gov.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
SUMMARY:
Public Participation
Instructions: We encourage comments
to be submitted via https://
www.regulations.gov. Please submit
comments only, include your name and
company name (if any), and cite
‘‘Provisions Pertaining to Preventing
Access to U.S. Sensitive Personal Data
and Government-Related Data by
Countries of Concern or Covered
Persons’’ in all correspondence. Anyone
submitting business confidential
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
information should clearly identify the
business confidential portion at the time
of submission, file a statement justifying
nondisclosure and referring to the
specific legal authority claimed, and
provide a non-confidential version of
the submission. For comments
submitted electronically containing
business confidential information, the
file name of the business confidential
version should begin with the characters
‘‘BC.’’ Any page containing business
confidential information must be clearly
marked ‘‘BUSINESS CONFIDENTIAL’’
at the top of that page. The
corresponding non-confidential version
of those comments must be clearly
marked ‘‘PUBLIC.’’ The file name of the
nonconfidential version should begin
with the character ‘‘P.’’ Any
submissions with file names that do not
begin with a ‘‘BC’’ will be assumed to
be public and will be posted without
change, including any business or
personal information provided, such as
names, addresses, email addresses, or
telephone numbers.
To facilitate an efficient review of
submissions, the Department of Justice
encourages but does not require
commenters to: (1) submit a short
executive summary at the beginning of
all comments; (2) provide supporting
material, including empirical data,
findings, and analysis in reports or
studies by established organizations or
research institutions; (3) describe the
relative benefits and costs of the
approach contemplated in this NPRM
and any alternative approaches; and (4)
refer to the specific proposed subpart or
defined term to which each comment is
addressed. The Department of Justice
welcomes interested parties’
submissions of written comments
discussing relevant experiences,
information, and views. Parties wishing
to supplement their written comments
with a follow-up meeting may request to
do so, and the Department of Justice
may accommodate such requests as
resources permit.
Table of Contents
I. Executive Summary
II. Background
III. Advance Notice of Proposed Rulemaking
and Comments
IV. Discussion of the Proposed Rule
A. Subpart C—Prohibited Transactions and
Related Activities
1. Section 202.210—Covered Data
Transactions
2. Section 202.301—Prohibited DataBrokerage Transactions
3. Section 202.201—Access
4. Section 202.249—Sensitive Personal
Data
5. Section 202.212—Covered Personal
Identifiers
PO 00000
Frm 00002
Fmt 4701
Sfmt 4702
6. Section 202.234—Listed Identifier
7. Section 202.242—Precise Geolocation
Data
8. Section 202.204—Biometric Identifiers
9. Section 202.224—Human Genomic Data
10. Other Human ‘Omic Data
11. Section 202.240—Personal Financial
Data
12. Section 202.241—Personal Health Data
13. Section 202.206—Bulk U.S. Sensitive
Personal Data
14. Section 202.205—Bulk
15. Section 202.222—Government-Related
Data
16. Section 202.302—Other Prohibited
Data-Brokerage Transactions Involving
Potential Onward Transfer to Countries
of Concern or Covered Persons
17. Section 202.303—Prohibited Human
Genomic Data and Human Biospecimen
Transactions
18. Section 202.304—Prohibited Evasions,
Attempts, Causing Violations, and
Conspiracies
19. Section 202.305—Knowingly Directing
Prohibited Transactions
20. Section 202.215—Directing
21. Section 202.230—Knowingly
B. Subpart D—Restricted Transactions
1. Section 202.401—Authorization To
Conduct Restricted Transactions; Section
202.402—Incorporation by Reference
2. Section 202.258—Vendor Agreement
3. Section 202.217—Employment
Agreement
4. Section 202.228—Investment Agreement
C. Subpart E—Exempt Transactions
1. Section 202.501—Personal
Communications; Section 202.502—
Information or Informational Materials;
and Section 402.503—Travel
2. Section 202.504—Official Business of
the United States Government
3. Section 202.505—Financial Services
4. Section 202.506—Corporate Group
Transactions
5. Section 202.507—Transactions Required
or Authorized by Federal Law or
International Agreements, or Necessary
for Compliance With Federal Law
6. Section 202.508—Investment
Agreements Subject to a CFIUS Action
7. Section 202.509—Telecommunications
Services
8. Section 202.510—Drug, Biological
Product, and Medical Device
Authorizations
9. Section 202.511—Other Clinical
Investigations and Post-Marketing
Surveillance Data
10. Other Exemptions
D. Subpart F—Determination of Countries
of Concern
1. Section 202.601—Determination of
Countries of Concern
a. China
b. Cuba
c. Iran
d. North Korea
e. Russia
f. Venezuela
E. Subpart G—Covered Persons
1. Section 202.211—Covered Person
2. Section 202.701—Designation of
Covered Persons
F. Subpart H—Licensing
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
1. Section 202.801—General Licenses
2. Section 202.802—Specific Licenses
3. Conditions on General and Specific
Licenses
G. Subpart I—Advisory Opinions
1. Section 202.901—Inquiries Concerning
Application of This Part
H. Subpart J—Due Diligence and Audit
Requirements
1. Section 202.1001—Due Diligence for
Restricted Transactions
2. Section 202.1002—Audits for Restricted
Transactions
I. Subpart K—Reporting and
Recordkeeping Requirements
1. Section 202.1101—Records and
Recordkeeping Requirements
2. Section 202.1102—Reports To Be
Furnished on Demand
3. Section 202.1103—Annual Reports
4. Section 202.1104—Reports on Rejected
Prohibited Transactions
J. Subpart M—Penalties and Finding of
Violation
1. Section 202.1301—Penalties for
Violations
2. Section 202.1305—Finding of Violation
K. Coordination With Other Regulatory
Regimes
L. Severability
V. Analysis for Proposed Bulk Thresholds
A. Analysis of Sensitivity of Each Category
of Sensitive Personal Data
1. Human Genomic Data
2. Biometric Identifiers
3. Precise Geolocation Data
4. Personal Health Data
5. Personal Financial Data
6. Covered Personal Identifiers
B. Grouping the Categories Into Tiers by
Similar Sensitivity
C. Proposed Bulk Thresholds for Each Tier
VI. Interpretation of ‘‘Information or
Informational Materials’’ in IEEPA
A. The Berman Amendment Is Intended To
Protect the Free Exchange of Ideas
B. The Berman Amendment Does Not
Reach Transactions Involving Sensitive
Personal Data Under This Proposed Rule
C. Exclusion for Materials Already Created
and in Existence
VII. Regulatory Requirements
A. Executive Orders 12866 (Regulatory
Planning and Review) as Amended by
Executive Orders 13563 (Improving
Regulation and Regulatory Review) and
14094 (Modernizing Regulatory Review)
1. Executive Summary
2. Introduction
3. Market Sectors Impacted by the
Proposed Regulation
a. Sensitive Personal Data and
Government-Related Data
i. Personal Financial Data
ii. Personal Health Data
iii. Precise Geolocation Data
iv. Human Genomic and Human ‘Omic
Data
v. Biometric Identifiers
vi. Covered Personal Identifiers
b. The Data-Brokerage Market
i. Companies That May Meet the Definition
of Data Brokers for the Purposes of the
Proposed Rule
ii. Market Size
iii. Products Sold by Data Brokers
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
iv. Price Information
v. Customers of Data-Brokerage Products
c. Agreements Affected by the Proposed
Regulation
i. Vendor Agreements
ii. Employment Agreements
iii. Investment Agreements
iv. Security Requirements
v. Due Diligence and Recordkeeping
vi. Audits
vii. Licenses
4. Need for Regulatory Action
5. Baseline (Without the Proposed Rule)
a. Baseline National Security and ForeignPolicy Risks by Category of Data
i. Human Genomic and Human ‘Omic Data
ii. Biometric Identifiers
iii. Precise Geolocation Data
iv. Personal Health Data
v. Personal Financial Data
vi. Covered Personal Identifiers
vii. Government-Related Data
b. Baseline: Total Potential U.S. Population
Affected by Risks
c. Summary of Baseline (Without the
Proposed Rule)
6. Alternative Approaches
7. Benefits of the Proposed Rule
8. Costs of the Proposed Rule
a. Value of Lost and Forgone Transactions
i. Global Market Value of Genomic,
Biometric, and Location Data
ii. U.S. Exports to Relevant Specific
Categories and to Countries of Concern
iii. Estimates of U.S. Exports of Genomic,
Biometric, and Location Data
iv. Estimates of U.S. Exports of Genomic,
Biometric, and Location Data to the Six
Countries of Concern
v. Total Estimated Value of Lost and
Forgone Transactions
vi. Alternative Methodology for Estimating
the Value of Lost and Forgone
Transactions
b. Security Costs
i. Similar Security Standards and
Frameworks
ii. Current Industry Compliance Level
iii. Costs of Compliance
c. Costs Associated With Compliance
Program: Due Diligence, Recordkeeping,
and Auditing
i. Due Diligence Costs
ii. Recordkeeping Costs
iii. Executive Order on Modernizing
Regulatory Review Recordkeeping and
Related Costs
iv. Auditing Costs
v. Estimated Recordkeeping Costs From the
Reviewed Literature
vi. Summary of a Compliance Program:
Due Diligence, Recordkeeping, and
Auditing
9. Summary of Regulatory Analysis
B. Regulatory Flexibility Act
1. Succinct Statement of the Objectives of,
and Legal Basis for, the Proposed Rule
2. Description of and, Where Feasible, an
Estimate of the Number of Small Entities
to Which The Proposed Rule Will Apply
3. Description of the Projected Reporting,
Recordkeeping, and Other Compliance
Requirements of the Proposed Rule
4. Identification of all Relevant Federal
Rules That May Duplicate, Overlap, or
Conflict With the Proposed Rule
PO 00000
Frm 00003
Fmt 4701
Sfmt 4702
86117
C. Executive Order 13132 (Federalism)
D. Executive Order 13175 (Consultation
and Coordination With Indian Tribal
Governments)
E. Executive Order 12988 (Civil Justice
Reform)
F. Paperwork Reduction Act
G. Unfunded Mandates Reform Act
I. Executive Summary
Executive Order 14117 of February
28, 2024, ‘‘Preventing Access to
Americans’ Bulk Sensitive Personal
Data and United States GovernmentRelated Data by Countries of Concern’’
(‘‘the Order’’), directs the Attorney
General to issue regulations that
prohibit or otherwise restrict United
States persons from engaging in any
acquisition, holding, use, transfer,
transportation, or exportation of, or
dealing in, any property in which a
foreign country or national thereof has
any interest (‘‘transaction’’), where the
transaction: involves United States
Government-related data (‘‘governmentrelated data’’) or bulk U.S. sensitive
personal data, as defined by final rules
implementing the Order; falls within a
class of transactions that has been
determined by the Attorney General to
pose an unacceptable risk to the
national security of the United States
because it may enable access by
countries of concern or covered persons
to government-related data or
Americans’ bulk U.S. sensitive personal
data; and meets other criteria specified
by the Order. On March 5, 2024, the
National Security Division of the
Department of Justice (‘‘DOJ’’ or ‘‘the
Department’’) issued an Advance Notice
of Proposed Rulemaking (‘‘ANPRM’’)
seeking public comment on various
topics related to implementation of the
Order.1
This Notice of Proposed Rulemaking
(‘‘NPRM’’) addresses the public
comments received on the ANPRM, sets
forth a proposed rule to implement the
Order, and seeks public comment. The
proposed rule identifies classes of
prohibited and restricted transactions;
identifies countries of concern and
classes of covered persons with whom
the regulations would prohibit or
restrict transactions involving
government-related data or bulk U.S.
sensitive personal data; establishes a
process to issue (including to modify or
rescind) licenses authorizing otherwise
prohibited or restricted transactions and
to issue advisory opinions; and
addresses recordkeeping and reporting
of transactions to inform investigative,
enforcement, and regulatory efforts of
the Department of Justice.
1 89
E:\FR\FM\29OCP2.SGM
FR 15780 (Mar. 5, 2024).
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86118
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
II. Background
On February 28, 2024, the President
issued Executive Order 14117
(Preventing Access to Americans’ Bulk
Sensitive Personal Data and United
States Government-Related Data by
Countries of Concern) (‘‘the Order’’),
pursuant to his authority under the
Constitution and the laws of the United
States, including the International
Emergency Economic Powers Act (50
U.S.C. 1701 et seq.) (‘‘IEEPA’’); the
National Emergencies Act (50 U.S.C.
1601 et seq.) (‘‘NEA’’); and title 3,
section 301 of the United States Code.
In the Order, the President expanded
the scope of the national emergency
declared in Executive Order 13873 of
May 15, 2019 (Securing the Information
and Communications Technology and
Services Supply Chain), and further
addressed with additional measures in
Executive Order 14034 of June 9, 2021
(Protecting Americans’ Sensitive Data
From Foreign Adversaries). The
President determined that additional
measures are necessary to counter the
unusual and extraordinary threat to U.S.
national security posed by the
continuing efforts of certain countries of
concern to access and exploit
government-related data or Americans’
bulk U.S. sensitive personal data.
The Order directs the Attorney
General, pursuant to the President’s
delegation of his authorities under
IEEPA, to issue regulations that prohibit
or otherwise restrict United States
persons from engaging in certain
transactions in which a foreign country
of concern or national thereof has an
interest. Restricted and prohibited
transactions include transactions that
involve government-related data or bulk
U.S. sensitive personal data, are a
member of a class of transactions that
the Attorney General has determined
poses an unacceptable risk to the
national security of the United States
because the transactions may enable
countries of concern or covered persons
to access government-related data or
bulk U.S. sensitive personal data, and
are not otherwise exempted from the
Order or its implementing regulations.
The Order directs the Attorney General
to issue regulations that identify classes
of prohibited and restricted
transactions; identify countries of
concern and classes of covered persons
whose access to government-related
data or bulk U.S. sensitive personal data
poses the national security risk
described in the Order; establish a
process to issue (including to modify or
rescind) licenses authorizing otherwise
prohibited or restricted transactions;
further define terms used in the Order;
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
address recordkeeping and reporting of
transactions to inform investigative,
enforcement, and regulatory efforts of
the Department of Justice; and to take
whatever additional actions, including
promulgating additional regulations, as
may be necessary to carry out the
purposes of the Order.
The Order and this proposed rule fill
an important gap in the United States
Government’s authorities to address the
threat posed by countries of concern
accessing government-related data or
Americans’ bulk U.S. sensitive personal
data. As the President determined in the
Order, ‘‘[a]ccess to Americans’ bulk
sensitive personal data or United States
Government-related data increases the
ability of countries of concern to engage
in a wide range of malicious activities.’’
As the ANPRM explained, countries of
concern can use their access to
government-related data or Americans’
bulk U.S. sensitive personal data to
engage in malicious cyber-enabled
activities and malign foreign influence
activities and to track and build profiles
on U.S. individuals, including members
of the military and other Federal
employees and contractors, for illicit
purposes such as blackmail and
espionage. And countries of concern can
exploit their access to governmentrelated data or Americans’ bulk U.S.
sensitive personal data to collect
information on activists, academics,
journalists, dissidents, political figures,
or members of nongovernmental
organizations or marginalized
communities to intimidate them; curb
political opposition; limit freedoms of
expression, peaceful assembly, or
association; or enable other forms of
suppression of civil liberties.
As the 2024 National
Counterintelligence Strategy explains,
‘‘as part of a broader focus on data as a
strategic resource, our adversaries are
interested in personally identifiable
information (PII) about U.S. citizens and
others, such as biometric and genomic
data, health care data, geolocation
information, vehicle telemetry
information, mobile device information,
financial transaction data, and data on
individuals’ political affiliations and
leanings, hobbies, and interests.’’ 2
These and other kinds of sensitive
personal data ‘‘can be especially
valuable, providing adversaries not only
economic and [research and
development] benefits, but also useful
[counterintelligence] information, as
hostile intelligence services can use
2 Nat’l Counterintel. & Sec. Ctr., National
Counterintelligence Strategy 2024 13 (Aug. 1, 2024),
https://www.dni.gov/files/NCSC/documents/
features/NCSC_CI_Strategy-pages-20240730.pdf
[https://perma.cc/9L2T-VXSU].
PO 00000
Frm 00004
Fmt 4701
Sfmt 4702
vulnerabilities gleaned from such data
to target and blackmail individuals.’’ 3
Nongovernmental experts have
underscored these risks. For example, a
recent study by the MITRE Corporation
summarized open-source reporting,
highlighting the threat of blackmail,
coercion, identification of high-risk
government personnel and sensitive
locations, and improved targeting of
offensive cyber operations and network
exploitation posed by hostile actors’
access to Americans’ data derived from
advertising technology.4
The development of artificial
intelligence (‘‘AI’’), high-performance
computing, big-data analytics, and other
advanced technological capabilities by
countries of concern amplifies the threat
posed by these countries’ access to
government-related data or Americans’
bulk U.S. sensitive personal data. For
instance, the U.S. National Intelligence
Council assessed in 2020 that ‘‘access to
personal data of other countries’
citizens, along with [artificial
intelligence]-driven analytics, will
enable [the People’s Republic of China]
to automate the identification of
individuals and groups beyond China’s
borders to target with propaganda or
censorship.’’ 5
Countries of concern can also exploit
their access to government-related data
regardless of volume to threaten U.S.
national security. One academic study
explained that ‘‘[f]oreign and malign
actors could use location datasets to
stalk or track high-profile military or
political targets,’’ revealing ‘‘sensitive
locations—such as visits to a place of
worship, a gambling venue, a health
clinic, or a gay bar—which again could
be used for profiling, coercion,
blackmail, or other purposes.’’ 6 The
MITRE report further explained that
location datasets could reveal ‘‘U.S.
military bases and undisclosed
intelligence sites’’ or ‘‘be used to
3 Id.
4 Kirsten Hazelrig, Ser. No. 14, Intelligence After
Next: Surveillance Technologies Are Imbedded Into
the Fabric of Modern Life—The Intelligence
Community Must Respond, The MITRE Corporation
2 (Jan. 5, 2023), https://www.mitre.org/sites/default/
files/2023-01/PR-22-4107-INTELLIGENCE-AFTERNEXT-14-January-2023.pdf [https://perma.cc/
3WA2-PGM2].
5 Nat’l Intel. Council, Assessment: Cyber
Operations Enabling Expansive Digital
Authoritarianism 4 (Apr. 7, 2020), https://
www.dni.gov/files/ODNI/documents/assessments/
NICM-Declassified-Cyber-Operations-EnablingExpansive-Digital-Authoritarianism-202004072022.pdf [https://perma.cc/ZKJ4-TBU6].
6 Justin Sherman et al., Duke Sanford Sch. of Pub.
Pol’y, Data Brokers and the Sale of Data on U.S.
Military Personnel 15 (Nov. 2023), https://
techpolicy.sanford.duke.edu/wp-content/uploads/
sites/4/2023/11/Sherman-et-al-2023-Data-Brokersand-the-Sale-of-Data-on-US-Military-Personnel.pdf
[https://perma.cc/BBJ9-44UH].
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
estimate military population or troop
buildup in specific areas around the
world or even identify areas of off-base
congregation to target.’’ 7 As another
example of these data risks and the
relative ease with which they can be
exploited, journalists were able to
commercially acquire from a data broker
a continuous stream of 3.6 billion
geolocation data points that were
lawfully collected on millions of people
from advertising IDs.8 The journalists
were then able to create ‘‘movement
profiles’’ for tens of thousands of
national security and military officials,
and from there, could determine where
they lived and worked as well as their
names, education levels, family
situations, and hobbies.9
The Order and this proposed rule seek
to mitigate these and other national
security threats that arise from countries
of concern accessing government-related
data or Americans’ bulk U.S. sensitive
personal data.
No current Federal legislation or rule
categorically prohibits or imposes
security requirements to prevent U.S.
persons from providing countries of
concern or covered persons access to
sensitive personal data or governmentrelated data through data brokerage,
vendor, employment, or investment
agreements. For example, the scope and
structure of the Protecting Americans’
Data from Foreign Adversaries Act of
2024 (see Pub. L. 118–50, div. I, 118th
Cong. (2024)) do not create a
comprehensive regulatory scheme that
adequately and categorically addresses
these national security risks, as
explained in part IV.K of this preamble.
Likewise, the Committee on Foreign
Investment in the United States
(‘‘CFIUS’’) has authority to assess the
potential national security risks of
certain investments by foreign persons
in certain United States businesses that
‘‘maintain[] or collect[] sensitive
personal data of United States citizens
that may be exploited in a manner that
threatens national security.’’ 10 CFIUS
only reviews certain types of
investments in U.S. businesses; it does
so on a transaction-by-transaction basis,
instead of prescribing prospective and
categorical rules regulating all such
transactions; and its authorities do not
7 Id.
8 Suzanne Smalley, US Company’s Geolocation
Data Transaction Draws Intense Scrutiny in
Germany, The Record (July 18, 2024), https://
therecord.media/germany-geolocation-us-databroker [https://perma.cc/ME9F-TAQ7] (citing joint
reporting by the German public broadcaster
Bayerische Rundfunk and digital civil rights
opinion news site netzpolitik.org).
9 Id.
10 50 U.S.C. 4565(a)(4)(B)(iii)(III).
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
extend to other activities that countries
of concern may use to gain access to
government-related data or Americans’
bulk U.S. sensitive personal data, such
as through purchases of such data on
the commercial market or through
vendor or employment agreements.11
Similarly, Executive Order 13873
prohibits any acquisition, importation,
transfer, installation, dealing in or use of
by U.S. persons from acquiring certain
information and communication
technologies and services (‘‘ICTS’’)
designed, developed, manufactured, or
supplied by foreign adversaries where,
among other things, the Secretary of
Commerce determines that the
transaction poses an ‘‘unacceptable risk
to the national security of the United
States or the security and safety of
United States persons.’’ 12 In building
upon the national emergency declared
in Executive Order 13873, the President,
in Executive Order 14034, determined
that connected software applications
operating on U.S. ICTS ‘‘can access and
capture vast swaths of . . . personal
information and proprietary business
information,’’ a practice that ‘‘threatens
to provide foreign adversaries with
access to that information.’’ 13 However,
as with CFIUS legal authorities, the
orders do not broadly empower the
United States Government to prohibit or
otherwise restrict the sale of
government-related data or Americans’
bulk U.S. sensitive personal data, and
the orders do not broadly restrict other
commercial transactions, such as
investment, employment, or vendor
agreements, that may provide countries
of concern access to government-related
data or Americans’ bulk U.S. sensitive
personal data.
The proposed rule would complement
these statutory and regulatory
authorities. It prescribes forwardlooking, categorical rules that prevent
U.S. persons from providing countries
of concern or covered persons access to
government-related data or Americans’
bulk U.S. sensitive personal data
through commercial data-brokerage
transactions. The proposed rule also
imposes security requirements on other
kinds of commercial transactions, such
as investment, employment, and vendor
agreements, that involve governmentrelated data or Americans’ bulk U.S.
sensitive personal data to mitigate the
risk that a country of concern could
access such data. The proposed rule
would address risks to government11 See generally Foreign Investment Risk Review
Modernization Act of 2018, Public Law 115–232,
tit. XVII, secs. 1701–28, 132 Stat. 1636, 2173.
12 E.O. 13873 of May 15, 2019, 84 FR 22689,
22690 (May 15, 2019).
13 E.O. 14034, 86 FR 31423, 31423 (June 9, 2021).
PO 00000
Frm 00005
Fmt 4701
Sfmt 4702
86119
related data or Americans’ bulk U.S.
sensitive personal data that current
authorities leave vulnerable to access
and exploitation by countries of concern
and provide predictability and
regulatory certainty by prescribing
categorical rules regulating certain kinds
of data transactions that could give
countries of concern or covered persons
access to government-related data or
Americans’ bulk U.S. sensitive personal
data.
III. Advance Notice of Proposed
Rulemaking and Comments
The National Security Division of the
Department published an ANPRM on
March 5, 2024 (former RIN: 1105–
AB72), soliciting public comment on
various topics related to the Order.14
The Department received and carefully
reviewed 64 timely comments in
response to the ANPRM from trade
associations, public interest advocacy
groups, think tanks, private individuals,
and companies, as well as comments
from several foreign governments. The
Department also received two additional
ex parte comments after the comment
period closed, which DOJ publicly
posted on regulations.gov.
During the comment period, the
Department of Justice, both on its own
and with other agencies, met with
businesses, trade groups, and other
stakeholders potentially interested in or
impacted by the contemplated
regulations to discuss the ANPRM. For
example, the Department discussed the
ANPRM with the Consumer Technology
Association, the Information Industry
Technology Council, Pharmaceutical
Research and Manufacturers of America,
the Biotechnology Innovation
Organization, the Bioeconomy
Information Sharing Analysis Center,
the U.S. Chamber of Commerce, Tesla,
Workday, Anthropic, and the Special
Competitive Studies Project, and it
provided briefings to the Secretary of
Commerce and Industry Trade Advisory
Committees 6, 10, and 12 administered
by the Office of the U.S. Trade
Representative and the Department of
Commerce. The Department also
discussed the Order and contemplated
regulations with stakeholders at events
open to the public, including ones
hosted by the American Conference
Institute, the American Bar Association,
the Center for Strategic and
International Studies, and the R Street
Institute, and through other public
engagements such as the Lawfare
Podcast, ChinaTalk Podcast, CyberLaw
Podcast, and the Center for
14 89
E:\FR\FM\29OCP2.SGM
FR 15780 (Mar. 5, 2024).
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86120
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
Cybersecurity Policy & Law’s Distilling
Cyber Policy podcast.
After the comment period closed, the
Department of Justice, along with the
Department of Commerce, followed up
with commenters who provided
feedback regarding the bulk thresholds
to discuss that topic in more detail,
including the Council on Government
Relations Industry Association,
Association of American Medical
Colleges, Airlines for America, Bank
Policy Institute, the Business
Roundtable, Information Technology
Industry Council, Centre for Information
Policy Leadership, Biotechnology
Innovation Organization, Software and
Information Industry Association,
Cellular Telephone Industries
Association, the internet and Television
Association, US Telecom, Ford Motor
Company, Bioeconomy Information
Sharing and Analysis Center, Coalition
of Services Industries, Enterprise Cloud
Coalition, Electronic Privacy
Information Center, Center for
Democracy and Technology, Business
Software Alliance, Global Data Alliance,
Interactive Advertising Bureau, U.S.China Business Council, IBM, Workday,
and individuals Justin Sherman, Mark
Febrizio, and Charlie Lorthioir. The
Department has also discussed the
Order and the ANPRM with foreign
partners to ensure that they understood
the Order and contemplated program
and how they fit into broader national
security, economic, and trade policies.
The Department considered each
comment submitted, including the ex
parte comments that have since been
publicly posted. Many of the comments
were general in nature and supported
the Department’s efforts and approach
with respect to the proposed rule.
Overall, commenters were generally
supportive of the intent of the proposed
rule. However, several commentators
representing industry questioned the
effectiveness of the proposed rule as
compared to the passage of a holistic
federal privacy law, proposed revisions,
and highlighted areas where the
proposed rule would benefit from
further clarity. The Department
discusses comments, and any edits or
revisions made in response to the
comments, in the discussion of the
proposed rule in part IV of this
preamble.
IV. Discussion of the Proposed Rule
The proposed rule implements the
Order through categorical rules that
regulate certain data transactions
involving government-related data or
bulk U.S. sensitive personal data that
could give countries of concern or
covered persons access or the ability to
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
access such data and present an
unacceptable risk to U.S. national
security. The proposed rule (1)
identifies certain classes of highly
sensitive transactions with countries of
concern or covered persons that the
proposed rule would prohibit in their
entirety (‘‘prohibited transactions’’) and
(2) identifies other classes of
transactions that would be prohibited
except to the extent they comply with
predefined security requirements
(‘‘restricted transactions’’) to mitigate
the risk of access to bulk U.S. sensitive
personal data by countries of concern.
The Attorney General has determined
that the prohibited and restricted
transactions set forth in the proposed
rule pose an unacceptable risk to the
national security of the United States
because they may enable countries of
concern or covered persons to access
and exploit government-related data or
bulk U.S. sensitive personal data.
In addition to identifying classes of
prohibited and restricted transactions
that pose an unacceptable risk to
national security, the proposed rule
identifies certain classes of transactions
that are exempt from the proposed rule.
For example, the proposed rule exempts
transactions for the conduct of the
official business of the United States
Government by employees, grantees, or
contractors thereof, and transactions
conducted pursuant to a grant, contract,
or other agreement entered into with the
United States Government, including
those for outbreak and pandemic
prevention, preparedness, and response.
The proposed rule also defines relevant
terms; identifies countries of concern;
defines covered persons; and creates
processes for the Department to issue
general and specific licenses, to issue
advisory opinions, and to designate
entities or individuals as covered
persons. The proposed rule also
establishes a compliance and
enforcement regime.
The Department relied upon
unclassified and classified sources to
support the proposed rule. Although the
unclassified record fully and
independently supports the proposed
rule without the need to rely on the
classified record, the classified record
provides supplemental information that
lends additional support to the
proposed rule. The proposed rule would
be the same even without the classified
record.
Some commenters offered overarching
comments. A few commenters made
suggestions that addressed issues
unrelated to the proposed rule, such as
expressing views on U.S. positions in
certain international negotiations over
digital trade. No change was made in
PO 00000
Frm 00006
Fmt 4701
Sfmt 4702
response to these comments. These
comments addressed unrelated issues
that are not relevant to the scope of the
proposed rule and that are directed to
other agencies and forums, and they
generally did not suggest any specific
changes to the contemplated program.
To the extent that these comments
intended to suggest that the Order’s and
proposed rule’s restrictions on access to
sensitive personal data are inconsistent
with international commitments by the
United States, the Department disagrees.
The proposed rule’s prohibitions and
restrictions on access to U.S. sensitive
personal data and government-related
data by countries of concern are
consistent with access restrictions on
sensitive personal data that have long
been imposed in other national security
contexts, including for some
transactions reviewed by CFIUS and the
Committee for the Assessment of
Foreign Participation in the United
States Telecommunications Services
Sector (‘‘Team Telecom’’).15 Those
access restrictions, in turn, are
consistent with or otherwise permissible
under trade and other international
agreements.16 For example, the World
Trade Organization’s (‘‘WTO’’) General
Agreement on Trade in Services
(‘‘GATS’’), like other trade agreements
to which the United States is a party,
includes an essential security interests
exception that states that nothing in the
agreement shall be construed to prevent
a party to such an agreement from
taking any action that it considers
necessary for the protection of its
essential security interests. As a result,
rather than prohibiting such access
restrictions, GATS and other relevant
international agreements to which the
United States is a party explicitly
authorize national security-based
restrictions on data access and data
flows through the longstanding essential
security exception. The proposed rule,
like conditions restricting access in
CFIUS or Team Telecom mitigation
15 See Foreign Investment Risk Review
Modernization Act of 2018, supra note 11 (CFIUS);
E.O. 13913, 85 FR 19643 (Apr. 4, 2020) (Team
Telecom); see, e.g., FCC, New Pacific Light Cable
Network GU Holdings-Google National Security
Agreement 20–044 Enclosure 1 (Dec. 16, 2021),
https://licensing.fcc.gov/cgi-bin/ws.exe/prod/ib/
forms/reports/related_filing.hts?f_key=-448225&f_
number=SCLLIC2020082700038 [https://perma.cc/
PD5E-BYWS].
16 See, e.g., Agreement on Trade-Related Aspects
of Intellectual Property Rights art. 73, Apr. 15, 1994,
amended Jan. 23, 2017, Marrakesh Agreement
Establishing the World Trade Organization, Annex
1C, 1869 U.N.T.S. 299, https://www.wto.org/
english/docs_e/legal_e/31bis_trips_09_e.htm
[https://perma.cc/FSP4-BBZQ]; General Agreement
on Tariffs and Trade art. XXI, Oct. 30, 1947, 61 Stat.
A—11, 55 U.N.T.S. 194, https://www.wto.org/
english/docs_e/legal_e/31bis_trips_e.pdf [https://
perma.cc/LE7M-ZM4F].
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
agreements to address identified
national security risks, is necessary to
protect the essential security interests of
the United States and is thus consistent
with such international agreements to
which the United States is a party.17
Notably, consistent with the United
States Government’s long-standing
support of cross-border data flows, the
proposed rule does not require data
localization or wholly restrict data flows
to any specific country. Rather, the
proposed rule only limits data transfers
in narrow, specifically defined
circumstances necessary to safeguard
security interests, and it is being
developed through a process that
enables stakeholder consultation and
input. The proposed rule is also
consistent with the United States’
longstanding support for Data Free
Flows Trust (‘‘DFFT’’). The categories of
prohibited and restricted transactions in
the proposed rule identify
circumstances that present an
unacceptable national security risk of
enabling countries of concern to access
and exploit Americans’ sensitive
personal data—circumstances that lack
the trust required for free data flows.
Several commenters suggested various
revisions to borrow or incorporate
aspects of international or State privacy
laws into this proposed rule. The
Department generally declines to adopt
these suggestions, except on a discrete
issue discussed in part IV.A.7 of this
preamble. The Department supports
privacy measures and national security
measures as complementary protections
for Americans’ sensitive personal data.
Despite some overlap, privacy
protections and national security
measures generally focus on different
challenges associated with sensitive
personal data. General privacy
protections focus on addressing
individual rights and preventing
individual harm, such as protecting the
rights of individuals to control the use
of their own data and reducing the
potential harm to individuals by
minimizing the collection of data on the
front end and limiting the permissible
uses of that data on the back end.
National security measures, by contrast,
focus on collective risks and
externalities that may result from how
17 See
Press Release, Off. of the U.S. Trade
Representative, Statements by the United States at
the Meeting of the WTO Dispute Settlement Body
(Jan. 27, 2023), https://ustr.gov/about-us/policyoffices/press-office/press-releases/2023/january/
statements-united-states-meeting-wto-disputesettlement-body [https://perma.cc/CQG5-9AZ5]
(emphasizing the United States’ commitment to
protect its essential security interests in the context
of World Trade Organization disputes); General
Agreement on Tariffs and Trade art. XXI, supra note
16.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
individuals and businesses choose to
sell and use their data, including in
lawful and legitimate ways.
For example, some commenters
suggested adding a new exemption for
transactions in which a U.S. individual
consents to the sale or disclosure of
their data to a country of concern or
covered person. The proposed rule
declines to adopt this exemption. Such
a consent-based exemption would leave
unaddressed the threat to national
security by allowing U.S. individuals
and companies to choose to share
government-related data or Americans’
bulk U.S. sensitive personal data with
countries of concern or covered persons.
It is precisely those choices that, in
aggregate, help create the national
security risk of access by countries of
concern or covered persons, and the
purpose of the Order and the proposed
rule is to address the negative
externality that is created by
individuals’ and companies’ choices in
the market in the first place. It would
also be inconsistent with other national
security regulations to leave it up to
market choices to decide whether to
give American technology, capital, or
data to a country of concern or covered
person. Export controls do not allow
U.S. companies to determine whether
their sensitive technology can be sent to
a foreign adversary, and sanctions do
not allow U.S. persons to determine
whether their capital and material
support can be given to terrorists and
other malicious actors. Likewise, the
proposed rule would not allow U.S.
individuals to determine whether to
give countries of concern or covered
persons access to their sensitive
personal data or government-related
data. One of the reasons that the public
is not in a position to assess and make
decisions about the national security
interests of the United States is that the
public typically does not have all of the
information available to make a fully
informed decision about the national
security interests of the United States.
Each subpart of the proposed rule,
including any relevant comments
received on the corresponding part of
the ANPRM, is discussed below in the
remaining sections of this preamble.
A. Subpart C—Prohibited Transactions
and Related Activities
The proposed rule identifies
transactions that are categorically
prohibited unless the proposed rule
otherwise authorizes them pursuant to
an exemption or a general or specific
license or, for the categories of restricted
transactions, in compliance with
security requirements and other
PO 00000
Frm 00007
Fmt 4701
Sfmt 4702
86121
requirements set forth in the proposed
rule.
1. Section 202.210—Covered Data
Transactions
The Order authorizes the Attorney
General to issue regulations that
prohibit or otherwise restrict U.S.
persons from engaging in a transaction
where, among other things, the Attorney
General has determined that a
transaction ‘‘is a member of a class of
transactions . . . [that] pose an
unacceptable risk to the national
security of the United States because the
transactions may enable countries of
concern or covered persons to access
bulk sensitive personal data or United
States Government-related data in a
manner that contributes to the national
emergency declared in this [O]rder.’’ 18
Pursuant to the Order, the proposed rule
categorically prohibits or, for the
categories of restricted transactions,
imposes security and other
requirements on certain covered data
transactions with U.S. persons and
countries of concern or covered persons
because the covered data transactions
may otherwise enable countries of
concern or covered persons to access
government-related data or bulk U.S.
sensitive personal data to harm U.S.
national security.
The proposed rule defines a ‘‘covered
data transaction’’ as any transaction that
involves any access to any governmentrelated data or bulk U.S. sensitive
personal data and that involves: (1) data
brokerage, (2) a vendor agreement, (3) an
employment agreement, or (4) an
investment agreement. See § 202.210.
The Department has determined that
these categories of covered data
transactions pose an unacceptable risk
to U.S. national security because they
may enable countries of concern or
covered persons to access governmentrelated data or bulk U.S. sensitive
personal data to engage in malicious
cyber-enabled activities, track and build
profiles on United States individuals for
illicit purposes, including blackmail or
espionage, and to intimidate, curb
political dissent or political opposition,
or otherwise limit civil liberties of U.S.
persons opposed to countries of
concern, among other harms to U.S.
national security. For instance, one
study has demonstrated that foreign
malign actors can purchase bulk
quantities of sensitive personal data
about U.S. military personnel from data
brokers ‘‘for coercion, reputational
damage, and blackmail.’’ 19 Countries of
18 89
FR 15423.
Sherman et al., supra note 6, at 14.
19 Justin
E:\FR\FM\29OCP2.SGM
29OCP2
86122
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
concern or covered persons could also
exploit vendor, employment, or
investment agreements to obtain access
to government-related data or bulk U.S.
sensitive personal data to harm U.S.
national security.20
In response to the ANPRM,
commenters asked that the Department
clarify when a transaction ‘‘involves’’
government-related data or bulk U.S.
sensitive personal data. The Department
has responded to those comments by
revising the definition of a ‘‘covered
data transaction’’ to any transaction that
involves any access to the data by the
counterparty to a transaction (rather
than any transaction that involves
government-related data or bulk U.S.
sensitive personal data).
2. Section 202.301—Prohibited DataBrokerage Transactions
The proposed rule prohibits any U.S.
person from knowingly engaging in a
covered data transaction involving data
brokerage with a country of concern or
a covered person. The proposed rule
defines ‘‘data brokerage’’ as the sale of
data, licensing of access to data, or
similar commercial transactions
involving the transfer of data from any
person (‘‘the provider’’) to any other
person (‘‘the recipient’’), where the
recipient did not collect or process the
data directly from the individuals
linked or linkable to the collected or
processed data. See § 202.214.
Because the data brokerage
prohibition, along with the other
prohibitions and restrictions, center
around data transactions involving
access to government-related data or
bulk U.S. sensitive personal data, the
Department addresses each of those key
terms and related terms in detail in the
following discussion.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
3. Section 202.201—Access
Adopting the approach contemplated
in the ANPRM without change, the
proposed rule defines ‘‘access’’ as
logical or physical access, including the
ability to obtain, read, copy, decrypt,
edit, divert, release, affect, alter the state
of, or otherwise view or receive, in any
form, including through information
systems, information technology
20 See, e.g., Dep’t of Commerce, Final
Determination: Case No. ICTS–20121–002,
Kaspersky Lab, Inc., 89 FR 52434, 52436 (June 24,
2024), https://www.govinfo.gov/content/pkg/FR2024-06-24/pdf/2024-13532.pdf [https://perma.cc/
LAS7-S7HF] (describing how Kaspersky employees
gained access to sensitive U.S. person data through
their provision of anti-virus and cybersecurity
software); see generally OFAC, U.S. Dep’t of Treas.,
Guidance on the Democratic People’s Republic of
Korea Information Technology Workers (May 16,
2022), https://ofac.treasury.gov/media/923131/
download?inline [https://perma.cc/8DTV-Q34S];
E.O. 14083, 87 FR 57369, 57373 (Sept. 15, 2022).
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
systems, cloud-computing platforms,
networks, security systems, equipment,
or software.
One commenter suggested that the
Department remove the term ‘‘divert’’
from the definition of ‘‘access’’ to avoid
unintentionally capturing activities that
do not involve actual access to data and
that, according to the commenter, do not
pose a risk to national security. The
Department declines to do so. The
definition of ‘‘access’’ is intentionally
broad. It includes the term ‘‘divert’’ to
ensure that the proposed rule covers
data transactions that would enable a
covered person to divert governmentrelated data or bulk U.S. sensitive
personal data from an intended
recipient to a country of concern or a
covered person, either for their own use
or for the use of countries of concern or
other covered persons, and to prevent
countries of concern or covered persons
from amassing data (including
anonymized, encrypted, aggregated, or
pseudonymized data), as discussed in
part IV.A.13 of this preamble.
4. Section 202.249—Sensitive Personal
Data
As previewed in the ANPRM, the
proposed rule builds on the Order by
further defining the six categories of
‘‘sensitive personal data’’ that could be
exploited by a country of concern to
harm U.S. national security if that data
is linked or linkable to any identifiable
U.S. individual or to a discrete and
identifiable group of U.S. persons.
These six categories are: (1) covered
personal identifiers; (2) precise
geolocation data; (3) biometric
identifiers; (4) human genomic data; (5)
personal health data; and (6) personal
financial data. The proposed rule also
categorically excludes certain categories
of data from the definition of the term
‘‘sensitive personal data.’’ These
exclusions include public or nonpublic
data that does not relate to an
individual, including trade secrets and
proprietary information, and data that
is, at the time of the transaction,
lawfully publicly available from
government records or widely
distributed media, personal
communications as defined in
§ 202.239, and information or
informational materials as defined in
§ 202.226. Nothing in the proposed rule
shall be construed to affect the
obligations of U.S. Government
departments and agencies under the
Foundations for Evidence-Based
Policymaking Act of 2018, Public Law
115–435 (2019), 44 U.S.C. 3501 et seq.
PO 00000
Frm 00008
Fmt 4701
Sfmt 4702
5. Section 202.212—Covered Personal
Identifiers
The Order defines ‘‘covered personal
identifiers’’ as ‘‘specifically listed
classes of personally identifiable data
that are reasonably linked to an
individual, and that—whether in
combination with each other, with other
sensitive personal data, or with other
data that is disclosed by a transacting
party pursuant to the transaction and
that makes the personally identifiable
data exploitable by a country of
concern—could be used to identify an
individual from a data set or link data
across multiple data sets to an
individual,’’ subject to certain
exclusions.21 The ANPRM thus
contemplated three subcategories of
covered personal identifiers: (1) listed
identifiers in combination with any
other listed identifier; (2) listed
identifiers in combination with other
sensitive personal data; and (3) listed
identifiers in combination with other
data that are disclosed by a transacting
party pursuant to the transaction that
makes the listed identifier exploitable
by a country of concern, if they could
be used to identify an individual from
a dataset or to link data across multiple
datasets to an individual.22 The ANPRM
also contemplated two exceptions: (1)
demographic or contact data that is
linked only to other demographic or
contact data; and (2) a network-based
identifier, account-authentication data,
or call-detail data that is linked only to
other network-based identifiers,
account-authentication data, or calldetail data as necessary for the
provision of telecommunications,
networking, or similar services. The
proposed rule expands the approach
described in the ANPRM by making the
exceptions applicable to all
subcategories of covered personal
identifiers, instead of being applicable
only to listed identifiers in combination
with any other listed identifiers. The
listed identifiers are described in more
detail in the next section.
With respect to the first subcategory,
listed identifiers in combination with
any other listed identifier: The ANPRM
contemplated a list-based approach that
would identify a comprehensive list of
eight classes of data determined by the
Attorney General to be reasonably
linked to an individual under the
Order’s definition of ‘‘covered personal
identifiers.’’ 23
With respect to the second
subcategory, listed identifiers in
combination with other sensitive
21 E.O.
22 89
14117, 89 FR 15421,15428 (Feb 28, 2024).
FR 15784–85.
23 Id.
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
personal data: The ANPRM
contemplated treating these
combinations as combined data subject
to the lowest bulk threshold applicable
to the categories of data present.24 The
proposed rule generally adopts the
approach described in the ANPRM, but
instead of addressing this category in
the definition of ‘‘listed identifiers,’’ the
proposed rule incorporates this category
as part of the definition of ‘‘bulk.’’
With respect to the third subcategory,
listed identifiers in combination with
other data that are disclosed by a
transacting party pursuant to the
transaction that makes the listed
identifier exploitable by a country of
concern: The ANPRM indicated that the
Department did not intend to impose an
obligation on transacting parties to
independently determine whether
particular combinations of data would
be ‘‘exploitable by a country of
concern.’’ 25 The ANPRM provided
several examples intended to be within
the scope of this subcategory and
several examples intended to be outside
the scope of this subcategory and sought
comment on ways in which this
subcategory could be further defined.26
In response, multiple commenters
suggested anchoring this subcategory to
the reasonable foreseeability that the
other data could be used to link the
listed identifier to a U.S. individual. As
these commenters explained, without
the connection to foreseeability, nearly
any public data could become covered
personal identifiers, because it is
possible that the transacting party
receiving the data could find some way
of linking any public data point to an
individual using the listed identifier.
The proposed rule largely adopts this
suggestion. Rather than requiring
companies to determine when linkage is
reasonably foreseeable on a case-by-case
basis, the proposed rule would define a
category of data for which the
Department believes it is reasonably
foreseeable that the other data could be
used to link the listed identifier to a
U.S. individual: other data that makes
the listed identifier linked or linkable to
other listed identifiers or to other
sensitive personal data. The proposed
rule thus narrows the third subcategory
to any listed identifier in combination
with other data that is disclosed by a
transacting party such that the listed
identifier is linked or linkable to other
listed identifiers or to other sensitive
personal data. See § 202.212(a)(2). The
proposed rule also incorporates the
examples described in the ANPRM and
24 Id.
at 15785.
25 Id.
26 Id.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
additional examples to illustrate how
this subcategory would and would not
apply.
6. Section 202.234—Listed Identifier
Adopting the approach contemplated
in the ANPRM,27 the proposed rule
defines a ‘‘listed identifier’’ as any piece
of data in any of the following data
fields: (1) full or truncated government
identification or account number (such
as a Social Security Number, driver’s
license or State identification number,
passport number, or Alien Registration
Number); (2) full financial account
numbers or personal identification
numbers associated with a financial
institution or financial-services
company; (3) device-based or hardwarebased identifier (such as International
Mobile Equipment Identity (‘‘IMEI’’),
Media Access Control (‘‘MAC’’) address,
or Subscriber Identity Module (‘‘SIM’’)
card number); (4) demographic or
contact data (such as first and last name,
birth date, birthplace, ZIP code,
residential street or postal address,
phone number, email address, or similar
public account identifiers); (5)
advertising identifier (such as Google
Advertising ID, Apple ID for
Advertisers, or other mobile advertising
ID (‘‘MAID’’)); (6) accountauthentication data (such as account
username, account password, or an
answer to a security question); (7)
network-based identifier (such as
internet Protocol (‘‘IP’’) address or
cookie data); or (8) call-detail data (such
as Customer Proprietary Network
Information (‘‘CPNI’’)). See § 202.234.
Under this definition, the term
‘‘covered personal identifiers’’ refers to
a much narrower set of material than
that covered by certain laws and
policies aimed generally at protecting
personal privacy.28 It encompasses only
the types of data and combinations
thereof that are expressly listed. For
example, the proposed rule’s definition
of ‘‘covered personal identifiers’’ would
not include an individual’s employment
history, educational history,
organizational memberships, criminal
history, or web-browsing history. Some
commenters suggested that the
Department adopt a broader definition
that aligns with the definition of
27 Id.
at 15784.
e.g., California Consumer Privacy Act of
2018, Cal. Civ. Code sec. 1798.140(v)(1) (West 2024)
(defining ‘‘personal information’’ in the context of
a generalized privacy-focused regime); Regulation
(EU) 2016/679 of the European Parliament and of
the Council of Apr. 27, 2016, On the Protection of
Natural Persons with Regard to the Processing of
Personal Data and on the Free Movement of Such
Data, and Repealing Directive 95/46/EC, art. 4(1)
(defining ‘‘personal data’’ in the context of a
generalized data privacy regime).
28 C.f.,
PO 00000
Frm 00009
Fmt 4701
Sfmt 4702
86123
‘‘personally identifiable information’’
used in State or European Union (’’EU’’)
privacy laws to ease the burden of
compliance. The Department declines to
adopt this approach, and the proposed
rule retains the definition stated in the
ANPRM without change. Although it
may be true that ‘‘personally identifiable
information’’ is a familiar term in laws
and guidance addressing the privacy
and security of data held by the private
sector and government, it is such a
broad term that adopting a definition
akin to it would significantly expand
the scope of the regulations and
therefore require that the Department
regulate more commercial transactions
or relationships than seem necessary, at
least at this time, to mitigate the highest
priority national security risks
articulated in the Order. Furthermore,
the commenters supplied no data to
suggest that any cost savings realized
from adopting an existing definition
would outweigh the added burdens of
regulating a larger swath of transactions.
Similarly, another commenter
suggested broadening the definition of
‘‘covered personal identifiers’’ to add
categories of data from State and EU
privacy laws, such as web-browsing
data and data that identifies or could
lead to inferences about membership in
protected classes such as race, religion,
and national origin. The proposed rule
makes no change in response to this
comment. As previewed in the ANPRM,
the proposed rule’s definition of
‘‘covered personal identifiers’’ is
tailored to address the national security
risks identified in the Order, and the
Department is establishing the program
by issuing proposed rulemakings in
tranches based on priority. Also, the
Department intends to regularly monitor
the effectiveness and impact of the
regulations once they become effective.
Absent more specific information from
commenters on this topic about the
cross-border use of these additional
kinds of identifiers by foreign
governments in ways that could harm
Americans, the proposed rule retains
the definition stated in the ANPRM
without change at this time.
One commenter suggested that the
Department remove basic contact
information from the listed identifiers.
The proposed rule maintains the
approach in the ANPRM without
change.29 The Order already contains an
exception to the definition of ‘‘covered
personal identifiers’’ for demographic or
contact data that is linked only to other
demographic or contact data. The
proposed rule implements the exception
articulated in the Order and previewed
29 89
E:\FR\FM\29OCP2.SGM
FR 15784.
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86124
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
in the ANPRM, which excludes such
data from the definition of ‘‘covered
personal identifiers.’’ 30
By contrast, another commenter
recommended that ‘‘covered personal
identifiers’’ be expanded to include
demographic or contact data that is
linked only to other demographic or
contact data, because most Americans
believe that information to be deserving
of privacy protections. The Department
declines to adopt this addition to the
definition of ‘‘covered personal
identifiers.’’ Such an expansion of the
definition would be contrary to the
Order, which specifically exempts this
kind of data from its scope.31
Additionally, as the commenter
acknowledges, a significant amount of
this information is already publicly
available to countries of concern, and
therefore country of concern access to
this type of information does not carry
the same national security risk as access
to the other covered personal identifiers
identified in these regulations, even if it
may raise separate privacy
considerations.
A few commenters advocated
removing truncated government
identification and account numbers
from the definition of ‘‘listed
identifiers,’’ given their widescale use.
One commenter supported the inclusion
of these truncated identifiers because
they are regularly used to identify
individuals. The proposed rule
continues to include these truncated
identifiers as contemplated in the
ANPRM because, as one commenter
points out, they could be, and are, ‘‘used
to identify an individual from a data set
or link data across multiple data sets to
an individual[.]’’ They therefore fall
within the Order’s definition of
‘‘covered personal identifiers’’ when
they are combined with certain other
categories of data. Although these
truncated numbers may be used widely,
the proposed rule would not regulate
how they are used in most transactions.
Specifically, it would not regulate how
these truncated numbers are used
domestically, a company’s internal use
of that data (other than with respect to
covered persons who are employees), or
transactions abroad involving third
countries (other than with respect to
certain conditions for the data brokerage
to address onward sale).
The proposed rule also contains a
non-substantive change in language
designed to be more technically
accurate and to clarify that any piece of
data in any of the listed classes of data
constitutes a listed identifier. See
30 Id.
31 89
FR 15428.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
§ 202.234. This change remains
consistent with the examples previewed
in the ANPRM and in the proposed rule
showing that multiple pieces of data
(such as account username and account
password) in the same data field
(account-authentication data) each
count as separate listed identifiers.32
7. Section 202.242—Precise Geolocation
Data
The proposed rule defines ‘‘precise
geolocation data’’ as data, whether realtime or historical, that identifies the
physical location of an individual or a
device with a precision of within 1,000
meters. Examples of ‘‘precise
geolocation data’’ include GPS
coordinates and IP address geolocation.
To help develop this definition, the
Department examined the settings
available to software developers in
Android and iOS, the two most popular
mobile device operating systems, for the
precision of geolocation readings.
Available options included accuracy to
within 10 meters, 100 meters, 1,000
meters, 3,000 meters, and 10,000+
meters.33 The Department selected
1,000 meters as the option that most
carefully balanced the risk that
countries of concern or covered persons
could exploit U.S. persons’ precise
geolocation data and current technology
practices and standards. The
Department also considered State
privacy laws, with which companies are
already familiar and which provide
examples of the level of precision at
which a device’s location warrants
protection.34
A few commenters suggested that the
Department define ‘‘precise geolocation
data’’ as that term is defined in the
California Privacy Rights Act, which
includes a geographic radius of 1,850
feet (approximately 563 meters). The
Department did not accept this
suggestion because our assessment of
the relevant national security interests
required a broader geographic area, in
part due to the types of United States
Government personnel and locations
(such as military bases with large
surrounding footprints) that are relevant
to national security. By contrast, the
California standard does not take these
national security interests relating to
32 89
FR 15785.
33 CLLocationAccuracy,
Apple Developer, https://
developer.apple.com/documentation/corelocation/
cllocationaccuracy [https://perma.cc/AZ48-VSCP];
Change Location Settings, Android Developer,
https://developer.android.com/develop/sensorsand-location/location/change-location-settings
[https://perma.cc/5BY3-P7L3].
34 See, e.g., Cal. Civ. Code sec. 1798.140(w)
(which uses a radius of 1,850 feet); Utah Consumer
Privacy Act, Utah Code Ann. sec. 13–61–101(33)(a)
(West 2024) (which uses a radius of 1,750 feet).
PO 00000
Frm 00010
Fmt 4701
Sfmt 4702
Government personnel into account.
One commenter suggested that the
Department omit the phrase ‘‘based on
electronic signals or inertial sensing
units,’’ which was included in the
ANPRM definition of ‘‘precise
geolocation data,’’ to make the term
more technology-neutral as to the
method of collection.35 The Department
has adopted this suggestion and deleted
that phrase from the proposed
definition.
8. Section 202.204—Biometric
Identifiers
Adopting the approach contemplated
in the ANPRM without change, the
proposed rule defines ‘‘biometric
identifiers’’ as measurable physical
characteristics or behaviors used to
recognize or verify the identity of an
individual, including facial images,
voice prints and patterns, retina and iris
scans, palm prints and fingerprints, gait,
and keyboard usage patterns that are
enrolled in a biometric system and the
templates created by the system.
9. Section 202.224—Human Genomic
Data
Adopting the approach contemplated
in the ANPRM without change, the
proposed rule defines ‘‘human genomic
data’’ as data representing the nucleic
acid sequences that constitute the entire
set or a subset of the genetic instructions
found in a human cell, including the
result or results of an individual’s
‘‘genetic test’’ (as defined in 42 U.S.C.
300gg–91(d)(17)) and any related human
genetic sequencing data. The term
‘‘human genomic data’’ does not include
non-human data, such as pathogen
genetic sequence data, that is derived
from or integrated into human genomic
data.
10. Other Human ’Omic Data
The Department of Justice is
considering regulating, as prohibited or
restricted transactions in the final rule,
certain transactions in which a U.S.
person provides a country of concern (or
covered person) with access to bulk
human ’omic data, other than human
genomic data, as defined in § 202.224.
At a high level, the ’omics sciences
examine biological processes that
contribute to the form and function of
cells and tissues.36 The categories of
’omic data that the Department is
considering regulating could include
35 89
FR 15785.
e.g., Evolution of Translational Omics:
Lessons Learned and the Path Forward 23, 33
(Christine M. Micheel et al., eds., 2012), https://
www.ncbi.nlm.nih.gov/books/NBK202168/pdf/
Bookshelf_NBK202168.pdf [https://perma.cc/Q5YE7XLM].
36 See,
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
human epigenomic data, glycomic data,
lipidomic data, metabolomic data, metamultiomic data, microbiomic data,
phenomic data, proteomic data, and
transcriptomic data. The Department
does not intend the definition of metamultiomic data to include nonhuman
data separated from human data or for
the definition of microbiomics data to
include data related to individual
pathogens, even when derived from
human sources. The Department is
considering whether to include the
following definitions of these terms in
the final rule:
1. Epigenomic data: data derived from
the analysis of human epigenetic
modifications, which are changes in
gene expression or cellular phenotype
that do not involve alterations to the
DNA sequence itself. These epigenetic
modifications include modifications
such as DNA methylation, histone
modifications, and non-coding RNA
regulation.
2. Glycomic data: data derived from
the analysis of the structure, function,
and interactions of glycans (complex
carbohydrates) within human biological
systems. The field of glycomics
generally aims to understand the roles
of glycans in cell–cell communication,
immune responses, and various
diseases.
3. Lipidomic data: data derived from
a systems-level characterization of
lipids from a human or human cell,
including their identification,
quantification, and characterization in
biological systems. Routine clinical
measurements of lipids for
individualized patient care purposes
would not be considered lipidomic data
because such measurements would not
entail a systems-level analysis of the
complete set of lipids found in such a
sample.
4. Metabolomic data: data derived
from the analysis of metabolites, the
small molecules produced during
metabolism, that aim to understand
disease mechanisms, identify
biomarkers for diagnosis, and develop
targeted treatments by revealing the
dynamic biochemical activities in a
living system. This data provides a
general snapshot of an organism, tissue,
or cell, offering insights into
physiological and pathological
processes.
5. Meta-multiomic data: The
Department is considering the following
options for defining meta-multiomic
data:
(i) Datasets that include two or more
categories of human ’omic data
identified in this regulation, which can
include data derived from the human
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
genome, proteome, transcriptome,
epigenome, or metabolome; or
(ii) Datasets that include two or more
categories of human ’omic data
identified in this regulation and that
include ’omic data from another species.
6. Microbiomic data: data derived
from analysis of all the microorganisms
of a given community within the human
body (including a particular site on the
human body). Microbiomic data is
implicated in the field of metagenomics,
which generally aims to investigate and
understand genetic material of entire
communities of organisms, including
the composition of a microbial
community.
7. Phenomic data: data derived from
analysis of human phenotypes,
including physical traits, physiological
parameters, and behavioral
characteristics.
8. Proteomic data: data derived from
analysis of human proteomes, which
refers to the entire set of proteins
expressed by a human genome, cell,
tissue, or organism. The field of
proteomics generally aims to identify
and characterize proteins and study
their structures, functions, interactions,
and post-translational modifications.
9. Transcriptomic data: data derived
from analysis of a human transcriptome,
which is the complete set of RNA
transcripts produced by the human
genome under specific conditions or in
a specific cell type. The field of
transcriptomics generally aims to
understand gene expression patterns,
alternative splicing, and regulation of
RNA molecules.
The Department is considering
excluding from the definition of other
human ’omic data pathogen-specific
data embedded in ’omic data sets.
The Department welcomes input from
commenters regarding the potential
risks and benefits that may arise from
restricting or prohibiting covered data
transactions with a country of concern
or covered person involving some or all
of these categories of other human ’omic
data. The Department is particularly
interested in comments addressing the
health, economic, or scientific impacts
of regulating such data transactions, as
well as any national security
implications. Specifically:
• In what ways, if any, should the
Department of Justice elaborate or
amend the definitions of these classes of
other human ’omic data? If the
definitions should be elaborated or
amended, why?
• Should bulk data transactions
involving these types of other human
’omic data be regulated? If so, which
types of human ’omic data—including
any not listed—should be regulated,
PO 00000
Frm 00011
Fmt 4701
Sfmt 4702
86125
why should they be regulated, and how
should they be regulated? Additionally,
what bulk thresholds should apply and
why?
• To what extent would the
regulation of bulk data transactions
involving these types of other human
’omic data affect individuals’ rights to
share their own biological samples (e.g.,
blood, urine, tissue, etc.) or health,
’omic, and other data?
• What would be the effects of
prohibiting or restricting transactions
involving these data classes in the final
rule, particularly with respect to:
Æ health outcomes
Æ health supply chain impacts
Æ research and administrative costs
Æ economic costs due to (1) imposing
these regulations, or (2) allowing
unregulated bulk access to human ’omic
data
Æ innovation costs
• What additional risks should be
considered if these bulk data
transactions are not regulated,
specifically as they relate to:
Æ risks stemming from exploitable
health information
Æ manipulation of bulk data for
strategic advantage over the United
States
Æ use of bulk datasets for the creation
and refinement of AI or other similar
advanced technologies
11. Section 202.240—Personal Financial
Data
Adopting the approach contemplated
in the ANPRM without change, the
proposed rule defines ‘‘personal
financial data’’ as data about an
individual’s credit, charge, or debit
card, or bank account, including
purchases and payment history; data,
including assets liabilities, debts, and
transactions in a bank, credit, or other
financial statement; or data in a credit
report or in a ‘‘consumer report’’ (as
defined in 15 U.S.C. 1681a(d)).
One commenter sought clarification
that personal financial data does not
include inferences based on that data,
suggesting, for example, that hotel
record transactions may be personal
financial data but an ultimate inference
that the person is interested in business
travel should not be considered
personal financial data. As set forth in
the Order and previewed in the
ANPRM, the proposed rule would
prohibit or restrict only certain
categories of transactions in
government-related data or bulk U.S.
sensitive personal data, neither of which
include inferences on their own.37
37 89
E:\FR\FM\29OCP2.SGM
FR 15783; 89 FR 15428–29.
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86126
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
12. Section 202.241—Personal Health
Data
The ANPRM contemplated defining
‘‘personal health data’’ as ‘‘individually
identifiable health information,’’ as
defined under the Health Insurance
Portability and Accountability Act of
1996 (‘‘HIPAA’’), ‘‘regardless of whether
such information is collected by a
‘covered entity’ or ‘business
associate.’ ’’ 38
Several commenters supported
defining personal health data as
‘‘individually identifiable health
information.’’ That definition is similar
to how those terms are defined in
HIPAA and its implementing
regulations. However, one commenter
expressed confusion as to how crossreferencing that definition in this
program would relate to ‘‘covered
entities’’ or ‘‘business associates’’ under
HIPAA. The proposed rule adopts much
of the substance of the approach in the
ANPRM while providing greater clarity
to address this confusion. Instead of
defining ‘‘personal health information’’
by cross referencing and incorporating
HIPAA, the proposed rule reproduces
the relevant substance of the HIPAA
definition to provide greater clarity that
the definition does not turn on the
HIPAA-specific inquiry of whether data
is handled by covered entities or
business associates. Further, unlike the
HIPAA definition, the proposed rule
would not define health information in
terms of whether the information
identifies individuals, because the
proposed rule applies regardless of
whether data is de-identified.
As a result, the proposed rule defines
‘‘personal health data’’ as health
information that relates to the past,
present, or future physical or mental
health or condition of an individual; the
provision of healthcare to an individual;
or the past, present, or future payment
for the provision of healthcare to an
individual. The term includes basic
physical measurements and health
attributes (such as bodily functions,
height and weight, vital signs,
symptoms, and allergies); social,
psychological, behavioral, and medical
diagnostic, intervention, and treatment
history; test results; logs of exercise
habits; immunization data; data on
reproductive and sexual health; and
data on the use or purchase of
prescribed medications. The proposed
rule would operate on a categorical
basis and would determine that the
category of personal health data
generally meets the requirements of
being ‘‘exploitable by a country of
38 Id.;
see 42 U.S.C. 1320d(6); 45 CFR 160, 103.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
concern to harm United States national
security’’ and ‘‘is linked or linkable to
any identifiable United States
individual or to a discrete and
identifiable group of United States
individuals’’ under section 7(l) of the
Order. To be sure, it is possible to
hypothesize a limited data set of
discrete information related to an
individual’s physical or mental health
condition that is not inherently linked
or linkable to U.S. individuals (such as
a data set of only heights or weights
with no identifying information). But
based on the information currently
available, it does not appear that such
limited datasets accurately reflect how
personal health data is stored,
transmitted, and used in the real world,
and thus it does not appear appropriate
to adjust the proposed rule to account
for this hypothetical at this time. The
Department welcomes comments on the
extent to which such datasets exist and
are the subject of covered data
transactions between U.S. persons and
countries of concern or covered persons.
13. Section 202.206—Bulk U.S.
Sensitive Personal Data
Adopting the approach contemplated
in the ANPRM without change, the
prohibitions and restrictions apply to
‘‘bulk U.S. sensitive personal data,’’
which the proposed rule defines as a
collection or set of sensitive personal
data relating to U.S. persons, in any
format, regardless of whether the data is
anonymized, pseudonymized, deidentified, or encrypted. The bulk
thresholds of data set by the proposed
rule are addressed in detail in part V of
this preamble.
Several commenters requested that
the Department align the categories of
sensitive personal data with State data
privacy laws, particularly to exclude
encrypted, pseudonymized, deidentified, or aggregated data from the
proposed rule’s coverage. In contrast,
other commenters supported the
Department’s treatment of
pseudonymized, de-identified, or
encrypted data, including to prevent the
data from being re-identified in the
future and to recognize that not all
techniques for pseudonymization, deidentification, encryption, or
aggregation are equally effective. The
Department declines to adjust the
proposed rule to exclude anonymized,
encrypted, pseudonymized, or deidentified data, and the proposed rule
adopts the approach described in the
ANPRM without change. As the Order
emphasizes, even where types of
sensitive personal data are
‘‘anonymized, pseudonymized, or deidentified, advances in technology,
PO 00000
Frm 00012
Fmt 4701
Sfmt 4702
combined with access by countries of
concern to large datasets, increasingly
enable countries of concern that access
this data to re-identify or de-anonymize
data,’’ which could reveal exploitable
sensitive personal information on U.S.
persons.39 As the Department has
recently explained, ‘‘[o]pen-source
reporting has repeatedly raised
concern[s] that supposedly anonymized
data is rarely, if ever, truly
anonymous.’’ 40 As a recent study has
explained, for example, ‘‘[a]ggregated
insights from location data’’ could be
used to damage national security.41
Examples abound. Researchers in 2024
used a little more than a year’s worth of
‘‘raw, ‘ping’-level data, a year’s worth of
location data from de-identified
smartphones in 26 major metropolitan
areas encompassing nearly every SEC
office and most public firm
headquarters to identify non-public
investigations and enforcement actions,
and glean insights about how those
visits affected financial markets.42 In
2018, the publication of a global
heatmap of anonymized users’ location
data collected by a popular fitness app
enabled researchers to quickly identify
and map the locations of military and
government facilities and activities.43
Similarly, in 2019, New York Times
writers were able to combine a single set
of bulk location data collected from cell
phones and bought and sold by
location-data companies—which was
anonymized and represented ‘‘just one
slice of data, sourced from one
company, focused on one city, covering
less than one year’’—with publicly
available information to identify, track,
and follow ‘‘military officials with
security clearances as they drove home
at night,’’ ‘‘law enforcement officers as
they took their kids to school,’’ and
‘‘lawyers (and their guests) as they
39 89 FR 15426; see also E.O. 14083, 87 FR 57369,
57372–73 (Sept. 15, 2022).
40 In Camera, Ex Parte Classified Decl. of David
Newman, Principal Deputy Assistant Att’y Gen.,
Nat’l Sec. Div., U.S. Dep’t of Just., Doc. No. 2066897
at Gov’t App. 74–75 ¶¶ 100–01, TikTok Inc. v.
Garland, Case Nos. 24–1113, 24–1130, 24–1183
(D.C. Cir. July 26, 2024) (publicly filed redacted
version) (hereinafter ‘‘Newman Decl.’’).
41 Sherman et al., supra note 6, at 15.
42 William C. Gerken et al., Watching the
Watchdogs: Tracking SEC Inquiries using
Geolocation Data 2–4 (Aug. 30, 2024) (unpublished
manuscript), https://ssrn.com/abstract=4941708
[https://perma.cc/L7L9-WU3T].
43 E.g., Richard Perez-Pena & Matthew Rosenberg,
Strava Fitness App Can Reveal Military Sites,
Analysts Say, N.Y. Times (Jan. 29, 2018), https://
www.nytimes.com/2018/01/29/world/middleeast/
strava-heat-map.html [https://perma.cc/FT3AW547]; Jeremy Hsu, The Strava Heat Map and the
End of Secrets, Wired (Jan. 29, 2018), https://
www.wired.com/story/strava-heat-map-militarybases-fitness-trackers-privacy/ [https://perma.cc/
6TWD-P76B].
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
traveled from private jets to vacation
properties.’’ 44 A 2019 research study
concluded that ‘‘99.98% of Americans
would be correctly re-identified in any
dataset using 15 demographic
attributes,’’ thus ‘‘suggest[ing] that even
heavily sampled anonymized datasets
are unlikely to satisfy the modern
standards for anonymization set forth by
[the EU’s General Data Protection
Regime] and seriously challenge the
technical and legal adequacy of the deidentification release-and-forget
model.’’ 45 Other studies and reports
have reported similar results.46 As a
result, as the Department recently
explained, ‘‘[a]dversaries can use these
datasets to reverse-engineer anonymized
data and identify people, subjects, or
devices that were supposedly
anonymized.’’ 47
Similar concerns exist with respect to
encrypted data. Countries of concern
amass large quantities of encrypted data
including by harvesting encrypted data
now in order to decrypt it in the future
should advances in quantum
technologies render current standard
public-key cryptographic algorithms
ineffective.48 Encryption keys can also
44 Stuart A. Thompson & Charlie Warzel, Twelve
Million Phones, One Dataset, Zero Privacy, N.Y.
Times (Dec. 19, 2019), https://www.nytimes.com/
interactive/2019/12/19/opinion/location-trackingcell-phone.html [https://perma.cc/X3VB-429P].
45 Luc Rocher et al., Estimating the Success of ReIdentifications in Incomplete Datasets Using
Generative Models, 10 Nature Commc’ns, at 1
(2019), https://www.nature.com/articles/s41467019-10933-3.pdf [https://perma.cc/SYJ7-KA95]; see
also Alex Hern, ‘Anonymised’ Data Can Never Be
Totally Anonymous, Says Study, The Guardian (Jul.
23, 2019), https://www.theguardian.com/
technology/2019/jul/23/anonymised-data-never-beanonymous-enough-study-finds [https://perma.cc/
5BF8-745A].
46 See, e.g., Alex Hern, New York Taxi Details
Can Be Extracted From Anonymised Data,
Researchers Say, The Guardian (June 27, 2014),
https://www.theguardian.com/technology/2014/
jun/27/new-york-taxi-details-anonymised-dataresearchers-warn [https://perma.cc/6SYK-6ZEG]
(reporting that a researcher ‘‘discovered that the
anonymous data’’ of taxi records ‘‘was easy to
restore to its original, personally identifiable
format,’’ taking a ‘‘matter of only minutes to
determine which [license] numbers were associated
with which pieces of anonymised data’’ and only
an hour to ‘‘de-anonymise the entire dataset,’’
making it possible to ‘‘figure out which person
drove each trip’’ and to determine taxi drivers’
supposedly anonymous home addresses); Ryan
Singel, Netflix Spilled Your Brokeback Mountain
Secret, Lawsuit Claims, Wired (Dec. 17, 2009),
https://www.wired.com/2009/12/netflix-privacylawsuit/ [https://perma.cc/B96P-AY97] (reporting
on researchers who de-anonymized a Netflix dataset
of movie ratings by using publicly available
information, which revealed ‘‘political leanings and
sexual orientation’’ in some cases, and reporters
who ‘‘quickly’’ de-anonymized supposedly
anonymous AOL search-engine logs ‘‘to track down
real people’’).
47 Newman Decl., supra note 40, at Gov’t App. 33
¶ 105.
48 David Lague, U.S. and China Race to Shield
Secrets from Quantum Computers, Reuters (Dec. 14,
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
be stolen, handed over under
compulsion, and otherwise obtained for
use in decrypting datasets.49
A few commenters suggested that the
approach contemplated in the ANPRM
would weaken national security by
failing to differentiate between data that
is encrypted or otherwise protected and
data that is not. In their view,
encryption is an important tool to
secure data from unauthorized access,
and treating encrypted and nonencrypted data alike could discourage
the use of encryption, weakening the
overall security of data. Other
commenters, however, supported
treating pseudonymized, encrypted, deidentified, and aggregated data as
sensitive personal data because of the
ability to re-identify such data and the
rapid advancements in re-identification
techniques. The Department declines to
modify the proposed rule in response to
these comments. As contemplated in the
ANPRM, the proposed rule explicitly
recognizes and relies upon the privacy
and national security-preserving value
of high quality, effective methods of
encryption, de-identification,
pseudonymization, and aggregation by
specifically authorizing certain
otherwise prohibited transactions so
long as they meet the security
requirements described in part IV.B.1 of
this preamble, including by using datalevel control(s) such as these techniques
in combination with other security
requirements. At the same time, as
contemplated in the ANPRM, the
proposed rule also recognizes that
ineffective methods of encryption, deidentification, pseudonymization, and
aggregation present the same
unacceptable national security risk of
access by countries of concern and
covered persons as the risks posed by
such access to identifiable data that is
not secured through any of these
techniques. The proposed rule thus
allows otherwise prohibited
employment agreements, vendor
agreements, and investment agreements
2023), https://www.reuters.com/investigates/
special-report/us-china-tech-quantum/ [https://
perma.cc/9HAA-46XA]; Nat’l Counterintel. & Sec.
Ctr., Protecting Critical and Emerging U.S.
Technologies From Foreign Threats 5 (Oct. 2021),
https://www.dni.gov/files/NCSC/documents/
SafeguardingOurFuture/FINAL_NCSC_
Emerging%20Technologies_Factsheet_10_22_
2021.pdf [https://perma.cc/L6ZU-8HU7]; Nat’l
Cybersec. Ctr. of Excellence, NIST SP 1800–38B,
Migration to Post-Quantum Cryptography, at 1 (drft.
Dec. 2023), https://www.nccoe.nist.gov/sites/
default/files/2023-12/pqc-migration-nist-sp-180038b-preliminary-draft.pdf [https://perma.cc/FXF2BJ62].
49 Can Encrypted Data be Hacked?, IT
Foundations (Apr. 19, 2021), https://
itfoundations.com/can-encrypted-data-be-hacked/
[https://perma.cc/E3TN-YAVV].
PO 00000
Frm 00013
Fmt 4701
Sfmt 4702
86127
only if they use any combination of the
data-level requirements necessary to
prevent access to covered data by
covered persons or countries of concern,
as requirements laid out in the security
requirements to be published by the
Department of Homeland Security
(‘‘DHS’’), in addition to organizationaland system-level requirements.
Commenters also requested that the
Department use existing State privacy
law definitions to define the categories
of sensitive personal data, such as
personal financial data. Commenters
stated that many companies already
know how to comply with State privacy
laws. The Department has considered
these comments. However, as discussed
in part IV.A.6 of this preamble, the cited
definitions do not necessarily align with
the specific national security goals of
these regulations. Therefore, the
proposed rule adopts the approach
described in the ANPRM without
change and does not adopt the State
privacy law definitions of the terms in
the proposed rule.
14. Section 202.205—Bulk
As previewed in the ANPRM, the
proposed rule’s prohibitions apply to
bulk amounts of U.S. sensitive personal
data (in addition to the separate
category of government-related data).
The proposed rule defines ‘‘bulk’’ as any
amount of such data that meets or
exceeds thresholds during a given 12month period, whether through one
covered data transaction or multiple
covered data transactions involving the
same U.S. person and the same foreign
person or covered person. The proposed
rule sets specific thresholds for each
category of sensitive personal data. See
§ 202.205. Certain specified data
transactions that exceed those
thresholds are ‘‘covered data
transactions’’ and thus subject to the
proposed rule’s prohibitions unless they
are otherwise authorized by the
proposed rule. See § 202.210. The
Department has determined the
proposed bulk thresholds based on the
analysis previewed in the ANPRM and
described in more detail in part V of this
preamble.
A few commenters expressed
concerns that it would be necessary to
decrypt data to determine whether it
meets a relevant bulk threshold and
suggested discarding the bulk
thresholds as a result. They noted that
decrypting data is generally less secure
and could lead to unauthorized access.
The proposed rule makes no change in
response to these comments, for several
reasons. First, many businesses
engaging in the categories of prohibited
and restricted transactions generally use
E:\FR\FM\29OCP2.SGM
29OCP2
86128
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
the data in the course of operating their
business, rather than merely serving as
a pass-through for encrypted data as the
comments suggest. While encrypting
data in transit and data at rest is and
should be a standard security technique,
and encrypting data in use is
increasingly common, data is routinely
decrypted while it is being actively
accessed, processed, filtered, sorted,
searched, analyzed, displayed, and
otherwise used by a business (for
example, when an authorized employee
or user opens and searches an encrypted
file or database). However, nothing in
the proposed rule imposes a legal
requirement to decrypt data to comply.
Instead, the proposed rule requires only
that U.S. persons implement a riskbased compliance program tailored to
their individual risk profiles. And data
may also be encrypted using
cryptographic methods that permit some
computation and analysis to be
performed on cyphertext that ascertains
the kinds and volume of data without
decrypting the data.50 Businesses can
map the kinds and volumes of their data
to evaluate it against the bulk thresholds
in the data life cycle in which it is either
decrypted for access or encrypted in
use.
Second, even beyond mapping data in
use, companies choosing to engage in
these categories of data transactions can
and should have some awareness of the
volume of data they possess and in
which they are transacting. For
example, typically data-using entities
maintain metrics, such as user statistics,
that can help estimate the number of
impacted individuals for the purposes
of identifying whether a particular
transaction meets the bulk threshold.51
Given that the bulk thresholds are built
around order-of-magnitude evaluations
50 Abbas Acar et al., A Survey on Homomorphic
Encryption Schemes: Theory and Implementation,
51 [No. 4] ACM Computing Survs. 79:1, 79:2 (2018),
https://dl.acm.org/doi/pdf/10.1145/3214303
[https://perma.cc/AM69-7ZWV]. In addition, to the
extent that businesses use emerging techniques
(such as homomorphic encryption) that permit
computations to be performed on encrypted data
without first decrypting it, these techniques may
enable businesses to map their data even if it
remains encrypted.
51 Justin Ellingwood, User Data Collection:
Balancing Business Needs and User Privacy,
DigitalOcean (Sept. 26, 2017), https://
www.digitalocean.com/community/tutorials/userdata-collection-balancing-business-needs-and-userprivacy [https://perma.cc/GCX5-RGSK]; Jodie
Siganto, Data Tagging: Best Practices, Security &
Implementation Tips, Privacy108 (Nov. 14, 2023),
https://privacy108.com.au/insights/data-taggingfor-security/ [https://perma.cc/8PQA-89DA];
National Institutes of Health, Metrics for Data
Repositories and Knowledgebases: Working Group
Report 7, (Sept. 15, 2021), https://
datascience.nih.gov/sites/default/files/MetricsReport-2021-Sep15-508.pdf [https://perma.cc/
8KBQ-HWRK].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
of the quantity of user data, it is
reasonable for entities to conduct
similar order-of-magnitude-based
assessments of their data stores and
transactions for the purposes of
regulatory compliance. Companies
already must understand, categorize,
and map the volumes of data they have
for other regulatory requirements, such
as State laws requiring notification of
data breaches of specific kinds of data
above certain thresholds.52
Third, this concern appears premised
on a scenario in which a U.S. business
handles only encrypted data on which
no computational functions can be
performed to determine the kinds and
volume of data, never accesses the
decrypted data in its business, does not
have other proxies or metrics to
determine the kinds and volumes of
data in which it is transacting, and must
comply with the prohibitions and
restrictions in the proposed rule. This
scenario appears to be an edge case at
best, and the comments do not provide
a real-world example of this scenario or
its frequency. Indeed, as discussed in
some of the examples contained in the
proposed rule, if a U.S. entity merely
provides a platform for, or transports
data between, a U.S. customer and a
covered person or country of concern,
and thus does not know or reasonably
should not know of the kind or volume
of data involved, then it generally
would not ‘‘knowingly’’ engage in a
prohibited transaction if the U.S.
customer uses that platform or
infrastructure to engage in a prohibited
transaction with a covered person.
Instead, the U.S. customer would
generally be responsible for having
‘‘knowingly’’ engaged in the prohibited
transaction, as illustrated in the
clarification of the ‘‘knowingly’’
standard and the new examples
incorporated into the proposed rule. See
§ 202.230. Similarly, if a U.S. entity
merely stores encrypted data on behalf
of a U.S. customer and does not possess
the encryption key, and if the U.S.
entity does not know or reasonably
should not know the kind or volume of
data involved, the U.S. entity generally
would not meet the ‘‘knowingly’’
standard of the proposed rule.
Fourth, to the extent that there is a
U.S. business that handles only
encrypted data on which no
computational functions can be
performed to determine the kinds and
volume of data, never accesses the
decrypted data in its business, does not
have other proxies or metrics to
52 See, e.g., Del. Code. Ann. tit. 6, sec. 12B—100
to—104 (West 2024); N.M. Stat. Ann. sec. 57–12C–
10 (LexisNexis 2024).
PO 00000
Frm 00014
Fmt 4701
Sfmt 4702
determine the kinds and volumes of
data it is transacting, and is subject to
the prohibitions and restrictions in the
proposed rule, that U.S. business would
have choices under the proposed rule. It
would be able to engage with the
Department and seek an advisory
opinion or a specific license tailored to
its business. Similarly, it would have
choices about how best to comply as
part of its individualized, risk-based
compliance program. For example, it
can choose not to engage in prohibited
or restricted transactions with countries
of concern or covered persons as part of
its individualized risk-based
compliance program. If the U.S.
business chooses to engage in categories
of transactions potentially subject to the
proposed rule, it can conduct reasonable
due diligence on the source of its
encrypted data (such as engaging with
and obtaining contractual commitments
from its customers) to determine the
volume and kinds of data in which it is
transacting. Or, if it chooses to engage
in restricted transactions with countries
of concern or covered persons, it can
assume that its transactions involve
bulk volumes of sensitive personal data
and comply with the security
requirements and other applicable
conditions out of an abundance of
caution.
Even if this hypothetical U.S.
business were to choose to engage in
categories of transactions potentially
subject to the proposed rule, and it
voluntarily decided to briefly decrypt
the data to determine the kinds and
volume of its data as part of its riskbased compliance program, commentors
have not provided evidence that such a
brief decryption would meaningfully
increase the risks of unauthorized
access relative to the risks involved in
routine decryption for business use.
Encryption is one security tool designed
to mitigate the risk of unauthorized
access to data.53 Entities should use
encryption as a tool whenever possible,
including when data is at rest, in transit,
and in use. However, using encryption
does not eliminate risk or the
requirement to perform appropriate due
diligence. If an entity is using data at
any point or has access to both
encrypted data and the encryption key,
that entity has full se into and control
over the data on its systems for the
53 What Is Encryption?, Cloudflare, https://
www.cloudflare.com/learning/ssl/what-isencryption/ [https://perma.cc/T3KT-BURX];
Cybersec. & Infrastructure Sec. Agency, Zero Trust
Maturity Model 5, 27 (v. 2.0 Apr. 2023), https://
www.cisa.gov/sites/default/files/2023-04/zero_
trust_maturity_model_v2_508.pdf [https://
perma.cc/F9LB-JVL9].
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
purposes of this regulation.54 Entities
are responsible for balancing risks
within their systems, with encryption
serving as one available tool for
achieving risk management goals
alongside other tools like data
governance and data minimization
plans, role-based and least-privilege
access controls, and identity
management through multifactor
authentication.55
It is the responsibility of the regulated
entity to manage risk that already exists,
which includes making choices about
the best way to manage its own
particular risk and tradeoffs between
various data risk management strategies,
including technical measures like
encryption, organizational policies, and
access management. Other options
include altering commercial activities to
minimize the size and scope of covered
data transactions and utilizing a strong
data governance regime to minimize the
type and quantity of data collected. If
data cannot remain encrypted while in
use, the risk of temporarily decrypting
data to comply with regulations can be
offset by measures such as welldesigned data collection, data
management, and data security
programs. Given these factors, any risk
associated with a hypothetical U.S.
business’ decision to temporarily
decrypt data that would otherwise
remain encrypted at all times in the
business’ life cycle would appear to be
much more remote and attenuated than
the risk that accrues by allowing the
U.S. business to engage in a transaction
that grants a country of concern or
covered person access to encrypted
government-related data or bulk U.S.
sensitive personal data.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
15. Section 202.222—GovernmentRelated Data
As set forth in § 202.222, the proposed
rule would not impose any bulk
54 Clare Stouffer, What Is Encryption? How It
Works + Types of Encryption, Norton: Blog (July 18,
2023), https://us.norton.com/blog/privacy/what-isencryption [https://perma.cc/RC3D-NS95].
55 Nat’l Sec. Agency & Cybersec. & Infrastructure
Sec. Agency, Recommended Best Practices for
Administrators: Identity and Access Management
(n.d.), https://media.defense.gov/2023/Mar/21/
2003183448/-1/-1/0/ESF%20identity%20and
%20access%20management%20recommended
%20best%20practices%20for%20administrators
%20pp-23-0248_508c.pdf [https://perma.cc/B7VP4RWF]; Mohammed Khan, Data Minimization—A
Practical Approach, ISACA (Mar. 29, 2021), https://
www.isaca.org/resources/news-and-trends/industrynews/2021/data-minimization-a-practical-approach
[https://perma.cc/8APH-5E5A]; Cybersec. &
Infrastructure Sec. Agency, Protecting Sensitive and
Personal Information From Ransomware-Caused
Data Breaches (n.d.), https://www.cisa.gov/sites/
default/files/publications/CISA_Fact_SheetProtecting_Sensitive_and_Personal_Information_
from_Ransomware-Caused_Data_Breaches508C.pdf [https://perma.cc/Q7TN-NLR4].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
threshold requirements on transactions
involving government-related data. The
proposed rule defines subcategories of
government-related data for locations
and personnel, as contemplated in the
ANPRM. For the location subcategory,
the proposed rule defines ‘‘governmentrelated data’’ as any precise geolocation
data, regardless of volume, for any
location within any area enumerated on
the Government-Related Location Data
List in § 202.1401 that the Attorney
General has determined poses a
heightened risk of being exploited by a
country of concern to reveal insights to
the detriment of national security about
locations controlled by the Federal
Government, including insights about
facilities, activities, or populations in
those locations, because of the nature of
those locations or the personnel who
work there. The purpose of this list is
to prevent countries of concern from
exploiting the geolocation data in these
locations, such as by using aggregated
geolocation data to draw inferences
about facilities, activities, or
populations located there that could
undermine U.S. national security or
foreign policy or to conduct intelligence
or counterintelligence operations
against government employees or
contractors, or against government
facilities, as discussed in parts II, IV(D)
and V(A) of this preamble. As set forth
in the proposed rule, the locations that
the Department might add to this list
may include the worksites or duty
stations of Federal Government
employees or contractors who occupy
national security positions, as that term
is defined in 5 CFR 1400.102(a),
wherever they are located. The locations
may also include military installations,
embassies or consulates, or other
facilities worldwide that support the
Federal Government in achieving its
national security, defense, intelligence,
law enforcement, or foreign policy
missions. The proposed rule thus
modifies the definition contemplated in
the ANPRM by setting forth more details
about the types of locations that will be
listed on the Government-Related
Location Data List.56
The proposed rule also proposes a
format for the Government-Related
Location Data List and proposes some
areas for inclusion on that List. See
§ 202.1401. This is not yet a
comprehensive list of locations. The
Department anticipates that the final
rule will include additional locations
associated with military, other
Government, or other sensitive facilities
or locations that meet the criteria in the
definition. These locations may include,
56 89
PO 00000
FR 15787.
Frm 00015
Fmt 4701
for example, military bases, embassies,
or law enforcement facilities.
For the personnel subcategory, the
proposed rule adopts the ANPRM’s
contemplated definition without change
by defining ‘‘government-related data’’
as any sensitive personal data,
regardless of volume, that a transacting
party markets as linked or linkable to
current or recent former employees or
contractors, or former senior officials, of
the United States Government,
including the military and intelligence
community.57
Commenters were generally
supportive of the proposed rule’s
protections for government-related data.
A few commenters requested that the
proposed rule provide clarity as to what
constitutes a ‘‘former senior official’’
and a ‘‘recent former employee.’’ The
proposed rule defines ‘‘recent former
employees or contractors’’ as employees
or contractors who have worked for or
provided services to the United States
Government, in a paid or unpaid status,
within the 2 years preceding a proposed
covered data transaction. See § 202.245.
The proposed rule defines a ‘‘former
senior official’’ as either a ‘‘former
senior employee’’ or ‘‘former very senior
employee,’’ as those terms are defined
in the ethics regulations pertaining to
post-employment conflicts of interest
for former Executive Branch or
independent agency employees. 5 CFR
2641.104. See § 202.220.
One commenter expressed concern
that, with respect to the personnel
subcategory, companies will have to ask
individuals whether they are former
government employees when collecting
their data and retain that information to
ensure they can comply with the
regulations. The commenter argued that
this could have the unintended
consequence of inadvertently creating a
database of sensitive information that
bad actors could target. While the
Department appreciates that concern
and agrees that this unintended
consequence should be avoided, the
Department has designed the proposed
rule to specifically avoid this problem
by defining the personnel subcategory
based on how the U.S. person markets
the data, not on whether a particular
dataset contains data on former
government employees or contractors.
In other words, the personnel
subcategory applies only to transactions
in which the U.S. person has already
identified and described sensitive
personal data as being about certain
government personnel. This subcategory
does not apply on the basis of the
presence or absence of data linked to
57 Id.
Sfmt 4702
86129
E:\FR\FM\29OCP2.SGM
29OCP2
86130
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
certain government personnel in the
underlying sensitive personal data.
One commenter suggested removing
the qualifier that data had to be
‘‘marketed’’ as data about members of
the military or intelligence community
because certain data can still be ‘‘linked
or linkable’’ to members of the military
through geolocation without being
explicitly marketed as such. As the
Order’s second category of governmentrelated data confirms, sensitive personal
data that is linked to categories of data
that could be used to identify current or
certain former government personnel
can present a national security risk,
even if a transacting party does not
market it as linked or linkable to those
personnel.58 The Department is still
considering how to address this issue,
specifically whether to include, and
how to define, this category of
information in the proposed rule while
minimizing the unintended
consequence described above in this
section. The Department appreciates
any views from the public.
16. Section 202.302—Other Prohibited
Data-Brokerage Transactions Involving
Potential Onward Transfer to Countries
of Concern or Covered Persons
As previewed in the ANPRM, the
proposed rule also includes a
prohibition specific to data brokerage to
address transactions involving the
onward transfer or resale of governmentrelated data or bulk U.S. sensitive
personal data to countries of concern
and covered persons.59 See § 202.302.
The proposed rule defines ‘‘data
brokerage’’ as the sale of data, licensing
of access to data, or similar commercial
transactions involving the transfer of
data from any person (‘‘the provider’’) to
any other person (‘‘the recipient’’),
where the recipient did not collect or
process the data directly from the
individuals linked or linkable to the
collected or processed data. See
§ 202.214. The proposed rule prohibits
any U.S. person from knowingly
engaging in a covered data transaction
involving data brokerage with any
foreign person that is not a covered
person unless the U.S. person
contractually requires that the foreign
person refrain from engaging in a
subsequent covered data transaction
involving that data with a country of
concern or covered person. This narrow
circumstance is the only instance in
which the proposed rule’s regulation of
covered data transactions could impact
transactions involving third countries
(i.e., U.S. persons’ covered data
58 89
FR 15429.
59 89 FR 15792.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
transactions in which a country of
concern or covered person is not a
party).
Commenters generally supported the
feasibility of using contractual
requirements to address the resale of
data as contemplated in the ANPRM.
They noted, however, that it may be
difficult for U.S. persons to enforce
those requirements or to ensure that the
data is not subsequently resold in
violation of those provisions. Several
aspects of the proposed rule are
designed to address these concerns.
First, in addition to requiring a
contractual commitment from the
foreign person not to engage in a
subsequent covered data transaction
with a country of concern or covered
person, as contemplated in the ANPRM,
the proposed rule adds a requirement
for U.S. persons engaged in such
transactions to report any known or
suspected violations of the required
contractual provision. This requirement
creates a mechanism to provide the
necessary information for the
Department to investigate and take
appropriate action to address any
violations of the proposed rule. Second,
relying on both its own investigations
and its investigations of any known or
suspected violations reported by private
parties, the Department intends to
exercise the designation authority under
the proposed rule to designate as
covered persons, as appropriate, foreign
third parties that violate the contractual
provisions required by this prohibition.
See § 202.701. Third, consistent with
the overall approach to compliance and
enforcement under the proposed rule,
the Department expects U.S. persons
engaged in these kinds of data brokerage
transactions to take reasonable steps to
evaluate whether their foreign
counterparties are complying with the
contractual provision as part of
implementing risk-based compliance
programs under the proposed rule.
Absent indications of evasion,
conspiracy, or knowingly directing
prohibited transactions, U.S. persons
that conduct adequate due diligence as
part of a risk-based compliance program
would not have engaged in a prohibited
transaction if the foreign counterparty
later violates the required contractual
provision or if the U.S. person fails to
detect such violations. Depending on
the circumstances, a U.S. person’s
failure to conduct adequate due
diligence may subject the U.S. person to
enforcement actions if that failure
would constitute an evasion of the
regulations, such as repeatedly knowing
of violations by a foreign person and
continuing to engage in data-brokerage
PO 00000
Frm 00016
Fmt 4701
Sfmt 4702
transactions with that foreign person.
The Department welcomes public input
on any additional measures that should
be considered as part of the final rule.
In addition, after the final rule goes into
effect, the Department intends to
monitor the effectiveness of the
measures to address the risk of onward
sale and make any appropriate
adjustments.
Although not specifically raised by
commenters, the Department is
considering the specific language used
to describe the contractual requirement.
As previewed in the ANPRM,60 the
proposed rule frames the contractual
requirement as an obligation to provide
that the foreign party ‘‘refrain from
engaging in a subsequent covered data
transaction involving the same data
with a country of concern or covered
person.’’ See § 202.302(a)(1). The
Department invites public comment on
this language, including whether any
alternative language (such as inserting
‘‘knowingly’’ before ‘‘refrain’’ or
‘‘contractually requires that the foreign
person use best efforts not to engage’’)
would be more appropriate.
Commenters expressed varying views
about the contemplated definition of
‘‘data brokerage.’’ Several commenters
expressed concerns about the breadth of
the definition of ‘‘data brokerage’’ in the
ANPRM.61 Some commenters suggested
that the proposed term, and in
particular the phrase ‘‘or similar
commercial transactions,’’ creates
uncertainty as to its scope and fails to
distinguish between selling data for
monetary purposes and transferring data
pursuant to normal business operations.
Some commenters urged the
Department to limit the scope of the
proposed rule to ‘‘data brokers’’ by
adopting the definition used in existing
State privacy laws, such as
California’s.62 Others proposed ways
that the Department should narrow the
definition, including by requiring that
the data be sold in exchange for
monetary or other valuable
consideration; that the data must be the
object of the transaction and not shared
incident to the development, testing, or
sale of a product or service; or that the
data must be knowingly transferred or
sold. Other commenters suggested that
the Department amend the definition of
‘‘sale’’ to exclude the disclosure of
sensitive personal data to service
providers processing data on behalf of a
U.S. company, to third parties for
providing products or services
requested by a U.S. company, or for
60 Id.
61 See
62 See
E:\FR\FM\29OCP2.SGM
89 FR 15788.
Cal. Civ. Code 1798.99.80 (West 2024).
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
disclosures or transfers to subsidiaries
or affiliates of U.S. companies. Still
other commenters supported the
approach contemplated by the ANPRM
for defining data brokerage by reference
to transactions, not the identities of the
parties, noting that the ANPRM’s
approach is stronger than existing State
privacy laws, and encouraged the
adoption of a broad definition.
The Department declines to revise the
definition of ‘‘data brokerage’’ in
response to these comments. The
definition of ‘‘data brokerage’’ in the
proposed rule is intentionally designed
to address the activity of data brokerage
that gives rise to the national security
risk, regardless of the kind of entity that
engages in it. Both first-party data
brokerage (i.e., by the person that
directly collected the U.S. person’s data)
and third-party data brokerage (i.e., by a
person that did not directly collect the
U.S. person’s data, such as a subsequent
reseller) present similar national
security risks: the outright sale and
transfer of sensitive personal data to a
country of concern or covered person.
For this reason, the proposed definition
intentionally regulates data transactions,
including transactions that transfer data
to entities in countries of concern for
product development, an issue raised by
numerous commenters, because those
transactions give rise to the risks
discussed in the Order. In addition,
commenters did not provide any
specific evidence that the proposed
definition of data brokerage would have
any measurable economic impact
related to product development or
testing.63 Consequently, the proposed
rule maintains the approach described
in the ANPRM without change.
A few commenters expressed concern
about how this provision might affect
the ability of biomedical and
pharmaceutical manufacturers to share
clinical trial data with drug and device
regulators in countries of concern.
Relatedly, a few commenters expressed
concerns that the proposed rule’s
inclusion of aggregated and anonymized
data would prohibit companies from
using clinical trial data to launch
clinical trials in countries of concern or
sharing safety and efficacy data obtained
from clinical trials in the United States
with countries of concern. The proposed
rule includes two exemptions
responsive to these comments, in
sections 202.510 and 202.511. These
exemptions allow certain transactions
relevant to medical research, marketing,
and safety, as explained in more detail
below.
63 See
infra note 418 and accompanying text.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
17. Section 202.303—Prohibited Human
Genomic Data and Human Biospecimen
Transactions
As previewed in the ANPRM, the
proposed rule includes a prohibition to
specifically address the risks posed by
covered data transactions involving
access by countries of concern to U.S.
persons’ bulk human genomic data and
human biospecimens from which that
bulk data can be derived, such as
covered data transactions that give
access to bulk human genomic data to
laboratories owned or operated by
covered persons or provide them with
human biospecimens from which such
data can be derived. The proposed rule
prohibits any U.S. person from
knowingly engaging in any covered data
transaction involving human genomic
data that provides a country of concern
or covered person with access to bulk
U.S. sensitive personal data that
consists of human genomic data or
human biospecimens from which such
data could be derived, where the
number of U.S. persons in the dataset is
greater than the applicable bulk
threshold at any point in the preceding
12 months, whether in a single covered
data transaction or aggregated across
covered data transactions. This
prohibition applies to any of the
categories of covered data transactions
that involve access to bulk human
genomic data or human biospecimens
from which bulk human genomic data
can be derived, even when the
transactions involve an employment,
investment, or vendor agreement. In
other words, transactions falling within
the scope of proposed § 202.303 are
never treated as restricted transactions
under the proposed rule. Relatedly, and
as discussed in more detail with respect
to the categories of exempt transactions,
the proposed rule exempts (1)
transactions for the conduct of the
official business of the United States
Government by employees, grantees, or
contractors thereof, or transactions
conducted pursuant to a grant, contract,
or other agreement entered into with the
United States Government, including
those for outbreak and pandemic
prevention, preparedness, and response;
and (2) data transactions, including the
sharing of human biospecimens from
which human genomic data may be
derived, that are required or authorized
by certain specified international
arrangements addressing global and
pandemic preparedness.
One commenter sought clarification
that vendor, employment, and
investment agreements involving access
to bulk human genomic data, or human
biospecimens from which such data
PO 00000
Frm 00017
Fmt 4701
Sfmt 4702
86131
could be derived, are prohibited
transactions under subpart C of the
proposed rule rather than restricted
transactions under subpart D of the
proposed rule. The commenter
suggested that the proposed rule should
clarify that such vendor, employment,
and investment agreements are
prohibited because they present the
same policy concerns as other categories
of transactions involving access to this
kind of data. The Department agrees. As
shown by Example 49 in the ANPRM,
vendor, employment, and investment
agreements involving access to this kind
of sensitive personal data are prohibited
rather than restricted.64 For the
avoidance of doubt, § 202.303 of the
proposed rule clarifies that the
authorization for restricted transactions,
see §§ 202.401–202.402, does not apply
to any transactions involving access to
bulk human genomic data or bulk
human biospecimens.
18. Section 202.304—Prohibited
Evasions, Attempts, Causing Violations,
and Conspiracies
Adopting the approach contemplated
in the ANPRM without change, the
proposed rule prohibits any transactions
that have the purpose of evading or
avoiding the proposed rule’s
prohibitions, or that cause a violation of
or attempt to violate the proposed rule’s
prohibitions. The proposed rule also
prohibits conspiracies formed to violate
the proposed rule’s prohibitions.
One commenter suggested expanding
the scope of the regulations to prohibit
transactions involving algorithms or
artificial intelligence models that are
trained and developed using bulk U.S.
sensitive personal data in certain
circumstances. The commenter
described a scenario in which the
transfer of such an algorithm or model
provides a means to evade the
prohibitions—for example, where a
transaction gives a country of concern or
covered person access to the model, and
the model makes the underlying bulk
U.S. sensitive personal data on which it
was trained available to that country of
concern or covered person. According to
the commenter, this access could occur
by querying the model in such a way
that results in it sharing all of or a
highly relevant component of the
underlying data on which it was
trained, such as a query that resulted in
identification of people with a
particular medical condition.65 Apart
64 89
FR 15794.
Johansson & Balder Janryd, Preventing
Health Data from Leaking in a Machine Learning
System 4–6 (2024) (First Cycle 15 credits, KTH
Royal Institute of Technology), https://kth.diva65 Tim
E:\FR\FM\29OCP2.SGM
Continued
29OCP2
86132
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
from concerns over access to the
underlying data, a model could also
provide insights into counterintelligence targeting that would not
otherwise be observable from the
underlying sensitive personal data. The
Department shares these concerns. In
response to the comment, the proposed
rule includes Examples 5 and 6 in
§ 202.304(b) highlighting how these
regulations would apply in certain
scenarios where bulk U.S. sensitive
personal data would be licensed or sold
to support algorithmic development,
including cases of evasion, or where
sensitive personal data could be
extracted from artificial intelligence
models. The Department will continue
to evaluate the national-security risks in
this emerging area as it considers the
effectiveness of this regulation. To the
extent that there are broader concerns
about national-security risks from the
export of artificial intelligence models
or algorithms regardless of the access
they provide to sensitive personal data
(such as their ability to provide insights
that would not otherwise be observable
from the data on which they are
trained), the Department believes that
other authorities, such as export
controls and Executive Order 13859 of
February 11, 2019 (Maintaining
American Leadership in Artificial
Intelligence),66 are more appropriate in
the first instance to address those
concerns.
19. Section 202.305—Knowingly
Directing Prohibited Transactions
Adopting the approach contemplated
in the ANPRM without change, the
proposed rule prohibits U.S. persons
from knowingly directing any covered
data transaction that would be a
prohibited transaction (including
restricted transactions that do not
comply with the security requirements)
if engaged in by a U.S. person.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
20. Section 202.215—Directing
Adopting the approach contemplated
in the ANPRM without change, the
proposed rule defines ‘‘directing’’ to
mean that the U.S. person has any
authority (individually or as part of a
group) to make decisions on behalf of a
foreign entity and exercises that
authority. For example, a U.S. person
would direct a transaction by exercising
portal.org/smash/get/diva2:1865596/
FULLTEXT01.pdf [https://perma.cc/S5S8-M3DJ];
see, e.g., Anuj Mudaliar, ChatGPT Leaks Sensitive
User Data, OpenAI Suspects Hack, Spiceworks
(Feb. 1, 2024), https://www.spiceworks.com/tech/
artificial-intelligence/news/chatgpt-leaks-sensitiveuser-data-openai-suspects-hack/ [https://perma.cc/
AS5E-FATZ].
66 E.O. 13859, 84 FR 3967 (Feb. 11, 2019).
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
their authority to order, decide to
engage, or approve a transaction that
would be prohibited under these
regulations if engaged in by a U.S.
person.
21. Section 202.230—Knowingly
Adopting the approach contemplated
in the ANPRM without change, the
proposed rule defines ‘‘knowingly’’ to
mean, with respect to conduct, a
circumstance, or a result, that the U.S.
person had actual knowledge of, or
reasonably should have known about,
the conduct, circumstance, or result. To
determine what an individual or entity
reasonably should have known in the
context of prohibited transactions, the
Department will take into account the
relevant facts and circumstances,
including the relative sophistication of
the individual or entity at issue, the
scale and sensitivity of the data
involved, and the extent to which the
parties to the transaction at issue appear
to have been aware of and sought to
evade the application of these proposed
rules. As a result of the knowledge
standard, the regulations incorporating
the word ‘‘knowingly’’ do not adopt a
strict liability standard.
The ‘‘knowingly’’ language is also not
intended to require U.S. persons, in
engaging in vendor agreements and
other classes of data transactions with
foreign persons, to conduct due
diligence on the employment practices
of those foreign persons to determine
whether the foreign persons’ employees
qualify as covered persons. For instance,
as illustrated by Examples 37 and 38 in
the ANPRM, which are incorporated
into the proposed rule, it would not be
a prohibited transaction for a U.S.
person to enter into a vendor agreement
to have bulk U.S. sensitive personal data
processed or stored by a foreign person
that is not a covered person, even if that
foreign person then employs covered
persons and grants them access to the
data (absent any indication of evasion or
knowing direction).67 In those
circumstances, the U.S. person would
not be expected to conduct due
diligence on the foreign person’s
employment practices as part of its riskbased compliance program.
Several commenters sought clarity
about liability where service providers
have little or no knowledge of the data
that customers keep or transact on their
infrastructure. They also requested that
the Department distinguish between
data controllers and data processers. In
response to these comments, the
proposed rule has provided additional
examples to clarify the function of the
67 89
PO 00000
FR 15792.
Frm 00018
Fmt 4701
Sfmt 4702
‘‘knowingly’’ standard. See
§ 202.230(b)(2)–(6). As the examples
demonstrate, if a U.S. entity merely
provides a software platform or owns or
operates infrastructure for a U.S.
customer, and thus does not know or
reasonably should not know of the kind
or volume of data involved, then the
U.S. entity generally would not
‘‘knowingly’’ engage in a prohibited
transaction if the U.S. customer uses
their platform or infrastructure to
engage in a prohibited transaction.
Instead, the U.S. customer would
generally be responsible for having
‘‘knowingly’’ engaged in the prohibited
transaction. Likewise, if a U.S. entity
merely stores encrypted data on behalf
of a U.S. customer and does not have
access to the encryption key (or has
access only to an emergency backup
encryption key usable only at the
customer’s explicit request), and if the
U.S. entity is reasonably unaware of the
kind or volume of data involved, the
U.S. entity generally would not meet the
‘‘knowingly’’ standard of the proposed
rule.
The Department declines, however, to
draw a categorical distinction between
processors and controllers in the
proposed rule. Inserting a categorical
distinction based on the kind of entity
would be inconsistent with the structure
and overall approach of the proposed
rule, which addresses activities that
present an unacceptable national
security risk. In addition, as the new
examples illustrate, the same kinds of
entities can engage in different kinds of
activities, some of which (such as
merely providing a software platform)
raise different risks than others (such as
providing a software platform and
services to handle and process the data).
The ‘‘knowingly’’ standard provides the
requisite flexibility to address the
national security risks while providing
a basis to distinguish responsibility
based on the activities and roles that
particular entities may have. The
proposed rule thus adopts the approach
described in the ANPRM with the
additional examples described above in
this section to illustrate the
‘‘knowingly’’ standard.
Similarly, one comment sought
clarification that the proposed rule
would apply only to U.S. persons that
have or maintain control over the bulk
U.S. sensitive personal data involved in
a prohibited or restricted transaction. As
the commenter explained, an
automobile manufacturer should not
have compliance obligations with
respect to bulk U.S. sensitive personal
data that is transferred via an
aftermarket device that was installed in
a vehicle fleet by the owner. As
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
previewed in the ANPRM, the proposed
rule imposes prohibitions and
restrictions only on U.S. persons that
are engaged in covered data transactions
that meet certain criteria. In the
commenter’s example, the U.S.
automobile manufacturer has not
engaged in a covered data transaction
with respect to the aftermarket device.
As a result, no change was made to the
proposed rule in response to this
comment.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
B. Subpart D—Restricted Transactions
1. Section 202.401—Authorization To
Conduct Restricted Transactions;
Section 202.402—Incorporation by
Reference
The proposed rule sets forth three
classes of transactions (vendor
agreements, employment agreements,
and investment agreements) that are
prohibited unless the U.S. person
entering into the transactions complies
with the ‘‘security requirements’’
referenced in section 202.248. The goal
of the proposed security requirements is
to address national security and foreignpolicy threats that arise when countries
of concern and covered persons access
government-related data or bulk U.S.
sensitive personal data that may be
implicated by the categories of restricted
transactions. The security requirements
have been developed and proposed by
the Cybersecurity and Infrastructure
Security Agency (‘‘CISA’’) in
coordination with the Department. CISA
has published the proposed
requirements—the CISA Proposed
Security Requirements for Restricted
Transactions—on its website, as
announced via a Federal Register notice
requesting comment on those proposed
security requirements issued
concurrently with this proposed rule.
The proposed security requirements
require U.S. persons engaging in
restricted transactions to comply with
organizational and system-level
requirements, such as ensuring that
basic organizational cybersecurity
policies, practices, and requirements are
in place, as well as data-level
requirements, such as data
minimization and masking, encryption,
or privacy-enhancing techniques. After
CISA receives and considers public
input, it will revise as appropriate and
publish the final security requirements.
The Department of Justice will then
incorporate by reference the published
final security requirements in the final
rule that the Department issues.
Interested parties can view CISA’s
proposed security requirements on
CISA’s website at https://www.cisa.gov/
and can review CISA’s notice
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
requesting comments on the proposed
security requirements in the notice
docketed as CISA–2024–0029 (October
29, 2024).
The proposed rule also clarifies that
restricted transactions are not
prohibited only if they comply with the
security requirements and other
applicable requirements for conducting
restricted transactions. The proposed
rule includes a new example that makes
it clear that U.S. persons engaging in
restricted transactions may not, absent a
license, use measures other than the
security requirements and other
applicable conditions to mitigate the
risk posed by country-of-concern or
covered-person access.
Some commenters provided feedback
on the security requirements that would
govern restricted transactions. As
explained in the ANPRM, CISA will be
soliciting comments on the proposed
security requirements as part of a
separate notice-and-comment process in
parallel with this NPRM, and the
Department urges commenters to
provide any comments on the security
requirements through that process.
2. Section 202.258—Vendor Agreement
The proposed rule defines a ‘‘vendor
agreement’’ as any agreement or
arrangement, other than an employment
agreement, in which any person
provides goods or services to another
person, including cloud-computing
services, in exchange for payment or
other consideration. The ANPRM
contemplated defining the term ‘‘cloudcomputing services’’ as that term is
defined in NIST Special Publication
(‘‘SP’’) 800–145.68 NIST SP 800–145
describes cloud computing in a way that
includes different essential
characteristics, deployment models, and
service models, such as ‘‘Infrastructure
as a Service (IaaS),’’ ‘‘Platform as a
Service (PaaS),’’ and ‘‘Software as a
Service (SaaS).’’ 69 Because cloud
computing is just one example of
several types of services that may be
involved in a vendor agreement, it does
not appear useful to separately or
specially define that term in the
proposed rule at this time. The
Department may consider issuing
guidance in the future that describes
cloud computing in reference to the
NIST definition.
68 89
FR 15788.
Peter Mell & Timothy Grance, The NIST
Definition of Cloud Computing (NIST, SP 800–145,
Sept. 2011), https://nvlpubs.nist.gov/nistpubs/
Legacy/SP/nistspecialpublication800-145.pdf
[https://perma.cc/HUJ5-B2JS].
69 See
PO 00000
Frm 00019
Fmt 4701
Sfmt 4702
86133
3. Section 202.217—Employment
Agreement
The proposed rule defines an
‘‘employment agreement’’ as any
agreement or arrangement in which an
individual, other than as an
independent contractor, performs work
or performs job functions directly for a
person in exchange for payment or other
consideration, including employment
on a board or committee, executive-level
arrangements or services, and
employment services at an operational
level.
4. Section 202.228—Investment
Agreement
The proposed rule defines an
‘‘investment agreement’’ as any
agreement or arrangement in which any
person, in exchange for payment or
other consideration, obtains direct or
indirect ownership interests in or rights
in relation to (1) real estate located in
the United States or (2) a U.S. legal
entity. The proposed rule categorically
excludes certain passive investments
that do not pose an unacceptable risk to
national security because they do not
give countries of concern or covered
persons a controlling ownership
interest, rights in substantive decisionmaking, or influence through a noncontrolling interest that could be
exploited to access government-related
data or bulk U.S. sensitive personal
data. Specifically, the proposed rule
excludes from ‘‘investment agreement’’
investments (1) in any publicly traded
security, in any security offered by any
investment company that is registered
with the United States Securities and
Exchange Commission, such as index
funds, mutual funds, exchange-traded
funds, or made as limited partners (or
equivalent) into a venture capital fund,
private equity fund, fund of funds, or
other pooled investment fund, if the
limited partner’s contributions and
influence are circumscribed as set forth
in the proposed rule; (2) that give the
covered person less than 10 percent of
total voting and equity interest in a U.S.
person; and (3) that do not give a
covered person rights beyond those
reasonably considered to be standard
minority shareholder protections.
With respect to the requirement of a
de minimis percentage of total voting
and equity interest, the Department is
considering a range of different
proposals. The proposed rule’s
definition of ‘‘investment agreement’’
would apply to investments that give a
covered person a certain percentage or
more of total voting and equity interest
in a U.S. person, even where that
investment is not accompanied by other
E:\FR\FM\29OCP2.SGM
29OCP2
86134
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
formal rights beyond standard minority
shareholder protections. The proposed
rule would include this de minimis
threshold to account for the
unacceptable national security risk
posed by otherwise passive investments
that may provide investors with
meaningful economic leverage or
informal influence over access to a
company’s assets (like sensitive
personal data) even when the investors
do not obtain formal rights, control, or
access beyond standard minority
shareholder protections. The proposed
rule would tentatively set this threshold
number at 10 percent to exclude truly
passive investments while also
capturing investments that informally
may provide covered persons with
influence that presents unacceptable
national security risks. The Department
is also considering de minimis
thresholds that are significantly lower
and higher than this percentage, such as
the 5 percent threshold above which
investors must publicly report their
direct or indirect beneficial ownership
of certain covered securities under the
Securities Exchange Act of 1934, 15
U.S.C. 78m(d). As a result, the final
figure in the proposed rule could
potentially cover passive investments
that provide less (or more) than 10percent voting and equity interests in a
U.S. person. The Department invites
public comment on the specific de
minimis threshold that should be used
in this exception for passive
investments.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
C. Subpart E—Exempt Transactions
As previewed in the ANPRM, the
proposed rule exempts several classes of
data transactions from the scope of the
proposed rule’s prohibitions.
1. Section 202.501—Personal
Communications; Section 202.502—
Information or Informational Materials;
and Section 402.503—Travel
The proposed rule exempts three
classes of data transactions to the extent
that they involve data that is statutorily
exempt from regulation under IEEPA:
personal communications, information
or informational materials, and data that
is ordinarily incident to travel to or from
another country.
One comment suggested clarifying
that the exemption for personal
communications that do ‘‘not involve a
transfer of anything of value’’ under 50
U.S.C. 1702(b)(1) is ‘‘inclusive of
business and commercial transactions.’’
The proposed rule makes no change in
response to this comment, as the
clarification does not seem necessary at
this time, given the scope of the
statutory exemption and the proposed
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
rule. Section 1702(b)(1) applies to any
‘‘personal communication,’’ so it would
be inappropriate to rely on that statutory
language to exempt, as this comment
suggests, ‘‘business and commercial
transactions.’’ Further, the categories of
sensitive personal data encompassed by
the proposed rule do not include any
personal communications. For example,
fingerprints and other biometric
identifiers, human genetic testing
results, and data about financial assets
and liabilities are not
‘‘communications’’ from one person to
another. Any clarification of the phrase
‘‘a transfer of anything of value,’’
therefore, does not appear necessary. To
the extent the commenters, a group of
trade associations representing
telecommunications providers, are
concerned that personal
communications between individuals
that do not involve a transfer of
anything of value are business
transactions from their perspective, as
purveyors of telecommunications
services, the Department refers the
commenters to the qualified exemption
for telecommunications services in
proposed § 202.509.
The Department discusses the
exemption for information or
informational materials in part VI of this
preamble.
Although not raised by commenters,
the proposed rule also adds a separate
exemption for data transactions that are
ordinarily incident to travel to or from
another country, such as arranging
travel or importing baggage for personal
use. This exemption implements and
tracks the statutory exemption in 50
U.S.C. 1702(b)(4).
2. Section 202.504—Official Business of
the United States Government
Adopting the approach contemplated
in the ANPRM without change, the
proposed rule exempts data transactions
to the extent that they are for (1) the
conduct of the official business of the
United States Government by its
employees, grantees, or contractors; (2)
any authorized activity of any United
States Government department or
agency (including an activity that is
performed by a Federal depository
institution or credit union supervisory
agency in the capacity of receiver or
conservator); or (3) transactions
conducted pursuant to a grant, contract,
or other agreement entered into with the
United States Government. Most
notably, this exemption would exempt
grantees and contractors of Federal
departments and agencies, including the
Department of Health and Human
Services, the Department of Veterans
Affairs, the National Science
PO 00000
Frm 00020
Fmt 4701
Sfmt 4702
Foundation, and the Department of
Defense, so that those agencies can
pursue grant-based and contract-based
conditions to address risks that
countries of concern can access
sensitive personal data in transactions
related to their agencies’ own grants and
contracts, as laid out in section 3(b) of
the Order—without subjecting those
grantees and contractors to dual
regulation.
3. Section 202.505—Financial Services
Section 2(a)(v) of the Order exempts
any transaction that is ‘‘ordinarily
incident to and part of the provision of
financial services, including banking,
capital markets, and financial insurance
services, or required for compliance
with any Federal statutory or regulatory
requirements, including any regulations,
guidance, or orders implementing those
requirements.’’ 70 The proposed rule
defines these exempt transactions in
further detail. Notably, the proposed
rule exempts the transfer of personal
financial data or covered personal
identifiers incidental to the purchase
and sale of goods and services (such as
the purchase, sale, or transfer of
consumer products and services through
online shopping or e-commerce
marketplaces, while still prohibiting
these marketplaces from conducting
data transactions that involve data
brokerage), as well as exempting the
transfer of personal financial data or
covered personal identifiers for the
provision or processing of payments or
funds transfers.
Numerous commenters expressed
support for the financial-services
exemption. Commenters expressed
appreciation for the exemption’s careful
scoping to enable business and
commercial transactions. Commenters
sought specific edits to the paymentprocessing part of the exemption to
ensure that it covers operations
involving payment dispute resolution,
payor authentication, tokenization,
payment gateway, payment fraud
detection, payment resiliency,
mitigation and prevention, and
payment-related loyalty point program
administration. The Department
appreciates these suggested
clarifications, and the proposed rule
incorporates these proposed edits by
explicitly adding the provision of
services ancillary to processing
payments and funds transfers, with the
suggested examples, to the list of
exempt financial services transactions.71
The financial-services exemption aims
to identify the low-risk business and
70 89
71 89
E:\FR\FM\29OCP2.SGM
FR 15423.
FR 15794.
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
commercial transactions that should
continue unimpeded while also
ensuring that the Order and its
implementing regulations do not serve
as a broader economic decoupling from
countries of concern. These edits are
consistent with that purpose.
Another commenter also suggested
that investment-management services be
included in the financial-services
exemption. The Department does not
intend to impede activities that are
ordinarily incident to and part of the
provision of investment-management
services that manage or provide advice
on investment portfolios or individual
assets for compensation (such as
devising strategies and handling
financial assets and other investments
for clients) or provide services ancillary
to investment-management services
(such as broker-dealers executing trades
within a securities portfolio based upon
instructions from an investment
advisor). For further clarity, the
proposed rule explicitly adds
investment-management services to the
financial-services exemption set out in
§§ 202.505(a)(1) and 202.505(a)(6).
One commenter requested an
exemption for cargo-related information
containing listed identifiers. The
Department believes this comment is
focused on scenarios in which bulk
personal identifiers are transferred as
part of shipping purchased goods
internationally. The Department
declines to adopt a separate exemption,
or an expansion of the scope of the
exemption for transfers of data required
by or authorized by Federal law or
international agreement, for cargorelated information because the
proposed rule already exempts the
transfer of personal financial data or
covered personal identifiers incidental
to the purchase and sale of goods and
services. This existing exemption
appears to adequately address the
scenario raised by the commenter. Thus,
the proposed rule adopts the approach
described in the ANPRM.
Although not raised by any
commenters, the Department is also
considering whether and how the
financial-services exemption should
apply to employment and vendor
agreements between U.S. financialservices firms and covered persons
where the underlying financial services
provided do not involve a country of
concern. Under this exemption, U.S.
persons would be required to evaluate
whether a particular data transaction
(such as a transaction involving data
brokerage or a vendor, employment, or
investment agreement) is ‘‘ordinarily
incident to and part of’’ the provision of
financial services such that it is treated
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
as an exempt transaction.72 At one end
of the spectrum, and as previewed by
Example 53 in the ANPRM, if a U.S.
financial institution or financialservices company uses a data center
operated by a covered person in a
country of concern to facilitate
payments to U.S. persons in that
country of concern, the proposed rule
would treat that vendor agreement as
‘‘ordinarily incident to and part of’’ the
facilitation of those payments—and thus
exempt.73 See § 202.505(b)(3). On the
other end of the spectrum, and as
previewed by Example 27 in the
ANPRM, if a U.S. financial institution or
financial-services company hires a
covered person as a data scientist with
access to its U.S. customers’ bulk
personal financial data to develop a new
app that could be sold as a standalone
product to the company’s customers, the
proposed rule would treat this
employment agreement as not
‘‘ordinarily incident to and part of’’ the
financial services provided by the U.S.
company—and thus not exempt.74 See
§ 202.217(b)(4).
Between those two ends of the
spectrum, the Department is considering
whether the transactions in the
following new examples should be
treated as exempt transactions or as
restricted transactions:
• New example in § 202.505(b)(4).
Same as Example 3 (see § 202.505(b)(3)),
but the underlying payments are
between U.S. persons in the United
States and do not involve a country of
concern: A U.S. bank or other financial
institution, to facilitate payments that
do not involve a covered person or
country of concern (e.g., between U.S.
persons in the United States), stores and
processes the customers’ bulk financial
data using a data center operated by a
third-party service provider in a country
of concern, which is a covered person.
Should the vendor agreement with the
covered person, which is otherwise a
restricted transaction, be treated as
‘‘ordinarily incident to and part of’’ the
72 Cf., e.g., 31 CFR 560.405(c) (discussing OFAC
exemption for transactions ‘‘ordinarily incident to
a licensed transaction’’ as applied to scenarios
involving the provision of transportation services to
or from Iran), 515.533 n.1 (discussing OFAC
exemption for transactions ‘‘ordinarily incident to’’
a licensed transaction as applied to scenarios
involving the licensed export of items to any person
in Cuba); Letter from R. Richard Newcomb,
Director, U.S. Dep’t of Treas., Off. of Foreign Assets
Control, Re: Iran: Travel Exemption (Nov. 25, 2003),
https://ofac.treasury.gov/media/7926/
download?inline [https://perma.cc/3VRL-X886]
(discussing the OFAC exemption for transactions
‘‘ordinarily incident to’’ travel as applied to
scenarios involving the use of airline-service
providers from a sanctioned jurisdiction).
73 89 FR 15794.
74 89 FR 15789.
PO 00000
Frm 00021
Fmt 4701
Sfmt 4702
86135
U.S. financial institution’s facilitation of
payments that do not involve a covered
person or country of concern?
• New example in § 202.505(b)(12). A
U.S. company provides wealthmanagement services and collects bulk
personal financial data on its U.S.
clients. The U.S. company appoints a
citizen of a country of concern, who is
located in a country of concern, to its
board of directors. In connection with
the board’s data security and
cybersecurity responsibilities, the
director could access the bulk personal
financial data. Should the employment
agreement with the covered person as a
board director, which is otherwise a
restricted transaction, be treated as
‘‘ordinarily incident to and part of’’ the
U.S. company’s provision of wealthmanagement services to its U.S. clients?
The Department is tentatively
considering treating the transactions in
both examples as restricted transactions
because it does not believe that an
employment agreement (including the
hiring of board members) or a vendor
agreement that gives a covered person
access to U.S. persons’ bulk sensitive
personal data is a reasonable and typical
practice in providing the underlying
financial services that do not otherwise
involve covered persons or a country of
concern. These transactions therefore
appear to pose the same unacceptable
national security risk regardless of the
kinds of underlying services provided
by the U.S. person. The Department
welcomes public comment to inform its
resolution of this issue, including the
extent to which it is reasonable,
necessary, and typical practice for U.S.
financial-services firms to hire covered
persons as employees or vendors with
access to U.S. persons’ bulk sensitive
personal data as part of providing
financial services that do not involve a
country of concern; why U.S. financialservices firms hire covered persons
instead of non-covered persons in those
circumstances; and any additional
compliance costs that would be
incurred if the transactions in these
examples were treated as restricted
transactions. In addition, after issuance
of the final rule, the Department intends
to consult the Department of the
Treasury and Federal financial
regulatory agencies as part of issuing
any guidance or advisory opinions
regarding the application of the
financial-services exemption.
4. Section 202.506—Corporate Group
Transactions
As previewed in the ANPRM, the
proposed rule exempts covered data
transactions to the extent that they are
(1) between a U.S. person and its
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86136
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
subsidiary or affiliate located in (or
otherwise subject to the ownership,
direction, jurisdiction, or control of) a
country of concern; and (2) ordinarily
incident to and part of administrative or
ancillary business operations (such as
sharing employees’ covered personal
identifiers for human-resources
purposes; payroll transactions like the
payment of salaries and pensions to
overseas employees or contractors;
paying business taxes or fees;
purchasing business permits or licenses;
sharing data with auditors and law firms
for regulatory compliance; and risk
management). The ANPRM called this
exemption ‘‘intra-entity transactions.’’ 75
For greater clarity and accuracy, the
proposed rule revises the name of this
exemption to ‘‘corporate group
transactions.’’
Some commenters requested that the
Department broaden the corporate group
transactions exemption to include
routine business activities performed by
third-party service providers. Similarly,
commenters proposed augmenting the
same exemption to include suppliers
and other third-party vendors who are
contractually bound to maintain privacy
requirements and who engage in
product and services development,
research, and improvement activities for
U.S. companies. The Department
declines to incorporate these
suggestions because they would not
adequately mitigate the threats posed by
access to government-related data or
bulk U.S. sensitive personal data by a
country of concern or covered person.
Thus, the proposed rule adopts the
approach described in the ANPRM
without change, permitting restricted
transactions involving vendor
agreements to proceed as long as they
comply with the proposed rule’s
security requirements designed to
mitigate access to the sensitive personal
data by countries of concern and
covered persons.
One commenter requested
clarification that it would not be a
prohibited transaction for a U.S.
company to provide access to a global
company staff directory to its business
office and employees located in a
country of concern. Consistent with the
approach contemplated in the ANPRM,
this scenario would not be a prohibited
or restricted transaction under the
proposed rule for two independent
reasons. First, a company directory
containing only contact or demographic
data linked to other contact or
demographic data would not fall within
the definition of ‘‘covered personal
identifiers’’ and thus would not
75 89
FR 15794.
VerDate Sep<11>2014
17:46 Oct 28, 2024
constitute government-related data or
bulk U.S. sensitive personal data. As a
result, there would be no covered data
transaction in providing such a
directory. Second, the U.S. company’s
sharing of the directory would not be a
prohibited or restricted transaction,
regardless of whether the business office
is a foreign branch or a subsidiary or
affiliate: if the business office in the
country of concern is a branch of the
U.S. company, the branch is part of the
same ‘‘U.S. person’’ as the U.S.
company, and the U.S. company has not
engaged in any transaction with a
foreign person in the first place. If, by
contrast, the business office is a
subsidiary or affiliate of the U.S.
company, the sharing is an exempt
corporate group transaction because a
transaction within a corporate group
granting its employees access to a
company directory is ordinarily
incident to ancillary or administrative
business operations. (In different
circumstances where that exemption is
not applicable, a transaction within a
corporate group that gives an employee
who is a covered person access to
government-related data or bulk U.S.
sensitive personal data would generally
be a restricted employment agreement.)
5. Section 202.507—Transactions
Required or Authorized by Federal Law
or International Agreements, or
Necessary for Compliance With Federal
Law
As previewed in the ANPRM, the
proposed rule exempts covered data
transactions to the extent that they are
required or authorized by Federal law,
international agreements or specified
global health and pandemic
preparedness measures, or necessary for
compliance with Federal law.
Some commenters requested clarity
about whether the exemption for
regulatory compliance (which the
ANPRM contemplated as part of the
financial-services exemption) applies to
compliance with all Federal law, not
just financial laws.76 The Department
acknowledges that this is a correct
understanding of this exemption. To
improve clarity and reflect this
understanding, the proposed rule moves
the exemption for compliance with
Federal law from the financial-services
exemption to a standalone subpart of
the exemption for transactions required
or authorized by Federal law or
international agreements.
The proposed rule clarifies that, with
respect to international agreements
authorizing or requiring data
transactions, the exemption applies only
76 89
Jkt 265001
PO 00000
FR 15794–95.
Frm 00022
Fmt 4701
Sfmt 4702
to international agreements to which the
United States is a party. Some
commenters requested a non-exhaustive
list of international agreements to which
this exemption applies. The proposed
rule adds an illustrative list of specific
international agreements to which this
exemption applies.
One commenter sought clarification
on whether transactions required or
authorized by international agreements
include transactions in accordance with
arrangements that facilitate
international commercial data flows,
such as the Global Cross-Border Privacy
Rules (‘‘G–CBPR’’) and Global Privacy
Recognition for Processors (‘‘G–PRP’’)
Systems of the Global Cross-Border
Privacy Rules Forum (‘‘Global CBPR
Forum’’) and the Asia-Pacific Economic
Cooperation (‘‘APEC’’) Cross-Border
Privacy Rules (‘‘APEC CBPR’’) and
APEC Privacy Recognition for
Processors Systems. These arrangements
are outside the scope of the exemption
for international agreements. These
arrangements consist of frameworks for
coordinating national regulatory
measures, and they do not facilitate the
sharing of data between the U.S. and a
country of concern. Thus, data
transactions covered by this proposed
rule would not be ‘‘pursuant to these
arrangements as necessary to meet the
definitional requirements of the
exemption. The Department further
declines to expand the scope of the
exemption to incorporate these
arrangements, which are designed to
address general privacy concerns and
other issues rather than the national
security risks detailed in the Order. The
same commenter also sought clarity as
to whether the EU–U.S. Data Privacy
Framework (‘‘DPF’’) would be such an
international agreement. The EU–U.S.
DPF is similarly an arrangement that
falls outside the scope of the exemption.
The EU–U.S. DPF fulfills different
objectives than the proposed rule and
does not facilitate the sharing of
information between a U.S. person and
a country of concern or covered person.
For example, under the EU–U.S. DPF
and pursuant to Executive Order 14086
of October 7, 2022 (Enhancing
Safeguards for United States Signals
Intelligence Activities), the Attorney
General determined that the laws of EU/
European Economic Area countries
require appropriate safeguards for
signals intelligence activities affecting
U.S. persons’ personal data.77
77 E. O. 14086, 87 FR 62283 (Oct. 7, 2022); Dep’t
of Just., Attorney General Designations of the
European Union, Iceland, Liechtenstein, and
Norway as ‘‘Qualifying States’’, 88 FR 44844 (July
13, 2023).
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
Furthermore, while DPF- and APEC
CBPR-certified companies are subject to
domestic law, including the Order, no
DPF or APEC CBPR countries or
jurisdictions are currently designated as
countries of concern under this
Executive Order. As such, the
provisions of the Order would not apply
to transfers conducted in reliance on the
DPF or APEC CBPR, and any data
transactions that the proposed rule does
cover would not be ‘‘pursuant to’’ such
arrangements as required for this
exemption. Therefore, the proposed rule
adopts the approach contemplated by
the ANPRM without change.
6. Section 202.508—Investment
Agreements Subject to a CFIUS Action
Adopting the approach contemplated
by the ANPRM, the proposed rule
exempts investment agreements to the
extent that they are the subject of a
‘‘CFIUS action’’ as defined in section
202.207 (i.e., CFIUS has suspended a
proposed or pending transaction, or
entered into or imposed mitigation
measures to address a national security
risk involving access to sensitive
personal data by countries of concern or
covered persons). The rationale for this
approach is discussed separately in part
IV.K of this preamble.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
7. Section 202.509—
Telecommunications Services
The proposed rule exempts
transactions that are ordinarily incident
to and part of telecommunications
services.
Multiple commenters requested that
the proposed rule include an additional
exemption for data that is incidental to
the provision and delivery of
communications services. They asked
that this kind of data be carved out from
the scope of any restrictions on sensitive
personal data for consumers,
enterprises, and governments, including
but not limited to international calling,
mobile voice, and data roaming.
Commenters also requested that
communications service providers be
able to use, disclose, or permit access to
covered data obtained from their
customers, either directly or indirectly
through agents, to initiate, render, bill,
and collect for communications
services. These commenters assert that
global commerce relies on effective and
efficient global communications, that
restrictions on such bulk U.S. sensitive
personal data could hinder the ability of
Americans to communicate globally,
and that the United States Government
has long held a policy of ensuring that
communications are enabled even with
countries subject to U.S. sanctions.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
The Department appreciates the need
to ensure Americans’ ability to
communicate globally, including with
and in countries of concern, and does
not intend for these regulations to
impede the ability of U.S.
telecommunications service providers to
operate. Accordingly, the Department
has included in the proposed rule an
exemption that seeks to address this
concern. The proposed exemption is
intended to be narrowly tailored to
ensure that U.S. telecommunications
service providers retain the ability to
operate unimpeded while also
continuing to mitigate the national
security risk associated with data
brokerage (i.e., the sale of or leasing of
access to customer data) to countries of
concern and covered persons.
8. Section 202.510—Drug, Biological
Product, and Medical Device
Authorizations
Under the proposed rule, certain data
transactions necessary to obtain and
maintain regulatory approval to market
a drug, biological product, medical
device, or combination product in a
country of concern would be exempt
from the prohibitions in the proposed
rule. This exemption balances the need
to mitigate the risks to U.S. national
security from the unrestricted transfer of
bulk U.S. sensitive personal data to
countries of concern against the
scientific, humanitarian, and economic
interests in enabling the sale of
medicines in those countries. The
proposed rule includes reporting
requirements that will allow the
Department to maintain visibility on the
type and amount of data that is being
transmitted to countries of concern
under this exemption.
This exemption is limited to data that
is de-identified; required by a regulatory
entity to obtain or maintain
authorization or approval to research or
market a drug, biological product,
device, or combination product (i.e.,
covered product); and reasonably
necessary to evaluate the safety and
effectiveness of the covered product. For
example, de-identified data that is
gathered in the course of a clinical
investigation and would typically be
required for Food and Drug
Administration (‘‘FDA’’) approval of a
covered product would generally fall
within the exemption. Conversely,
clinical participants’ precise geolocation
data, even if required by a country of
concern’s regulations, would fall
outside the scope of the exemption
because such data is not reasonably
necessary to evaluate safety or
effectiveness.
PO 00000
Frm 00023
Fmt 4701
Sfmt 4702
86137
The Department recognizes that data
collection and submission continue
beyond the initial regulatory approval
process, and it intends the term
‘‘regulatory approval data’’ to include
data from post-market clinical
investigations (conducted under
applicable FDA regulations, including
21 CFR parts 50 and 56), clinical care
data, and post-marketing surveillance,
including data on adverse events.78 For
example, where continued approval to
market a drug in a country of concern
is contingent on submission of data
from ongoing product vigilance or other
post-market requirements, the
exemption applies.
The exemption applies even where
FDA authorization for a product has not
been sought or obtained. The
Department does not, in these
regulations, intend to require U.S.
companies to first seek authorization to
market a product in the United States
before seeking regulatory approval from
a country of concern.
The exemption is limited to
transactions that are necessary to obtain
or maintain regulatory approval in the
country of concern. The Department
specifically invites comments on the
types of transactions that are necessary
to that end. By way of illustration,
Example 3 of § 202.510, as proposed,
would not exempt a vendor or
employment agreement with a covered
person to prepare data for submission to
a country of concern’s regulatory entity
because the Department does not
currently believe that such transactions
are necessary to obtain regulatory
approval. The Department seeks
comments on whether, and why, such a
vendor or employment agreement with
a covered person to prepare data for
submission is necessary and should be
exempt.
As Example 3 reflects, the Department
does not currently believe that it is
reasonably necessary to use a covered
person—as opposed to services
provided by the U.S. company itself or
by a non-covered person—to prepare
data for regulatory submission.
Although the marginal risk to national
security from granting additional
covered persons access to the
submission data may be low, given that
the submission data is ultimately being
transferred directly to the government of
78 See U.S. Food & Drug Admin., What Is a
Serious Adverse Event? (May 18, 2023), https://
www.fda.gov/safety/reporting-serious-problems-fda/
what-serious-adverse-event#:∼:text=An%20adverse
%20event%20is%20any,medical%20product%20in
%20a%20patient [https://perma.cc/9Q23-HRWY]
(‘‘An adverse event is any undesirable experience
associated with the use of a medical product in a
patient’’).
E:\FR\FM\29OCP2.SGM
29OCP2
86138
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
a country of concern, the Department
believes that a third-party vendor in this
scenario may require access to a broader
set of data than the regulatory body
itself. At the same time, the Department
recognizes that regulatory and legal
expertise relevant to a country of
concern is likely to be concentrated in
the country of concern. Employment
and vendor transactions in this context
would be restricted, not prohibited,
transactions, and generally could
proceed if the requirements applicable
to restricted transactions were followed.
The Department welcomes comments
that address this scenario and other
similar transactions, including the
potential impacts to clinical research,
medical product development and
authorizations, and companies’ business
practices and operations, as well as the
feasibility of obtaining regulatory
approval without engaging covered
persons to access bulk U.S. sensitive
personal data or if such engagements are
subject to the security, recordkeeping,
and reporting requirements applicable
to restricted transactions.
The exemption requires that parties
engaged in transactions involving
regulatory approval data with countries
of concern nonetheless comply with the
recordkeeping and reporting
requirements otherwise applicable to
U.S. persons engaged in restricted
transactions, because of the heightened
national security risk that arises from
transmitting U.S. sensitive personal data
or government-related data directly to a
government entity in a country of
concern.
The Department seeks comment on
the proposed scope of this exemption,
including on the definition of regulatory
approval data and the extent to which
data submissions to regulatory entities
in countries of concern may involve
personally identifiable data.
9. Section 202.511—Other Clinical
Investigations and Post-Marketing
Surveillance Data
A few commenters expressed
concerns that the proposed rule’s
inclusion of aggregated and anonymized
data would prohibit companies from
launching clinical investigations in
countries of concern. Commenters also
noted the possibility that overly
restrictive prohibitions might harm
biopharmaceutical innovation. The
Department has considered these
comments and agrees that some
exemption or accommodation for
clinical research may be appropriate.
The Department proposed the
exemption in § 202.511 for that purpose.
To help inform the appropriate contours
of the proposed provision, the
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
Department invites additional
comments that illustrate the scope of
transactions that might be subject to the
proposed rule’s restrictions and
prohibitions and the consequences for
clinical research if the proposed
prohibitions and restrictions were
applied to that context.
The United States has a national
security interest in the development,
authorization, and availability of
medical products, including medical
countermeasures to diagnose, treat, or
prevent serious or life-threatening
diseases or conditions that may be
attributable to biological, chemical,
radiological, or nuclear agents. The
Department seeks to mitigate the
national security risk described in the
Order without unduly burdening the
biomedical innovation that benefits U.S.
persons. The Department is considering
how to effectively strike that balance
and how to scope an exemption for
transactions related to or supporting
FDA-regulated research to meet that
goal.
The Department is considering the
scope of a possible exemption along
three axes. First, in terms of the types
of data that would be within the
exemption; second, in terms of the types
of transactions involving that data that
would be exempted; and third, in terms
of the duration of any exemption.
On the first axis, the Department
anticipates that any exemption would
concern data obtained in the course of
clinical investigations related to drugs,
biological products, devices, and
combination products, as those terms
are defined in the Federal Food, Drug,
and Cosmetic Act (‘‘FD&C Act’’) and
FDA regulations. The Department
believes that these products raise the
most significant countervailing
economic, health, and scientific
concerns that might outweigh the
national security interests otherwise at
stake. The Department seeks comment
on whether the exemption should
exempt clinical investigations data
related to other products, such as foods
(including dietary supplements) that
bear a nutrient content claim or a health
claim, food and color additives, and
electronic products, as those terms are
defined in the FD&C Act.
The Department also recognizes the
existing regulatory framework in these
contexts and is evaluating whether these
provisions adequately reduce the
national security risk associated with
the transfer of bulk U.S. sensitive
personal data to a country of concern or
covered person. The FD&C Act and FDA
regulations provide a robust framework
to protect the confidentiality and
privacy of data collected from subjects
PO 00000
Frm 00024
Fmt 4701
Sfmt 4702
in clinical investigations. This current
framework of statutory and regulatory
requirements protects the rights and
safety of human subjects, ensuring that
their private information is handled
securely. For example, section 505(i) (21
U.S.C. 355(i)) and section 520(g) (21
U.S.C. 360j(g)) of the FD&C Act address
the use of investigational new drugs and
investigational devices, respectively, in
clinical investigations and require that
informed consent be obtained from
subjects, with certain exceptions.
The implementing regulations
established by the FDA in 21 CFR parts
50, 56, 312, and 812 include various
requirements, including related to
informed consent of human subjects and
Institutional Review Boards (‘‘IRBs’’).
For example, 21 CFR part 56 details
requirements for IRB review, approval,
and ethical oversight of FDA-regulated
clinical investigations. Information
about the confidentiality of records
must be given to prospective subjects as
part of informed consent (21 CFR
50.25(a)(5)), and to approve research, an
IRB must determine that, where
appropriate, there are adequate
provisions to protect the privacy of
subjects and to maintain the
confidentiality of data (21 CFR
56.111(a)(7)). In addition, FDA
regulations in 21 CFR part 11 establish
requirements to ensure the authenticity,
integrity, and, when appropriate,
confidentiality of certain electronic
records (21 CFR 11.10, 11.30). The FDA
further issued a proposed rule in
September 2022 proposing to require
that certain information about future
secondary use of subjects’ information
or biospecimens be provided to
prospective subjects.79
These regulations are principally
focused on patient privacy, however,
and do not directly address the national
security concerns that animate the
Order. As the Department has explained
elsewhere in this preamble, privacy
protections, in general, focus on
addressing individual rights and
preventing individual harm by
protecting individuals’ right to control
the use of their own data and reducing
the potential harm to individuals by
minimizing the collection of data on the
front end and limiting the permissible
uses of that data on the back end.
National security measures, by contrast,
focus on collective risks and
externalities that may result from how
individuals and businesses choose to
sell and use their data, including in
lawful and legitimate ways. But the
79 Protection of Human Subjects and Institutional
Review Boards, 87 FR 58733 (proposed Sept. 28,
2022).
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
Department is evaluating whether these
existing regulations—for example, the
requirements for informed consent
under 21 CFR part 50—could offer
sufficiently robust protection to also
mitigate national security concerns.
The exemption would also apply to
clinical care data indicating real-world
performance or safety of products, or
post-marketing surveillance data
(including pharmacovigilance and postmarketing safety monitoring), where
necessary to support or maintain
authorization by the FDA. These
submissions to FDA involve
deidentified data and the exemption
arising under proposed § 202.511(a)(2)
would apply only to deidentified data.
On the second axis, the Department is
considering what kinds of transactions
to exempt when they involve data that
implicates the exemption—such as,
hypothetically, bulk U.S. sensitive
personal data collected in the course of
an FDA-regulated clinical investigation
to develop a drug. One possibility
would be to exempt all transactions that
are part of the conduct of the
investigation. Another possibility would
be to limit an exemption to only certain
types of transactions that are especially
important to the conduct of a clinical
investigation and that cannot feasibly be
avoided without jeopardizing the
clinical investigation.
The Department does not intend to
categorically preclude clinical
investigations from being conducted in
a country of concern and does not
believe that the proposed rule, even
without a clinical investigation-focused
exemption, does so. The proposed rule
generally does not prohibit or restrict
the flow of data from a country of
concern to the United States and does
not apply to data unrelated to U.S.
persons. The Department seeks
additional comments on whether, why,
and to what extent it would be
necessary for U.S. persons to transmit
bulk U.S. sensitive personal data to a
covered person in order to support a
clinical investigation taking place in a
country of concern.
For example, the Department has
considered the following hypothetical:
• A U.S. sponsor conducts a clinical
investigation to determine the safety
and effectiveness of an investigational
drug product. The clinical investigation
involves a multinational trial with both
U.S. citizens and non-U.S. citizens
enrolled in the trial at different sites
across the world, including in a country
of concern, to support authorization of
the product in the intended use
populations. As part of the
investigation, and pursuant to an
employment or vendor agreement, the
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
sponsor transmits bulk U.S. sensitive
personal data to covered persons in the
country of concern to conduct a data
analysis of the product’s safety and
effectiveness across different population
groups. This clinical investigation
supports an application for a marketing
permit for a product regulated by the
FDA (i.e., a drug for human use). The
trial in this example is subject to the
FDA’s regulatory framework for clinical
investigations.
The Department believes that, absent
an exemption, the employment or
vendor agreement described in this
hypothetical would be a restricted
transaction (or a prohibited transaction,
if it involves the transfer of bulk human
genomic data or biospecimens from
which such data could be derived). The
Department seeks comments on whether
such a vendor agreement should be
considered to be ‘‘ordinarily incident to
and part of’’ a clinical investigation;
how prevalent and important the
practice of sending bulk U.S. sensitive
personal data to a covered person in a
country of concern is; and the potential
impacts to clinical research, medical
product development and authorization,
and industry if such transactions were
restricted or prohibited.
The Department also seeks comments
on how these concerns apply in postmarketing scenarios, such as
pharmacovigilance and post-marketing
safety monitoring necessary to support
or maintain authorization. For example,
the Department has considered the
following hypothetical:
• A U.S. pharmaceutical company is
required to submit reports to the FDA of
adverse events related to its FDAapproved drug for human use,
consistent with the requirements under
21 CFR 314.80.80 The firm markets
many other drug products; has a wide
global distribution, including in a
country of concern; and receives
thousands of reports per year for its
various marketed products. Under a
vendor agreement, the firm may
outsource processing of these reports to
entities outside of the United States,
including in a country of concern. The
firm may also need to exchange adverse
event information about its FDAapproved drug product with its
distributors in a country of concern to
pool the data and identify any adverse
events trends across different
population groups or conditions of use
and submit those data to the FDA.
As in the context of the clinical
investigation, the Department believes
80 An adverse event report describes the
experience of an individual who has experienced
an adverse event associated with the use of a drug.
PO 00000
Frm 00025
Fmt 4701
Sfmt 4702
86139
that, absent an exemption, the vendor
agreements described in this
hypothetical would be restricted or
prohibited. The Department seeks
comments on how pervasive and
important the practice of outsourcing
the processing of adverse event reports
to a covered person is, as well as on
how pervasive and important it is to
share adverse event information
concerning U.S. persons with drug
distributors in a country of concern. The
Department seeks comments on the
potential impacts to patient safety,
industry, and the feasibility of obtaining
or maintaining regulatory authorizations
if such transactions were to be
prohibited.
The Department is also aware that, as
appropriate and required, certain data
related to post-marketing surveillance
are made available to global public
health authorities, such as the World
Health Organization Vigibase.
Submissions by the United States
Government itself, such as FDA
submissions to Vigibase, would be
exempt under proposed § 202.504. The
Department expects that similar data
transactions by U.S. persons, even if
such data transactions were considered
to be with a country of concern or a
covered person so as to fall within the
scope of the restrictions and
prohibitions, would nonetheless be
exempt under proposed § 202.507. The
Department seeks specific comments on
the nature and type of such submissions
and a list of such global health
authorities. The Department also notes
that, if it is lawfully available to the
public from a Federal, State, or local
government record or in widely
distributed media, such data would not
meet the definition of sensitive personal
data under § 202.249(b)(2).
FDA regulations include
recordkeeping provisions such that FDA
investigators can gather information
about any data transactions, including
to countries of concern. See 21 CFR part
312.62. However, in general, FDA’s
regulations related to clinical
investigations do not require sponsors to
report data transactions to the FDA in
the manner proposed in the
recordkeeping and reporting
requirements set forth in §§ 202.1101(a)
and 202.1102. The Department is
considering requiring reporting even for
transactions within any exemption to
better evaluate the national security
risks going forward and seeks comments
on the cost and feasibility for industry
of also complying with the
recordkeeping and reporting
requirements set forth in §§ 202.1101(a)
and 202.1102 with respect to
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86140
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
transactions related to clinical
investigations.
The Department recognizes that U.S.
companies employing covered
persons—such as foreign persons
primarily resident in a country of
concern to support a clinical
investigation there—may have to adjust
data access policies or protocols to limit
covered persons’ access to bulk U.S.
sensitive personal data. The Department
seeks comment on this issue, including
the costs and feasibility of adopting
such policies or protocols and the likely
effect of such policies on medical
product research and development, as
well as obtaining or maintaining
regulatory authorization.
The Department also notes that, under
§ 202.504, covered data transactions that
occur as part of federally funded
research would be exempt from the
proposed rule’s prohibitions (although
possibly subject to separate restrictions
applicable to a Federal grantee, to
include requirements established
pursuant to section 3(b)(i) of the Order).
The Department invites comment on the
proportion of pharmaceutical research
that would not be exempt under that
exemption, the cost and feasibility of
complying with different regulatory
requirements depending on the source
of funding, and the impact on medical
product research and development.
If the Department were to implement
an exemption for clinical investigations,
clinical data, and post-marketing
surveillance as described in this section,
it could potentially do so through one
or more general licenses as opposed to
including the exemption in the final
rule. General licenses may be a more
flexible regulatory tool that can be
adjusted to varying circumstances.
Preliminarily, however, the Department
believes that a codified exemption
would provide more clarity and
certainty for relevant entities. The
Department also invites comments on
the best mechanism to implement an
exemption for such data transactions.
Finally, on the third axis, the
Department is considering whether any
exemption, or parts of it, could feasibly
be time-limited to allow industry to
shift existing processes and operations
out of countries of concern over a
transition period. The Department is
cognizant of the long planning times
and high costs associated with clinical
research. If the Department does not
broadly exempt clinical research from
the scope of the prohibitions, it may
consider delaying the effective date of
the proposed rule with respect to such
research to enable affected entities to
complete ongoing or imminent trials
without disruption or delay, while
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
transitioning planning and policies for
future trials. The Department could
potentially implement such a delay by
general or specific licenses, and could
use a set period of time or could limit
the exemption to studies already past a
certain stage, such as submission of an
Investigational New Drug application to
the FDA by a set date. The Department
seeks comment—taking into account
other exemptions, such as for federally
funded research—on the number of
clinical investigations that would be
disrupted, and the extent of such
disruption, if the prohibitions were
immediately applicable; how long and
how to structure any delay to minimize
disruption without inviting misplaced
reliance; and the best mechanism for
implementing such a delay.
10. Other Exemptions
The Department is considering
whether it is necessary or appropriate to
adopt a tailored exemption that would
permit covered data transactions
involving the export to countries of
concern or transfer or sale to covered
persons of certain human biospecimens,
like blood plasma, intended for direct
medical use that the proposed rule
would otherwise prohibit. The
Department welcomes views about the
specific types of biospecimens exported
to countries of concern, or transferred or
sold to covered persons for direct
medical use that the Department should
consider exempting from the
prohibition on bulk transfers of human
genomic data or biospecimens from
which bulk human genomic data could
be derived. Important considerations
could include the importance of the
biospecimens for direct medical use; the
relative ease with which a country of
concern or covered person could derive
bulk human genomic data from the
biospecimens; the economic and
humanitarian value of permitting such
transactions; and any other national
security concerns the Department
should consider.
A few commenters requested that the
Department create a new exemption for
data processed by a covered person on
behalf of a U.S. person for product
research, development, or improvement
where the U.S. person directs the
manner of data processing and
contractually binds the covered person
to maintain the privacy and security of
the data. These comments were too
vague to be addressed or implemented.
For example, they did not identify the
kinds of products that the U.S. person
would seek to develop or the kinds of
data that would be required for that
development. In any case, as the
Department discusses in part IV.D.1 of
PO 00000
Frm 00026
Fmt 4701
Sfmt 4702
this preamble, countries of concern have
the legal authority and political systems
to force, coerce, and influence entities
in their jurisdictions to share their data
and access with the government.
Entities operating in these jurisdictions
may be legally compelled to comply
with these requests, regardless of their
trustworthiness or contractual
commitments. The Department assesses
that the kind of contractual provisions
contemplated by these commenters
would not adequately mitigate the risk
that countries of concern could compel
these covered persons to provide them
access to government-related data or
Americans’ bulk U.S. sensitive personal
data. Further, other commenters
expressed concern about relying on
private parties to monitor and enforce
contractual provisions on their own, as
discussed in part IV.A.16 of this
preamble.
D. Subpart F—Determination of
Countries of Concern
1. Section 202.601—Determination of
Countries of Concern
As explained in the ANPRM and
above in part II of this preamble,
countries of concern could exploit
government-related data or bulk U.S.
sensitive personal data for a range of
activities detrimental to U.S. national
security, including coercion, blackmail,
surveillance, espionage, malicious
cyber-enabled activities, malign foreign
influence, curbing political dissent and
opposition, and tracking and building
profiles on potential targets.
The Order instructs the Attorney
General to ‘‘identify, with the
concurrence of the Secretary of State
and the Secretary of Commerce,
countries of concern.’’ 81 In the
proposed rule, the Attorney General has
determined, with the concurrence of the
Secretaries of State and Commerce, that
the governments of six countries—the
People’s Republic of China (‘‘China’’ or
‘‘PRC’’), along with the Special
Administrative Region of Hong Kong
and the Special Administrative Region
of Macau; the Russian Federation
(‘‘Russia’’); the Islamic Republic of Iran
(‘‘Iran’’); the Democratic People’s
Republic of Korea (‘‘North Korea’’); the
Republic of Cuba (‘‘Cuba’’); and the
Bolivarian Republic of Venezuela
(‘‘Venezuela’’)—have engaged in a longterm pattern or serious instances of
conduct significantly adverse to the
national security of the United States or
the security and safety of U.S. persons,
and pose a significant risk of exploiting
government-related data or bulk U.S.
81 89
E:\FR\FM\29OCP2.SGM
FR 15424.
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
sensitive personal data to the detriment
of the national security of the United
States or the security and safety of U.S.
persons.
In determining that a country has
engaged in a long-term pattern or
serious instances of conduct
significantly adverse to the national
security of the United States or the
security and safety of U.S. persons, the
proposed rule accounts for a range of
conduct, including transnational
repression; malicious cyber activities;
sanctions evasion; theft of intellectual
property, trade secrets, and technology;
foreign malign influence; 82 and humanrights abuses. Even where human-rights
abuses do not directly involve U.S.
persons, the Department considers
human-rights abuses to be significantly
adverse to national security because of
their indirect effects. For example, by
developing, testing, and using
sophisticated surveillance technology
on their own populations or conducting
surveillance on their own populations,
countries can expand the use of those
methods and potentially deploy them
directly against U.S. persons or U.S.
interests in the future.83 Furthermore, a
country that commits human-rights
violations shows its disregard for
international norms and its intention to
use the coercive power of the state to
accomplish its policy goals. For
example, countries that commit humanrights violations may also attempt to
surveil or coerce their citizens in the
United States, including through
transnational repression.84 Based on its
experience, the Department believes
that such factors demonstrate that a
country presents a risk that, if provided
access, it would exploit governmentrelated data or bulk U.S. sensitive
personal data to the detriment of the
national security of the United States or
the security and safety of U.S. persons.
During the ANPRM’s comment
period, commenters requested that the
proposed rule include criteria and a
transparent process for the Department
of Justice to designate countries of
concern, including by conducting robust
interagency discussion and soliciting
82 See
50 U.S.C. 3059(f)(2).
Counterintel. & Sec. Ctr., China’s
Collection of Genomic and Other Healthcare Data
from America: Risks to Privacy and U.S. Economic
and National Security 3–4 (Feb. 2021), https://
www.dni.gov/files/NCSC/documents/
SafeguardingOurFuture/NCSC_China_Genomics_
Fact_Sheet_2021revision20210203.pdf [https://
perma.cc/BL4H-WJSW].
84 Press Release, U.S. Dep’t of Just., Two Arrested
for Operating Illegal Overseas Police Station of the
Chinese Government (Apr. 17, 2023), https://
www.justice.gov/opa/pr/two-arrested-operatingillegal-overseas-police-station-chinese-government
[https://perma.cc/XM9B-2BU7].
khammond on DSKJM1Z7X2PROD with PROPOSALS2
83 Nat’l
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
public comment. The proposed rule
makes no change in response to this
comment. The Order already requires
that prior to amending the list of
countries of concern, the Department
must obtain concurrence by the
Secretary of State and the Secretary of
Commerce and undertake a rulemaking
that is subject to the ordinary process of
robust interagency review and notice
and public comment. In addition to the
opportunity for notice and public
comment on this proposed rule’s
identification of countries of concern,
the Department took the optional step of
issuing an ANPRM to permit an
additional opportunity for public
comment on the contemplated countries
of concern.
One commenter supported aligning
the list of countries of concern with the
list established by the Department of
Commerce in 15 CFR 791.4, which was
adopted pursuant to Executive Order
13873. The ANPRM already
contemplated identifying the same
countries as countries of concern under
the Order as the Department of
Commerce identified as foreign
adversaries under Executive Order
13873. The proposed rule adopts that
approach and identifies those same
countries for reasons explained further
in this part.
Other commenters expressed
concerns that the list of six countries of
concern contemplated in the ANPRM is
too narrow and does not adequately
address entities based in third countries
that engage in or facilitate surveillance
on U.S. citizens. The proposed rule
makes no change in response to this
comment. As the ANPRM described, the
Department intends to establish this
program by issuing proposed
rulemakings in tranches based on
priority and effective administration of
the program. The Department intends to
continue working closely with the
Department of State, Department of
Commerce, and other agencies to
monitor the effectiveness of the
regulations and the need for any
changes. Similarly, one commenter
suggested that the Department consider
designating a larger group of countries
as countries of concern based upon
those countries’ lack of privacy laws or
lack of enforcement of their privacy
laws. The Department declines to adopt
this approach at this time. The Order’s
focus is addressing the national security
risk posed by country of concern access
to government-related data or
Americans’ bulk U.S. sensitive personal
data. The Order does not establish a
general data privacy regime. The
proposed rule thus maintains the
PO 00000
Frm 00027
Fmt 4701
Sfmt 4702
86141
country of concern framework described
in the ANPRM without change.
Informed by the ANPRM comments
and the Department’s independent
research and analysis, which are
summarized in part IV.D of this
preamble, the Department proposes
identifying the same countries of
concern as those identified by the
Department of Commerce in
implementing Executive Order 13873.
The proposed rule’s definition of each
of these countries includes political
subdivisions, agencies, or
instrumentalities of those countries. In
addition, the Order specifically defines
a ‘‘country of concern,’’ and the
Department has determined that every
country included on the list of countries
of concern meets that definition.
The Department seeks comment from
the public on the proposed countries of
concern. The proposed rule identifies
these six countries as countries of
concern for the following reasons.
a. China
The Department has determined, with
the concurrence of the Secretaries of
State and Commerce, that China has
engaged in a long-term pattern of
conduct significantly adverse to the
national security of the United States
and the security and safety of U.S.
persons. Among other conduct
significantly adverse to the national
security of the United States and the
security and safety of U.S. persons,
China engages in transnational
repression; 85 steals trade secrets and
intellectual property; 86 conducts
foreign malign influence; 87 commits
human rights abuses that could help it
develop the capability to surveil,
manipulate, or extort U.S. persons; 88
and conducts extensive malicious cyber
activities.89
85 Press Release, U.S. Dep’t of Just., Seven
Hackers Associated with Chinese Government
Charged with Computer Intrusions Targeting
Perceived Critics of China and U.S. Businesses and
Politicians (Mar. 25, 2024), https://www.justice.gov/
opa/pr/seven-hackers-associated-chinesegovernment-charged-computer-intrusions-targetingperceived [https://perma.cc/YQC7-JDCU].
86 Id.; Off. of the Dir. of Nat’l Intel., Annual
Threat Assessment of the U.S. Intelligence
Community, at 12 (Feb. 5, 2024), https://
www.dni.gov/files/ODNI/documents/assessments/
ATA-2024-Unclassified-Report.pdf [https://
perma.cc/FX84-ZR7E].
87 Off. of the Dir. of Nat’l Intel., supra note 86,
at 12.
88 Nat’l Counterintel. & Sec. Ctr., supra note 83,
at 3–4.
89 Off. of the U.S. Trade Rep., Four-Year Review
of Actions Taken in the Section 301 Investigation:
China’s Acts, Policies, and Practices Related to
Technology Transfer, Intellectual Property, and
Innovation, at 15–33 (May 14, 2024), https://
ustr.gov/sites/default/files/05.14.2024%20Four%
E:\FR\FM\29OCP2.SGM
Continued
29OCP2
86142
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
According to the Office of the Director
of National Intelligence (‘‘ODNI’’),
China is ‘‘the most active and persistent
cyber threat to U.S. Government,
private-sector, and critical infrastructure
networks.’’ 90 China’s cyber espionage
operations have included
‘‘compromising telecommunications
firms, providers of managed services
and broadly used software, and other
targets potentially rich in follow-on
opportunities for intelligence collection,
attack, or influence operations.’’ 91
China ‘‘conducts cyber intrusions that
are targeted to affect U.S. and non-U.S.
citizens beyond its borders—including
journalists, dissidents, and individuals
it views as threats—to counter views it
considers critical of [Chinese
Communist Party] narratives, policies
and actions.’’ 92 It also conducts malign
influence operations to ‘‘sow doubts
about U.S. leadership, undermine
democracy, and extend [China’s]
influence.’’ 93
Because China aggressively obtains
and exploits data on U.S. persons
through both commercial means and
theft, and has growing artificial
intelligence capabilities, it poses a
significant risk of exploiting
government-related data or Americans’
bulk U.S. sensitive personal data to the
detriment of the national security of the
United States and the security and
safety of U.S. persons.
China aggressively obtains and
exploits data on U.S. persons via
commercial and illicit means. The
National Counterintelligence and
Security Center (‘‘NCSC’’) has warned
that China ‘‘views bulk personal data,
including healthcare and genomic data,
as a strategic commodity to be collected
and used for its economic and national
security priorities.’’ 94 As ODNI has also
explained, China ‘‘has engaged in
extensive and years-long efforts to
accumulate structured datasets, in
particular on U.S. persons, to support its
intelligence and counterintelligence
operations,’’ 95 and is ‘‘rapidly
20Year%20Review%20of%20China%20Tech%
20Transfer%20Section%20301%20(Final).pdf
[https://perma.cc/W6FN-4C38].
90 Off. of the Dir. of Nat’l Intel., supra note 86,
at 12.
91 Off. of the Dir. of Nat’l Intel., Annual Threat
Assessment of the U.S. Intelligence Community 10
(Feb. 6, 2023), https://www.odni.gov/files/ODNI/
documents/assessments/ATA-2023-UnclassifiedReport.pdf [https://perma.cc/4B2Y-7NVD].
92 Id.
93 Id.
94 Nat’l Counterintel. & Sec. Ctr., supra note 83,
at 1.
95 In Camera, Ex Parte Classified Decl. of Casey
Blackburn, Assistant Dir. of Nat’l Intel., Doc. No.
2066897 at Gov’t App. 10 ¶ 31, TikTok Inc. v.
Garland, Case Nos. 24–1113, 24–1130, 24–1183
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
expanding and improving its artificial
intelligence and big data analytics
capabilities for intelligence
operations.’’ 96 China ‘‘uses a number of
methods to obtain data.’’ 97 For example,
China engages in the ‘‘wholesale theft’’
of sensitive personal data of U.S.
persons.98 The following are some
examples of the PRC’s aggressive
campaign to steal and exploit
government-related data or bulk U.S.
sensitive personal data: 99
• In 2024, a Federal grand jury
returned an indictment against hackers
working for Chinese intelligence
services for, among other things,
targeting high-ranking United States
Government officials and staffers for a
presidential campaign by sending
thousands of malicious emails.100 The
hackers potentially compromised the
email and cloud storage accounts and
telephone records belonging to millions
of Americans.101
• In 2020, a Federal grand jury
returned an indictment against four
members of the PRC’s People’s
Liberation Army for hacking U.S. creditreporting agency Equifax in 2017.102
The hackers stole the data of
approximately 145 million victims,
obtaining, ‘‘in a single breach, . . . the
sensitive personally identifiable
information for nearly half of all
American citizens.’’ 103
(D.C. Cir. July 26, 2024) (publicly filed redacted
version) (hereinafter ‘‘Blackburn Decl.’’).
96 Id. at Gov’t App. 10 ¶ 30.
97 Id. at Gov’t App. 10 ¶ 32.
98 The Strategic Competition Between the U.S.
and the Chinese Communist Party: Hearing Before
the H. Select Comm., 108th Cong. (2024) (statement
of Christopher Wray, Director, Fed. Bureau of
Investig.), https://www.fbi.gov/news/speeches/
director-wrays-opening-statement-to-the-houseselect-committee-on-the-chinese-communist-party
[https://perma.cc/89CA-DPHQ]; see also Nat’l Intel.
Council, supra note 5, at 3.
99 Nat’l Intel. Council, supra note 5, at 3; Wray,
supra note 98.
100 Press Release, U.S. Dep’t of Just., supra note
85; Indictment, United States v. Gaobin, No. 24–cr–
43 (E.D.N.Y. filed Jan. 30, 2024).
101 Indictment ¶ 15, Gaobin, 24–cr–43.
102 Indictment ¶¶ 2–3, United States v. Zhiyong,
No. 20–cr–046 (N.D. Ga. filed Jan. 28, 2020); see
also Press Release, U.S. Dep’t of Just., Chinese
Military Personnel Charged with Computer Fraud,
Economic Espionage and Wire Fraud for Hacking
into Credit Reporting Agency Equifax (Feb. 10,
2020), https://www.justice.gov/opa/pr/chinesemilitary-personnel-charged-computer-fraudeconomic-espionage-and-wire-fraud-hacking
[https://perma.cc/2TW4-2HGP].
103 Indictment ¶ 3, Zhiyong, No. 20–cr–046; see
also Nat’l Intel. Council, supra note 5, at 4;
Christopher Wray, Dir., Fed. Bureau of Investig.,
The Threat Posed by the Chinese Government and
the Chinese Communist Party to the Economic and
National Sec. of the United States, Address at the
Hudson Institute Event on China’s Attempt to
Influence U.S. Institutions (July 7, 2020), https://
www.fbi.gov/news/speeches/the-threat-posed-bythe-chinese-government-and-the-chinesecommunist-party-to-the-economic-and-national
PO 00000
Frm 00028
Fmt 4701
Sfmt 4702
• In 2015, PRC hackers stole the
health records of 78.8 million persons
from U.S. health insurance provider
Anthem, Inc.,104 and stole the
background investigation records of 21.5
million prospective, current, and former
Federal employees and contractors from
the Office of Personnel Management.105
• In 2021, a Federal grand jury
returned an indictment against four
Chinese nationals working for PRC
intelligence services for hacking into the
computer systems of dozens of
companies, universities, and
government entities between 2011 and
2018 to steal sensitive technical
technology and data, including material
related to genetic sequencing.106
• In 2021, cyber actors linked to
China’s intelligence services exploited
previously undisclosed vulnerabilities
in Microsoft Exchange Server,
compromising tens of thousands of
computers and networks, including
those in the United States, in a massive
operation.107
• In 2018, a Federal grand jury
returned an indictment against two PRC
intelligence-affiliated officials for
conducting a campaign targeting the
computer networks and systems of
technology and cloud-service
companies in at least a dozen U.S.
States, as well as United States
Government agencies, to access their
customers’ data.108 At least eight major
security-of-the-united-states [https://perma.cc/
LMJ6-882S].
104 Nat’l Counterintel. & Sec. Ctr., supra note 83,
at 3.
105 U.S. Off. of Pers. Mgmt., Cybersecurity
Incidents, https://www.opm.gov/cybersecurityresource-center/#url=Cybersecurity-Incidents
[https://perma.cc/V87Q-2K6W]; Nat’l Counterintel.
& Sec. Ctr., supra note 83.
106 See Press Release, U.S. Dep’t of Just., Four
Chinese Nationals Working with the Ministry of
State Security Charged with Global Computer
Intrusion Campaign Targeting Intellectual Property
and Confidential Business Information, Including
Infectious Disease Research (July 19, 2021), https://
www.justice.gov/opa/pr/four-chinese-nationalsworking-ministry-state-security-charged-globalcomputer-intrusion [https://perma.cc/KJ76-KRKS];
Indictment ¶ 4, United States v. Xiaoyang, No. 21–
cr–01622 (S.D. Cal. filed May 28, 2021).
107 Press Release, The White House, The United
States, Joined by Allies and Partners, Attributes
Malicious Cyber Activity and Irresponsible State
Behavior to the People’s Republic of China (July 19,
2021), https://www.whitehouse.gov/briefing-room/
statements-releases/2021/07/19/the-united-statesjoined-by-allies-and-partners-attributes-maliciouscyber-activity-and-irresponsible-state-behavior-tothe-peoples-republic-of-china/ [https://perma.cc/
5ESU-43VY].
108 See Press Release, U.S. Dep’t of Just., Two
Chinese Hackers Associated with the Ministry of
State Security Charged with Global Computer
Intrusion Campaigns Targeting Intellectual Property
and Confidential Business Information (Dec. 20,
2018), https://www.justice.gov/opa/pr/two-chinesehackers-associated-ministry-state-security-chargedglobal-computer-intrusion [https://perma.cc/5M68-
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
managed service providers were
compromised, as well as the National
Aeronautics and Space Administration
and the Department of Energy.109 Over
12 years, hackers stole hundreds of
gigabytes of data, including the
personally identifiable information of
over 100,000 U.S. Navy personnel.110
As ODNI has explained, China ‘‘also
tries to leverage access through its
relationships with Chinese companies,
strategic investments in foreign
companies, and by purchasing large
data sets.’’ 111 China and Chinese
companies ‘‘have sought to acquire
sensitive health and genomic data on
U.S. persons through, for example,
investment in U.S. firms that handle
such data or by partnering with
healthcare or research organizations in
the United States to provide genomic
sequencing services.’’ 112 China also
strategically acquires sensitive personal
data on U.S. persons through
commercial means, such as by investing
in U.S. firms through Chinese
companies and engaging in partnerships
with hospitals, universities, and
research organizations.113 China
employs a wide array of means to
ensure that the Chinese government
benefits from Chinese companies’
relationships with U.S. companies. Not
only do direct investments by Chinese
companies facilitate China’s strategic
objectives,114 but those direct
investments also promote a strategy of
‘‘military-civil fusion’’ that ensures that
China’s military can ‘‘acquire advanced
technologies and expertise developed by
[Chinese] companies, universities, and
research programs that appear to be
civilian entities.’’ 115
These commercial means of obtaining
sensitive personal data on U.S. persons
are paired with China’s national677J]; see also Indictment ¶¶ 3–5, United States v.
Zhu, No. 18–cr–891 (S.D.N.Y. filed Dec. 17, 2018).
109 Indictment ¶¶ 5–6, Zhu, No. 18–cr–891.
110 Indictment ¶ 10, Zhu, No. 18–cr–891.
111 Blackburn Decl., supra note 95, at Gov’t App.
11 ¶ 33.
112 Id. at Gov’t App. 11 ¶ 33(a).
113 Nat’l Counterintel. & Sec. Ctr., supra note 83,
at 2.
114 Off. of the U.S. Trade Representative, Exec.
Off. Of the Pres., Findings of the Investigation into
China’s Acts, Policies, and Practices Related to
Technology Transfer, Intellectual Property, and
Innovation Under Section 301 of the Trade Act of
1974 63 (Mar. 22, 2018), https://ustr.gov/sites/
default/files/Section%20301%20FINAL.PDF
[https://perma.cc/SAS4-JSNK].
115 Press Release, U.S. Dep’t of Def., DOD
Releases List of People’s Republic of China (PRC)
Military Companies in Accordance with Section
1260H of the National Defense Authorization Act
for Fiscal Year 2021 (Jan. 31, 2024), https://
www.defense.gov/News/Releases/Release/Article/
3661985/dod-releases-list-of-peoples-republic-ofchina-prc-military-companies-in-accord/ [https://
perma.cc/S7HA-384R].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
security laws that compel companies to
share data they have collected on U.S.
persons with the Chinese
government.116 As the Department has
explained, ‘‘China has enacted the
world’s most comprehensive set of laws,
regulations, and national plans to
broadly define its national and public
security interests in data and to govern
data collection, sales, sharing, and
storage.’’ 117 Given ‘‘the authoritarian
structures and laws of the PRC regime,
Chinese companies lack meaningful
independence from the PRC’s agenda
and objectives,’’ and ‘‘even putatively
‘private’ companies based in China do
not operate with independence from the
government and cannot be analogized to
private companies in the United
States.’’ 118 This regime includes
‘‘several laws that, in concert, allow the
Chinese government to access sensitive
personal data possessed by Chinese
companies,’’ 119 such as the following:
• The National Security Law of the
People’s Republic of China
(promulgated by the Standing
Committee of the National People’s
Congress, July 1, 2015, effective July 1,
2015), which ‘‘imposes broad
obligations on corporations as well as
citizens to assist and cooperate with the
Chinese government in protecting what
it defines as national security’’ and to
‘‘assist military agencies and relevant
departments with national security
efforts.’’ 120
• The Cybersecurity Law of the
People’s Republic of China
(promulgated by the Standing
Committee of the National People’s
Congress, Nov. 7, 2016, effective June 1,
2017), which ‘‘requires Chinese
companies to store their data within
China, to cooperate with crime and
security investigations, and to allow full
access to data to Chinese
authorities.’’ 121
• The Anti-Terrorism Law of the
People’s Republic of China
(promulgated by the Standing
Committee of the National People’s
Congress, Dec. 27, 2015, effective Jan. 1,
2016, amended Apr. 27, 2018), which
authorizes the Chinese government to
conduct ‘‘electronic monitoring,’’
‘‘irregular inspections,’’ and ‘‘‘terrorism’
investigations and requires individuals
116 Nat’l
Counterintel. & Sec. Ctr., supra note 83,
at 4.
117 Newman Decl., supra note 40, at Gov’t App.
49 ¶ 16.
118 Id. at Gov’t App. 49 ¶ 17.
119 Id. at Gov’t App. 19 ¶ 18.
120 Id. at Gov’t App. 49–50 ¶ 19; see Exh. A to
Newman Decl., supra note 40.
121 Newman Decl., supra note 40, at Gov’t App.
50–51 ¶ 20; see Exh. B to Newman Decl., supra note
40.
PO 00000
Frm 00029
Fmt 4701
Sfmt 4702
86143
and organizations to comply, in secret,
with such investigations’’; broadly
‘‘defines ‘terrorism’ as ‘‘propositions
and actions that . . . create social panic,
endanger public safety, infringe on
personal and property rights, or coerce
state organs or international
organizations to achieve their political,
ideological, and other objectives’’; and
imposes on all organizations and
individuals ‘‘the obligation to assist and
cooperate with relevant departments in
anti-terrorism work.’’ 122
• The Counter-Espionage Law of the
People’s Republic of China
(promulgated by the Standing
Committee of the National People’s
Congress, Nov. 1, 2014, amended Apr.
26, 2023, effective July 1, 2023), which
authorizes ‘‘national security agency
staff’’ to ‘‘enter restricted areas,
locations, and units’’ and to ‘‘inspect the
electronic devices, facilities, and
relevant procedures and tools of
concerned individuals and
organizations,’’ and also requires
‘‘citizens and organizations’’ to ‘‘support
and assist’’ such efforts.123
These laws all ‘‘contain provisions
that prohibit individuals and
organizations from revealing when and
if the Chinese government has requested
any assistance or information from
them.’’ 124 As a result, China can
covertly obtain data on U.S. persons in
the possession of Chinese companies
without meaningful due process and
independent judicial oversight. China’s
commercial acquisitions of data also
contribute to the government’s growing
repository of data on U.S. persons.125
China’s access to bulk U.S. sensitive
personal data—whether via commercial
means or outright theft—fuels its
development of artificial intelligence
capabilities, which China believes will
drive the next revolution in military
affairs.126 The Office of the Director of
National Intelligence assesses that China
is ‘‘rapidly expanding and improving its
122 Newman Decl., supra note 40, at Gov’t App.
51 ¶ 21; see Exh. C. to Newman Decl., supra note
40.
123 Newman Decl., supra note 40, at Gov’t App.
51–52 ¶ 23; see Exh. E to Newman Dec., supra note
40.
124 Newman Decl., supra note 40, at Gov’t App.
52 ¶ 24.
125 Lisa Monaco, Deputy Att’y Gen., U.S. Dep’t of
Just., Remarks on Disruptive Technologies at
Chatham House (Feb. 16, 2023), https://
www.justice.gov/opa/speech/deputy-attorneygeneral-lisa-o-monaco-delivers-remarks-disruptivetechnologies-chatham [https://perma.cc/NW6DHM6Q] (‘‘So if a company operating in China
collects your data, it is a good bet that the Chinese
government is accessing it.’’).
126 Elsa B. Kania, ‘‘AI Weapons’’ in China’s
Military Innovation, Brookings Inst. (Apr. 2020),
https://www.brookings.edu/wp-content/uploads/
2020/04/FP_20200427_ai_weapons_kania_v2.pdf
[https://perma.cc/JPM7-YHV5].
E:\FR\FM\29OCP2.SGM
29OCP2
86144
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
AI and big data analytics capabilities for
intelligence operations’’ 127 and
‘‘increasing [its] ability to analyze and
manipulate large quantities of personal
information in ways that will allow [it]
to more effectively target and influence,
or coerce, individuals and groups in the
United States.’’ 128 In turn, China’s
advances in artificial intelligence
‘‘deepen[] the threats posed by
cyberattacks and disinformation
campaigns’’ that China is using ‘‘to
infiltrate [U.S.] society, steal [U.S.] data
and interfere in [U.S.] democracy.’’ 129
b. Cuba
khammond on DSKJM1Z7X2PROD with PROPOSALS2
The Department has determined, with
the concurrence of the Secretaries of
State and Commerce, that Cuba has
engaged in a long-term pattern of
conduct significantly adverse to the
national security of the United States
and the security and safety of U.S.
persons. The United States has long
recognized that the Cuban government
presents a national security threat to the
United States. Among other conduct
significantly adverse to the national
security of the United States and the
security and safety of U.S. persons,
Cuba conducts intelligence operations
against the United States; commits
human-rights abuses that, among other
effects, contribute to a significant
increase in migration into the United
States and its neighbors; 130 and
sponsors terrorism.131 Because of the
Cuban government’s actions, the United
States has imposed some form of
economic sanctions on Cuba since the
early 1960s, including under the
Trading with the Enemy Act of 1917.
The United States currently maintains a
127 Off. of the Dir. of Nat’l Intel., supra note 86,
at 12.
128 Nat’l Intel. Council, supra note 5, at 3.
129 Nat’l Counterintel. & Sec. Ctr., supra note 48,
at 4; Wray, supra note 98.
130 Press Release, U.S. Dep’t of Treas., Treasury
Sanctions Senior Cuban Officials in Response to
Violence Against Peaceful Demonstrators (Aug. 19,
2021), https://home.treasury.gov/news/pressreleases/jy0327 [https://perma.cc/TQP2-U79G];
Press Statement, The White House, Fact Sheet:
Biden Harris Administration Measures on Cuba
(July 22, 2021), https://www.whitehouse.gov/
briefing-room/statements-releases/2021/07/22/factsheet-biden-harris-administration-measures-oncuba/ [https://perma.cc/J7H7-BAA8]; Eric BazailEimil, Record-Breaking Numbers of Cuban Migrants
Entered the U.S. in 2022–23, Politico (Oct. 24,
2023), https://www.politico.com/news/2023/10/24/
record-breaking-numbers-of-cuban-migrantsentered-the-u-s-in-2022-23-00123346 [https://
perma.cc/ZQ6C-KCC4].
131 Press Release, U.S. Embassy in Cuba, U.S.
Announces Designation of Cuba as a State Sponsor
of Terrorism (Jan. 11, 2021), https://
cu.usembassy.gov/u-s-announces-designation-ofcuba-as-a-state-sponsor-of-terrorism/ [https://
perma.cc/6GE4-5JJS].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
comprehensive economic embargo on
Cuba.132
Because Cuba has engaged in longstanding efforts to target the United
States Government and United States
Government personnel for intelligence
purposes, Cuba poses a significant risk
of exploiting government-related data or
Americans’ bulk U.S. sensitive personal
data to the detriment of the national
security of the United States and the
security and safety of U.S. persons.
According to ODNI, Cuba’s intelligence
capabilities pose a ‘‘significant threat[ ]’’
to the United States.133 For decades,
Cuban intelligence services have sought
to obtain information about the United
States Government and to target U.S.
persons to pursue Cuba’s interests,
including espionage. For example, in
2024, a former U.S. Department of State
employee who served as U.S.
Ambassador to Bolivia admitted to
secretly acting as an agent of Cuba for
decades and received a 15-year prison
sentence.134 In another example, in
2010, a U.S. Department of State official
and his wife were sentenced to lengthy
prison sentences for participating in a
‘‘nearly 30-year conspiracy to provide
highly classified U.S. national defense
information’’ to Cuba.135 In 2004, a
Federal grand jury returned an
indictment against an individual for
conspiring to share information related
to U.S. national defense with Cuba,
including helping Cuban intelligence
services ‘‘spot, assess, and recruit U.S.
citizens who occupied sensitive
national security positions or had the
potential of occupying such positions in
the future to serve as Cuban agents.’’ 136
In 2002, an employee at the Defense
Intelligence Agency was sentenced to 25
years in prison for spying on behalf of
Cuba, including sharing the identities of
American undercover intelligence
officers working in Cuba with the Cuban
government.137 In 2022, Team Telecom
recommended that the Federal
Communications Commission (‘‘FCC’’)
deny an application for a license for a
subsea telecommunications cable that
would have directly connected the
United States to Cuba.138 Team Telecom
highlighted Cuba’s history of espionage
and intelligence activities targeting the
United States.139 Because Cuba’s stateowned telecommunications monopoly
would control the cable, Team Telecom
concluded that the cable would give the
Cuban government the ability and
opportunity to access U.S. persons’
internet traffic, data, and
communications transiting the cable,
and make the Cuban government an
even greater counterintelligence threat
to the United States.140
Cuba also has strong ties to both
China and Russia and might share any
information it obtains on U.S. persons
with either of those countries.141 For
example, in 2018, The Diplomat noted
that the Cuban government ‘‘has been
reported to sell its intercept data from
U.S. communications to third-party
buyers, particularly military adversaries
of the [United States],’’ including
China.142 Team Telecom has also found
that Cuba’s relationships with China
and Russia—which include extensive
economic, military and intelligence
cooperation—heighten the risk that
Cuba could share U.S. sensitive
132 Cuba Sanctions, U.S. Dep’t of State, https://
www.state.gov/cuba-sanctions/ [https://perma.cc/
Q7S9-9XA6].
133 Nat’l Counterintel. & Sec. Ctr., National
Counterintelligence Strategy of the United States
2020–2022, at 2 (Jan. 7, 2020), https://www.dni.gov/
files/NCSC/documents/features/20200205National_CI_Strategy_2020_2022.pdf [https://
perma.cc/V8NU-PN23].
134 Press Release, U.S. Dep’t of Just., Former U.S.
Ambassador and National Security Council Official
Admits to Secretly Acting as Agent of the Cuban
Government and Receives 15-Year Sentence (Apr.
12, 2024), https://www.justice.gov/opa/pr/formerus-ambassador-and-national security-councilofficial-admits-secretly-acting-agent [https://
perma.cc/NU9F-6NUS]; Complaint, United States v.
Rocha, No. 23–mj–04368 (S.D. Fla. filed Dec. 4,
2023).
135 Press Release, U.S. Dep’t of Just., Former State
Department Official Sentenced to Life in Prison for
Nearly 30-Year Espionage Conspiracy (July 16,
2010), https://www.justice.gov/opa/pr/former-statedepartment-official-sentenced-life-prison-nearly-30year-espionage-conspiracy [https://perma.cc/622FY6NR].
136 Press Release, U.S. Dep’t of Just., Unsealed
Indictment Charges Former U.S. Federal Employee
with Conspiracy to Commit Espionage for Cuba
(Apr. 25, 2013), https://www.justice.gov/opa/pr/
unsealed-indictment-charges-former-us-federal-
employee-conspiracy-commit-espionage-cuba
[https://perma.cc/ZSW8-7A4R]; Indictment ¶¶ 14–
34, United States v. Velazquez, No. 04–cr–044
(D.D.C. filed Feb. 5, 2004), ECF No. 1.
137 Ana Montes: Cuban Spy, Famous Cases and
Criminals, Fed. Bureau of Investig., https://
www.fbi.gov/history/famous-cases/ana-montescuba-spy [https://perma.cc/MJJ5-WG9X].
138 Press Release, U.S. Dep’t of Just., Team
Telecom Recommends the FCC Deny Application to
Directly Connect the United States to Cuba Through
Subsea Cable (Nov. 30, 2022), https://
www.justice.gov/opa/pr/team-telecomrecommends-fcc-deny-application-directly-connectunited-states-cuba-through [https://perma.cc/J7RFHM6U]; see generally ARCOS–1 USA, Inc., File No.
SCL–MOD–202100928–0039 (Fed. Commc’ns
Comm’n Nov. 29, 2022) (committee
recommendation to deny application), https://
www.justice.gov/opa/file/1555196/dl?inline
[https://perma.cc/F9SV-7U98].
139 ARCOS–1 USA, Inc., supra note 138, at 11–
12.
140 ARCOS–1 USA, Inc., supra note 138, at 14–
15.
141 Id. at 17–25.
142 Victor Robert Lee, Satellite Images: A
(Worrying) Cuban Mystery, Diplomat (June 8, 2018),
https://thediplomat.com/2018/06/satellite-imagesa-worrying-cuban-mystery [https://perma.cc/H6ZFP3QU].
PO 00000
Frm 00030
Fmt 4701
Sfmt 4702
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
personal data that it obtains with China
or Russia.143
c. Iran
The Department has determined, with
the concurrence of the Secretaries of
State and Commerce, that Iran has
engaged in a long-term pattern of
conduct significantly adverse to the
national security of the United States
and the security and safety of U.S.
persons. Iran engages in transnational
repression; 144 commits human-rights
abuses, including against U.S.
persons; 145 smuggles U.S.
technology; 146 evades U.S.
sanctions; 147 sponsors terrorism; 148 and
conducts malicious cyber activities,
among other conduct.
Because Iran has growing cyber
expertise and aggressively seeks to
obtain and exploit data on U.S. persons,
it poses a significant risk of exploiting
government-related data or Americans’
bulk U.S. sensitive personal data to the
detriment of the national security of the
United States and the security and
safety of U.S. persons. According to
ODNI, ‘‘Iran’s growing expertise and
willingness to conduct aggressive cyber
operations make it a major threat to the
security of U.S. and allied . . . networks
and data.’’ 149 Individuals linked to the
143 ARCOS–1
USA, Inc., supra note 138, at 17–
khammond on DSKJM1Z7X2PROD with PROPOSALS2
25.
144 Press Statement, Matthew Miller,
Spokesperson, Dep’t of State, Taking Actions to
Combat the Iranian Regime’s Transnational
Repression (Jan. 29, 2024), https://www.state.gov/
taking-actions-to-combat-the-iranian-regimestransnational-repression/ [https://perma.cc/VS2ZVA32].
145 Press Statement, Antony J. Blinken, Sec’y,
Dep’t of State, Designating Iranian Persons
Connected to Wrongful Detentions (Sept. 18, 2023),
https://www.state.gov/designating-iranian-personsconnected-to-wrongful-detentions/ [https://
perma.cc/2CFT-YQWB].
146 Press Statement, Matthew Miller,
Spokesperson, Dep’t of State, Designating Persons
Tied to Network Smuggling U.S. Technology to
Central Bank of Iran (Feb. 14, 2024), https://
www.state.gov/designating-persons-tied-to-networksmuggling-u-s-technology-to-central-bank-of-iran/
[https://perma.cc/XD7P-JKNU].
147 Press Release, U.S. Dep’t of Treas., Treasury
Targets Sanctions Evasion Network Moving Billions
for Iranian Regime (Mar. 9, 2023), https://
home.treasury.gov/news/press-releases/jy1330
[https://perma.cc/U8J2-NZ5Y]; Press Release, U.S.
Dep’t of Just., Justice Department Announces
Terrorism and Sanctions-Evasion Charges and
Seizures Linked to Illicit, Billion-Dollar Global Oil
Trafficking Network that Finances Iran’s Islamic
Revolutionary Guard Corps and Its Malign
Activities (Feb. 2, 2024), https://www.justice.gov/
opa/pr/justice-department-announces-terrorismand-sanctions-evasion-charges-and-seizures-linked
[https://perma.cc/AXS4-63QM]; Indictment ¶ 2,
United States v. Shahriyari, No. 24–cr–44 (S.D.N.Y.
filed Jan. 25, 2024), ECF No. 1, https://
www.justice.gov/opa/media/1336966/dl?inline
[https://perma.cc/T664-3F6U].
148 U.S. Dep’t of Just., supra note 147.
149 Off. of the Dir. of Nat’l Intel., supra note 86,
at 20.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
Iranian government engage in advanced
cyber activities that target U.S.
infrastructure,150 conduct cyber
espionage,151 and steal data from U.S.
persons, companies, and government
agencies. For example, in 2018, a
Federal grand jury returned an
indictment against nine Iranians for
stealing ‘‘more than 31 terabytes of
documents and data from more than 140
American universities, 30 American
companies, [and] five American
government agencies,’’ in part at the
behest of the Iranian government.152
In particular, Iranian hackers ‘‘have
engaged in widespread theft of personal
information . . . to track targets of
interest to the Iranian regime’’ 153 and
influence U.S. persons. During the 2020
U.S. elections, ‘‘Iranian cyber actors
obtained or attempted to obtain U.S.
voter information, sent threatening
emails to voters, and disseminated
disinformation about the election.’’ 154
According to ODNI, those same Iranian
actors have developed new cyber and
influence techniques that Iran could
deploy during the 2024 election
cycle.155 Iran-associated individuals
also target U.S. persons for
assassinations. For example, in 2023, a
Federal grand jury returned an
indictment against three individuals for
plotting the murder of a U.S. citizen
targeted by Iran for speaking out against
the regime’s human-rights abuses.156 In
150 Cybersec. & Infrastructure Sec. Agency, AA21–
321A, Cybersecurity Advisory: Iranian GovernmentSponsored APT Cyber Actors Exploiting Microsoft
Exchange and Fortinet Vulnerabilities in
Furtherance of Malicious Activities (Nov. 19, 2021),
https://www.cisa.gov/news-events/cybersecurityadvisories/aa21-321a [https://perma.cc/9F3HKY7F].
151 Cybersec. & Infrastructure Sec. Agency,
Iranian Government-Sponsored Actors Conduct
Cyber Operations Against Global Government and
Commercial Networks (Feb. 24, 2022), https://
www.cisa.gov/news-events/cybersecurity-advisories/
aa22-055a [https://perma.cc/46ZR-MDVN].
152 Press Release, U.S. Dep’t of Just., Nine
Iranians Charged with Conducting Massive Cyber
Theft Campaign on Behalf of the Islamic
Revolutionary Guard Corps (Mar. 23, 2018), https://
www.justice.gov/opa/pr/nine-iranians-chargedconducting-massive-cyber-theft-campaign-behalfislamic-revolutionary [https://perma.cc/F3BPGJP7].
153 Nat’l Intel. Council, supra note 5, at 4.
154 Off. of the Dir. of Nat’l Intel., supra note 86,
at 20.
155 Id. at 20.
156 Press Release, U.S. Dep’t of Just., Justice
Department Announces Charges and New Arrest in
Connection with Assassination Plot Directed from
Iran (Jan. 27, 2023), https://www.justice.gov/opa/pr/
justice-department-announces-charges-and-newarrest-connection-assassination-plot-directed
[https://perma.cc/WW34-K9AH]; Iran Sanctions,
U.S. Dep’t State, https://www.state.gov/iransanctions/ [https://perma.cc/MH6Z-EFV7]; see also
Press Release, U.S. Dep’t of Just., One Iranian and
Two Canadian Nationals Indicted in Murder-forHire Scheme (Jan. 29, 2024), https://
www.justice.gov/opa/pr/one-iranian-and-two-
PO 00000
Frm 00031
Fmt 4701
Sfmt 4702
86145
another example of Iran’s exploitation of
sensitive personal data, Iranian cyber
threat actors engaged in ‘‘widespread
theft’’ of personal information,
‘‘probably to support surveillance
operations that enable Iran’s humanrights abuses.’’ 157 Iranian threat actors
also ‘‘employed a years-long malware
campaign’’ that targeted Iranian citizens,
dissidents, journalists, and foreign
organizations, including U.S.-based
travel services companies that possess
personal information on millions of
travelers.158
d. North Korea
The Department has determined, with
the concurrence of the Secretaries of
State and Commerce, that North Korea
has engaged in a long-term pattern of
conduct significantly adverse to the
national security of the United States
and the security and safety of U.S.
persons. Among other conduct
significantly adverse to the national
security of the United States and the
security and safety of U.S. persons, it
develops weapons of mass
destruction; 159 commits human-rights
abuses, including against U.S.
persons; 160 evades U.S. sanctions; 161
and conducts malicious cyber activities.
canadian-nationals-indicted-murder-hire-scheme
[https://perma.cc/2DDC-Q7VQ]; Press Release, U.S.
Dep’t of Treas., The United States and United
Kingdom Target Iranian Transnational
Assassinations Network (Jan. 29, 2024), https://
home.treasury.gov/news/press-releases/jy2052
[https://perma.cc/SE4A-7G4U].
157 Press Release, U.S. Dep’t of Treas., Treasury
Sanctions Iranian Ministry of Intelligence and
Minister for Malign Cyber Activities (Sept. 9, 2022),
https://home.treasury.gov/news/press-releases/
jy0941 [https://perma.cc/98LB-5XYJ].
158 Press Release, Fed. Bureau of Investig., FBI
Releases Cybersecurity Advisory on Previously
Undisclosed Iranian Malware Used to Monitor
Dissidents and Travel and Telecommunications
Companies (Sept. 17, 2020), https://www.fbi.gov/
contact-us/field-offices/boston/news/press-releases/
fbi-releases-cybersecurity-advisory-on-previouslyundisclosed-iranian-malware-used-to-monitordissidents-and-travel-and-telecommunicationscompanies [https://perma.cc/K8V5-LA6U].
159 Press Statement, Antony J. Blinken, Sec’y,
Dep’t of State, Designation of Two DPRK
Individuals Supporting the DPRK’s Unlawful
Weapons of Mass Destruction and Missile Programs
(June 15, 2023), https://www.state.gov/designationof-two-dprk-individuals-supporting-the-dprksunlawful-weapons-of-mass-destruction-and-missileprograms/ [https://perma.cc/EV6L-3TCL].
160 Press Release, U.S. Dep’t of Treas., Treasury
Sanctions Over 40 Individuals and Entities Across
Nine Countries Connected to Corruption and
Human Rights Abuse (Dec. 9, 2022), https://
home.treasury.gov/news/press-releases/jy1155
[https://perma.cc/Y6ST-UVSP]; Bernd Debusmann
Jr., What Happened to US Citizens Like Otto
Warmbier Detained in North Korea, BBC News (July
18, 2023), https://www.bbc.com/news/world-uscanada-66236989 [https://perma.cc/MTL8-D425].
161 Press Statement, Antony J. Blinken, Sec’y,
Dep’t of State, The Democratic People’s Republic of
Korea’s Illicit Activities and Sanctions Evasion
E:\FR\FM\29OCP2.SGM
Continued
29OCP2
86146
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Regarding North Korea’s malicious
cyber activities, ODNI has concluded
that North Korea’s cyber program poses
a ‘‘sophisticated and agile espionage,
cybercrime, and attack threat,’’ and that
North Korea’s cyber forces are ‘‘fully
capable of achieving a variety of
strategic objectives against diverse
targets’’ in the United States.162
Because North Korea has
sophisticated cyber capabilities and
attempts to obtain and exploit data on
U.S. persons, it poses a significant risk
of exploiting government-related data or
Americans’ bulk U.S. sensitive personal
data to the detriment of the national
security of the United States and the
security and safety of U.S. persons.
North Korea conducts cyber-enabled
attacks and steals personal information
to influence and target U.S. persons. For
example, in 2014, North Korea-affiliated
hackers attacked U.S. company Sony
Pictures Entertainment in retaliation for
an American film depicting the North
Korean leader.163 They stole proprietary
information, personally identifiable
information, and confidential
communications; rendered Sony
Pictures Entertainment’s computers
inoperable; and threatened the
company’s executives and
employees.164 North Korea and North
Korea-affiliated hacker groups have
repeatedly targeted military networks,
critical infrastructure, and other
corporate networks to ‘‘steal data and
conduct disruptive and destructive
cyber activities.’’ 165 For example, in
2017, North Korea was responsible for a
massive ransomware attack that infected
hundreds of thousands of computers in
more than 150 countries.166 North Korea
also ‘‘uses cyber capabilities to steal
from financial institutions’’ and
‘‘generate revenue for its weapons of
mass destruction and ballistic missile
(May 6, 2022), https://www.state.gov/thedemocratic-peoples-republic-of-koreas-illicitactivities-and-sanctions-evasion/ [https://perma.cc/
LQ9B-9Z22].
162 Off. of the Dir. of Nat’l Intel., supra note 86,
at 22.
163 Press Release, U.S. Dep’t of Just., North Korean
Regime-Backed Programmer Charged with
Conspiracy to Conduct Multiple Cyber Attacks and
Intrusions (Sept. 6, 2018), https://www.justice.gov/
opa/pr/north-korean-regime-backed-programmercharged-conspiracy-conduct-multiple-cyberattacks-and [https://perma.cc/WXQ3-YMQA].
164 Press Release, Fed. Bureau of Investig., Update
on Sony Investigation (Dec. 19, 2014), https://
www.fbi.gov/news/pressrel/press-releases/updateon-sony-investigation [https://perma.cc/5H4K5EFV].
165 Cybersec. & Infrastructure Sec. Agency,
Guidance on the North Korean Cyber Threat (June
23, 2020), https://www.cisa.gov/news-events/
cybersecurity-advisories/aa20-106a [https://
perma.cc/X8CJ-TAYV].
166 U.S. Dep’t of Just., supra note 163.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
programs.’’ 167 North Korea’s cyber
actors use a range of tactics ‘‘to further
their larger espionage and financial
goals,’’ including conducting spear
phishing, abusing privileged access to
networks while working as information
technology contractors, exploiting
software vulnerabilities, and attacking
supply chains.168 North Korea is also
trying to use AI to further its offensive
cyber capabilities.169
e. Russia
The Department has determined, with
the concurrence of the Secretaries of
State and Commerce, that Russia has
engaged in a long-term pattern of
conduct significantly adverse to the
national security of the United States
and the security and safety of U.S.
persons. According to ODNI, Russia
poses ‘‘an enduring global cyber threat’’
and views ‘‘cyber disruptions as a
foreign policy lever to shape other
countries’ decisions.’’ 170 Russia has
launched a ‘‘full-scale war against
Ukraine;’’ 171 commits human-rights
abuses, including against U.S.
persons; 172 conducts malign influence
167 Cybersec. & Infrastructure Sec. Agency, supra
note 165.
168 Off. of the Dir. of Nat’l Intel., North Korean
Tactics, Techniques and Procedures for Revenue
Generation (July 2023), https://www.dni.gov/files/
CTIIC/documents/products/North-Korean-TTPs-forRevenue-Generation.pdf [https://perma.cc/Y949JJW4]; Press Release, U.S. Dep’t of Just., Justice
Department Announces Court-Authorized Action to
Disrupt Illicit Revenue Generation Efforts of
Democratic People’s Republic of Korea Information
Technology Workers (Oct. 18, 2023), https://
www.justice.gov/opa/pr/justice-departmentannounces-court-authorized-action-disrupt-illicitrevenue-generation [https://perma.cc/3JHY-UH5K].
169 Anne Neuberger, Deputy Nat’l Sec. Advisor for
Cyber & Emerging Tech., Nat’l Sec. Council, U.S.
Dep’t of State, Digital Press Briefing (Oct. 18, 2023),
https://www.state.gov/digital-press-briefing-withanne-neuberger-deputy-nationalsecurity-advisorfor-cyber-and-emerging-technologies/ [https://
perma.cc/GK88-FW8H].
170 Off. of the Dir. of Nat’l Intel., supra note 86,
at 16; see also Press Statement, The White House,
Fact Sheet: Imposing Costs for Harmful Foreign
Activities by the Russian Government (Apr. 15,
2021), https://www.whitehouse.gov/briefing-room/
statements-releases/2021/04/15/fact-sheetimposing-costs-for-harmful-foreign-activities-by-therussian-government/ [https://perma.cc/MD56GD27]; Nat’l Counterintel. & Sec. Ctr., SolarWinds
Orion Software Supply Chain Attack (Aug. 19,
2021), https://www.dni.gov/files/NCSC/documents/
SafeguardingOurFuture/SolarWinds%20Orion%20
Software%20Supply%20Chain%20Attack.pdf
[https://perma.cc/TS3M-MQQ7].
171 Press Statement, Antony J. Blinken, Sec’y,
Dep’t of State, Responding to Two Years of Russia’s
Full-Scale War Against Ukraine and Aleksey
Navalny’s Death (Feb. 23, 2024), https://
www.state.gov/responding-to-two-years-of-russiasfull-scale-war-against-ukraine-and-alekseynavalnys-death/ [https://perma.cc/K3SL-LHFF].
172 Press Statement, Vedant Patel, Principal
Deputy Spokesperson, Dep’t of State, Russia’s
Wrongful Detention of Journalist Evan Gershkovich
(Apr. 10, 2023), https://www.state.gov/russias-
PO 00000
Frm 00032
Fmt 4701
Sfmt 4702
campaigns; 173 evades U.S. sanctions; 174
and conducts malicious cyber
activities.175 Russia ‘‘continuously
refines and employs its espionage,
influence, and attack capabilities’’
against a variety of targets, including
critical infrastructure in the United
States.176 For example, in 2019, Russian
intelligence services perpetrated a
‘‘broad-scope cyber espionage
campaign’’ that exploited the
SolarWinds Orion platform and
compromised both United States
Government agencies and private-sector
organizations.177 The campaign gave
Russian intelligence ‘‘the ability to spy
on or potentially disrupt more than
16,000 computer systems
worldwide.’’ 178 Russian intelligence
ultimately used the attack to target
United States Government agencies and
employees for espionage.179
Because Russia has advanced cyber
capabilities and aggressively seeks to
obtain and exploit data on U.S. persons,
including to conduct influence
campaigns in the United States, it poses
a significant risk of exploiting
government-related data or Americans’
bulk U.S. sensitive personal data to the
detriment of the national security of the
United States and the security and
safety of U.S. persons. Russia engages in
the large-scale theft of sensitive personal
data and is ‘‘increasing [its] ability to
analyze and manipulate large quantities
of personal information,’’ enabling it ‘‘to
more effectively target and influence, or
coerce, individuals and groups in the
wrongful-detention-of-journalist-evan-gershkovich/
[https://perma.cc/XE2R-93RE].
173 Press Release, U.S. Dep’t of Treas., Treasury
Sanctions Actors Supporting Kremlin-Directed
Malign Influence Efforts (Mar. 20, 2024), https://
home.treasury.gov/news/press-releases/jy2195
[https://perma.cc/TB2X-YRPN]; Press Release, U.S.
Dep’t of Treas., Treasury Targets the Kremlin’s
Continued Malign Political Influence Operations in
the U.S. and Globally (July 29, 2022), https://
home.treasury.gov/news/press-releases/jy0899
[https://perma.cc/FXN8-J748].
174 Press Release, U.S. Dep’t of Treas., Treasury
Targets Sanctions Evasion Networks and Russian
Technology Companies Enabling Putin’s War (Mar.
31, 2022), https://home.treasury.gov/news/pressreleases/jy0692 [https://perma.cc/ERD6-ARTE].
175 Press Statement, Matthew Miller,
Spokesperson, Dep’t of State, U.S. Takes Action to
Further Disrupt Russian Cyber Activities (Dec. 7,
2023), https://www.state.gov/u-s-takes-action-tofurther-disrupt-russian-cyber-activities/ [https://
perma.cc/AW9F-E8BP].
176 Off. of the Dir. of Nat’l Intel., supra note 86,
at 16.
177 White House, supra note 170.
178 Id.
179 SolarWinds Cyberattack Demands Significant
Federal and Private-Sector Response (infographic),
U.S. Gov’t Accountability Off. (Apr. 22, 2021),
https://www.gao.gov/blog/solarwinds-cyberattackdemands-significant-federal-and-private-sectorresponse-infographic [https://perma.cc/3A2V6S59].
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
United States.’’ 180 For example, in
2013, Russian intelligence services
sponsored the theft of information
associated with at least 500 million
accounts from U.S. web services
company Yahoo!181 and used some of
that stolen information to obtain
unauthorized access to the email
accounts of United States Government
officials, among others.182 In 2020,
Russian cyber operations targeted and
compromised U.S. State and local
government networks and exfiltrated
some voter data.183 In another example,
in 2023, a Federal grand jury returned
an indictment against two Russian
individuals for obtaining unauthorized
access to the computers and email
accounts of current and former United
States Government employees and
stealing intelligence related to defense,
security policies, and nuclear energy
technology from the victims’
accounts.184 In 2024, Russian
intelligence services used compromised
routers to conduct ‘‘spearphishing and
similar credential harvesting campaigns
against targets of intelligence interest to
the Russian government, such as U.S.
and foreign governments and military,
security, and corporate
organizations.’’ 185
Russia also has a legal regime that
gives it the capability to covertly access
and exploit data through companies
subject to its jurisdiction. As the
Department of Commerce has explained,
‘‘Russian laws compel companies
subject to Russian jurisdiction to
cooperate with Russian intelligence and
law enforcement efforts, to include
requests from the Russian Federal
180 Nat’l
Intel. Council, supra note 5, at 3.
Release, U.S. Dep’t of Just., U.S. Charges
Russian FSB Officers and Their Criminal
Conspirators for Hacking Yahoo and Millions of
Email Accounts (Mar. 15, 2017), https://
www.justice.gov/opa/pr/us-charges-russian-fsbofficers-and-their-criminal-conspirators-hackingyahoo-and-millions [https://perma.cc/44UK-XM7P].
182 U.S. Dep’t of Just., supra note 181; Indictment
¶ 34, United States v. Dokuchaev, No. 17-cr-103
(N.D. Cal. filed Feb. 28, 2017).
183 Nat’l Intel. Council, ICA 2020–00078D,
Intelligence Community Assessment on Foreign
Threats to the 2020 US Federal Elections 3 (Mar.
10, 2021), https://www.dni.gov/files/ODNI/
documents/assessments/ICA-declass-16MAR21.pdf
[https://perma.cc/R8LM-KEUX].
184 Indictment ¶¶ 3–5, United States v.
Aleksandrovic, No. 23–cr–447 (N.D. Cal. filed Dec.
5, 2023).
185 Press Release, U.S. Dep’t of Just., Justice
Department Conducts Court-Authorized Disruption
of Botnet Controlled by the Russian Federation’s
Main Intelligence Directorate of the General Staff
(GRU) (Feb. 15, 2024), https://www.justice.gov/opa/
pr/justice-department-conducts-court-authorizeddisruption-botnet-controlled-russian [https://
perma.cc/8M8Z-C3SM].
khammond on DSKJM1Z7X2PROD with PROPOSALS2
181 Press
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
Security Service (‘‘FSB’’).’’ 186 These
laws include the following:
• Federal Law No. 40–FZ of April 3,
1995, ‘‘On the Federal Security
Service,’’ ‘‘requires FSB bodies to carry
out their activities in collaboration with
various entities in Russia’’ and places
private enterprises ‘‘under a legal
obligation to assist FSB bodies in the
execution of the duties assigned to FSB
bodies,’’ including intelligence and
counterintelligence activities.187
• Federal Law No. 144–EZ of August
12, 1995 (as amended), ‘‘On
Operational-Investigative Activity,’’
requires persons subject to Russian
jurisdiction to ‘‘assist the FSB with
operational-investigative activities
undertaken in the performance of FSB
duties, such as by installing equipment
supplied by the FSB for use in obtaining
information stored on computers.’’ 188
This law ‘‘makes it clear that, as a
general rule, operational-investigative
activities may be carried out against
anyone anywhere’’ and ‘‘makes it clear
that operational-search activities
include obtaining computer
information.’’ 189
• Federal Law No. 149–FZ of July 27,
2006, ‘‘On Information, Information
Technologies, and Protection of
Information,’’ imposes several
‘‘obligations on any entity that qualifies
as ‘an organizer of the dissemination of
information on the internet,’ ’’ which is
broadly defined to include any ‘‘person
who carries out activities to ensure the
operation of information systems and/or
programs for electronic computers that
are designed and/or used to receive,
transmit, deliver and/or process
electronic messages of users of the
internet.’’ 190 These obligations include
giving the FSB and other Russian
agencies in the field of security ‘‘the
information necessary to decode’’
encrypted data.191
In short, persons subject to Russia’s
jurisdiction must ‘‘assist the FSB in its
counterintelligence and intelligence
functions,’’ which ‘‘includes a duty to
assist the FSB in operational186 Kaspersky Lab, Inc., supra note 20, 89 FR
52435.
187 Report of Peter B. Maggs to the U.S. Dep’t of
Homeland Sec. ¶¶ 14–18 (Dec. 2, 2017), https://
www.internetgovernance.org/wp-content/uploads/
12-7-Exhibit-AR-Part-6-Maggs-report.pdf [https://
perma.cc/US4P-VMCP] (hereinafter ‘‘Maggs
Report’’) (supporting the Department of Homeland
Security’s Dec. 4, 2017 Final Decision on Binding
Operational Directive 17–01, Removal of KasperskyBranded Products).
188 Kaspersky Lab, Inc., supra note 20, 89 FR
52435 n.13; Maggs Report, supra note 187, ¶¶ 24–
25.
189 Maggs Report, supra note 187, ¶¶ 24–29.
190 Id. ¶ 21.
191 Id. ¶¶ 13(f), 31.
PO 00000
Frm 00033
Fmt 4701
Sfmt 4702
86147
investigative activity, in support of FSB
counterintelligence and intelligence
functions’’ such as ‘‘collecting
information from U.S. computers,’’
‘‘with no need for the FSB to have
obtained a court order.’’ 192
Finally, Russia also poses a ‘‘serious
foreign influence threat because of its
wide-ranging efforts to . . . sow
domestic discord, including among
voters inside the United States.’’ 193 In
July 2018, a Federal grand jury returned
an indictment against Russian
intelligence officers after they
conducted a spear phishing campaign
against volunteers and employees of a
presidential campaign and political
committees.194 The actors hacked into
computers, stole emails, covertly
monitored the computer activity of
campaign employees, and released the
hacked information to the public in an
attempt to interfere with the 2016 U.S.
presidential election.195
f. Venezuela
The Department has determined, with
the concurrence of the Secretaries of
State and Commerce, that Venezuela has
engaged in a long-term pattern of
conduct significantly adverse to the
national security of the United States
and the security and safety of U.S.
persons. Among other conduct
significantly adverse to the national
security of the United States and the
security and safety of U.S. persons,
Venezuela commits human-rights
abuses, including against U.S.
persons; 196 evades U.S. sanctions; 197
has concerning relationships with other
192 Id.
¶ 30.
of the Dir. of Nat’l Intel., supra note 86,
193 Off.
at 17.
194 Press Release, U.S. Dep’t of Just., Grand Jury
Indicts 12 Russian Intelligence Officers for Hacking
Offenses Related to the 2016 Election (July 13,
2018), https://www.justice.gov/opa/pr/grand-juryindicts-12-russian-intelligence-officers-hackingoffenses-related-2016-election [ https://perma.cc/
RG2P-SJLQ]; Indictment ¶¶ 2–5, United States v.
Netyksho, No. 18–cr–215 (D.D.C. filed July 13,
2018).
195 U.S. Dep’t of Just., supra note 194; Indictment
¶¶ 2–5, Netyksho, No. 8–cr–215.
196 U.S. Dep’t of State, 2022 Country Reports on
Human Rights Practices: Venezuela (2022), https://
www.state.gov/wp-content/uploads/2023/02/
415610_VENEZUELA-2022-HUMAN-RIGHTSREPORT.pdf [https://perma.cc/7TM9-P87S]; see
also, e.g., E.O. 13692, 80 FR 12747 (Mar. 8, 2015).
197 Press Release, U.S. Att’ys Off. DC, U.S. Dep’t
of Just., Largest U.S. Seizure of Iranian Fuel from
Four Tankers (Aug. 14, 2020), https://
www.justice.gov/usao-dc/pr/largest-us-seizureiranian-fuel-four-tankers [https://perma.cc/66EF42CD]; Fin. Crimes Enf’t Network, U.S. Dep’t of
Treas., FIN–2019–A002, Updated Advisory on
Widespread Public Corruption in Venezuela, 8 (May
3, 2019), https://www.fincen.gov/sites/default/files/
advisory/2019-05-03/
Venezuela%20Advisory%20FINAL%20508.pdf
[https://perma.cc/X5VL-HH69].
E:\FR\FM\29OCP2.SGM
29OCP2
86148
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
countries of concern; 198 and fosters
widespread corruption.199
Because Venezuela exploits its
demonstrated and systematic
relationships with other countries of
concern to degrade U.S. national
security; aggressively surveils its own
population to target perceived
government critiques, including with
the help of other countries of concern;
and, according to credible reports,
commits human-rights abuses,
including against U.S. citizens,
Venezuela’s access to governmentrelated data or Americans’ bulk U.S.
sensitive personal data poses a
significant risk to the national security
of the United States and the security
and safety of U.S. persons. Regarding
Venezuela’s human-rights abuses,
Venezuela surveils its domestic
population through telecommunications
providers to target perceived opponents,
including with the help of other
countries of concern.200 Venezuela’s
misuse of private telecommunications
capabilities for expansive surveillance
poses risks to U.S. persons, as the
regime has the capability to access data
on U.S. persons in Venezuela. For
example, in 2021, a report by Spanish
telecommunications company
Telefonica revealed that Venezuela
monitored the communications of
nearly 1.5 million of its users, which
represents over 20 percent of
Telefonica’s Venezuela-based
customers.201 In addition to
surveillance, there are credible reports
that Venezuela perpetrates extensive
human-rights abuses, such as torture,
extrajudicial killings, and enforced
disappearances. Venezuelan security
forces detain individuals, including U.S.
citizens, for long periods without due
process.202 According to the State
198 U.S. Dep’t of Just., supra note 197; Off. of the
Dir. of Nat’l Intel., supra note 86, at 29.
199 Press Release, U.S. Dep’t of Just., Former
Venezuelan National Treasurer and Her Husband
Sentenced in Money Laundering and International
Bribery Scheme (Apr. 19, 2023), https://
www.justice.gov/opa/pr/former-venezuelannational-treasurer-and-her-husband-sentencedmoney-laundering-and [https://perma.cc/AU8NC9UD]; Fin. Crimes Enf’t Network, supra note 197,
at 7.
200 U.S. Dep’t of State, supra note 196, at 19;
Marı́a Luisa Paúl, Venezuela Tapped 1.5 Million
Phone Lines. It’s Just the Start, Experts Warn.,
Wash. Post (June 28, 2022), https://
www.washingtonpost.com/nation/2022/06/28/
telefonica-wiretapping-venezuela-phone/ [https://
perma.cc/T8YV-A9TW].
201 U.S. Dep’t of State, supra note 196, at 19; Paúl,
supra note 200.
202 U.S. Dep’t of State, Venezuela Travel Advisory
(May 13, 2024), https://travel.state.gov/content/
travel/en/traveladvisories/traveladvisories/
venezuela-travel-advisory.html [https://perma.cc/
5F26-GNRM]; Clare Ribando Seelke et al., Cong.
Rsch. Serv., R44841, Venezuela: Background and
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
Department, the United States
Government is not generally notified of
the detention of U.S. citizens in
Venezuela or granted access to U.S.
citizen prisoners in Venezuela.203
Venezuela maintains close
relationships with other countries of
concern that, as described in part IV.D
of this preamble, possess sophisticated
surveillance capabilities and pose a
significant risk of exploiting
government-related data or Americans’
bulk U.S. sensitive personal data. Given
the nature of these relationships,
Venezuela might use technology
provided by these countries of concern
to obtain access to government-related
data or bulk U.S. sensitive personal
data, or share any access to governmentrelated data or bulk U.S. sensitive
personal data with these countries of
concern. For example, Venezuela uses
equipment provided by Chinese
technology company Zhongxing
Telecommunication Equipment (‘‘ZTE’’)
Corporation, which the FCC has
designated a national security threat to
the U.S. communications network and
supply chain, to monitor Venezuelan
citizens’ social, political, and economic
activities.204 The company has provided
Venezuela with identity cards, referred
to as ‘‘carnet de la patria’’ or ‘‘fatherland
cards,’’ that the regime can use to track
citizen behavior.205 Additionally,
Venezuelan and Russian state-owned
companies jointly own Evrofinance
Mosnarbank, a bank that has financed
Venezuela’s efforts to use digital
currencies to circumvent U.S. financial
sanctions.206 Evrofinance Mosnarbank
also provides financial support to
Petroleos de Venezuela, a Venezuelan
state-owned oil company that has been
used to embezzle and launder billions of
dollars.207 Venezuela also has
concerning military and intelligence ties
with other countries of concern. For
example, Russia provides military
U.S. Relations 7 (Dec. 6, 2022), https://
crsreports.congress.gov/product/pdf/R/R44841
[https://perma.cc/T8ZW-4RRA].
203 U.S. Dep’t of State, supra note 196.
204 FCC, Protecting Against National Security
Threats to the Communications Supply Chain
Through FCC Programs—ZTE Designation, 35 FCC
Rcd. 6633 (2020), https://docs.fcc.gov/public/
attachments/DA-20-691A1.pdf [https://perma.cc/
MK3W-SYEN].
205 Angus Berwick, How ZTE Helps Venezuela
Create China-Style Social Control, Reuters (Nov. 14,
2018), https://www.reuters.com/investigates/
special-report/venezuela-zte/ [https://perma.cc/
66X9-FBWD]; see also U.S. Dep’t of State, supra
note 196.
206 Fin. Crimes Enf’t Network, supra note 197, at
4–5.
207 Id.; Press Release, U.S. Dep’t of Treas.,
Treasury Sanctions Venezuela’s State-Owned Oil
Company Petroleos de Venezuela, S.A. (Jan. 28,
2019), https://home.treasury.gov/news/pressreleases/sm594 [https://perma.cc/375J-DR47].
PO 00000
Frm 00034
Fmt 4701
Sfmt 4702
support to Venezuela.208 Cuba provides
training to Venezuelan intelligence and
military personnel, and the two nations
support each other’s intelligence
operations.209
E. Subpart G—Covered Persons
1. Section 202.211—Covered Person
The proposed rule identifies a
‘‘covered person’’ as an individual or
entity that falls into one of the classes
of covered persons or that the Attorney
General has designated as a covered
person. An entity is a covered person if
it is a foreign person that: (1) is 50
percent or more owned, directly or
indirectly, by a country of concern; (2)
is organized or chartered under the laws
of a country of concern; or (3) has its
principal place of business in a country
of concern. An entity is also a covered
person if it is a foreign person that is 50percent or more owned, directly or
indirectly, by a covered person. Any
foreign individual who is an employee
or a contractor of such an entity or of
the country of concern itself is also a
covered person. Any foreign person who
is primarily a resident in the territorial
jurisdiction of a country of concern is
also a covered person.
The proposed rule would not
categorically treat citizens of countries
of concern located in third countries
(i.e., not located in the United States
and not primarily resident in a country
of concern) as covered persons. Instead,
it treats only a subset of country of
concern citizens in third countries
categorically as covered persons: those
working for the government of a country
of concern or for an entity that is a
covered person. All other country of
concern citizens located in third
countries would not qualify as covered
persons except to the extent that the
Attorney General designates them.
Some commenters believed that it
would be difficult for U.S. persons
208 Regina Garcia Cano, Venezuela’s Leader
Pledges Military Cooperation with Russia, AP News
(Feb. 16, 2022), https://apnews.com/article/europerussia-venezuela-vladimir-putin-south-americafc9e01895f52f8d9f52e501a93b2f089 [https://
perma.cc/M59U-SRUU]; Russia in the Western
Hemisphere: Assessing Putin’s Malign Influence in
Latin America and the Caribbean: Hearing Before
the H. Foreign Affs. Subcomm. on W. Hemisphere,
Civilian Sec., Migration, & Int’l Econ. Pol’y, 117th
Cong. 1–3 (2022) (statement of Evan Ellis, Senior
Associate, Ctr. for Strategic & Int’l Stud.), https://
csis-website-prod.s3.amazonaws.com/s3fs-public/
congressional_testimony/ts220720_Ellis.pdf
[https://perma.cc/K9VG-ZFW2].
209 Moises Rendon & Claudia Fernandez, Ctr. for
Strategic & Int’l Stud., The Fabulous Five: How
Foreign Actors Prop Up the Maduro Regime in
Venezuela 7 (2020), https://csis-websiteprod.s3.amazonaws.com/s3fs-public/publication/
201019_Rendon_Venezuela_Foreign_Actors.pdf
[https://perma.cc/39AG-LAAX].
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
subject to the proposed rule to
determine whether entities are 50
percent or more owned by countries of
concern, particularly where the foreign
companies are publicly traded
companies. However, this provision is
not unique to the proposed rule. It is
similar to sanctions regulations issued
by the Office of Foreign Assets Control
(‘‘OFAC’’) within the Department of the
Treasury. Such regulations treat any
entity owned in the aggregate, directly
or indirectly, 50-percent or more by one
or more blocked persons as itself a
blocked person, regardless of whether
the entity itself is designated pursuant
to an Executive Order or otherwise
identified on OFAC’s Specially
Designated Nationals and Blocked
Persons List.210 The proposed rule also
uses higher ownership thresholds than
some regulatory regimes, such as those
related to anti-money laundering, which
generally require certain companies to
identify beneficial owners with 25
percent or more (and, in some cases, 10
percent or more) direct or indirect legal
interest in an entity and to collect,
verify, and report specific information
about them.211 As other commenters
pointed out, businesses and third-party
service providers have developed tools
and services to assist with screening and
due diligence based on corporate
ownership in the sanctions, anti-money
laundering, and other regulatory
contexts. Consequently, the proposed
rule adopts the approach described in
the ANPRM without change.
One commenter recommended that
the Department clarify how the
proposed rule would apply to
companies headquartered outside a
country of concern but with business
operations in a country of concern. The
proposed rule maintains the framework
described in the ANPRM without
change, and the Department has
provided some additional examples in
the proposed rule to demonstrate how
the proposed rule treats foreign
branches and subsidiaries located in
countries of concern. See
§ 202.256(b)(5)(8). The proposed rule
also exempts corporate group
transactions that are ordinarily incident
to and part of administrative or ancillary
business operations, such as human
resources, including between U.S.
210 See generally OFAC, U.S. Dep’t of Treas.,
Revised Guidance on Entities Owned by Persons
Whose Property and Interests in Property Are
Blocked (Aug. 13, 2014), https://ofac.treasury.gov/
media/6186/download?inline [https://perma.cc/
Q87V-VZJQ].
211 See generally Beneficial Ownership
Information: Frequently Asked Questions, Fin.
Crimes Enf’t Network, https://www.fincen.gov/boifaqs [https://perma.cc/Z7KQ-PN79].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
entities and their foreign subsidiaries or
affiliates.
Several commenters suggested that
the Department rely solely on
designations and adopt an exclusively
list-based approach to the identification
of covered persons (similar to OFAC’s
Specially Designated Nationals and
Blocked Persons List or the Bureau of
Industry and Security’s (‘‘BIS’’) Entity
List) rather than applying the
prohibitions and restrictions to
categories of covered persons
supplemented by a non-exhaustive list.
The Department declines to adopt the
exclusively list-based approach. Such
an approach would be inconsistent with
the Order, as well as with the national
security risk associated with country of
concern access to government-related
data or bulk U.S. sensitive personal
data. Specifically, the national security
risk identified in the Order exists with
respect to any entity that is subject to
the ownership, direction, jurisdiction,
or control of a country of concern due
to the fact that each of the listed
countries of concern in the proposed
rule have legal or political systems that
allow the countries to obtain sensitive
personal data (and access to such data)
from persons subject to their ownership,
direction, jurisdiction, or control
without due process or judicial
redress.212 That risk exists with respect
212 Nat’l Counterintel. & Sec. Ctr., supra note 83,
at 1; Justin Sherman, Russia Is Weaponizing Its
Data Laws Against Foreign Organizations,
Brookings Inst. (Sept. 27, 2022), https://
www.brookings.edu/articles/russia-is-weaponizingits-data-laws-against-foreign-organizations/
[https://perma.cc/ATU2-SU3G]; U.S. Dep’t of State,
supra note 196, at 19; see generally Freedom in the
World 2024: North Korea, Freedom House, https://
freedomhouse.org/country/north-korea/freedomworld/2024 [https://perma.cc/5PAA-YMQ4];
Freedom on the Net 2022: Cuba, Freedom House,
https://freedomhouse.org/country/cuba/freedomnet/2022 [https://perma.cc/FFF6-ALCB]; Data
Security Business Advisory, Risks and
Considerations for Businesses Using Data Services
and Equipment from Firms Linked to the People’s
Republic of China, U.S. Dep’t of Homeland Sec.
(Dec. 22, 2020), https://www.dhs.gov/sites/default/
files/publications/20_1222_data-security-businessadvisory.pdf [https://perma.cc/B6XM-8G9V]; Anna
Borshchevskaya, ‘Brave New World’: Russia’s New
Anti-Terrorism Legislation, Wash. Inst. (July 8,
2016), https://www.washingtoninstitute.org/policyanalysis/brave-new-world-russias-new-antiterrorism-legislation [https://perma.cc/2XXZUTC7]; Combating the Iranian Cyber Threat:
Republic at the Center of Cyber Crime Charges in
Three Cases, Fed. Bureau of Investig. (Sept. 18,
2020), https://www.fbi.gov/news/stories/iran-atcenter-of-cyber-crime-charges-in-three-cases-091820
[https://perma.cc/DYL5-WXUC]; Amelia Williams,
Cuba: New data protection law—what you need to
know, Data Guidance (Sept. 2022), https://
www.dataguidance.com/opinion/cuba-new-dataprotection-law-what-you-need-know [https://
perma.cc/JH83-6P7S]; Joanna Robin, Maduro
regime doubles down on censorship and repression
in lead-up to Venezuelan election, ICIJ (July 24,
2024), https://www.icij.org/inside-icij/2024/07/
maduro-regime-doubles-down-on-censorship-and-
PO 00000
Frm 00035
Fmt 4701
Sfmt 4702
86149
to any person that is meaningfully
subject to their ownership, direction,
jurisdiction, or control—not only to
specific entities designated on a case-bycase basis. Entities that are meaningfully
subject to the ownership, direction,
jurisdiction, or control of a country of
concern are, as the FBI has described,
hybrid commercial threats. As the FBI
has explained, ‘‘[h]ybrid [c]ommercial
[t]hreats are businesses whose legitimate
commercial activity can facilitate
foreign government access to U.S. data,
critical infrastructure, and emerging
technologies that enable adversaries to
conduct espionage, technology transfer,
data collection, and other disruptive
activities under the disguise of an
otherwise legitimate commercial
activity.’’ 213
As such, trying to apply a list-based
approach would be insufficient to
mitigate the national security risk
identified in the Order and the proposed
rule. The categories of covered persons
defined in the Order and defined further
in the proposed rule identify categories
of persons that are meaningfully subject
to the ownership, direction, jurisdiction
of a country of concern, or control of a
country of concern or covered person,
and thus present this risk. Processes like
those used by OFAC to add blocked
persons to the Specially Designated
Nationals and Blocked Persons List or
by BIS to add entities to the Entity List,
which are generally based on a
particularized inquiry into whether the
target meets the applicable legal criteria
for designation,214 would thus be
repression-in-lead-up-to-venezuelan-election/
[https://perma.cc/6TBD-4J28]; U.S. Dep’t of State,
Bureau of Democracy, H.R. and Lab., 2021 Country
Reports on Human Rights Practices: North Korea
(2021), https://www.state.gov/wp-content/uploads/
2022/03/313615_KOREA-DEM-REP-2021-HUMANRIGHTS-REPORT.pdf [https://perma.cc/GF5Z25UG]; Freedom on the Net 2024: Iran, Freedom
House, at C4 and C6, https://freedomhouse.org/
country/iran/freedom-net/2024 [https://perma.cc/
2QKR-9E7C].
213 In Camera, Ex Parte Classified Decl. of Kevin
Vorndran, Assistant Dir., Counterintel. Div., Fed.
Bureau of Invest., Doc. No. 2066897 at Gov’t App.
33 ¶ 6, TikTok Inc. v. Garland, Case Nos. 24–1113,
24–1130, 24–1183 (D.C. Cir. July 26, 2024) (publicly
filed redacted version).
214 See 15 CFR 744.16 (1996) (‘‘The Entity List
(supplement No. 4 to [part 744]) identifies persons
. . . reasonably believed to be involved, or to pose
a significant risk of being or becoming involved, in
activities contrary to the national security or foreign
policy interests of the United States.’’); see also, 31
CFR 589.201(a) (2022) (blocking the property of
‘‘any person determined by the Secretary of the
Treasury’’ to, among other things, ‘‘be responsible
for or complicit in, or to have engaged in, directly
or indirectly,’’ actions or policies ‘‘that undermine
democratic processes or institutions in Ukraine’’ or
‘‘that threaten the peace, security, stability,
sovereignty, or territorial integrity of Ukraine’’ or
‘‘[m]isappropriation of state assets of Ukraine or of
an economically significant entity in Ukraine’’).
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86150
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
insufficient by themselves to address
the national security risk identified in
the Order. An exclusively list-based
approach could present considerable
compliance and enforcement
challenges. It also poses potential
evasion risks, similar to those
encountered by OFAC, and
circumvention threats that could
compromise national security. The
Department has determined not to
exclusively implement a list-based
program to mitigate the risk that listed
entities, such as corporations, would
rename or reorganize themselves in a
manner that avoids being subject to the
framework. Therefore, the proposed rule
adopts the approach described in the
ANPRM without change.
One commenter suggested that the
Department should not treat trustworthy
entities located in countries of concern
as covered persons. The Department
declines to do so, and the proposed rule
retains the framework described in the
ANPRM without change. Regardless of
the trustworthiness of entities, as
explained in part IV.E.1 of this
preamble, countries of concern have the
legal authority or political systems to
force, coerce, or influence entities in
their jurisdictions to share their data
and access with the government.215
One commenter urged the Department
to narrow the definition of ‘‘covered
persons’’ to exclude individuals who are
temporarily in the United States but are
otherwise residents of a country of
concern. The proposed rule adopts the
approach described in the ANPRM
without change. As described in the
ANPRM, including its Example 33,
anyone in the United States (including
temporarily in the United States) would
be considered a U.S. person, and no
U.S. persons (including those
temporarily in the United States) would
be categorically treated as covered
persons.216 A U.S. person (including a
temporary traveler to the United States)
would be a covered person only if they
had been designated by the Department.
The proposed rule adopts this proposal
unchanged from the ANPRM.
Two related commenters expressed
identical concerns that the definition of
‘‘covered persons’’ would require
companies to discriminate based on
nationality or race, particularly with
respect to employees who are primarily
resident in countries of concern. No
change was made in response to these
comments. As the Order makes clear,
status as a covered person does not
depend on the nationality or race of an
individual, and the Order and proposed
215 See
216 89
sources cited infra note 212.
FR 15790–91.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
rule are directed at persons of any
nationality or race who are subject to
the ownership, direction, jurisdiction,
or control of a country of concern. The
definition of ‘‘covered person’’
categorically includes any foreign
person that is primarily resident in a
country of concern, regardless of their
nationality or race. Likewise, the
definition of ‘‘covered person’’
categorically includes any foreign
person abroad who is an employee or
contractor of a country of concern or a
covered person that is an entity,
regardless of their nationality or race.
Similarly, the Department’s authority to
designate a specific individual as a
‘‘covered person’’ turns on a
determination that the individual is
subject to the control, jurisdiction, or
direction of a country of concern, or is
acting on behalf of or purporting to act
on behalf of a country of concern or
covered person, or has knowingly
caused or directed a violation of the
proposed rule. The definition of ‘‘U.S.
person’’ is also not dependent on a
person’s nationality or race; it includes,
for example, any person in the United
States and any U.S. citizen or lawful
permanent resident. For example, under
the proposed rule, a country of concern
citizen located in the United States is a
U.S. person (unless individually
designated). As a result, a U.S. person
of any particular race or nationality
would not be categorically treated as a
covered person, and the only
circumstance in which a U.S. person
would be treated as a covered person is
by individual designation.
Consequently, the proposed rule adopts
the approach described in the ANPRM
without change.
Several commenters sought
clarification that any U.S. subsidiary of
a covered person is considered a U.S.
person for purposes of these regulations.
The proposed rule would not treat any
U.S. person, including a U.S. subsidiary
of a covered person, as a covered person
unless the Department has designated
the U.S. subsidiary as a covered person
pursuant to the process described in the
proposed rule. No U.S. person,
including the U.S. subsidiary of a
covered person, would be categorically
treated as a covered person under the
proposed rule. The proposed rule
includes additional examples
highlighting the differences in treatment
between a U.S. subsidiary and its
foreign owner, as well as between U.S.
companies and their foreign branches.
2. Section 202.701—Designation of
Covered Persons
The proposed rule provides for the
Attorney General to publicly designate a
PO 00000
Frm 00036
Fmt 4701
Sfmt 4702
person, whether an individual or entity,
as a covered person with whom U.S.
persons may not knowingly engage in a
prohibited transaction, or a restricted
transaction that fails to comply with the
requirements of subpart D of the
proposed rule, except as otherwise
authorized under the proposed rule. The
Department intends generally to model
this process on the processes for
designation under the various sanctions
lists maintained by OFAC. Inclusion on
the Department’s Covered Persons List
would have no effect on a person’s
inclusion on other United States
Government designation lists, including
lists maintained by OFAC.
The Department expects that, in many
cases, designation will be unnecessary
because a person will be automatically
deemed a covered person by operation
of the definition of ‘‘covered person’’
discussed in part IV.E.1 of this
preamble. For example, an entity that is
majority-owned by a country of concern
would be a covered person by
definition, regardless of whether the
entity itself is designated by the
Attorney General and included on the
Department’s Covered Persons List.
Designation is not necessary in that
circumstance and, except as otherwise
authorized under the proposed rule, a
U.S. person would be prohibited from
knowingly engaging in a prohibited
transaction, or a restricted transaction
that fails to comply with the
requirements of subpart D, with such an
entity.
Even in these circumstances,
however, the Attorney General may
nonetheless designate such an entity
and identify that entity as a covered
person in the Federal Register and on
a Department website. Such designation
may serve to provide broader notice to
U.S. persons that the entity is a covered
person under the Order and the
regulations. For example, the definition
of ‘‘covered person’’ includes entities
that are majority-owned directly or
indirectly by a country of concern. In
some circumstances, indirect ownership
may not be readily apparent, and
Attorney General designation, published
in the Federal Register, will provide
notice that the entity is a covered
person. Even in the case of instances in
which the covered person status of an
entity is clear—such as companies that
are openly organized or chartered under
the laws of a country of concern or that
have their principal place of business in
a country of concern—designation and
publication in the Federal Register may
facilitate compliance with the
prohibitions and restrictions under the
Order and the regulations. Importantly,
however, the public list would not
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
exhaustively include all covered
persons, as any person that satisfies the
criteria of the relevant definitions will
be considered a covered person under
the proposed rule, regardless of whether
the person is also specifically identified
on the public list. Under the proposed
rule, for example, every company with
its principal place of business in any
country of concern is a ‘‘covered
person’’; the Department does not
intend to individually designate all such
companies.
The proposed rule also authorizes the
Department to designate as covered
persons other individuals or entities
that are not already captured by other
elements of the definition. This process
is modeled after other IEEPA-related
designation processes and contemplates
designation based on interagency
consultation and consideration of any
relevant sources of information (which
may include classified information).
Under the proposed rule, and consistent
with the Order, the Department could
designate as a covered person any
person that is owned or controlled by or
subject to the jurisdiction or direction of
a country of concern, is acting on behalf
of or purporting to act on behalf of a
country of concern or other covered
person, or is knowingly causing or
directing a violation of these
regulations. For example, individual
citizens of a country of concern
primarily residing in a third country are
not generally considered to be covered
persons. In specific cases, however,
covered data transactions with such
individuals may present an
unacceptable national security risk
because, for example, the individual
may be subject to the direction of a
country of concern. The proposed rule
provides for the Attorney General to
designate such an individual—or any
other individual or entity that satisfies
the substantive criteria in the proposed
rule—as a covered person.
Under the proposed rule, designation
as a covered person is effective upon the
Department’s announcement; a U.S.
person with actual knowledge of the
designated person’s status would be
prohibited from knowingly engaging in
a covered data transaction with that
person (except as otherwise authorized
under the proposed rule). After
publication in the Federal Register, the
Department would infer knowledge of
the designated person’s status on the
part of any U.S. person engaging in a
covered data transaction with that
person. As in the context of asset flight,
designations must be immediately
effective to prohibit the irreversible
transfer of regulated data—and the
attendant risk to national security—once
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
a designation is announced. If there
were delay, unscrupulous actors could
rush to complete transactions that
would soon become prohibited, thus
inviting precisely the national security
risk that the Order, and the designation,
is intended to mitigate. Like the OFAC
processes on which it is modeled, the
proposed rule includes a mechanism for
a person designated as a covered person
to seek administrative reconsideration
of the designation or removal from the
list of designated covered persons on
the basis of changed circumstances.
Designation as a covered person
reflects the risk to national security that
attaches to the designated person’s
relationship—whether voluntary or
involuntary—with a country of concern.
The definition of ‘‘covered person,’’ for
example, includes any foreign person
who is primarily resident in the
territorial jurisdiction of a country of
concern or any person who is an
employee or contractor of an entity with
its principal place of business in a
country of concern. As a general matter,
the national security risk from
concluding a covered data transaction
with such persons arises primarily from
the potential actions of the government
of the country of concern in relation to
that person, not from the intent or
personal characteristics of the
individual.
A few commenters expressed concern
that it will be difficult for businesses
subject to the proposed rule to identify
entities controlled by or subject to the
jurisdiction of countries of concern.
However, neither the ANPRM nor the
proposed rule would require companies
to determine whether entities are
subject to the control or jurisdiction of
a country of concern. Whether an entity
is controlled by or subject to the
jurisdiction or direction of a country of
concern is part of the criteria applied by
the Attorney General in designating
individuals and entities as covered
persons; it is not a standard to be
applied by the private sector. If the
Attorney General determines that an
individual or entity meets the criteria
for designation, the Attorney General
will specifically and publicly designate
that person, as addressed in the
foregoing discussion, and the private
sector can screen counterparties against
that public list. For entities not so
designated, the private sector need only
consult the four other categories of
covered persons discussed in part IV.E.1
of this preamble; the private sector need
not conduct any inquiry into whether
such an entity is controlled by or subject
to the jurisdiction or direction of a
country of concern. Therefore, the
proposed rule adopts the approach
PO 00000
Frm 00037
Fmt 4701
Sfmt 4702
86151
described in the ANPRM without
change.
F. Subpart H—Licensing
The Order authorizes the Attorney
General, in concurrence with the
Departments of State, Commerce, and
Homeland Security and in consultation
with other relevant agencies, to issue
(including to modify or rescind) licenses
authorizing a transaction that would
otherwise be a prohibited transaction or
a restricted transaction. The proposed
rule implements this provision of the
Order by providing processes for
regulated parties to seek, and for the
Attorney General to issue, general and
specific licenses. The Department
anticipates that licenses will be issued
only in rare circumstances as the
Attorney General deems appropriate.
1. Section 202.801—General Licenses
General licenses would be published
in the Federal Register and could be
relied upon by all relevant parties
affected by a particular element of these
regulations. As deemed appropriate, the
Attorney General, in concurrence and
consultation with other departments as
required by the Order, may issue a
general license permitting otherwise
prohibited transactions, including
pursuant to conditions specified in the
license. In those instances, otherwise
prohibited transactions that satisfy any
applicable conditions would be
permitted; there would be no
requirement for a party to seek further
authorization prior to concluding a
transaction covered by such a license.
General licenses could be issued to ease
industry’s transition once the proposed
rules become effective by potentially,
for example, authorizing orderly winddown conditions for covered data
transactions that would otherwise be
prohibited by the proposed rules.
2. Section 202.802—Specific Licenses
Specific licenses, on the other hand,
would cover only parties who apply to
the Department for such a license and
disclose the facts and circumstances of
the covered data transaction they seek to
engage in. Specific licenses would
authorize only the transactions
described in the license; a specific
license might authorize one or more
transactions that would otherwise be
prohibited.
3. Conditions on General and Specific
Licenses
Both general licenses and specific
licenses could include a range of
requirements or obligations as the
Department deems appropriate. For
example, a license might be conditioned
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86152
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
on additional disclosure requirements,
ongoing reporting obligations,
recordkeeping obligations, due diligence
requirements, certification
requirements, cybersecurity
requirements, or inclusion of certain
contractual terms. The Department
believes, as a general matter, that
imposing uniform requirements across
licenses to the greatest extent possible
will encourage adoption of those
practices as a matter of course and will
facilitate compliance for parties
operating under more than one license.
For example, recordkeeping
requirements for one license might be
identical to those of another license.
Nonetheless, the Department believes
that it is important to retain flexibility
in crafting applicable requirements—
especially in the context of specific
licenses—to account for varying
contexts of the contemplated
transactions and other aspects of the
license at issue. The proposed rule
reflects that flexibility.
The authorization provided by a
license is contingent on satisfying all
conditions of the license. Transactions
not conducted in compliance with a
license’s conditions would be subject to
the regulation’s restrictions and
prohibitions and may result in
violations of the proposed rule and
subject the transacting parties to
enforcement action. Misrepresentations
in the application process may render
the license void from the date of
issuance and may subject parties to
enforcement action. The proposed rule
contains provisions authorizing the
Department to require applicants for
specific licenses to use specific forms
and procedures published by the
Department. The proposed rule also
establishes a process to allow applicants
and other parties-in-interest to request
reconsideration of the denial of a license
based on new facts or changed
circumstances.
Under subpart D of the proposed rule,
governing restricted transactions, parties
may engage in certain otherwiseprohibited transactions if they satisfy
the specified security requirements.
These provisions operate functionally as
a general license to engage in certain
prohibited transactions when specific
conditions—the security requirements—
are met. The Department does not
anticipate issuing licenses in the
ordinary course to relieve parties from
complying with the security
requirements for restricted transactions
but may do so in unusual or unique
circumstances as necessary or
appropriate. The Department retains the
discretion, however, to issue general or
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
specific licenses that would apply to
otherwise restricted transactions.
G. Subpart I—Advisory Opinions
1. Section 202.901—Inquiries
Concerning Application of This Part
The proposed rule creates a system for
the Attorney General to provide
guidance on this part in the form of
official guidance or written advisory
opinions. The Department may issue
official guidance at any time, including
to address recurring or novel issues. The
Department may also issue guidance in
response to specific inquiries received
through advisory opinion procedures.
Under the proposed rule, the
Department may publish general forms
of interpretive guidance, such as
Frequently Asked Questions posted
online. The Department plans to make
any official guidance publicly available
to help potentially regulated parties
better understand the regulations and
the Department’s interpretation of the
regulations and the Order.
The proposed rule also creates a
mechanism for potentially regulated
parties to seek opinions about the
application of the regulations or the
Order to specific transactions. The
proposed rule would permit a U.S.
person engaging in a transaction
potentially regulated by the program to
request an interpretation of any
provision of this part. Advisory
opinions could cover, for example: (1)
whether a particular transaction is a
prohibited transaction or restricted
transaction; and (2) whether a person is
a U.S. person, foreign person, or covered
person. The proposed rule requires that
advisory opinions only be requested
regarding actual—not hypothetical—
transactions.
The proposed rule sets out procedural
and administrative requirements for
submitting a request for any advisory
opinion, including: (1) that the request
be made in writing, see § 202.1201; (2)
that the request identify all participants
in the transaction for which the opinion
is being sought (i.e., anonymous
requests will not be accepted); and (3)
that the request describe the actual, not
hypothetical, conduct giving rise to the
request for an advisory opinion.
Advisory opinions issued in response to
a party’s request may be published as
appropriate. A determination regarding
whether an advisory opinion or portions
of that opinion are appropriate for
publication will include consideration
of whether publication complies with
applicable laws and regulations (e.g.,
regarding the protection of confidential
business information). In addition, the
proposed rule makes clear that each
PO 00000
Frm 00038
Fmt 4701
Sfmt 4702
advisory opinion can be relied upon
only to the extent that the disclosures
made in obtaining the advisory opinion
were accurate and complete, and to the
extent that those disclosures continue to
accurately and completely reflect the
circumstances after the advisory
opinion is issued. Advisory opinions
will reflect the view of the Department
of Justice and will not bind any other
agency; an advisory opinion does not
affect obligations under provisions not
specifically discussed in the opinion.
Commenters supported the
Department’s proposal to provide
interpretive guidance to the public.
They also requested that the Department
publish the decisions for the public’s
benefit. As stated above, advisory
opinions may be published as
appropriate in compliance with
applicable laws and regulations. One
commenter requested that trade
associations be allowed to request
interpretive guidance on behalf of their
members. The proposed rule would
allow trade associations to seek
guidance on behalf of their members, so
long as the guidance sought relates to a
specific transaction and identifies the
parties to the transaction. Although one
commenter requested the ability to seek
guidance related to hypothetical
transactions, the Department declines to
extend the interpretive guidance
provision to such transactions to ensure
that any such guidance is based on
specific, factual circumstances so that it
is as helpful to the public as possible.
Consequently, the proposed rule adopts
the approach described in the ANPRM
without change.
H. Subpart J—Due Diligence and Audit
Requirements
The Order delegates to the Attorney
General, in consultation with relevant
agencies, the full extent of the authority
granted to the President by IEEPA as
may be necessary or appropriate to carry
out the purposes of the Order,217 and it
expressly states that the proposed rules
will ‘‘address the need for, as
appropriate, recordkeeping and
reporting of transactions to inform
investigative, enforcement, and
regulatory efforts.’’ 218 The Department
of Justice wishes to achieve widespread
compliance with the proposed rule, and
to gather the information necessary to
administer and enforce the program,
without unduly burdening U.S. persons
or discouraging data transactions that
the program is not intended to address.
The Department will encourage U.S.
persons subject to the proposed rule to
217 E.O.
218 Id.
E:\FR\FM\29OCP2.SGM
14117 sec. 2(b), 89 FR 15423.
sec. 2(c)(viii), 89 FR 15424.
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
develop, implement, and update
compliance programs as appropriate.
The compliance program suitable for a
particular U.S. person would be based
on that person’s individualized risk
profile and would vary depending on a
variety of factors, including the U.S.
person’s size and sophistication,
products and services, customers and
counterparties, and geographic
locations. The Department may issue
guidance on this topic to assist U.S.
persons to develop and implement
compliance programs. The Department
may also consider the adequacy of a
compliance program in any enforcement
action.
The proposed rule does not impose
affirmative due diligence and
recordkeeping requirements on every
U.S. person engaging in a covered data
transaction with a covered person or
country of concern. As discussed in part
IV.H.1 of this preamble, the proposed
rule only imposes affirmative due
diligence and recordkeeping
requirements as a condition of engaging
in a restricted transaction.
Two related commenters expressed
concerns that the proposed rule would
require U.S. companies to surveil their
employees’ communications to comply
with the prohibitions and restrictions.
No changes have been made in response
to this comment. The proposed rule
does not, on its face or in practice,
require surveillance of employees to
achieve compliance. Any U.S. person
engaging in activities relevant to the
proposed rule should take a risk-based
approach to their compliance program
and ensure that it aligns with their
business profile. Like sanctions, export
controls, and other national security
regulations, any compliance program
may include a mix of policies,
processes, resources, and technologies
to ensure compliance. Important aspects
of an effective compliance program may
include, for example, senior
management support and buy-in
(including adequate resources); a
routine and ongoing assessment of the
business’ risk profile to identify
potential issues under the regulations
that the business is likely to encounter;
internal controls informed by that risk
assessment, including policies and
procedures to identify and address data
transactions that may trigger obligations
under the regulations, appointing and
empowering responsible compliance
personnel, integrating these controls
into the company’s daily operations,
and ensuring that employees have
adequate training and job-specific
knowledge regarding the proposed rule
and internal controls; and testing these
controls and remediating any
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
weaknesses or gaps.219 The Department
is considering providing separate
guidance on implementing effective
risk-based compliance programs.
1. Section 202.1001—Due Diligence for
Restricted Transactions
As discussed in part IV.H of this
preamble, the Order delegates to the
Attorney General, in consultation with
relevant agencies, the full extent of the
authority granted to the President by
IEEPA as may be necessary or
appropriate to carry out the purposes of
the Order.220 In accordance with that
delegation, and adopting the approach
contemplated in the ANPRM, the
proposed rule imposes and details
affirmative due diligence requirements
as a condition of engaging in a restricted
transaction. The proposed rule imposes
know-your-data requirements, which
specifically require that U.S. persons
engaging in restricted transactions
develop and implement data
compliance programs with risk-based
procedures for verifying data flows,
including the types and volumes of data
involved in the transactions, the
identity of the transaction parties, and
the end-use of the data. The Order also
requires that the proposed rule address
the need for recordkeeping, as
appropriate.221 The proposed rule
imposes affirmative recordkeeping
requirements as a condition of engaging
in a restricted transaction, and requires
U.S. persons subject to these affirmative
requirements to maintain
documentation of their due diligence to
assist in inspections and enforcement,
and to maintain the results of annual
audits that verify their compliance with
the security requirements and, where
relevant, the license conditions to
which the U.S. persons may be subject.
2. Section 202.1002—Audits for
Restricted Transactions
Adopting the approach contemplated
in the ANPRM, the proposed rule would
impose and details an annual audit
requirement as a condition of engaging
in a restricted transaction to verify and
improve compliance with the security
requirements.
219 See generally OFAC, U.S. Dep’t of Treas., A
Framework for OFAC Compliance Commitments
(May 2, 2019), https://ofac.treasury.gov/media/
16331/download?inline [https://perma.cc/6EQYMD3L]; Bureau of Indus. & Sec., U.S. Dep’t of Com.,
Export Compliance Guidelines: The Elements of an
Effective Export Compliance Program (2017),
https://www.bis.doc.gov/index.php/documents/
pdfs/1641-ecp/file [https://perma.cc/KXT2-TMQ5].
220 E.O. 14117 sec. 2(b), 89 FR 15424.
221 E.O. 14117 sec. 2(c)(viii), 89 FR 15423.
PO 00000
Frm 00039
Fmt 4701
Sfmt 4702
86153
I. Subpart K—Reporting and
Recordkeeping Requirements
1. Section 202.1101—Records and
Recordkeeping Requirements
Adopting the approach contemplated
in the ANPRM, the proposed rule would
require any U.S. person engaging in a
restricted transaction to keep full and
accurate records of each restricted
transaction and to keep the records
available for examination for at least 10
years after the date of such transaction
(the length of the statute of limitations
for violations of IEEPA). The proposed
rule describes the required records in
detail, which include a written policy
describing the compliance program, a
written policy documenting
implementation of the security
measures for restricted transactions, the
results of any audits to evaluate
compliance with the security measures,
documentation of the due diligence
conducted to verify the data flow
involved in any restricted transaction,
and other pertinent information
regarding each transaction.
2. Section 202.1102—Reports To Be
Furnished on Demand
Adopting the approach contemplated
in the ANPRM, the proposed rule
includes provisions to assist the
Department in investigating potential
noncompliance with the proposed rules
of this program. These include requiring
any U.S. person to furnish under oath,
from time to time and at any time as
may be required by the Attorney
General, complete information relative
to any covered data transaction subject
to a prohibition or restriction.
3. Section 202.1103—Annual Reports
Adopting the approach contemplated
in the ANPRM, the proposed rule would
require reporting by U.S. persons who
engage in certain restricted transactions
or, in certain narrow circumstances, to
identify attempts to engage in
prohibited transactions. Specifically, the
proposed rule requires annual reports
from U.S. persons engaged in restricted
transactions involving cloud-computing
services where 25 percent or more of
that U.S. person’s equity interests are
owned (directly or indirectly, through
any contract, arrangement,
understanding, relationship, or
otherwise) by a country of concern or
covered person.
The Department may impose similar
reporting requirements on U.S. persons
engaging in licensed transactions as
conditions of specific or general
licenses. Those requirements may vary
depending on the nature of the licenses,
will be set forth in the licenses
E:\FR\FM\29OCP2.SGM
29OCP2
86154
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
themselves, and are not part of the
proposed rule.
4. Section 202.1104—Reports on
Rejected Prohibited Transactions
Adopting the approach contemplated
in the ANPRM, the proposed rule also
requires that any U.S. person that has
received and affirmatively rejected an
offer from another person to engage in
a prohibited transaction must submit a
report to the Department within 14
business days of rejecting it. These
reports will help the Department
identify instances in which potential
countries of concern or covered persons
seek to enter into prohibited
transactions with U.S. persons in
contravention of the proposed rule,
including through evasion. The
information submitted by these reports
will thus assist the Department in
monitoring U.S. persons’ compliance
with the proposed rule, identifying
matters for potential investigation,
undertaking enforcement actions, and
identifying ways in which to refine the
proposed rule in the future.
J. Subpart M—Penalties and Finding of
Violation
khammond on DSKJM1Z7X2PROD with PROPOSALS2
1. Section 202.1301—Penalties for
Violations
Adopting the approach contemplated
in the ANPRM, the proposed rule also
includes a process for imposing civil
monetary penalties similar to those used
in other IEEPA-based regimes. See 31
CFR part 501, Appendix A; 15 CFR part
764. The proposed rule includes
mechanisms for pre-penalty notice, an
opportunity to respond, and a final
decision. Under the proposed rule,
penalties may be based on
noncompliance with the proposed rules
of this program, material misstatements
or omissions in connection with this
program, false certifications or
submissions pursuant to the proposed
rules of this program, or other actions
and factors. The proposed rule
stipulates that, consistent with due
process requirements, the Department of
Justice will give the alleged violator any
relevant non-classified information that
forms the basis of any enforcement
action and a meaningful opportunity to
respond.
As part of this proposed rulemaking,
the Department is adjusting for inflation
the civil monetary penalty that can be
imposed under IEEPA in accordance
with section four of the Federal Civil
Penalties Inflation Adjustment Act of
1990 (Pub. L. 101–410, 104 Stat. 890; 28
U.S.C. 2461 note), as amended by the
Federal Civil Penalties Inflation
Adjustment Act Improvements Act of
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
2015 (Pub. L. 114–74, tit. VII, sec. 701,
129 Stat. 584, 599, 28 U.S.C. 2461 note)
(‘‘FCPIA Act’’), for penalties assessed
after the effective date of this proposed
part with respect to violations occurring
after November 2, 2015.
For consistency with the civil
monetary penalties imposed in other,
more widely known IEEPA-based
regimes administered by the Department
of the Treasury’s OFAC, the Department
of Justice proposes incorporating
OFAC’s prior annual adjustments to
IEEPA’s maximum civil monetary
penalty as an initial catch-up
adjustment applicable to this part.
Those adjustments by OFAC occurred
on August 1, 2016 (Implementation of
the Federal Civil Penalties Inflation
Adjustment Act, 81 FR 43070 (July 1,
2016)), February 10, 2017 (Inflation
Adjustment of Civil Monetary Penalties,
82 FR 10434 (Feb. 10, 2017)); March 19,
2018 (Inflation Adjustment of Civil
Monetary Penalties, 83 FR 11876 (Mar.
19, 2018)); June 14, 2019 (Inflation
Adjustment of Civil Monetary Penalties,
84 FR 27714 (June 14, 2019)); April 9,
2020 (Inflation Adjustment of Civil
Monetary Penalties, 85 FR 19884 (Apr.
9, 2020)); March 17, 2021 (Inflation
Adjustment of Civil Monetary Penalties,
86 FR 14534 (Mar. 17, 2021)); February
9, 2022 (Inflation Adjustment of Civil
Monetary Penalties, 87 FR 7369 (Feb. 9,
2022)); January 13, 2023 (Inflation
Adjustment of Civil Monetary Penalties,
88 FR 2229 (Jan. 13, 2023)); and January
12, 2024 (Inflation Adjustment of Civil
Monetary Penalties, 89 FR 2139 (Jan. 12,
2024)).
The proposed maximum civil
monetary penalty for violations of this
part after its effective date would
therefore be the greater of $368,136 or
an amount that is twice the amount of
the transaction that is the basis of the
violation with respect to which the
penalty is imposed.222 The Department
of Justice proposes making annual
adjustments to the civil monetary
penalty on an annual basis after the
effective date of this part consistent
with the FCPIA Act.
2. Section 202.1305—Finding of
Violation
The proposed rule also provides a
process in which the Department might
issue a finding of violation where the
Department determines that a party has
violated the regulations and that an
administrative response short of a civil
monetary penalty is warranted. As with
civil penalties, the proposed rule also
222 See 50 U.S.C. 1705(b); Inflation Adjustment of
Civil Monetary Penalties, 89 FR 2139 (Jan. 12,
2024).
PO 00000
Frm 00040
Fmt 4701
Sfmt 4702
provides that, consistent with due
process requirements, the Department
will give the alleged violator any
relevant non-classified information that
forms the basis of any finding of
violation and a meaningful opportunity
to respond.
K. Coordination With Other Regulatory
Regimes
The Order requires the Department of
Justice to address, as appropriate,
coordination with other United States
Government entities, such as CFIUS,
OFAC, agencies that operate exportcontrol programs, and other entities
implementing relevant programs,
including those implementing Executive
Order 13873; Executive Order 14034 of
June 9, 2021 (Protecting Americans’
Sensitive Data from Foreign
Adversaries); and Executive Order
13913 of April 4, 2020 (Establishing the
Committee for the Assessment of
Foreign Participation in the United
States Telecommunications Services
Sector).223 The Department does not
currently intend or anticipate that this
new program will significantly overlap
with existing programs. As explained in
the ANPRM, existing programs do not
provide prospective, categorical rules to
address the national security risks posed
by transactions between U.S. persons
and countries of concern (or persons
subject to their ownership, direction,
jurisdiction, or control) that pose an
unacceptable risk of providing those
countries with access to governmentrelated data or bulk U.S. sensitive
personal data.
The Department has identified and
considered three potential areas of
overlap between this proposed rule and
existing regulatory regimes.
First, the Department has considered
the potential interaction between this
proposed rule’s application to
investment agreements and CFIUS’s
authority to review ‘‘covered
transactions,’’ see generally 50 U.S.C.
4565. Some ‘‘investment agreements,’’
as defined in the proposed rule, would
also be covered transactions or covered
real estate transactions subject to
CFIUS’s jurisdiction. See § 202.228; 50
U.S.C. 4565(a)(4). The ANPRM
contemplated an approach in which the
proposed rule would independently
regulate, as a restricted transaction, an
investment agreement that is also a
covered transaction or covered real
estate transaction subject to review by
CFIUS unless and until a ‘‘CFIUS
action’’ occurs in which CFIUS imposes
an order or condition or enters into a
mitigation agreement to resolve the
223 E.O.
E:\FR\FM\29OCP2.SGM
14117, sec. 2(c)(vii), 89 FR 15424.
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
national security risk arising from the
transaction.224 As explained in the
ANPRM, this approach would preserve
CFIUS’s authority to develop bespoke
protections to mitigate risks arising from
covered transactions or covered real
estate transactions—or recommend that
the President prohibit a transaction—
where CFIUS concludes that such action
is necessary to address the national
security risk arising from the
transaction. To implement this
approach, the ANPRM contemplated an
exemption in the proposed rule that
would apply categorically for all
covered transactions that are subject to
CFIUS actions, rather than requiring the
Department to issue a specific license
for each investment agreement subject
to a CFIUS action.
The proposed rule adopts the
approach described in the ANPRM and
implements that approach by adding a
corresponding exemption for any
investment agreement that is subject to
a ‘‘CFIUS action,’’ defining that term,
and providing examples. See § 202.508.
Under the proposed rule, if a CFIUS
action occurs with respect to an
investment agreement, that investment
agreement would become exempt from
the proposed rule and would be subject
only to CFIUS’s authority going forward.
The Department, in close coordination
with the Department of the Treasury, as
chair of CFIUS, would retain
enforcement authority with respect to
any violations of the proposed rule
before the effective date of the CFIUS
action. Alternatively, in some instances,
CFIUS may not review a particular
transaction at all or may conclude its
review or assessment of a transaction
without taking a CFIUS action. Because
CFIUS’s authority to mitigate
transactions is limited to risks that
‘‘arise[s] as a result’’ of the particular
transaction, see 50 U.S.C.
4565(l)(3)(A)(i), the fact that CFIUS
takes no action does not mean that the
transaction poses no national security
risk. For example, the transaction may
implicate pre-existing national security
risks that do not arise from the
particular transaction CFIUS can
review.’’ In those scenarios, any
obligations under the proposed rule
would continue to apply with respect to
the transaction. Similarly, if CFIUS
requests information from parties about
a transaction for which no filing has
been submitted to CFIUS under 31 CFR
800.504(b) or 31 CFR 802.501(b), the
Department will closely coordinate with
the Department of the Treasury with
respect to any enforcement action under
the proposed rule with respect to that
224 89
FR 15798–99.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
investment agreement. CFIUS may also
refer a covered transaction or covered
real estate transaction to the President,
in which case any obligations under the
proposed rule would continue to apply
and the Department would closely
coordinate with the Department of the
Treasury on any enforcement actions
under the proposed rule. The same
would be true after any Presidential
order under 50 U.S.C. 4565(d) following
a referral from CFIUS, absent any
accompanying CFIUS action. The
Department, in consultation with CFIUS
member agencies, continues to evaluate
alternative approaches, such as
regulating investment agreements as
restricted transactions regardless of
whether they are ‘‘covered transactions’’
subject to a CFIUS action. The
Department welcomes comments on this
potential alternative approach, as well
as any other proposed alternatives.
Second, the Department has
considered, in consultation with the
Federal Trade Commission (‘‘FTC’’) and
other agencies, the potential interaction
between this proposed rule’s
application to data-brokerage
transactions and the Protecting
Americans’ Data from Foreign
Adversaries Act of 2024 (‘‘PADFAA’’).
See Public Law 118–50, div. I 138 Stat.
895, 960 (2024). The PADFAA generally
makes it unlawful for a ‘‘data broker to
sell’’ or ‘‘otherwise make available
personally identifiable sensitive data of
a United States individual’’ to any
foreign adversary country or any entity
that is controlled by a foreign adversary
and authorizes the FTC to bring civil
enforcement actions for any violations.
The proposed rule would generally
prohibit U.S. persons from engaging in
covered data transactions involving data
brokerage with countries of concern or
covered persons.
Following consultation with the FTC,
the Department does not believe that it
would be appropriate to alter the
proposed rule’s scope in light of the
PADFAA for several reasons. There are
significant differences in scope between
the PADFAA and the proposed rule.
The PADFAA’s prohibition applies to
entities that meet the statutory
definition of ‘‘data broker.’’ 225 By
contrast, the proposed rule would
regulate certain transactions involving
‘‘data brokerage,’’ a term that is broader
and covers activities that present the
national security risk of allowing
countries of concern access to sensitive
personal data, regardless of the kinds of
entities that engage in that activity. In
225 Protecting Americans’ Data from Foreign
Adversaries Act of 2024, Pub. L. 118–50, div. I, sec.
2(c)(3) 138 Stat. 895, 960 (2024).
PO 00000
Frm 00041
Fmt 4701
Sfmt 4702
86155
addition, the proposed rule would reach
any U.S. persons—including
individuals, not just entities—who
engage in the regulated categories of
activities. Similarly, the PADFAA
applies to a narrower category of
activities than the proposed rule. Unlike
the PADFAA, the proposed rule
expressly addresses the re-export or
resale of data by third parties and
indirect sales through intermediaries.
The PADFAA excludes from the
definition of ‘‘data broker’’ any entity
that transmits a U.S. individual’s data at
that individual’s request or direction,
whereas the proposed rule would not
contain any such exception in light of
the national security threat posed even
in such instances. In addition, the
PADFAA does not provide any
mechanisms for affected parties to seek
clarification or redress, such as the
advisory opinions, general licenses, and
specific licenses available to parties
under the proposed rule. Similarly, the
PADFAA provides general contours for
entities and businesses to determine
whether a counterparty is ‘‘subject to
the direction or control’’ of either: (1) a
person that is domiciled in,
headquartered in, has its principal place
of business in, or is organized under the
laws of a foreign adversary country; or
(2) an entity that is 20-percent or more
owned by such a person.226 The
proposed rule provides different criteria
for determining whether a person is
‘‘covered’’ under the regulatory
program, and it contemplates a
designation process, which the
PADFAA lacks.
Given the PADFAA’s structure and
the significant differences in scope, the
Department declines to alter the
proposed rule’s scope in light of the
PADFAA. The Department and the FTC
intend to coordinate closely to ensure
that these authorities are exercised in a
harmonized way to minimize any
conflicting obligations or duplicative
enforcement. For example, the
Department and the FTC intend to
coordinate, as appropriate, on licensing
decisions and on any potential
enforcement actions under the PADFAA
with respect to activities that may be
authorized, exempt, or licensed under
the proposed rule. Thus, the proposed
rule adopts the approach described in
the ANPRM without change.
Third, the Department has considered
the potential interaction between this
proposed rule’s application to vendor
agreements and any actions taken by the
Secretary of Commerce under Executive
Orders 13873 and 14034. Some vendor
agreements, as defined in this proposed
226 Id.
E:\FR\FM\29OCP2.SGM
at sec. 2(c)(2).
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86156
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
rule, could also be the subject of an
action by the Secretary of Commerce
regarding an information and
communications technology and
services (‘‘ICTS’’) transaction that
involves ICTS that is designed,
developed, manufactured, or supplied
by persons owned by, controlled by, or
subject to the jurisdiction or direction of
a foreign adversary and presents the
types of unacceptable national security
risks described in Executive Orders
13873 and 14034. Even so, the
Department does not believe that it
would be appropriate to alter the scope
of this proposed rule for several reasons.
While these two authorities could
potentially address some of the same
national security risks related to vendor
agreements, they would do so in
different ways and by focusing on
different vectors of risk. Executive Order
14117 and this proposed rule seek to
address this risk by addressing
transactions involving the export of U.S.
sensitive personal data, such as
restricting a U.S. person’s ability to
enter into a vendor agreement that
grants access to government-related data
or bulk U.S. sensitive personal data to
a country of concern or covered person.
Executive Orders 13873 and 14034, on
the other hand, seek to address
transactions involving the acquisition,
import, or use, among other actions, of
technology or services developed or
otherwise sourced from a foreign
adversary by U.S. persons or in the
United States. For that reason, the ICTS
authority addresses a broader range of
potential national security risks than
access to Americans’ bulk sensitive
personal data.
In addition, this proposed rule
(through the incorporation by reference
of the CISA security requirements for
restricted transactions, including vendor
agreements) creates a floor for the
security of all government-related data
or Americans’ bulk U.S. sensitive
personal data involved in a restricted
transaction. Only by complying with
these requirements (or operating under
an applicable license) could a U.S.
person engage in a proposed restricted
transaction. Executive Order 13873 and
its implementing regulations do not
establish a baseline set of mitigation
measures to protect this data across all
of types of vendors that could be subject
to prohibition or restriction. Rather, the
Department of Commerce will exercise
that authority by taking an action with
respect to transactions involving a
specific vendor 227 or proposing
regulation of a sector-specific set of
227 See Kaspersky Lab, Inc., 89 FR 52435 n.13;
Maggs Report, supra note 187.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
ICTS.228 Nothing in this proposed rule
would prevent the Department of
Commerce from exercising its ICTS
authorities to take vendor-specific
actions or promulgate sector-specific
rules. At this time, any overlap between
these two authorities is hypothetical,
and the Department does not believe
that there will be any substantial
impact. The Department is, however,
considering approaches to address any
potential overlap that might arise
between the requirements of this
proposed rule and any ICTS actions
undertaken by the Department of
Commerce, whether through an
understanding between the Department
of Commerce and Department of Justice
or a more formal licensing process that
could apply where the Department of
Commerce has taken action under its
ICTS authorities. The Department
welcomes comments on the identified
approaches, or any others, to address
any potential overlap that might arise.
L. Severability
The Department intends for the
provisions of this proposed rule to be
severable from each other. In short, if a
court holds that any provision in a final
28 CFR part 202 is invalid or
unenforceable, the Department intends
that the remaining provisions of a final
28 CFR part 202, as relevant, would
continue in effect to the greatest extent
possible. In addition, if a court holds
that any such provision is invalid or
unenforceable as to a particular person
or circumstance, the Department
intends that the provision would remain
in effect as to any other person or
circumstance. Depending on the
circumstances and the scope of the
court’s order, remaining provisions of a
final rule likely could continue to
function sensibly independent of any
provision or application held invalid or
unenforceable. For example, the
prohibitions and restrictions related to
transactions involving access to
personal health data could continue to
apply even if a court finds that the
restrictions or prohibitions on
transactions involving access to
biometric data are invalid. Similarly, the
proposed rule could be applied with
respect to North Korea even if a court
finds its application with respect to
Russia is invalid.
228 See Securing the Information and
Communications Technology and Services Supply
Chain: Connected Vehicles, 89 FR 15066 (Mar. 1,
2024) (to be codified at 15 CFR pt. 7), https://
www.federalregister.gov/documents/2024/03/01/
2024-04382/securing-the-information-andcommunications-technology-and-services-supplychain-connected-vehicles [https://perma.cc/PV7Y998V].
PO 00000
Frm 00042
Fmt 4701
Sfmt 4702
V. Analysis for Proposed Bulk
Thresholds
The Department of Justice proposes
volume-based thresholds for each
category of sensitive personal data and
for combined datasets. The bulk
thresholds are based on a risk-based
assessment that accounts for the
characteristics of datasets that affect the
data’s vulnerability to exploitation by
countries of concern and that affect the
consequences of exploitation. In
conducting this assessment, the
Department considered numerous ways
that a country of concern might exploit
each category of sensitive personal data.
In general, bulk U.S. sensitive personal
data is useful for deriving additional
information about individuals or
subpopulations, such as demography,
geography, and interests, that can be
used to identify vulnerabilities.229 The
advertising industry has long recognized
that such data is useful for predicting
and influencing behavior.230 Influencing
behavior is similarly at the root of
intelligence recruitment.231 The
Department assessed how a foreign
intelligence service might use bulk U.S.
sensitive personal data as part of the
agent recruitment cycle—a ‘‘systematic
method for finding agents who will
meet national intelligence information
needs’’—among other potential malign
uses.232 While the categories of sensitive
personal data may have a variety of
applications for foreign intelligence
services or foreign governments, they
may be especially useful to parts of the
first three steps of agent recruitment:
• ‘‘spotting (or identifying)
individuals who can meet intelligence
needs’’;
• ‘‘assessing whether the spotted
individuals have the placement and
access to provide desired information’’;
and
229 What Is Targeted Advertising, and How Does
It Work?, RTB House (May 13, 2024), https://
blog.rtbhouse.com/what-is-targeted-advertisingand-how-does-it-work/ [https://perma.cc/EQ5QM6KD].
230 See The Role of Data in the Targeted
Advertising Industry, New Am., https://
www.newamerica.org/oti/reports/special-delivery/
the-role-of-data-in-the-targeted-advertisingindustry/ [https://perma.cc/LMX7-B93Q]; Ben
Collier, Targeted Social Media Ads Are Influencing
Our Behaviour—and the Government Uses Them
Too, Conversation (Feb. 27, 2024), https://
theconversation.com/targeted-social-media-ads-areinfluencing-our-behaviour-and-the-governmentuses-them-too-223576 [https://perma.cc/YGA8YKF9].
231 See id.; Randy Burkett, An Alternative
Framework for Agent Recruitment: From MICE to
RASCLS, 57 Stud. Intel. 7, 13 (2013), https://
www.cia.gov/resources/csi/static/
9ccc45dc156271d11769e5205ec49c29/AltFramework-Agent-Recruitment-1.pdf [https://
perma.cc/9GQU-UTET]; Collier, supra note 230.
232 Burkett, supra note 231, at 13.
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
• ‘‘developing a relationship with the
individual to . . . explore whether they
will be responsive to . . . tasking for
intelligence information.’’ 233
The Department’s subject-matter
experts identified seven characteristics
relevant to the exploitability and
national security harm posed by any
particular type of data: purpose (i.e.,
how the data can be used), changeability
(i.e., how easy it would be for an
individual to deliberately change or
falsify the data in question), control (i.e.,
who tracks and manages the data),
availability (i.e., how easily the data can
be obtained), volume (i.e., the number of
data points in a dataset), velocity (i.e.,
how quickly the dataset evolves), and
quality (i.e., how much processing is
required to use the data). These
characteristics help describe the
national security risk of each type of
sensitive personal data by providing a
methodology for analyzing their value to
an adversary. For example, availability
and control focuses on the ease with
which an adversary may be able to
acquire this data using licit or illicit
means. Quality and changeability
examine the ease and speed with which
an adversary can use the data. Volume,
velocity, and purpose are other
important attributes of these datasets
that focus on how valuable a particular
data may be to an adversary and how
long it is likely to remain valuable.
Using this framework of
characteristics, the Department
evaluated the relative sensitivity of each
of the seven categories of bulk U.S.
sensitive personal data and ranked them
based on their potential value to enable
foreign governments and foreign
intelligence services engaged in agent
recruitment to: (1) identify or spot
individuals within bulk datasets for
intelligence needs; (2) group individuals
into specific categories to assess their
value for intelligence purposes; and (3)
characterize the behaviors and
vulnerabilities of individuals to identify
ways to develop and exploit
relationships. The Department then
considered how close in sensitivity each
category was to the other, grouped them
into tiers of similar sensitivity (resulting
in four tiers), and then set proposed
numerical thresholds for each tier.
To conduct the analysis, the
Department considered use cases from
each category of bulk U.S. sensitive
personal data based on widely available
information about commercial practices
around data,234 news reports of past
233 Id.
234 See, e.g., Max Freedman, How Businesses Are
Collecting Data (And What They’re Doing With It),
Bus. News Daily (Oct. 20, 2023), https://
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
incidents involving data with national
security implications,235 and a survey of
covered transactions reviewed by CFIUS
that implicated sensitive personal data.
The Department also considered how
future changes in technology could
affect the utility and value of each
category of data.236
A. Analysis of Sensitivity of Each
Category of Sensitive Personal Data
1. Human Genomic Data
The Department of Justice assesses
that human genomic data is the most
sensitive category of sensitive personal
data. To conduct the analysis, the
Department considered human genetic
testing data, which sequences only
specific portions of the human genome
for a specific purpose (e.g., identifying
ancestry, diagnosing a specific disease);
and sequencing of a complete human
genome, a still-emerging capability with
a wide variety of potential
applications.237 Based on the multiple
characteristics that were considered of
high sensitivity, and especially noting
that the velocity of this data has very
high sensitivity, human genomic data is
highly sensitive:
• Purpose: High sensitivity. Human
genomic data has unique purposes
among the categories of bulk U.S.
sensitive personal data. It is not only
useful for identifying traits such as
health, emotional stability, mental
capacity, appearance, and physical
abilities that might be useful in
intelligence recruitment; countries of
concern may also use this data to
www.businessnewsdaily.com/10625-businessescollecting-data.html [https://perma.cc/944WZC4M].
235 See, e.g., Hsu, supra note 43; Garrett M. Graff,
China’s Hacking Spree Will Have a Decades-Long
Fallout, Wired (Feb. 11, 2020), https://
www.wired.com/story/china-equifax-anthemmarriott-opm-hacks-data/ [https://perma.cc/48WKM9AM]; Press Release, U.S. Dep’t of Just., Member
of Sophisticated China-Based Hacking Group
Indicted for Series of Computer Intrusions,
Including 2015 Data Breach of Health Insurer
Anthem Inc. Affecting Over 78 Million People (May
9, 2019), https://www.justice.gov/opa/pr/membersophisticated-china-based-hacking-group-indictedseries-computer-intrusions-including [https://
perma.cc/84YH-CVA5].
236 See, e.g., Steve Van Kuiken, Tech at the Edge:
Trends Reshaping the Future of IT and Business,
McKinsey Digital (Oct. 21, 2022), https://
www.mckinsey.com/capabilities/mckinsey-digital/
our-insights/tech-at-the-edge-trends-reshaping-thefuture-of-it-and-business [https://perma.cc/HW2SN464]; Adam D. Nahari & Dimitris Bertsimas,
External Data and AI Are Making Each Other More
Valuable, Harv. Bus. Rev. (Feb. 26, 2024), https://
hbr.org/2024/02/external-data-and-ai-are-makingeach-other-more-valuable [https://perma.cc/2ZAS8VBB].
237 Luca Bonomi et al., Privacy Challenges and
Research Opportunities for Genomic Data Sharing,
52 Nature Genetics 646 (2020), https://
www.ncbi.nlm.nih.gov/pmc/articles/PMC7761157/
[https://perma.cc/2J8T-BLLF].
PO 00000
Frm 00043
Fmt 4701
Sfmt 4702
86157
develop military capabilities such as
bioweapons.238 Because human
genomic data includes the unique
genetic code of an individual, it is
exceptionally useful in identifying
individuals.239 For example, an
adversary with access to an individual’s
genomic data may be able to predict
physical features, such as eye, hair, and
skin color, and vocal and facial
characteristics.240 As technology
develops further, analysts may also be
able to use such genomic data to
determine an individual’s propensity
toward certain behaviors, such as
aggression or risky activities.241 Finally,
foreign adversaries could potentially use
human genomic data to conduct or
support surveillance, oppression,
extortion, and influence operations; and
could potentially use this data to inform
biological weapons development.242
• Changeability: High sensitivity.
Human genomic data is difficult to
deliberately alter. While certain
technologies, such as Clustered
Regularly Interspaced Short
Palindromic Repeats (‘‘CRISPR’’), can
alter or edit the human genome in
extremely targeted, localized ways,
larger-scale alterations remain
technologically impossible.243 As a
result, human genomic data is largely
immutable over an individual’s lifetime.
• Control: High sensitivity. Corporate
entities such as healthcare laboratories
usually process and control human
238 Ken Dilanian, Congress Wants to Ban China’s
Largest Genomics Firm from Doing Business in the
U.S. Here’s Why, NBC News (Jan. 25, 2024), https://
www.nbcnews.com/politics/nationalsecurity/
congress-wants-ban-china-genomics-firm-bgi-fromus-rcna135698 [https://perma.cc/T2Y2-R7RZ]; Ron
Pulivarti et al., Nat’l Inst. of Standards & Tech.,
NIST IR 8432, Cybersecurity of Genomic Data 9
(2023), https://nvlpubs.nist.gov/nistpubs/ir/2023/
NIST.IR.8432.pdf [https://perma.cc/5D3G-BEEZ].
239 Bonomi et al., supra note 237.
240 Christopher Lippert et al., Identification of
Individuals by Trait Prediction Using WholeGenome Sequencing Data, 114 PNAS 10166 (Sept.
5, 2017), https://www.pnas.org/doi/full/10.1073/
pnas.1711125114 [https://perma.cc/CM4L-GPE4].
241 J.C. Barnes et al., The Propensity for
Aggressive Behavior and Lifetime Incarceration
Risk: A Test for Gene-Environment Interaction (G x
E) Using Whole-Genome Data, 49 Aggr. & Violent
Behav. (Nov.–Dec. 2019), https://
www.sciencedirect.com/science/article/abs/pii/
S1359178919300631 [https://perma.cc/3GVFMPKF]; Heather Buschman, Large Study Identifies
Genetic Variants Linked to Risk Tolerance and
Risky Behaviors, UC San Diego Health (Jan. 2019),
https://health.ucsd.edu/news/press-releases/201901-14-large-study-identifies-genetic-variants-linkedto-risk-tolerance-risky-behaviors/ [https://perma.cc/
FMV2-GKYE].
242 Pulivarti et al., supra note 238, at 9.
243 What Are Genome Editing and CRISPR-Cas9?,
MedlinePlus (updated Mar. 22, 2022), https://
medlineplus.gov/genetics/understanding/
genomicresearch/genomeediting/ [https://perma.cc/
42K9-765F].
E:\FR\FM\29OCP2.SGM
29OCP2
86158
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
genomic data.244 Because human
genomic data is tied to an individual at
a biological level, it is basically
immutable. Additionally, biological
residue such as saliva, blood, and hair
can contain human genomic data, and
this residue is difficult for an individual
to completely control.245
• Availability: High sensitivity. Bulk
human genomic data is difficult to
obtain in the commercial marketplace,
as it remains an emerging capability. For
example, the crucial technologies that
formed the foundation for scaled
commercial applications of genomic
sequencing are still less than 20 years
old.246 In addition, medical systems
tightly control access to and distribution
of this information through privacy
regulations and general scientific
ethics.247 Because this data is currently
hard to acquire but has myriad potential
applications, it is highly valued.
• Volume: Varied sensitivity. A
complete human nuclear genome
contains about 3.2 billion base pairs,
with each base pair representing a
unique data point.248 This human
genome can be divided into codons of
three base pairs each, each of which
codes for a unique amino acid.249 This
human genome can also be divided into
tens of thousands of genes, each of
which code for the production of
specific proteins and other cellular
activity and each of which can have
multiple variants.250 Data sets
244 Bonomi et al., supra note 237, at Table 2;
Genomic & Infrastructure Services, Quest
Diagnostics, https://www.questdiagnostics.com/
business-solutions/life-sciences/biotech/genomicinfrastructure-services [https://perma.cc/WD2E2YXA].
245 Am. Bar Ass’n, ABA Standards for Criminal
Justice: DNA Evidence at 25 (3d ed. 2007), https://
www.americanbar.org/content/dam/aba/
publications/criminal_justice_standards/dna_
evidence.pdf [https://perma.cc/3CSA-Q6J9]; Alexia
Ramirez, Police Need a Warrant to Collect DNA We
Inevitably Leave Behind, ACLU (Mar. 10, 2020),
https://www.aclu.org/news/privacy-technology/
police-need-a-warrant-to-collect-dna-we-inevitablyleave-behind [https://perma.cc/9MGJ-LDZP].
246 Joseph Wilson, Sequencing—The Next
Generation, Nature (Feb. 10, 2021), https://
www.nature.com/articles/d42859-020-00103-7
[https://perma.cc/PY2Q-GKNY].
247 Privacy in Genomics, Nat’l Hum. Genome
Rsch Inst. (Feb. 6, 2024), https://www.genome.gov/
about-genomics/policy-issues/Privacy [https://
perma.cc/2YU5-GBRZ].
248 Terence A. Brown, The Human Genome, in
Genomes (2d ed. 2002), https://
www.ncbi.nlm.nih.gov/books/NBK21134/ [https://
perma.cc/Q9EW-FB7E].
249 Codon, Nat’l Cancer Inst., https://
www.cancer.gov/publications/dictionaries/geneticsdictionary/def/codon [https://perma.cc/GDB6T32U].
250 See Steven L. Salzberg, Open Questions: How
Many Genes Do We Have?, 16 BMC Biology (Aug.
20, 2018), https://bmcbiol.biomedcentral.com/
articles/10.1186/s12915-018-0564-x [https://
perma.cc/89MV-J6HU].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
containing human genomic data will be
of different sizes—for example, a data
set including the complete genome of an
individual will be much larger than the
data set just identifying specific genes
present that may affect the chances of a
specific cancer. A larger data set is more
sensitive. Thus, the volume sensitivity
of genomic information may vary
because the datasets containing human
genomic data are likely to vary widely
in size.
• Velocity: Very high sensitivity.
Human genomic data remains largely
stable over an individual’s lifetime, and
while the ability to interpret that data
may evolve over time, the underlying
information will not change.251
Furthermore, the value of human
genomic data will likely increase
significantly in the future as technology
develops.252 It requires protection now
to prevent future exploitation.253
• Quality: Varied sensitivity.
Processing a single sample of human
genomic data can take as long as 48
hours. As a result, computing power
continues to limit analysts’ ability to use
fully sequenced but unevaluated human
genomic data.254 However, analysts will
be increasingly able to take advantage of
public databases and open-source tools
to evaluate sequenced and analyzed
data, reducing the computational power
required to evaluate such processed
datasets.255
2. Biometric Identifiers
The Department of Justice assesses
that biometric identifiers are the second
most sensitive category of sensitive
personal data. To conduct the analysis,
the Department considered physical
biometrics measurements (e.g., eye
patterns, fingerprints, facial features) as
well as behavioral biometrics
measurements (e.g., gait, keystroke
recognition, signature).256 Biometric
251 Kate Lyle et al., Immortal Data: A Qualitative
Exploration of Patients’ Understandings of Genomic
Data, 31 Eur. J. Hum. Genetics 681 (Mar. 31, 2023),
https://doi.org/10.1038/s41431-023-01325-9
[https://perma.cc/V6BM-NEE8].
252 Genomic Data Science, Nat’l Hum. Genome
Rsch Inst. (Apr. 5, 2022), https://www.genome.gov/
about-genomics/fact-sheets/Genomic-Data-Science
[https://perma.cc/8YD2-MQZJ]; Nat’l Counterintel.
& Sec. Ctr., supra note 83.
253 Pulivarti et al., supra note 238, at 7–10.
254 See Nathan Eddy, High-Performance
Computing Breaks the Genomics Bottleneck,
HealthTech (Feb. 13, 2023), https://
healthtechmagazine.net/article/2023/02/highperformance-computing-breaks-genomicsbottleneck [https://perma.cc/LCD5-X3K2].
255 See, e.g., Genome, Nat’l Libr. Med., https://
www.ncbi.nlm.nih.gov/genome/ [https://perma.cc/
XEV9-FRYH].
256 Sterling Miller, The Basics, Usage, and
Privacy Concerns of Biometric Data, Thomsons
Reuters (July 20, 2022), https://
legal.thomsonreuters.com/en/insights/articles/the-
PO 00000
Frm 00044
Fmt 4701
Sfmt 4702
data is moderately to highly sensitive
overall based primarily on the purpose,
changeability, and control
characteristics below:
• Purpose: High sensitivity. Biometric
data is specifically intended to identify
specific individuals based on
distinguishing biological or behavioral
characteristics.257 In addition, analysts
can identify certain categorizing
characteristics from this data—for
example, inferring gender from facial
features.258 Finally, biometric
information can be used to authenticate
users, either alone or as part of a multifactor authentication protocol.
Fingerprints, voiceprints, and facial
scans provide useful reference points for
identifying individuals for intelligence
recruitment, espionage, and influence
based on their patterns of life. Searches
through video footage, police records,
and intelligence databases using
biometrics could provide points of
leverage for coercion, blackmail, and
influence.
• Changeability: Moderate-to-high
sensitivity. Biometric data is generally
difficult to deliberately change or falsify
because it is linked to the physical
characteristics of an individual.
However, it can evolve as individuals
age or be altered through activities such
as limb loss or amputation, long-term
manual labor, or physical retraining.259
• Control: Moderate-to-high
sensitivity. Physical biometric
information is largely beyond the ability
of an individual to control or conceal.
If an individual’s fingerprint or other
basics-usage-and-privacy-concerns-of-biometricdata [https://perma.cc/92HR-4YMX]; Types of
Biometrics, Biometrics Inst., https://
www.biometricsinstitute.org/what-is-biometrics/
types-of-biometrics/ [https://perma.cc/W7FD-5P6B].
257 Int’l Org. for Standardization, ISO/IEC TR
24741:2018, Information Technology—Biometrics—
Overview and Application (2018), https://
www.iso.org/obp/ui/#iso:std:iso-iec:tr:24741:ed2:v1:en [https://perma.cc/P3RB-56RM]; see What Is
Biometrics?, Biometrics Inst., https://
www.biometricsinstitute.org/what-is-biometrics/
[https://perma.cc/2APY-5WBM].
258 D. Gowtami Annapurna et al., Gender
Identification from Facial Features, 15 Int’l J.
Innovations Eng’g & Tech. 5 (2020), https://
ijiet.com/wp-content/uploads/2020/03/21.pdf
[https://perma.cc/9M69-GXZ8].
259 See, e.g., Jesse M. Charlton et al., Learning Gait
Modifications for Musculoskeletal Rehabilitation:
Applying Motor Learning Principles to Improve
Research and Clinical Implementation, 101
Physical Therapy, Feb. 2021, at 2, https://
www.ncbi.nlm.nih.gov/pmc/articles/PMC7899063/
[https://perma.cc/JJ9W-CKDA]; Javier Galbally et
al., A Study of Age and Ageing in Fingerprint
Biometrics, 14 IEEE Transactions on Info. Forensics
& Sec. 1351 (2019), https://ieeexplore.ieee.org/
stamp/stamp.jsp?tp=&arnumber=8509614 [https://
perma.cc/FK88-THWY]; Physiological and
Behavioural Biometrics, Biometrics Inst., https://
www.biometricsinstitute.org/physiological-andbehavioural-biometrics/ [https://perma.cc/8QE4LW74].
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
physiological biometric measurement is
compromised, it can be impossible to
change.260 Additionally, covert or
passive measures such as surveillance
cameras or latent fingerprints can
capture biometric data without the
targeted individual’s knowledge.261
However, certain types of behavioral
biometric information, such as gait and
voice, may be possible to change,
though it may be difficult.
• Availability: Moderate sensitivity.
Certain types of biometric data could be
widely available in certain records, such
as facial features derived from
photographs on the internet.262 Others,
such as gait, are not widely available.
Reliable bulk biometric databases
remain difficult enough to assemble that
they are seen as important national
security assets.263
• Volume: Varied sensitivity. Video
surveillance footage, which could be
used to derive biometric information
from tens or hundreds of individuals
walking by the camera, collects up to 30
frames of potentially high-definition
photo images per second.264 In contrast,
a single human face can be represented
by approximately 80 distinct nodal
points, each of which could be
represented as a single number.265
• Velocity: Moderate sensitivity.
Certain types of biometric information
can change, for example as individuals
age or change weight.266 However,
260 See Off. of the Victorian Info. Comm’r,
Biometrics and Privacy—Issues and Challenges
(July 2019), https://ovic.vic.gov.au/privacy/
resources-for-organisations/biometrics-and-privacyissues-and-challenges/ [https://perma.cc/ME8RXWJU]; Is Biometric Information Protected by
Privacy Laws?, Bloomberg L. (June 20, 2024),
https://pro.bloomberglaw.com/insights/privacy/
biometric-data-privacy-laws/ [https://perma.cc/
56EZ-69HK].
261 Id.
262 Katherine Tangalakis-Lippert, Clearview AI
Scraped 30 Billion Images from Facebook and
Other Social Media Sites and Gave Them to Cops:
It Puts Everyone into a ‘Perpetual Police Line-Up’,
Bus. Insider (Apr. 2, 2023), https://
www.businessinsider.com/clearview-scraped-30billion-images-facebook-police-facial-recogntiondatabase-2023-4 [https://perma.cc/6LZG-NBUT].
263 Kelsey Atherton, The Enduring Risks Posed by
Biometric Identification Systems, Brookings Inst.
(Feb. 9, 2022), https://www.brookings.edu/articles/
the-enduring-risks-posed-by-biometricidentification-systems/ [https://perma.cc/65DW832R].
264 Optiview, A Practical Guide to CCTV Video
Resolutions, https://optiviewusa.com/cctv-videoresolutions/ [https://perma.cc/K24Y-MJA5].
265 Chris De Silva et al., NEC Corp., It’s All About
the Face: Face Recognition (2013), https://
www.nec.com/en/global/solutions/safety/pdf/NECFR_white-paper.pdf [https://perma.cc/P5PJ-8LQ2].
266 Joel R. McConvey, How Aging, Injury and
Capture Impact the Challenge of Change in
Biometric Identifiers, Biometric Update (Dec. 25,
2023), https://www.biometricupdate.com/202312/
how-aging-injury-and-capture-impact-thechallenge-of-change-in-biometric-identifiers
[https://perma.cc/285T-5L2E].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
because biometrics are physical, many
will remain substantially the same over
a person’s lifetime. For example,
fingerprints are constant over a lifetime,
and iris patterns remain largely stable
even as children grow.267
• Quality: Varied sensitivity. Factors
including the quality of sensors and
environmental conditions can affect the
reliability of readings stored in
databases.268 The complex nature of
most biometric data systems means data
quality can be further affected by
obscured or degraded characteristics,
subject behavior, data collection,
compression and sampling efforts,
feature extraction issues, matching
errors, and administrative and database
problems.269 As a result, the value of a
bulk biometric data source to an analyst
will depend on the quality of the
underlying dataset.
3. Precise Geolocation Data
The Department of Justice assesses
that precise geolocation data is the third
most sensitive category of sensitive
personal data. To conduct the analysis,
the Department considered geolocation
measurements obtained by a variety of
means, including Global Positioning
Systems (‘‘GPS’’), cell tower proximity,
Wi-Fi networks, Bluetooth signals, and
IP geolocation.270 It considered use
cases where sets of geolocation points
were linked to a specific device and
included timestamps; were linked to a
specific device but did not include
timestamps; and were not linked to
either specific devices or timestamps
but instead represented an aggregate
picture of where individuals were
taking devices. In many—but not all—
instances across these use cases, precise
267 Justin Lee, New Research Proves that
Fingerprint Accuracy Remains Unchanged Over
Time, Biometric Update (June 30, 2015), https://
www.biometricupdate.com/201506/new-researchproves-that-fingerprint-accuracy-remainsunchanged-over-time [https://perma.cc/C95UDSSS]; Priyanka Das et al., Iris Recognition
Performance in Children: A Longitudinal Study, 3
IEEE Transactions on Biometrics, Behav. & Identity
Sci. 138 (Jan. 13, 2021), https://ieeexplore.ieee.org/
document/9321488 [https://perma.cc/X2KJ-G4EE].
268 Off. of the Victorian Info. Comm’r, supra note
260.
269 Austin Hicklin & Rajiv Khanna, Mitretek Sys.,
The Role of Data Quality in Biometric Systems (Feb.
9, 2006), https://citeseerx.ist.psu.edu/
document?repid=rep1&type=
pdf&doi=a892c6e2cf2fdd94bab672a
987940f2bb6996119 [https://perma.cc/4YWPKDWH].
270 Paige M. Boshell, The Power of Place:
Geolocation Tracking and Privacy, Bus. L. Today
(Mar. 25, 2019), https://businesslawtoday.org/2019/
03/power-place-geolocation-tracking-privacy/
[https://perma.cc/MWB2-7BWN]; Daniel Ionescu,
Geolocation 101: How It Works, the Apps, and Your
Privacy, PCWorld (Mar. 29, 2010), https://
www.pcworld.com/article/511772/geolo.html
[https://perma.cc/C28D-XYXU].
PO 00000
Frm 00045
Fmt 4701
Sfmt 4702
86159
geolocation data is moderately to highly
sensitive based primarily on the
purpose, changeability, volume, and
quality characteristics below:
• Purpose: High sensitivity. Analysts
can use geolocation data to derive
detailed information about patterns of
life, as well as other types of sensitive
personal data such as home address and
place of work.271 They may use it to
identify influential individuals for
blackmail and coercion, physically map
and target sensitive sites and high-risk
personnel, create near-real-time
situational awareness, and target
offensive cyber operations.272 They may
also use it to identify a specific person,
such as who goes to a residence, as well
as large numbers of people, such as
everyone who goes to the Pentagon.273
• Changeability: Moderate sensitivity.
Geolocation data is technically collected
(i.e., derived from signals and electronic
devices). As a result, individuals can
spoof or alter this data with some effort.
One common way to affect the apparent
location of a device is through a Virtual
Private Network (‘‘VPN’’), which can
affect the apparent location of a device
based on its IP address, while connected
applications that can spoof a GPS
location on a cellphone are readily
available online.274 More complicated
spoofing techniques require
transmission of a false radio signal to
override a legitimate GPS signal.275
• Control: Moderate sensitivity.
Precise geolocation data is collected
from electronic devices, which an
individual can typically leave behind or
be separated from. However, these
devices usually collect geolocation data
in the background, often beyond the
control or visibility of the individual,
using software services built into device
operating systems.276 These sensors are
271 Hsu,
supra note 43.
supra note 4.
273 Alex Hern, Fitness Tracking App Strava Gives
Away Location of Secret US Army Bases, The
Guardian (Jan. 28, 2018), https://
www.theguardian.com/world/2018/jan/28/fitnesstracking-app-gives-away-location-of-secret-us-armybases [https://perma.cc/J7N3-BHKU]; Hsu, supra
note 43.
274 See, e.g., Shweta, What a VPN Hides (And
What It Doesn’t), Forbes Advisor (June 5, 2024),
https://www.forbes.com/advisor/business/software/
what-does-vpn-hide/ [https://perma.cc/MF23SYK7]; Tim Fisher, How to Fake a GPS Location on
Your Phone, Lifewire (June 18, 2024), https://
www.lifewire.com/fake-gps-location-4165524
[https://perma.cc/ZB8S-X3ZB].
275 What Is GPS Spoofing and How Do You
Defend Against It?, Okta (Aug. 16, 2023), https://
www.okta.com/identity-101/gps-spoofing/ [https://
perma.cc/ZM7K-4349].
276 See, e.g., Build Location-Aware Apps, Google
for Developers (July 1, 2024), https://
developer.android.com/develop/sensors-andlocation/location[https://perma.cc/LVM6-TZGK].
272 Hazelrig,
E:\FR\FM\29OCP2.SGM
29OCP2
86160
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
present in an increasing number of
devices, including phones, cars, and
smartwatches.277
• Availability: Moderate sensitivity.
Commercial companies collect
geolocation data in large volumes and
consider it valuable for identifying
consumers and evaluating their
behavior.278 It is subject to increasing
regulatory protection, with laws passed
in California and Virginia to regulate
precise geolocation data, and
Massachusetts considering a law that
would ban the sale of user location data
as of the date of the proposed rule.279
These restrictions make the date more
sensitive because it is less generally
available.
• Volume: High sensitivity.
Technically, geolocation is often a
combination of latitude and longitude,
along with related fields such as
timestamps, accuracy measurements,
device identifiers, and IP addresses.280
This string of information requires
relatively little space to store and is
simple, and geolocation information is
often collected in very large quantities
to be meaningful for commercial or
research purposes at scale. For example,
one provider of geolocation data
advertised a dataset covering 1 year
with 214 million daily data points,
suggesting the relatively small amount
of information contained in each data
point.281 In general, geolocation data is
sold in many differently sized sets and
different ways, ranging from small,
277 Rob Gabriele, 170 Million Americans Own
GPS Tracking Devices; Market to Grow Over Next
Six Months, SafeHome.org (July 15, 2024), https://
www.safehome.org/gps-industry-outlook-statistics/
[https://perma.cc/C3ZY-2WCA]; Securing the
Information and Communications Technology and
Services Supply Chain: Connected Vehicles, supra
note 228.
278 Robert Archacki et al., Unlocking Value with
Location Intelligence, Bos. Consulting Grp. (Feb. 4,
2021), https://www.bcg.com/publications/2021/
leveraging-location-intelligence-across-industries
[https://perma.cc/XM6A-NQRG].
279 BCLP, Precise Geolocation: Recent Trends and
Enforcement, JD Supra (Mar. 30, 2023), https://
www.jdsupra.com/legalnews/precise-geolocationrecent-trends-and-8834493/ [https://perma.cc/
4YMR-J8NE]; Will Shanklin, Massachusetts Weighs
Outright Ban on Selling User Location Data,
Engadget (July 10, 2023), https://
www.engadget.com/massachusetts-weighs-outrightban-on-selling-user-location-data-191637974.html
[https://perma.cc/X43U-Q35P].
280 Geolocation Data 101: A Guide to Powerful
Place-Based Insights, Zartico, https://
www.zartico.com/blog/guide-to-using-geolocationdata#where-does-geolocation-come-from [https://
perma.cc/M6SG-5PRF]; see Amended Complaint
¶¶ 27–28, Fed. Trade Comm’n v. Kochava, Inc., No.
22–cv–00377 (D. Idaho 2023), ECF No. 26, https://
www.ftc.gov/system/files/ftc_gov/pdf/
26AmendedComplaint%28unsealed%29.pdf
[https://perma.cc/4KWL-ZEJE].
281 Factori Products, Datarade, https://
datarade.ai/data-providers/lifesight/data-products
[https://perma.cc/3XEP-9BVH].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
precisely targeted geofenced areas using
ads to global datasets containing records
on billions of devices.282
• Velocity: Low sensitivity.
Commercially available geolocation
datasets typically offer 1 to 5 years of
data.283 This indicates a relatively
limited lifespan and may vary.
Compared to other types of data under
consideration, this data is less valuable
and useful over long time periods due
to other factors such as volume.
• Quality: Moderate sensitivity.
Analysts can purchase geolocation data
in a variety of formats, including realtime and historical data, over a variety
of geographic locations.284 Analysts can
determine valuable information about
patterns of life from this information.285
However, this data is generally provided
as raw, unprocessed ‘‘pings,’’ which
require machine analysis to derive
useful insights.
The Department of Justice assesses
that personal health data is the fourth
most sensitive category of sensitive
personal data. In conducting the
analysis, the Department considered
personal health records as well as
claims and billing information. Unlike
the three categories discussed in parts
V.A.1, V.A.2, and V.A.3 of this
preamble, personal health data contains
a much more heterogeneous set of data,
with sensitivity varying across the
evaluated characteristics. Based
primarily on the purpose, control, and
availability characteristics described
below, the Department assesses personal
health data to be moderately sensitive
overall:
• Purpose: Moderate sensitivity.
Personal health records contain a
variety of information, including
information on medical history,
medications, treatments, tests,
immunizations, implanted devices, and
associated data.286 They may also
contain financial information (where
related to billing), and covered personal
identifiers.287 As a result, analysts could
use them for a variety of identifying,
characterizing, and categorizing
activities, including identifying
vulnerabilities in an individual’s
background that could be leveraged to
coerce that individual into recruitment
by a foreign intelligence service. For
example, healthcare records can reveal
healthcare providers and embarrassing
or expensive medical conditions that
help our adversaries target individuals
and groups for intelligence recruitment,
espionage, and influence. Severe
injuries, chronic medical conditions,
and mental health information provide
points of leverage for coercion,
blackmail, and influence. In extreme
circumstances, countries of concern
could even exploit information gathered
from personal health records to target
individuals using certain medical
devices or taking certain
prescriptions.288
• Changeability: Moderate sensitivity.
Many medical records contain objective
information, such as laboratory test
results and physical measurements.
They also contain information that an
individual could falsify by providing an
inaccurate medical history, describing
false symptoms, and hiding certain
behaviors or habits to avoid negative
consequences, get access to medication
or insurance, or for simple emotional
reasons such as guilt or shame.289
• Control: Moderate sensitivity.
Personal health records are often based
on information provided by an
individual and subject to strict privacy
laws that help ensure individual control
of this data.290 As a result, this data may
not be available without an individual’s
permission. However, it is typically
maintained by third parties, such as
doctors, hospitals, and insurance
systems, placing it in record systems
outside an individual’s direct control.291
282 See Jon Keegan & Alfred Ng, There’s a
Multibillion-Dollar Market for Your Phone’s
Location Data, Markup (Sept. 30, 2021), https://
themarkup.org/privacy/2021/09/30/theres-amultibillion-dollar-market-for-your-phoneslocation-data [https://perma.cc/3TUV-HHGV].
283 See, e.g., What Is Mobile Location Data?
Definition, Uses, Datasets, & Providers, Datarade
(Sept. 23, 2024), https://datarade.ai/datacategories/mobile-location-data [https://perma.cc/
X8FH-GY9Y].
284 Sherman et al., supra note 6.
285 See, e.g., Thompson & Warzel, supra note 44.
286 See, e.g., The Guide to Getting & Using Your
Health Records, Off. Nat’l Coordinator for Health
Info. Tech., https://www.healthit.gov/how-to-getyour-health-record/ [https://perma.cc/K2ZH7VTW]; Dick Cheney Feared Assassination Via
Medical Device Hacking: ‘I Was Aware of the
Danger,’ ABC News (Oct. 19, 2023), https://
abcnews.go.com/US/vice-president-dick-cheney-
feared-pacemaker-hacking/story?id=20621434
[https://perma.cc/Q779-MESR].
287 See Trisha Torrey, How to Get Your Medical
Records, Verywell Health (May 11, 2023), https://
www.verywellhealth.com/how-to-get-copies-of-yourmedical-records-2615505 [https://perma.cc/2VY5PXJA].
288 See, e.g., Dick Cheney Feared Assassination
Via Medical Device Hacking, supra note 286.
289 John J. Palmieri & Theodore A. Stern, Lies in
the Doctor-Patient Relationship, 11 Prim. Care
Companion J. Clinical Psychiatry 163, 165 (2009),
https://www.ncbi.nlm.nih.gov/pmc/articles/
PMC2736034/ [https://perma.cc/AH9L-FD5K].
290 Health Information Privacy Law and Policy,
Off. Nat’l Coordinator for Health Info. Tech.,
https://www.healthit.gov/topic/health-informationprivacy-law-and-policy [https://perma.cc/2XHZUPFE].
291 Trisha Torrey, Who Can Access Your Medical
Records? VeryWell Health (Mar. 11, 2022), https://
4. Personal Health Data
PO 00000
Frm 00046
Fmt 4701
Sfmt 4702
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
• Availability: High sensitivity.
Personal health data is considered
highly private and is well protected by
privacy legislation. Data is shared as
part of clinical trials, but access to such
data is recognized as a continuing
challenge within the healthcare
community.292 Furthermore, health data
remains highly valuable to cyber
criminals on the dark web, as compared
to data such as credit card numbers and
Social Security numbers, pointing to the
general difficulty in obtaining this
information in bulk quantities.293
• Volume: Varied sensitivity. As
discussed, personal health data
generally contains large amounts of data
of varying formats and structures,
ranging from the highly structured and
technical information in lab results, to
the more unstructured data, such as xray images and magnetic resonance
imaging scans. Such variation means the
amount of information may range from
very small, such as the results of a
single test, to very voluminous, such as
a complete medical history. The volume
of elements such as progress notes is
also increasing, further expanding
variability.294
• Velocity: Moderate-to-low
sensitivity. As discussed, personal
health data contains a variety of
different types of information, but many
of these records are lab tests,
diagnostics, and other treatment
information that may be less useful to
analysts. However, certain pieces of
information of enduring value—such as
information on chronic disease and
hereditary conditions—may be mixed in
with other pieces of information,
somewhat raising the overall sensitivity.
• Quality: Low sensitivity. Personal
health records vary widely in terms of
data type, quantity, precision, and
consistency,295 making personal health
www.verywellhealth.com/who-has-access-to-yourmedical-records-2615502 [https://perma.cc/BX525URC].
292 Sonali Kochhar et al., Clinical Trial Data
Sharing: Here’s the Challenge, 9 BMJ Open (2019),
https://bmjopen.bmj.com/content/9/8/e032334
[https://perma.cc/392P-PVKN].
293 Sanjay Cherian, Healthcare Data: The Perfect
Storm, Forbes (Jan. 14, 2022), https://
www.forbes.com/sites/forbestechcouncil/2022/01/
14/healthcare-data-the-perfect-storm [https://
perma.cc/DR6V-D7QY].
294 Adam Rule et al., Length and Redundancy of
Outpatient Progress Notes Across a Decade at an
Academic Medical Center, 4 JAMA Network Open
(July 19, 2021), https://www.ncbi.nlm.nih.gov/pmc/
articles/PMC8290305/ [https://perma.cc/7NA87Y9N].
295 See, e.g., Alex Roehrs et al., Personal Health
Records: A Systematic Literature Review, 19 J. Med.
Internet Rsch. under sections titled Overview,
Electronic Health Records, and Personal Health
Records (Jan. 6, 2017), https://
www.ncbi.nlm.nih.gov/pmc/articles/PMC5251169/
[https://perma.cc/T6MA-29VB].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
data less suitable for automated
machine analysis than other types of
data. Analysts or automated systems
may not be able to draw useful
conclusions without a great deal of
context surrounding highly technical
diagnostic data. ‘‘Note bloat’’—
unnecessarily lengthy information—is a
recognized issue within the medical
community, indicating the ongoing
challenge of obtaining quality, valuable
information.296 Much of the useful
information may be contained in
generalized diagnostics, particularized
forms, and images that analysts may not
be able to easily transform into useful
conclusions, particularly if patients are
not being truthful.297
5. Personal Financial Data
The Department of Justice assesses
that personal financial data is the fifth
most sensitive category of sensitive
personal data. To conduct the analysis,
the Department considered data linked
directly with personal financial
accounts (e.g., records with account
numbers and names), data included in
financial applications such as data used
to apply for mortgages or loans (e.g.,
credit history), and related data
routinely exchanged during a
transaction (e.g., account numbers,
routing numbers). Personal financial
data includes records that are
confidential (e.g., complete bank
account information, including name).
Personal financial data includes a
variety of data types with varying
sensitivity and moderate sensitivity
overall based primarily on the purpose,
changeability, availability, and quality
characteristics below:
• Purpose: Moderate sensitivity.
Financial institutions must uniquely
identify and verify the identity of
individuals both to track financial flows
and to comply with regulations such as
anti-money laundering.298 In order to do
this, they store a mix of data that is
useful for identifying individuals. Other
categories of financial data, such as
credit or consumer reports, provide data
that can be useful for characterizing
behavior or grouping individuals into
categories.299 Today, most individuals
leave a digital trail through their
296 See Cures for Note Bloat, ForeSee Medical
(June 9, 2023), https://www.foreseemed.com/blog/
note-bloat-cures [https://perma.cc/AB34-CYGL].
297 Palmieri & Stern, supra note 289.
298 Frequently Asked Questions (FAQ) Regarding
Anti-Money Laundering (AML), FINRA, https://
www.finra.org/rules-guidance/key-topics/aml/faq
[https://perma.cc/Z9TK-WBRW].
299 Barry Paperno, How Credit Scores Predict
Your Behavior, Yahoo! Finance (May 24, 2013),
https://finance.yahoo.com/news/credit-scorespredict-behavior-113006994.html [https://perma.cc/
GC4S-6H67].
PO 00000
Frm 00047
Fmt 4701
Sfmt 4702
86161
purchases and other financial activities,
revealing behaviors, activities, and
patterns of life.300 They provide insight
into their financial condition, personal
preferences, habits, and concerns
through brokerage activity, savings
account information, and insurance
records. Foreign intelligence services
could derive other sensitive personal
data, such as workplace and daily life
habits, including vulnerabilities in an
individual’s personal life that may be
leveraged to coerce that individual into
recruitment by a foreign intelligence
service, from financial transaction
data.301 Use of a financial instrument to
purchase products or services reveals
spending habits and patterns of life that
help our adversaries target individuals
and groups for intelligence recruitment,
espionage, and influence. Debt,
creditworthiness, and financial troubles
provide points of leverage for coercion,
blackmail, and influence.
• Changeability: Moderate-to-high
sensitivity. Financial information on an
individual is recorded and maintained
by financial institutions, which depend
on possessing reliable and accurate
information. However, individuals do
have some ability to change their
financial identifiers by, for example,
closing one account and opening
another. Additionally, the continued
existence of money laundering as a law
enforcement issue demonstrates that
financial information can be, to some
extent, controlled or manipulated by an
individual.302
• Control: Moderate sensitivity.
Financial information and records are
managed and maintained by centralized
financial institutions. Credit cards and
checks leave a history with the financial
institution, but individuals have the
power to pay in cash or other
anonymized methods and not reveal
transactions to these financial
institutions.303 Ultimately, this
300 Nicholas Anthony, Policy Analysis No. 945,
The Right to Financial Privacy, CATO Inst. (May 2,
2023), https://www.cato.org/policy-analysis/rightfinancial-privacy#conclusion [https://perma.cc/
5K3E-BUPF] (‘‘Today, technology is an integral part
of modern life: Americans use credit or debit cards
for nearly all purchases, acquire loans directly on
their phones, and leave a digital trail nearly
everywhere they go.’’).
301 Carola Westermeier, Money Is Data—The
Platformization of Financial Transactions, 23 Info.,
Commc’n & Soc’y 2047, 2050–52 (2020), https://
www.tandfonline.com/doi/full/10.1080/
1369118X.2020.1770833 [https://perma.cc/TD9JUF9U].
302 Examples of Money Laundering Techniques,
LexisNexis (May 4, 2023), https://
www.lexisnexis.com/blogs/gb/b/compliance-riskdue-diligence/posts/examples-money-laundering
[https://perma.cc/6MHE-U83S].
303 See, e.g., Edvardas Mikalauskas, The Ultimate
Guide to Safe and Anonymous Online Payment
E:\FR\FM\29OCP2.SGM
Continued
29OCP2
86162
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
information reflects the activity of
individuals, leaving it partly in their
control.
• Availability: Moderate sensitivity.
The sharing of certain types of
information maintained by financial
institutions is controlled by privacy
regulations.304 However, credit card,
debit card, and bank account numbers,
and other financial identifiers and
information, are routinely exchanged as
a matter of course in commercial
transactions; credit reports are regularly
used by financial institutions and
businesses as part of background
checks; and transaction data is provided
to marketing and third-party data
analytics organizations.305 Credit cards
and online financial account credentials
can command between $15 and $200 on
the dark web, as compared with Social
Security numbers, which command less
than $10.306
• Volume: Moderate-to-low
sensitivity. Over 100 million credit card
transactions occur in the United States
each day.307 While each transaction
contains a small amount of information,
this total transaction volume represents
a massive dataset that analysts must
mine to achieve useful results. Other
types of information, such as data in
credit reports, can contain information
in a wide variety of formats that may be
bulkier to manage and store.
• Velocity: Varied sensitivity.
Analysts can use certain pieces of data,
such as long-term loans, for a very long
time. However, other pieces of
information, such as information on
individual transactions, may lose their
value to an analyst over a short period
of time.
• Quality: Moderate sensitivity.
Analysts usually value personal
financial data not for the information
Methods in 2024, Cybernews (Dec. 12, 2023),
https://cybernews.com/resources/the-ultimateguide-to-safe-and-anonymous-online-paymentmethods/ [https://perma.cc/5EX5-8YFC].
304 See, e.g., Gramm-Leach-Bliley Act tit. V, 15
U.S.C. 6801–09; Privacy Rule Handbook, Fed.
Deposit Ins. Corp. (Aug. 11, 2023), https://
www.fdic.gov/regulations/examinations/
financialprivacy/handbook/ [https://
perma.cc/NK9U-MVFY].
305 See, e.g., R.J. Cross, How Mastercard Sells Its
‘Gold Mine’ of Transaction Data, U.S. PIRG (June
17, 2024), https://pirg.org/edfund/resources/howmastercard-sells-data/ [https://perma.cc/N4T8P3ZG].
306 Paul Bischoff, Dark Web Prices for Stolen
PayPal Accounts Up, Credit Cards Down: Report,
Comparitech (Aug. 12, 2023), https://
www.comparitech.com/blog/vpn-privacy/dark-webprices/ [https://perma.cc/88HM-2VZK].
307 Erica Sandberg, The Average Number of Credit
Card Transactions per Day & Year, iMerchant
Direct (Nov. 5, 2020), https://
www.imerchantdirect.com/news/number-of-creditcard-transactions-per-day-year [https://perma.cc/
NVZ8-M3PR].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
itself, but for what it can reveal about
an individual’s behavior.308 As a result,
some analysis is usually required to
make it useful. Additionally, financial
records such as credit reports can
contain inaccurate information or make
erroneous connections between
individuals and assets.309
6. Covered Personal Identifiers
The Department of Justice assesses
that covered personal identifiers are the
sixth most sensitive category of
sensitive personal data. Covered
personal identifiers come from a variety
of contexts and are of varying quality.
For example, people have used certain
types of covered personal identifiers
(e.g., Social Security numbers) for
decades, and numerous entities collect
them, making them more available than
other categories of data. Other types of
covered personal identifiers (e.g.,
advertising IDs) are distributed widely
and only useful when collected in very
large volumes and linked to other pieces
of data.310 The variety and variability of
this category makes it inherently more
difficult to characterize across the board
than other categories. Based primarily
on the purpose, changeability, and
velocity characteristics below, the
Department assesses covered personal
identifiers to have low sensitivity
relative to the other categories of
sensitive personal data:
• Purpose: Moderate sensitivity. As
stated in the proposed rule, covered
personal identifiers are pieces of data
that can be useful for identifying
individuals, making them inherently
sensitive. However, covered personal
identifiers include pieces of information
that are uniquely identifying (e.g.,
Social Security numbers) as well as
those that are deliberately designed to
be anonymous (e.g., advertising
identifiers).311 Covered personal
308 Alessio Balduini et al., Combining Financial
and Behavioral Information to Predict Defaults for
Small and Medium-Sized Enterprises: A Dynamic
Weighting Approach, Moody’s Analytics (Sept.
2017), https://www.moodysanalytics.com/articles/
2017/combining-financial-and-behavioralinformation [https://perma.cc/X8DS-WPZB]; Luke
Goldsten, Rollups: The Big Data Machine Driving
Online Sports Betting, Am. Prospect (Apr. 4, 2022),
https://prospect.org/power/rollups-big-datamachine-driving-online-sports-betting/ [https://
perma.cc/AZ97-H4TW].
309 Is My Credit Report Accurate? For Over 40
Million Americans, the Answer Is No, Am. Bankr.
Inst., https://www.abi.org/feed-item/is-my-creditreport-accurate-for-over-40-million-americans-theanswer-is-no [https://perma.cc/462F-UMEN].
310 Priv. Int’l, Examples of Data Points Used in
Profiling, 3–12 (2018), https://
privacyinternational.org/sites/default/files/2018-04/
data%20points%20used%20in%20tracking_0.pdf
[https://perma.cc/LF63-XUDT].
311 Are Advertising Unique IDs Anonymous?,
Panda Sec. (July 21, 2021), https://
PO 00000
Frm 00048
Fmt 4701
Sfmt 4702
identifiers and unique IDs can be used
to link other datasets containing more
directly exploitable information.312 For
example, they can help link databases of
habitual visitors to gambling sites with
debt collection records or a database of
government records. They could link
advertising IDs, IP addresses, and SIM
card numbers to personal mobile
devices, home addresses, and
government mobile devices. However,
in general, covered personal identifiers
are primarily useful as identifiers,
reducing their overall sensitivity
because they themselves reveal little
information.
• Changeability: Moderate-to-low
sensitivity. As a category, they cover a
range of data points that differ in terms
of ease of change. For example, Social
Security numbers are difficult to
change, requiring evidence that an
individual is in danger from domestic
violence, other abuse, or identity
theft.313 In contrast, account identifiers
and passwords can be changed at a
user’s discretion. Many covered
personal identifiers, including passport
numbers, device IMEIs, and addresses,
do change on a semi-regular basis as
passports are reissued, devices are
replaced, and individuals move.
• Control: Moderate-to-low
sensitivity. Some covered personal
identifiers—particularly governmentissued identifiers such as Alien
Registration Numbers and Social
Security numbers or financial identifiers
such as account information—are fully
outside the control of an individual.
Others are fully controlled by an
individual, including email addresses
and account identifiers. Still other
covered personal identifiers such as
phone numbers may be issued by a third
party, but an individual can change
them at will.
• Availability: Low sensitivity.
Covered personal identifiers such as
phone numbers and home addresses
have been used as unique identifiers in
a variety of systems, ranging from
customer loyalty trackers to tax records.
Many are available as part of the public
record.314 Technical covered personal
www.pandasecurity.com/en/mediacenter/
advertising-ids/ [https://perma.cc/ANA8-JE2H].
312 Priv. Int’l, supra note 310.
313 Is It Possible to Get a New Social Security
Number?, AARP (Apr. 8, 2022), https://
www.aarp.org/retirement/social-security/questionsanswers/new-number.html [https://perma.cc/X759P6LF].
314 See, e.g., Brian Fung, DC Makes It Shockingly
Easy to Snoop on Your Fellow Voters, Wash. Post
(June 14, 2016), https://www.washingtonpost.com/
news/the-switch/wp/2016/06/14/d-c-s-board-ofelections-makes-it-shockingly-easy-to-snoop-onyour-fellow-voters/ [https://perma.cc/5A2J-VNAZ];
How Your Phone Number is Exposed: Phone
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
identifiers such as IP addresses are
necessarily widely available as a matter
of technical necessity.
• Volume: Low sensitivity. Online
data-brokerage firms advertise datasets
of mobile advertising IDs containing
hundreds of millions to billions of
records.315 Tens of millions of Social
Security numbers are routinely found
on the dark web, suggesting the large
volumes in which these data points are
stored and shared by companies.316
Companies such as Twitter (now X)
hold the phone numbers and email
addresses of more than 100 million
individuals.317 As these examples
demonstrate, covered personal
identifiers are routinely held and used
in massive volumes. At such large
volumes, this type of data tends to be
less sensitive because it reduces the
ability of an adversary to identify a
specific individual (such as
distinguishing between people who
have the same name, have lived at the
same address, etc.), absent other data
that can be used to narrow down and
link the identifiers to individuals.
• Velocity: Moderate-to-low
sensitivity. Covered personal identifiers
such as Social Security numbers and
names can be quite persistent, changing
infrequently or not at all over an
individual’s lifetime. Covered personal
identifiers like mobile advertising IDs
cease to be useful in as little as 7 to 8
months.318 In general, the useful
lifespan of many covered personal
identifiers is limited. Only a few
covered personal identifiers follow an
individual over a lifetime, while many
have lifespans measured in weeks to
months, reducing the overall sensitivity
of the category.
• Quality: Low sensitivity. For
example, an individual user may have
multiple mobile advertising IDs across
multiple devices. Advertising specialists
assert that 91 percent of companies have
data quality issues, including from
Number Leaks, Nat’l. Cybersec. All. (Aug. 25, 2023),
https://staysafeonline.org/online-safety-privacybasics/how-your-phone-number-is-exposed/
(https://perma.cc/4CL3-9WRW).
315 See, e.g., MAID—PII Data: Best MAID—PII
Datasets & Databases, Datarade, https://
datarade.ai/search/products/maid-pii-data [https://
perma.cc/6NWA-YEBK].
316 See Chloe Veltman, Millions of Customers’
Data Found on Dark Web in Latest AT&T Data
Breach, NPR (Mar. 30, 2024), https://www.npr.org/
2024/03/30/1241863710/att-data-breach-dark-web
[https://perma.cc/GAD6-R9KU].
317 See Complaint ¶ 29, United States v. Twitter,
Inc., No. 22–cv–03070 (N.D. Cal. May 25, 2022),
ECF No. 1, https://www.ftc.gov/system/files/ftc_gov/
pdf/2023062TwitterFiledComplaint.pdf [https://
perma.cc/4Z9J-5N3H].
318 3 Uses for Mobile Advertising IDs to Copy
Today, FullContact (Feb. 21, 2022), https://
www.fullcontact.com/blog/2022/02/21/mobileadvertising-id/ [https://perma.cc/RR89-25HL].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
outdated data and user-error
mistakes.319 Individuals may also make
and use throwaway email accounts to
avoid spam.320 Major technology
companies, such as Apple, offer the
ability to create relay emails specifically
to obfuscate certain underlying covered
personal identifiers.321
B. Grouping the Categories Into Tiers by
Similar Sensitivity
Based on this ranking, the Department
grouped the categories of sensitive
personal data into four tiers based on
how similar or dissimilar, in terms of
sensitivity, each category is compared to
the other. Human genomic data, the
most sensitive category, is unique and
substantially more sensitive than
biometric data due to its lower
changeability and velocity. As a result,
the Department placed human genomic
data on its own in the first tier. While
not as sensitive as human genomic data,
biometric identifiers and precise
geolocation data are generally more
sensitive than either personal health or
personal financial data because the data
is more structured, making it more
useful for machine-based analysis.
Biometric identifiers and precise
geolocation data also identify
individuals with more precision than
personal health data or personal
financial data, making the results of
machine-based analysis more valuable
to human analysts. As a result, the
Department grouped biometric
identifiers and precise geolocation data
together into the second tier and
grouped personal financial data and
personal health data together into the
third tier. Finally, compared to personal
financial data or personal health data,
covered personal identifiers are more
varied in terms of use, making them less
useful to foreign intelligence services.
As a result, the Department grouped
covered personal identifiers into the
fourth tier.
To help verify the relative
sensitivities and tiered groupings
yielded by the seven-factor analysis, the
Department compared the results of this
analysis to other circumstances in
319 Barley Laing, Why Customer Loyalty Starts
with Clean Data, Advert. Week, https://
advertisingweek.com/why-customer-loyalty-startswith-clean-data/ [https://perma.cc/LJ3G-9M7F].
320 Vivian McCall, How to Make a Throwaway
Email Account to Avoid Spam from the websites
You Sign up for, Bus. Insider (Dec. 22, 2020),
https://www.businessinsider.com/guides/tech/howto-make-a-throwaway-email-account [https://
perma.cc/27C4-DQJQ].
321 Communicating Using the Private Email Relay
Service, Apple Dev., https://developer.apple.com/
documentation/sign_in_with_apple/sign_in_with_
apple_js/communicating_using_the_private_email_
relay_service [https://perma.cc/62AC-K9HK].
PO 00000
Frm 00049
Fmt 4701
Sfmt 4702
86163
which the Federal Government or state
governments have treated these
categories of data as sensitive. To start,
the Department examined over 50
transactions reviewed by CFIUS in
which the government identified, and
took action to address, a risk to national
security posed by access to data by
countries of concern or persons subject
to their ownership, direction,
jurisdiction, or control. The Department
examined the types and volumes of data
involved in each CFIUS transaction to
identify the lowest volumes of data that
the government identified as a risk to
national security posed by each of these
transactions, which served as proxy for
how sensitive CFIUS has generally
considered each category of data with
respect to identified national security
risks relating to that data.
In the case of personal financial data,
personal health data, and covered
personal identifiers, the Department was
able to identify enough CFIUS
transactions to present a reasonable
sample. It identified the following
approximate numbers as the lowest
volumes identified by CFIUS as
presenting a national security risk
warranting action in the context of the
specific transactions involving sensitive
personal data that CFIUS reviewed:
• Personal financial data: 16,000
individuals
• Personal health data: 85,000
individuals
• Covered personal identifiers:
100,000 individuals
Based on these data points, the
Department confirmed that its
sensitivity analysis of these three
categories was consistent with previous
CFIUS national security assessments, at
least in the specific contexts of those
case-by-case CFIUS reviews.
Because there was not a sufficiently
large sample of CFIUS matters for
human genomic data, biometric data, or
precise geolocation data, and because
there does not appear to be another
national security program with relevant
quantitative or qualitative data on this
topic, the Department examined how
the Federal Government and States treat
these three remaining categories under
privacy laws to help verify the results of
its seven-factor assessment. While
privacy laws and national security laws
generally address different challenges
associated with sensitive personal data,
as explained in part IV of this preamble,
there is some overlap in the ultimate
harms that both seek to address. These
privacy-based analogues thus help
provide some indication of the relative
capability of each category of sensitive
personal data to be exploited and used
to cause harm.
E:\FR\FM\29OCP2.SGM
29OCP2
86164
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
In the case of human genomic data,
the Department confirmed its
assessment that this category of data is
more sensitive than the three previously
mentioned categories of data (covered
personal identifiers, personal financial
data, and personal health data) by
evaluating comparative data from the
FTC. The FTC has taken action against
companies making deceptive privacy
claims on cases involving the human
genetic data of as few as 2,600
individuals.322 In doing so, the FTC’s
complaint alleged that the company’s
‘‘disregard for the basic security’’ of this
data caused it to be ‘‘publicly exposed
online,’’ 323 revealing, among other
things, ‘‘the level of risk for having or
developing certain health
conditions.’’ 324 The FTC also explained
that this kind of ‘‘DNA data is sensitive
because it’s about who’’ a person is and
is ‘‘so sensitive there’s a law to protect
you from discrimination based on
genetic information when you’re trying
to get work or health insurance.’’ 325 In
contrast, eight other FTC cases between
2021 and 2023 involving only covered
personal identifiers, personal financial
data, or personal health data involved
data on one million or more individuals.
The fact that the FTC took action in a
case involving a significantly lower
amount of compromised human
genomic data supports the Department’s
assessment that human genomic data is
substantially more sensitive than other
data types.
In the case of biometric data, the
Department confirmed its assessment
with reference to State legislation. Three
States—Washington,326 Texas,327 and
Illinois 328—have prohibited the sale,
lease, or disclosure of biometric
identifiers for purposes other than the
provision of a specific commercial
service, such as confirming a consumerrequested financial transaction.
Massachusetts is also contemplating
322 Complaint ¶ 28, 1Health.io, Inc., No. C–4798
(F.T.C. Sept. 6, 2023), https://www.ftc.gov/system/
files/ftc_gov/pdf/1Health-Complaint.pdf [https://
perma.cc/W5SZ-CE3A].
323 Id.
324 Id. ¶ 9.
325 Jim Kreidler, Keep People’s Sensitive DNA
Information Private, Fed. Trade Comm’n (June 16,
2023), https://consumer.ftc.gov/consumer-alerts/
2023/06/keep-peoples-sensitive-dna-informationprivate [https://perma.cc/VLC4-JYKM].
326 Biometric Identifiers, Wash. Rev. Code 19.375,
https://app.leg.wa.gov/RCW/
default.aspx?cite=19.375&full=true [https://
perma.cc/2GZM-6FEG].
327 Biometric Identifiers, Tex. Bus. & Com. Code
503.001, https://statutes.capitol.texas.gov/Docs/BC/
htm/BC.503.htm [https://perma.cc/F2WW-ZNR7].
328 Biometric Information Privacy Act, 740 Ill.
Comp. Stat. 14 (2008), https://www.ilga.gov/
legislation/ilcs/
ilcs3.asp?ActID=3004&ChapterID=57 [https://
perma.cc/KMD8-QP8D].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
such a law at the time of this proposed
rule.329 The legislative action in these
cases supports the Department’s
assessment that the transfer of even very
small amounts of biometric data could
prove highly damaging and thus that
this data should be subject to a lower
threshold.
In the case of geolocation data, the
Department confirmed its assessment
with reference to other government
actions and reporting suggesting that
even small amounts of geolocation data
could be sensitive. The FTC charged
two companies with causing injury to
consumers by selling geolocation data
that did not exclude information on
sensitive locations, such as reproductive
health clinics, places of worship, and
addiction recovery facilities, and issued
an order banning one of those
companies from selling data without
consumer consent.330 It also noted a
data breach that involved 2,200
customers as part of its action against a
company that harvested and shared data
on people’s physical movements.331 The
FCC has also levied fines for selling
location data without customer
consent.332 The National Security
Agency has noted the importance of
limiting location data exposure.333
Congressional testimony has highlighted
how commercial datasets can be used to
precisely identify individuals in
sensitive national security roles.334 The
329 Act to Protect Biometric Information, H. 63,
193d. Gen. Ct. (Mass. 2003), https://
malegislature.gov/Bills/193/H63 [https://perma.cc/
26GH-JTCZ].
330 Press Release, Fed. Trade Comm’n, FTC Sues
Kochava for Selling Data that Tracks People at
Reproductive Health Clinics, Places of Worship,
and Other Sensitive Locations (Aug. 29, 2022),
https://www.ftc.gov/news-events/news/pressreleases/2022/08/ftc-sues-kochava-selling-datatracks-people-reproductive-health-clinics-placesworship-other [https://perma.cc/G6L6-G6XL].
331 Press Release, Fed. Trade Comm’n, FTC Bans
SpyFone and CEO from Surveillance Business and
Orders Company to Delete All Secretly Stolen Data
(Sept. 1, 2021), https://www.ftc.gov/news-events/
news/press-releases/2021/09/ftc-bans-spyfone-ceosurveillance-business-orders-company-delete-allsecretly-stolen-data [https://perma.cc/SG4B-P6SV].
332 Derek B. Johnson, FCC Takes $200 Million Bite
Out of Wireless Carriers for Sharing Location Data,
CyberScoop (Apr. 29, 2024), https://
cyberscoop.com/fcc-fines-wireless-carriers-200million/ [https://perma.cc/9UKR-4KXY].
333 Nat’l Sec. Agency, PP–20–0535, Limiting
Location Data Exposure (Aug. 2020), https://
media.defense.gov/2020/Aug/04/2002469874/-1/-1/
0/CSI_limiting_location_data_exposure_final.pdf
[https://perma.cc/763S-8D5T].
334 Data Brokerage, the Sale of Individuals’ Data,
and Risks to Americans’ Privacy, Personal Safety,
and National Security: Hearing Before the
Subcomm. on Oversight & Investigations of the H.
Comm. on Energy & Com., 118th Cong. (2023)
(statement of Justin Sherman, Senior Fellow and
Research Lead, Data Brokerage Project, Sanford
School of Public Policy), https://
d1dth6e84htgma.cloudfront.net/Sherman_
PO 00000
Frm 00050
Fmt 4701
Sfmt 4702
Massachusetts State legislature is
considering a bill at the time of this
proposed rule that would ban the sale
of phone location data.335 These
comparisons all support the
Department’s assessment that this type
of data is relatively more sensitive than
other types of data, such as personal
identifiers.
C. Proposed Bulk Thresholds for Each
Tier
The Department of Justice developed
numerical thresholds using the four
tiers of sensitivity based on the number
of individuals included in a dataset. In
the ANPRM, the Department set the
overall upper limit for these thresholds
at one million individuals.336 As
explained in the ANPRM, within each
group, the Department set a potential
upper and lower limit for each of the
bulk thresholds, relying on orders-ofmagnitude differences to develop
preliminary judgments.
The Department sought input on the
thresholds from the public in response
to the ANPRM. Commenters expressed
a wide variety of general concerns
regarding the ranges of the potential
bulk thresholds. Some commenters
stated that the potential thresholds were
too high, some that they were too low,
some that the thresholds should be zero,
and some that relying on thresholds was
objectionable for other reasons. None of
the comments, however, provided any
actionable data points, use cases, or
evidence that would support an
alternative analytical framework or
support adopting one particular
threshold over another. Given that lack
of specificity, the Department (along
with the Department of Commerce)
followed up individually with each
commenter on this topic to seek any
additional information available that
informed their comments, as described
in part III of this preamble. Those
engagements did not yield any
substantially new qualitative or
quantitative information to reliably
inform the selection of the proposed
bulk thresholds.
Based on this analysis and public
comment, the proposed rule would set
the following bulk thresholds:
• Human genomic data: More than
100 U.S. persons.
Testimony_4_19_23_b40d947a8e.pdf [https://
perma.cc/9ACJ-ZT8R].
335 Shanklin, supra note 279.
336 89 FR 15786; cf. 31 CFR 800.241(a) (defining
sensitive personal data to include ‘‘identifiable
data’’ that a U.S. business collects or maintains ‘‘on
greater than one million individuals’’ during a
relevant 12-month period).
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
• Biometric identifiers and precise
geolocation data: More than 1,000 U.S.
persons.
• Personal health data and personal
financial data: More than 10,000 U.S.
persons.
• Covered personal identifiers: More
than 100,000 U.S. persons.
The proposed bulk thresholds for all
the categories of sensitive personal data
except human genomic data are
approximately the middle order of
magnitude of the preliminary ranges
identified in the ANPRM (e.g., the
proposed threshold of 1,000 U.S.
persons for biometric identifiers is the
middle order of magnitude in the
ANPRM’s range of 100 to 10,000).337
Given the high sensitivity of human
genomic data and the significant
additional national security risks posed
by human genomic data beyond
counterintelligence risks, the proposed
bulk threshold for human genomic data
is the lowest order of magnitude in the
preliminary range identified in the
ANPRM. These proposed bulk
thresholds are generally consistent with
the order of magnitude of the minimum
number of individuals in a dataset that
the United States Government and other
actors have treated as presenting a
national security risk or as otherwise
sensitive in the use cases and
comparisons described in part V.B of
this preamble.
The Department has considered
whether the potential economic impact
should affect our choice of thresholds
for the purpose of defining ‘‘bulk’’ in
these regulations and has determined it
should not. First, the Department
expects that the proposed rule will
likely have some economic impact with
respect to the prohibitions and
restrictions on covered data transactions
that have been determined to pose an
unacceptable national security risk. The
Department seeks to avoid and
minimize unintended economic impacts
on activities that do not present such
national security risk. Neither the
Department nor commenters have
identified any actionable data or
analysis suggesting that the choice of
thresholds above zero is reasonably
likely to result in unintended
downstream impacts, as explained
further in part VII.A of this preamble.
Second, based on the information
provided to the Department and the
Department’s own analysis to date, it
seems unlikely that the data or analysis
would be detailed and representative
enough to reasonably affect the choice
of any specific thresholds within the
ranges identified in the ANPRM. While
337 89
FR 15786.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
it is theoretically possible that choosing
a higher (or lower) threshold would
correspondingly affect both the numbers
of captured transactions and the
resultant costs, it is also possible that a
meaningfully significant sample size of
U.S. persons conducting prohibited and
restricted transactions at volumes that
generally exceed the upper end of the
ranges in the ANPRM. There is no
known, reliable qualitative or
quantitative data that objectively favors
adopting one of those likely possibilities
at this time. For example, the average
volume and distribution of volumes of
human genomic data in covered data
transactions between U.S. persons and
countries of concern (or covered
persons) is unknown. Because there is
no data available to determine how
often, for example, U.S. persons engage
in such transactions at volumes above
1,000 U.S. persons as compared to 100,
there is insufficient data to support a
conclusion that the choice between 100
and 1,000 will meaningfully impact the
number of transactions subject to the
proposed rule. Accordingly, the
Department declines to deviate from the
risk-based analysis at this time.
VI. Interpretation of ‘‘Information or
Informational Materials’’ in IEEPA
The Department proposes exercising
its delegated statutory authority to
define ‘‘information or informational
materials’’ in 50 U.S.C. 1702(b)(3).
Under IEEPA, ‘‘[t]he President may
issue such regulations, including
regulations prescribing definitions, as
may be necessary for the exercise of the
authorities granted by this chapter.’’ 338
As courts have held, this provision
explicitly ‘‘authorize[s] the Executive
Branch to define the statutory terms of
IEEPA,’’ and definitions promulgated by
an agency that has been delegated this
authority thus ‘‘carry the force of law’’
subject to judicial deference.339 Section
2(b) of the Order delegated this statutory
authority to the Attorney General, and
the Department proposes to exercise this
authority to define ‘‘information or
informational materials’’ as follows.
To implement 50 U.S.C. 1702(b)(3),
the Department proposes defining
‘‘information or informational
materials’’ as limited to expressive
material and including publications,
films, posters, phonograph records,
338 50
U.S.C. 1704.
Oil Servs., Inc. v. U.S. Dep’t of
Treas., 750 F. Supp. 2d 150, 156 (D.D.C. 2010); see
also, e.g., Holy Land Found. v. Ashcroft, 333 F.3d
156, 162–63 (D.C. Cir. 2003); United States v. Lindh,
212 F. Supp. 2d 541, 562–63 & n.52 (E.D. Va. 2002);
Consarc Corp. v. U.S. Dep’t of Treas., Off. of Foreign
Assets Control, 71 F.3d 909, 914–15 (D.C. Cir.
1995); Consarc Corp. v. Iraqi Ministry, 27 F.3d 695,
701 (D.C. Cir. 1994).
339 Zarmach
PO 00000
Frm 00051
Fmt 4701
Sfmt 4702
86165
photographs, microfilms, microfiche,
tapes, compact disks, CD ROMs,
artworks, and news wire feeds.340
The proposed rule would adopt two
exclusions to this definition from
existing OFAC regulations and clarify
the definition’s application to nonexpressive materials. First, as previewed
in the ANPRM and explained in detail
below, the Department’s proposed rule
would clarify that the phrase
‘‘information or informational
materials’’ is limited to expressive
material, consistent with the purpose of
50 U.S.C. 1702(b)(3) to protect materials
involving the free exchange of ideas
from regulation under IEEPA. See
§ 202.226. The definition of
‘‘information or informational
materials’’ does not include nonexpressive data—i.e., data that is not
intended to communicate any idea. The
statute therefore permits the President,
and the Attorney General as his delegee
under the Order, to regulate transactions
involving the export of sensitive
personal data or government-related
data because this data is not expressive
and therefore falls outside the scope of
50 U.S.C. 1702(b)(3) (‘‘the Berman
Amendment’’). Second, the proposed
definition would, consistent with OFAC
regulations,341 exclude information or
informational materials that are not
fully created and in existence at the date
of the data transaction, or the
substantive or artistic alteration or
enhancement of information or
informational materials, or the provision
of marketing and business consulting
services, including to market, produce
or co-produce, or assist in the creation
of information or informational
materials. Third, the proposed
definition incorporates the statutory
exemption for items controlled for
export to the extent that such controls
promote the nonproliferation or
antiterrorism policies of the United
States, or with respect to which acts are
prohibited by 18 U.S.C. chapter 37. The
definition’s application to nonexpressive material and exclusion for
materials not fully created and in
existence are discussed in further detail
below.
A. The Berman Amendment Is Intended
To Protect the Free Exchange of Ideas
As noted above, § 202.226(a) of the
proposed rule clarifies that ‘‘information
or informational materials’’ is limited to
expressive material rather than
340 See, e.g., 31 CFR 544.304(a); 31 CFR
547.314(a)(1); 31 CFR 560.315(a); 31 CFR
576.306(a); 31 CFR 594.305(a).
341 See, e.g., 31 CFR 560.210(c)(2), 560.210;
United States v. Amirnazmi, 645 F.3d 564, 587 (3d
Cir. 2011).
E:\FR\FM\29OCP2.SGM
29OCP2
86166
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
including every piece of data that might
be characterized technically or
colloquially as ‘‘information or
informational materials.’’ This
interpretation is consistent with the
statute’s text and purpose, as
demonstrated by legislative history and
context, as well as judicial
interpretations.
The text indicates that the Berman
Amendment’s scope is properly limited
to expressive materials. The provision
restricts authority under IEEPA to
regulate imports and exports ‘‘regardless
of format or medium of transmission, of
any information or informational
materials, including but not limited to,
publications, films, posters, phonograph
records, photographs, microfilms,
microfiche, tapes, compact disks, CD
ROMs, artworks, and news wire feeds.’’
The specific examples accompanying
the phrase ‘‘information and
informational materials’’—publications,
films, posters, phonograph records,
photographs, microfilms, microfiche,
tapes, compact disks, CD ROMs,
artworks, and news wire feeds—reflect
Congress’ intent to protect the import or
export of expressive speech and
communicative works and mediums
that may be carrying such expressive
content. Although the statute provides
that it is ‘‘not limited to’’ the articulated
categories of information or specified
mediums, the general term ‘‘information
or informational materials’’ must be
read in the context of those examples
and should not be read to extend to
dissimilar categories of information to
those specifically articulated.342
Because those examples
overwhelmingly relate to expressive
materials, the term ‘‘information or
informational materials’’ is similarly
limited under the established
interpretive doctrine of noscitur a sociis.
Congress enacted the Berman
Amendment in 1988 and expanded it in
1994,343 and the initial version of the
Berman Amendment passed in 1988
further supports this argument. It
amended IEEPA to state that the
President’s authority under the statute
did not include the authority ‘‘to
regulate or prohibit, directly or
342 See, e.g., Dubin v. United States, 599 U.S. 110,
124–25 (2023) (‘‘ ‘Under the familiar interpretive
canon noscitur a sociis, a word is known by the
company it keeps.’ ‘[T]his canon is often wisely
applied where a word is capable of many meanings
in order to avoid the giving of unintended breadth
to the Acts of Congress.’ ’’ McDonnell v. United
States, 579 U.S. 550, 568–69 (2016) (citations
omitted).)
343 Omnibus Trade and Competitiveness Act of
1988, Public Law 100–418, 2502(b), 102 Stat. 1107,
1371–72; Foreign Relations Authorization Act,
Fiscal Years 1994 and 1995, Public Law 103–236,
sec. 525, 108 Stat. 382, 474 (1994).
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
indirectly . . . the importation from any
country, or the exportation to any
country, whether commercial or
otherwise, of publications, films,
posters, phonograph records,
photographs, microfilms, microfiche,
tapes, or other informational materials.
The specified items shared the common
attribute of having the primary or
exclusive purpose of conveying
expressive information, and the catchall term ‘‘other informational materials’’
therefore carried that same limitation
under the canon of ejusdem generis.344
This interpretation is further reinforced
by the statute’s use of ‘‘other’’ before
‘‘informational materials,’’ indicating a
commonality with the enumerated
items. As further discussed below, there
is no indication that, in amending the
1988 text, Congress sought to deviate
from that understanding. The 1994
amendment that enacted the current
version of the Berman Amendment was
titled ‘‘Free Trade in Ideas,’’ indicating
the provision’s reach and orientation
toward expressive and communicative
materials.345 The statute includes an
accompanying provision providing ‘‘the
sense of the Congress that the President
should not restrict travel or exchanges
for informational, education, religious,
cultural, or humanitarian purposes or
for public performances or
exhibitions.’’ 346 Together, these features
confirm that the ‘‘information or
informational materials’’ covered by the
Berman Amendment are limited to the
kind of expressive information that is
central to the free exchange of ideas; the
Berman Amendment is not intended to
broadly encompass every piece of data
that might technically or colloquially be
described as ‘‘information.’’
The proposed interpretation is
consistent with Congress’ purpose in
enacting the Berman Amendment. As
one court explained shortly after the
Berman Amendment’s initial enactment
in 1988, there is an ‘‘obvious First
Amendment orientation of the words
344 See, e.g., Bissonnette v. LePage Bakeries Park
St., LLC, 144 S. Ct. 905, 911 (2024) (explaining the
‘‘familiar canon of statutory interpretation’’ of
ejusdem generis under which ‘‘courts interpret a
general or collective term at the end of a list of
specific items in light of any ‘common attributes
shared by the specific items’’) (cleaned up); see also
Ali v. Fed. Bureau of Prisons, 552 U.S. 214, 225
(2008) (explaining that ‘‘the inference embodied in
ejusdem generis’’ is ‘‘that Congress remained
focused on the common attribute when it used the
catchall phrase’’).
345 Foreign Relations Authorization Act, Fiscal
Years 1994 and 1995, Public Law 103–236, sec. 525,
108 Stat. 382, 474 (1994); see, e.g., Merit Mgmt.
Grp., LP v. FTI Consulting, Inc., 138 S. Ct. 883, 893
(2018) (section headings ‘‘supply clues as to what
Congress intended’’).
346 Public Law 103–236, sec. 525(a), 108 Stat. at
474.
PO 00000
Frm 00052
Fmt 4701
Sfmt 4702
‘informational materials.’ ’’ 347 Other
courts have reached similar conclusions
about the Berman Amendment’s
purpose.348 And courts have
consistently upheld the Executive
Branch’s interpretations that distinguish
between the types of informational
materials that are covered or not
covered, explaining that these reflect
‘‘permissible interpretation[s]’’ of the
Berman Amendment ‘‘in light of
IEEPA’s competing imperatives (i.e.,
restricting material support for hostile
regimes while encouraging the robust
interchange of information).’’ 349
These courts’ interpretations are
grounded in the relevant historical and
legislative context, which reflects
Congress’ intent to protect the free
exchange of ideas. Before the Berman
Amendment’s enactment in 1988, the
President’s broad authority to regulate
commerce with foreign countries under
IEEPA and its predecessor and wartime
sibling, the Trading with the Enemy Act
of 1917 (‘‘TWEA’’), did not contain any
statutory exception for ‘‘information or
informational materials,’’ and the
implementing regulations and licenses
generally did not exempt information or
informational materials from trade
embargoes. Before and during the Cold
War, the Executive Branch exercised
these authorities to prohibit the
importation of and dealing in certain
merchandise. These general regulations
applied to books, newspapers, and
magazines originating in countries
designated as enemy nations, such as
Cuba, Vietnam, China, North Korea, and
347 Cernuda v. Heavey, 720 F. Supp. 1544, 1550
(S.D. Fla. 1989).
348 See, e.g., United States v. Amirnazmi, 645
F.3d 564, 586–87 (3d Cir. 2011); Kalantari v. NITV,
Inc., 352 F.3d 1202, 1205 (9th Cir. 2003) (explaining
that the ‘‘Berman Amendment was designed to
prevent the executive branch from restricting the
international flow of materials protected by the
First Amendment’’); Marland v. Trump, 498 F.
Supp. 3d 624, 630 (E.D. Pa. 2020) (explaining that
the Berman Amendment prevents the use of IEEPA
to ‘‘ ‘prohibit or restrict directly or indirectly the
import or export of information that is protected
under the First Amendment to the U.S.
Constitution’ ’’ (quoting H.R. Conf. Rep. No. 103–
482, at 236)); United States v. Griffith, 515 F. Supp.
3d 106, 116–17 (S.D.N.Y. 2021); United States v.
Alavi, CR 07–429–PHX–NVW, 2008 WL 1989773, at
*1 (D. Ariz. May 5, 2008) (similar).
Two recent cases examining the provision are not
to the contrary, since both cases dealt with only
expressive materials. See TikTok Inc. v. Trump, 507
F. Supp. 3d 92, 98–100, 105 (D.D.C. 2020); Marland
v. Trump, 498 F. Supp. 3d at 636. The United States
Government did not dispute that these expressive
communications exchanged on TikTok were
‘‘informational materials’’ under the Berman
Amendment. See TikTok, 507 F. Supp. 3d, at 108.
349 See Amirnazmi, 645 F.3d at 583, 587; see also
Griffith, 515 F. Supp. 3d at 116–17; Alavi, 2008 WL
1989773, at *1.
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Cambodia.350 Absent a license granted
by the Department of the Treasury,
Americans could not import these
materials into the United States or
otherwise deal in them. To obtain such
a license, an applicant had to show
either that the books, magazines, and
other materials were small-value ‘‘bona
fide gift[s]’’ that did not provide ‘‘any
direct or indirect financial or
commercial benefit’’ to the enemy
country or its nationals,351 or that
payment for the commercial import of
the materials was made into a blocked
account.352 These prohibitions resulted
in, for example, customs officials in the
1960s seizing ‘‘packages containing
English language books and newspapers
produced in North Vietnam and China’’
and refusing their entry until licenses
were granted.353
Prior to the Berman Amendment’s
enactment, the United States
Government took varying approaches to
imports of expressive materials. The
Executive Branch initially required
licenses for U.S. imports of thousands of
Cuban publications destined for
Americans’ personal use, and then later
‘‘nominally allowed the importation of
informational materials from Cuba but
in reality, banned such importation by
requiring that the importers make
payment into blocked U.S.
accounts.’’ 354 Plaintiffs challenged
these prohibitions and seizures under
the First Amendment, but courts upheld
them as constitutional on the grounds
that the specific restrictions were
merely ‘‘incidental’’ to the purpose of
the regulations in restricting the flow of
capital to enemy nations.355 In contrast,
the 1985 Nicaraguan embargo and 1986
Libyan embargo explicitly authorized
the import of ‘‘books, newspapers,
magazines, films, phonograph records,
tape recordings, photographs,
microfilm, microfiche, posters, and
similar materials’’ and thus preserved
Americans’ ability to receive news,
350 E.g., 31 CFR 515.204 (1985) (Cuba); 31 CFR
500.204 (1976) (China, North Korea, Vietnam,
Cambodia).
351 31 CFR 515.544(b) (1985); 31 CFR 500.544
(1971).
352 31 CFR 515.545(b) (1985); 31 CFR 500.545
(1974).
353 Burt Neuborne & Steven R. Shapiro, The
Nylon Curtain: America’s National Border and the
Free Flow of Ideas, 26 Wm. & Mary L. Rev. 719, 730
(1985).
354 Walsh v. Brady, 927 F.2d 1229, 1230 (D.C. Cir.
1991) (citing 31 CFR 515.545 (1987)); see id. at 731.
355 E.g., Veterans & Reservists for Peace in
Vietnam v. Regional Comm’r of Customs, 459 F.2d
676, 681 (3d Cir. 1972); Teague v. Regional Comm’r
of Customs, 404 F.2d 441, 445–46 (2d Cir. 1968);
American Documentary Films, Inc. v. Sec’y of
Treas., 344 F. Supp. 703, 706–07 (S.D.N.Y. 1972).
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
ideas, and other expressive content from
those nations.356
Congress enacted the Berman
Amendment against this regulatory and
judicial backdrop and as an explicit
‘‘reaction’’ to the continued, and
continually upheld, import restrictions
on and seizures of ‘‘shipments of
magazines and books’’ from most
embargoed countries.357 The Berman
Amendment thus ‘‘codif[ied] current
practice . . . in the recent embargoes of
trade with Nicaragua and Libya of
exempting information materials and
publications from import
restrictions,’’ 358 and used the same
terms to do so (‘‘publications,’’ ‘‘films,’’
‘‘posters,’’ and so on).
The legislative history confirms what
context makes clear: The Berman
Amendment was designed to reach
expressive information protected by the
First Amendment. The relevant House
committee report explains that Congress
intended the Berman Amendment to
protect the import and export of
expressive materials; the report
favorably cited and quoted from an
American Bar Association House of
Delegates statement that ‘‘no
prohibitions should exist on imports to
the United States of ideas and
information if their circulation is
protected by the First Amendment.’’ 359
‘‘Accordingly,’’ the report continued,
‘‘these sections also exempt
informational materials and
publications from the export restrictions
that may be imposed under these
356 See 31 CFR 540.536 (1985); 31 CFR 550.507
(1986); 31 CFR 550.411 (1986).
357 E.g., United States v. Amirnazmi, 645 F.3d
564, 584 (3d Cir. 2011); Kalantari v. NITV, Inc., 352
F.3d 1202, 1205 (9th Cir. 2003).
358 Walsh, 927 F.2d at 1233 (quoting H.R. Rep.
No. 40, 100th Cong., 1st Sess., pt. 3, at 113 (1987));
see also id. at 1233 n.3 (explaining that House
report’s incorporation into the Berman Act’s official
legislative history). The House committee report
favorably cited the Nicaragua and Libya blockades,
which had exempted certain ‘‘informational
materials such as books, records, and films.’’ H.R.
Rep. No. 100–40, pt. 3, at 71. The committee
indicated an intention to ‘‘codify’’ that practice of
‘‘exempting information materials and publications
from import restrictions.’’ Id. at 113.
359 H.R. Rep. No. 100–40, supra note 358, at 113.
Although this committee report accompanied H.R.
3, a predecessor bill that was vetoed in May 1988,
see H.R. Doc. No. 100–200, 100th Cong., 2d Sess.
(1988) (veto message), the President and Congress
later agreed on a successor bill, H.R. 4848, that
contained the same informational-materials
exception as its predecessor and that ultimately was
enacted into law as the Omnibus Trade and
Competitiveness Act of 1988. Since this Act was
‘‘derived largely from [the] predecessor bill’’ and
‘‘was not itself the subject of legislative debate,’’ the
Act ‘‘specifically provide[d] that the legislative
history for the predecessor bill, H.R. 3, generally is
treated as its own legislative history.’’ Cernuda, 720
F. Supp. at 1547–48; see Pub. L. 100–418, sec. 2(a),
102 Stat. 1107, 1119 (1988).
PO 00000
Frm 00053
Fmt 4701
Sfmt 4702
86167
acts.’’ 360 Senator Charles Mathias, the
sponsor of an earlier bill that contained
identical language removing restrictions
on the import and export of information
and that was the predecessor to the 1988
bill that enacted the Berman
Amendment, explained that ‘‘[t]he
thread that ties all of these changes
together’’ is ‘‘an ideal embodied in the
first amendment [sic]: The removal of
barriers that inhibit the free exchange of
ideas across international frontiers.’’ 361
Mathias emphasized not the specific
doctrine of the First Amendment but
rather its ‘‘philosophy’’ and ‘‘ideal[s],’’
including an ‘‘open and robust debate in
the marketplace of ideas.’’ 362 As he
further explained, ‘‘this liberty, secured
by the first amendment [sic], is thwarted
by a number of laws which permit the
Government to restrict the flow of
information and the travel of
individuals into and out of the United
States,’’ including ‘‘restrict[ing] the
import and export of information on the
basis of the political doctrines contained
in the information’’—restrictions that
the Berman Amendment was designed
to address.363
In 1994, Congress updated the
Berman Amendment in ways that
reinforced the expressive focus of the
term ‘‘information or informational
materials.’’ Between the enactment of
the Berman Amendment in 1988 and
Congress’ update in 1994, the Executive
Branch had taken ‘‘a narrow view of
what constituted ‘informational
materials.’ ’’ 364 Some of these restrictive
Executive Branch interpretations were
successfully challenged in court, and
others were not. For example, the
Department of the Treasury had
interpreted the term ‘‘informational
materials’’ as excluding ‘‘intangible
items, such as telecommunications
transmissions’’ (an interpretation that
the courts approved),365 and original art
in the form of paintings (an
360 H.R.
Rep. No. 100–40, supra note 358, at 113.
Cong. Rec. 6550 (Mar. 27, 1986) (statement
of Sen. Charles Mathias).
362 Id. at 6550–51.
363 Id.; see Cernuda, 720 F. Supp. at 1550
(explaining that ‘‘[t]he point’’ of the Berman
Amendment was to ‘‘totally exempt[ ] from
prohibition or regulation the import of ideas and
information protected by the First Amendment’’
and thus ‘‘eliminate[ ] the sort of constitutional
questions that arose in cases like American
Documentary Films and Teague’’).
364 United States v. Amirnazmi, 645 F.3d 583, 584
(3d Cir. 2011).
365 Foreign Assets Control Regulations and Cuban
Assets Control Regulations, 54 FR 5229 (Feb. 2,
1989) (codified at 31 CFR 500.206(a), (c),
500.332(b)(2) (1989)); 31 CFR 515.545(b) (2010)
(prohibiting the remittance of royalties or other
payments relating to works not yet in being); see
Capital Cities/ABC, Inc. v. Brady, 740 F. Supp.
1007, 1011–12 (S.D.N.Y. 1990).
361 132
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86168
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
interpretation that the courts
rejected).366
Congress responded to these
regulatory and judicial decisions by
‘‘clarify[ing]’’ the text of the Berman
Amendment through the passage of the
Free Trade in Ideas Act.367 As with the
original 1988 version, the 1994 version
of the Berman Amendment, as reflected
in its text and legislative history,
focuses on excluding expressive
materials from regulation. In its 1994
changes, Congress added new examples
of expressive materials to the Berman
Amendment but did not otherwise
expand its scope to include, for
example, even non-expressive materials.
First, Congress changed the term ‘‘other
informational materials’’ to ‘‘any
information or informational materials.’’
Second, Congress moved the new term
from the end of the list to the beginning
and expanded the list of materials, so
that it now reads ‘‘any information or
informational materials, including but
not limited to, publications, films,
posters, phonograph records,
photographs, microfilms, microfiche,
tapes, compact disks, CD ROMs,
artworks, and news wire feeds.’’ 368
Third, Congress made explicit that the
Berman Amendment applied to
information or informational materials
‘‘regardless of format or medium of
transmission.’’ 369
The legislative history of these
changes confirms that Congress
intended to maintain the Berman
Amendment’s exclusive focus on
protecting expressive materials from
regulation under IEEPA and did not
intend to exclude from the President’s
regulatory power the full scope of what
colloquially might be understood to be
information or informational materials.
Among other things, the effect of these
changes was, as the 1994 House report
explained, to ‘‘clarify’’ the Berman
Amendment by ‘‘eliminating some of
the unintended restrictive
administrative interpretations of it.’’ 370
For example, by adding the words
‘‘regardless of format or medium of
transmission,’’ the 1994 amendment
overrode the interpretation excluding
intangible materials that was
unsuccessfully challenged in Capital
Cities/ABC, Inc. v. Brady, 740 F. Supp.
1007, 1015 (S.D.N.Y. 1990). Similarly,
the 1994 amendment codified the
decision in Cernuda v. Heavey, 720 F.
366 See
Cernuda, 720 F. Supp. at 1549–52.
Rep. No. 103–482, 103d Cong., 2d Sess.,
at 239 (conf. rep.), reprinted in 1994 U.S.C.C.A.N.
398, 483; see Public Law 103–236, sec. 525(b), 108
Stat. 382, 474 (1994) (codified at 50 U.S.C. 1702(b)).
368 Public Law 103–236, supra note 367, at 474.
369 Id.
370 H.R. Rep. No. 103–482, supra note 367, at 239.
367 H.R.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
Supp. 1544, 1548 (S.D. Fla. 1989), by
adding ‘‘artworks’’ to the illustrative list
of informational materials and
otherwise took the opportunity to
‘‘expand[ ] the exemption’s nonexclusive list of informational materials
to include new media, such as compact
discs and CD ROMs,’’ on which
expressive information may exist.371 But
the House conference report makes clear
that the 1994 amendment ‘‘only
intended to address some of those
restrictive interpretations’’ while
leaving other interpretations in place.372
For example, Congress ‘‘did not
disabuse OFAC of its belief that it could
permissibly regulate ‘informational
materials not fully created and in
existence at the date of the transaction’ ’’
and ‘‘did not counteract’’ that
interpretation, which is discussed in
more detail below.373 By explicitly
acknowledging that the bill was
intended to overrule some but not all
narrow interpretations of ‘‘information
or informational materials,’’ Congress
rejected a meaning that would include
anything that, in a colloquial sense,
could potentially be ‘‘information or
informational materials.’’ 374
Similarly, Rep. Howard Berman, the
sponsor of the original Berman
Amendment in 1988, described the 1994
amendment as designed to protect the
right ‘‘to impart and receive information
and ideas.’’ 375 ‘‘Even at the height of the
Cold War,’’ he recounted, the United
States ‘‘positively promoted the
exchange of literary and artistic work in
an attempt to liberalize and open up the
cultural and political climate in those
countries,’’ and the then-recent fall of
the Soviet Union ‘‘suggest[ed] that
contact with Americans and the
exposure to American ideas were
crucial to the momentous changes
which are taking place there, to our
great national advantage.’’ 376 The
legislative history underscores what is
apparent in the statutory text and
context: The term is not meant to
encompass everything that might
technically or colloquially be described
as ‘‘information.’’
Congress’ purpose in enacting the
Berman Amendment was to protect the
free exchange of ideas, and the Berman
Amendment does not exempt from
regulation all types of conduct,
information, or communications.377
Although the message need not be
particularized or articulable, as in the
case of many pieces of art, it must still
‘‘communicate . . . ideas.’’ 378 The
types of ‘‘information or informational
materials’’ listed in the Berman
Amendment, such as ‘‘publications,’’
‘‘news wire feeds,’’ and ‘‘artworks,’’ are
mediums for expressing and conveying
an idea to others.379
371 Kalantari v. NITV, Inc., 352 F.3d 1202, 1205
(9th Cir. 2003).
372 H.R. Rep. No. 103–482, supra note 367, at 239.
373 United States v. Amirnazmi, 645 F.3d 564, 586
(3d Cir. 2011).
374 See, e.g., id. at 586–87 (‘‘When Congress is
aware of an agency’s interpretation of a statute and
takes no action to correct it while amending other
portions of the statute, it may be inferred that the
agency’s interpretation is consistent with
congressional intent.’’).
375 138 Cong. Rec. 15052 (June 16, 1992)
(statement of Rep. Berman).
376 Id.
377 See, e.g., Texas v. Johnson, 491 U.S. 397, 404
(1989).
378 Hurley v. Irish-Am. Gay, Lesbian & Bisexual
Grp. of Bos., 515 U.S. 557, 570 (1995).
379 50 U.S.C. 1702(b)(3).
380 See infra §§ 202.249(b)(4) (excluding from the
definition of ‘‘sensitive personal data’’ ‘‘information
or informational materials’’), 202.226(a) (limiting
‘‘information or informational materials’’ to
‘‘expressive materials’’).
381 So too for ‘‘government-related data,’’ which
the proposed rule defines to mean certain sensitive
personal data or certain precise geolocation data,
regardless of volume.
PO 00000
Frm 00054
Fmt 4701
Sfmt 4702
B. Regulated Transactions Involving
Sensitive Personal Data Under This
Proposed Rule Do Not Implicate the
Berman Amendment’s Restrictions on
Regulating Expressive Material
The proposed rule would regulate
transactions involving sensitive
personal data that is non-expressive and
thus is fully consistent with the Berman
Amendment.380 It would regulate
commercial transactions involving the
export of government-related data or
bulk U.S. sensitive personal data that
lacks expressive content.
The specific types of sensitive
personal data proposed here for
regulation are not expressive in nature
because the data itself, whether in bulk
or in isolation, does not convey an
idea.381 For example, a person’s
fingerprints (biometric identifiers); DNA
sequence (genomic data); financial
account numbers or their browser’s IP
address (covered personal identifiers);
debts and income (personal financial
data); weight, blood type, test results,
and treatments (personal health data);
and their telephone’s location history
(precise geolocation data) do not convey
expressive messages or ideas to the
recipient. Sensitive personal data
instead serves functional purposes, and
the regulations proposed here are
designed to prevent the export of this
data based on its functionality to create
and facilitate national security harms,
not regulate the expression of ideas.
For example, human genomic data is
the biological code of human
functioning and growth. It is primarily
used (along with personal health data)
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
to understand and address
vulnerabilities in human functioning,
health, and disease. The same human
genomic data that can be used to design
disease therapy can also be used to
identify genetic variability in a
population, which can potentially be
used for nefarious purposes such as
identifying and exploiting susceptibility
to disease. Large human genetic datasets
used for ancestry, solving crimes, and
research can also be misused for
counterintelligence purposes, including
targeting, surveillance, coercion,
blackmail, intimidation, and
influence.382 Datasets containing human
genomic data do not communicate any
idea; they simply contain functionally
useful data.
Biometric identifiers (like a
fingerprint, palm print, iris pattern, or
facial feature) are ‘‘the measurement of
physiological characteristics’’ of an
individual that are primarily used for
security and identity verification—for
example, by comparing the
measurements of an identifier against
those of previously enrolled identifiers
permitted to access a system.383
Similarly, precise geolocation data
measures geographic location,
ordinarily defined by its longitude and
latitude coordinates, that is used to
identify the physical location of a
device (and thus persons associated
with the device). Geolocation data is
primarily used to enable and facilitate,
for example, navigation, tracking, the
implementation of security measures
through geofencing, anti-fraud
measures, targeted advertising, and the
provision of certain services like
roadside assistance. Biometric
identifiers and precise geolocation data
do not communicate any idea; they
simply contain functionally useful data.
At their core, and as defined in these
proposed regulations, personal financial
data and personal health data also
contain only functionally useful data
that does not convey any idea or
message. The former typically identifies
and measures an individual’s financial
accounts, assets, debts, and liabilities,
primarily to enable, facilitate, and track
commercial activity (for example, by
exchanging account and routing
numbers, balances, and amounts to
enable payments, or by identifying
assets, debts, and liabilities associated
with a particular individual to
determine creditworthiness for loan
applications). The latter typically
382 See, e.g., Nat’l Counterintel. & Sec. Ctr., supra
note 83, at 4.
383 Nat’l Inst. of Standards & Tech., Biometrics,
https://www.nist.gov/programs-projects/biometrics
[https://perma.cc/SV3S-THLD].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
identifies and measures an individual’s
medical conditions and history,
primarily to assess and track an
individual’s health condition and
determine a medical course of action.
Finally, covered personal identifiers
are specifically listed classes and
combinations of data that are
‘‘reasonably linked to an individual.’’ 384
This data (such as Social Security
numbers, financial account numbers,
hardware-based identifiers, advertising
identifiers, and network-based
identifiers) is primarily used to identify
devices and individuals, and to
distinguish them from each other. They
are not typically used to express and
communicate ideas or messages.
In sum, the regulations contained in
this proposed rule appropriately
‘‘balance[ ] IEEPA’s competing
purposes’’ in ‘‘restricting material
support for hostile regimes while
encouraging the robust interchange of
information.’’ 385 The export of nonexpressive data (including the sensitive
personal data that the proposed rule
would regulate) does not implicate the
exchange of ideas and expression that
the Berman Amendment protects. At the
same time, allowing sensitive personal
data to fall into the hands of countries
of concern would directly support and
enable their attempts to undermine
national security, including through
traditional and economic espionage,
surveillance, sabotage, blackmail, and
other nefarious activities. Moreover,
these categories of sensitive personal
data are already subject to some existing
government regulation in the context of
domestic commercial transactions. It
would be unreasonable to interpret
IEEPA—a statute that is specifically
designed to address foreign threats to
national security, foreign policy, and the
economy—as disallowing regulation of
the same commercial transactions when
they involve transferring such data to a
country of concern.
This proposed interpretation aligns
with the suggestions of several
commenters to clarify the extent to
which the transmission of expressive
content and associated metadata,
including through internet traffic, to
entities and individuals in countries of
concern would be exempt from the
proposed regulations. Under this
interpretation, expressive content and
associated metadata that is not sensitive
personal data would be categorically
outside the scope of the proposed
definition of ‘‘sensitive personal data’’
and thus outside the scope of the
384 89
FR 15428–29.
States v. Amirnazmi, 645 F.3d 564, 587
(3d Cir. 2011).
385 United
PO 00000
Frm 00055
Fmt 4701
Sfmt 4702
86169
proposed regulations, regardless of the
type of activity (or transaction)
involved. The Department believes that
other aspects of the proposed rule (such
as bulk thresholds or the definition of
‘‘covered data transaction’’) would also
protect the dissemination of expressive
content and its associated metadata. The
Department welcomes further comments
on this issue.
To the extent that any parties believe
that the sensitive personal data involved
in their covered data transactions may
nevertheless qualify as ‘‘information or
informational materials’’ that is exempt
under 50 U.S.C. 1702(b)(3), they can
seek clarification using the proposed
administrative processes for seeking an
advisory opinion or applying for a
specific license before engaging in the
transaction.
C. Exclusion for Materials Already
Created and in Existence
Finally, consistent with longstanding
OFAC practice, the proposed rule would
exclude ‘‘information or informational
materials not fully created and in
existence at the date of the data
transaction, or the substantive or artistic
alteration or enhancement of
information or informational materials,
or the provision of marketing and
business consulting services, including
to market, produce or co-produce, or
assist in the creation of information or
informational materials’’ from the
definition of ‘‘information or
informational materials.’’
§ 202.206(b)(1). Many commercial
services and transactions may result in
the creation of information or
informational materials. This exclusion
balances ‘‘IEEPA’s competing
imperatives (i.e., restricting material
support for hostile regimes while
encouraging the robust interchange of
information)’’ and reflects a ‘‘reasoned
determination’’ that 50 U.S.C. 1702(b)(3)
is not meant to exempt ‘‘information or
informational materials’’ that ‘‘would
not be produced but for’’ commercial
transactions that could be otherwise
prohibited or regulated.386 In the
sanctions context, for example, a
prohibition on providing consulting
services would preclude provision of a
consulting report even though such a
report might otherwise be characterized
as ‘‘informational materials.’’ 387 In the
386 Amirnazmi, 645 F.3d at 587; see also, e.g.,
United States v. Griffith, 515 F. Supp. 3d 106, 116–
17 (S.D.N.Y. 2021).
387 Cf., e.g., Off. of Foreign Assets Control, U.S.
Dep’t of Treas., Guidance on Certain Publishing
Activities, at 2–3 (Oct. 28, 2016), https://
ofac.treasury.gov/media/6516/download?inline
[https://perma.cc/GF9U-M4TJ]; Off. of Foreign
E:\FR\FM\29OCP2.SGM
Continued
29OCP2
86170
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
context of this proposed rulemaking, a
U.S. company’s customization and sale
of bulk U.S. sensitive personal data in
response to a customer’s particular
criteria would fall within this
independent exclusion and would not
constitute information or informational
materials (in addition to falling outside
the definition of ‘‘information or
informational material’’ because it is
non-expressive material).
The legislative history of the Berman
Amendment indicates that Congress was
aware of this same interpretation in
sanctions programs under IEEPA
administered by OFAC and chose not to
change it. The Department of the
Treasury construed the Berman
Amendment not to apply to
‘‘informational materials not fully
created and in existence at the date of
the transaction, or to the substantive or
artistic alteration or enhancement of
informational materials, or to the
provision of marketing and business
consulting services’’ shortly after it was
enacted.388 As discussed above, when
Congress amended the statute in 1994,
it overrode other government
interpretations of the Berman
Amendment but it ‘‘did not disabuse
OFAC of its belief that it could
permissibly regulate ‘informational
materials not fully created and in
existence at the date of the transaction’ ’’
and ‘‘did not counteract’’ that
interpretation.389 Courts, relying in part
on this legislative history, have affirmed
this interpretation of the Berman
Amendment,390 and the Department
accordingly incorporates it into the
definition of ‘‘information or
informational materials’’ in proposed
§ 202.226.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
VII. Regulatory Requirements
The Department designated the
proposed rule as significant under
Executive Order 12866, as amended,
and the Office of Information and
Regulatory Affairs in the Office of
Management and Budget (‘‘OMB’’)
reviewed the proposed rule.391 In
addition, this section includes the
required assessments of the reporting
and recordkeeping burdens under the
Paperwork Reduction Act of 1995,392
and the potential impact on small
Assets Control, U.S. Dep’t of Treas., Letter No.
031211–FARCL–IA–14, Interpretive Ruling: Posting
of Information from Iran on Website, at 2 (Dec. 11,
2003), https://ofac.treasury.gov/media/7921/
download?inline [https://perma.cc/J7FP-CVAS].
388 31 CFR 500.206(c) (1989).
389 Amirnazmi, 645 F.3d at 586.
390 See Amirnazmi, 645 F.3d at 583–88; Griffith,
515 F. Supp. 3d at 116–17.
391 E.O. 12866, 58 FR 51735 (Sept. 30, 1993).
392 44 U.S.C. 3501 et seq.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
entities pursuant to the Regulatory
Flexibility Act.393
A. Executive Orders 12866 (Regulatory
Planning and Review) as Amended by
Executive Orders 13563 (Improving
Regulation and Regulatory Review) and
14094 (Modernizing Regulatory Review)
1. Executive Summary
The Department of Justice estimates
the discounted annualized cost of the
proposed regulation to be approximately
$502 million annually. The extremely
high potential net benefits (i.e.,
expected benefits less estimated costs)
justify moving forward with the
proposed rule. The approximately $502
million estimated annual cost would
afford protection to well over 100
million American individuals who are
potential targets of adversaries using
bulk U.S. sensitive personal data. Also,
the approximately $502 million
estimated annual cost of the regulation
is about one-third of 1 percent (0.3
percent) of the $176 billion revenues
generated in the U.S. Computing,
Infrastructure, Data Processing Services,
and Web Hosting Services industry
sector.
2. Introduction.
The review that accompanies an
NPRM is known as a Preliminary
Regulatory Impact Analysis (‘‘RIA’’).
The Office of Management and Budget’s
Circular A–4 provides guidance to
Executive agencies on how to conduct
effective regulatory analyses.394 Circular
A–4 recognizes that good regulatory
393 5 U.S.C. 601 et seq. This proposed rulemaking
pertains to a foreign affairs function of the United
States and therefore is not subject to the notice-andcomment rulemaking requirements of the
Administrative Procedure Act (‘‘APA’’), which
exempts a rulemaking from such requirements ‘‘to
the extent there is involved . . . a military or
foreign affairs function of the United States.’’ 5
U.S.C. 552(a)(1). The proposed rule is being issued
to assist in addressing the national emergency
declared by the President with respect to the threat
posed to U.S. national security and foreign policy
by the continuing effort of countries of concern to
access and exploit government-related data or
Americans’ bulk U.S. sensitive personal data. As
described in the Order, this threat to the national
security and foreign policy of the United States has
its source in whole or substantial part outside the
United States. Accordingly, the proposed rule
would have a direct impact on foreign affairs
concerns, which include the protection of national
security against external threats (for example,
prohibiting or restricting transactions that pose an
unacceptable risk of giving countries of concern or
covered persons access to bulk sensitive personal
data). Although the proposed rule is not subject to
the APA’s notice and comment requirements, the
Department is engaging in notice and comment
rulemaking for this proposed rule, consistent with
sections 2(a) and 2(c) of the Order.
394 Off. of Mgmt. & Budget, Circular No. A–4,
Regulatory Analysis (Nov. 9, 2023), https://
www.whitehouse.gov/wp-content/uploads/2023/11/
CircularA-4.pdf [https://perma.cc/8J6A-K75Y].
PO 00000
Frm 00056
Fmt 4701
Sfmt 4702
analyses cannot be conducted according
to a formula; that conducting highquality analysis requires competent
professional judgment; and that
different regulations may call for
different emphases in the analysis,
depending on the nature and
complexity of the regulatory issue and
the sensitivity of the benefit and cost
estimates of the key assumptions.395
Circular A–4 states that RIA analysts
‘‘should aim for transparency about the
key methods, data, and other analytical
choices you make in your analysis.’’ 396
It also encourages consultation with key
stakeholders, which can ‘‘be useful in
ensuring that your analysis addresses all
of the relevant issues and that you have
access to all pertinent data,’’ noting that
‘‘[e]arly consultation can be especially
helpful.’’ 397 At the outset of this
research, the Department reached out to
the private sector and other government
agencies regarding data that would be
useful to the analysis. The response has,
in general, been that the information
and data available to and known by
other agencies and the private sector
that would potentially be relevant to
conducting such an analysis are
incomplete, irrelevant, and unreliable.
The Department’s own search found
that there are enough information
sources available to make a reasonable
estimate of the impact of the proposed
rule based on a cost analysis that
considers the value of transactions lost
due to the prohibitions, the security and
due diligence costs associated with the
pursuit of restricted transactions, and
adequate data to approximate the
number of firms likely to be affected by
the regulation. Regarding the estimated
value of transactions lost to the
prohibitions, impacts could vary by the
bulk thresholds for each of the data
categories outlined in the proposed rule.
However, due to data limitations, this
analysis does not attempt to estimate
cost sensitivities based upon
alternatives to the proposed bulk
thresholds. We welcome comments on
addressing this analytical issue.
Given the limitations on available
information, the resulting uncertainty,
and the qualifications surrounding the
analysis, the Department has been
unable to assess that any secondary
impacts, such as how the prohibition on
bulk U.S. sensitive personal data
transfers to the countries of concern
would influence international trade, are
reasonably likely. Based on the available
information, such secondary impacts are
too speculative and hypothetical to be
395 Id.
at 4.
396 Id.
397 Id.
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
quantified in this analysis. Although the
scope of the proposed rule is limited,
indirect trade impacts could run into
the hundreds of millions of dollars;
nevertheless, such costs would be
impossible to calculate at this juncture,
and such analysis is outside the scope
of this assessment.
This analysis considers the direct
costs of the proposed regulation.
Although it does not devote a section to
indirect costs, Circular A–4 advises
analysts to look beyond the obvious
costs and benefits of a regulation for
additional costs and benefits, which are
sometimes referred to as ‘‘indirect’’
effects or ‘‘downstream’’ effects.398
Beyond the direct costs, there will be
other market repercussions associated
with the proposed regulation. Foreign
firms will have less revenue from selling
bulk U.S. sensitive personal data
purchased from U.S. firms; new
businesses may arise to provide vetting
information to firms seeking entrance
into the restricted transactions market;
misunderstandings of the proposed
regulation may result in firms spending
more than necessary to comply; overall
increased data security may result in
more secure data and systems;
transactions that are not prohibited may
be reduced by firms not understanding
nuances of the prohibitions; and, in
retaliation, foreign countries may enact
their own prohibitions and restrictions
that may adversely affect U.S.
businesses.
Additionally, staff of the Department
of Commerce Office of Undersecretary
for Economic Affairs note that there will
be indirect costs from the loss of
database imports from countries of
concern, forgone productivity gains
associated with potential innovation
resulting from access to restricted data
by individuals in countries of concern,
and firms’ reduced access to employees
from countries of concern. At this point,
the Department is not aware of any data
with which to assess these costs, and
the assessment of such costs is outside
the scope of this RIA.
The regulatory review faces
significant challenges in developing
quantitative estimates of the monetary
costs and benefits of the proposed
regulation. Among these challenges to a
reliable comparison of quantified cost
398 Id. at 56. The usage of the term ‘‘indirect
costs’’ in this analysis differs from the ANPRM’s
‘‘Economic Impact,’’ which discussed the expected
‘‘indirect costs’’ of the rulemaking primarily in
terms of due diligence and security costs. See 89 FR
15799–800. In this analysis, the term ‘‘indirect
costs’’ refers to downstream effects and does not
necessarily encompass due diligence and security
costs; to the extent that such costs are discussed,
the Department simply refers to them by their own
terms.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
and benefits, is the nature of the benefits
that are expected from the regulation.
These benefits include the security of
the American people, economic
prosperity and opportunity, and
democratic values, all of which are
beyond a reasonable, reliable, and
acceptable estimate of quantified
monetary value.399 In contrast, although
precise, reliable, and relevant data to
estimate the regulation’s cost impacts
are not publicly available, the
Department has made a preliminary
estimate of those costs using knowledge
of the entities affected by the proposed
rule; the transactions likely to be
involved; and previous estimates of the
costs of compliance with similar
activities, such as due diligence, audits,
recordkeeping, and reporting. Policy
decisions will be informed by whether
the benefits expected from the
regulation justify the estimated costs.
3. Market Sectors Impacted by the
Proposed Regulation
The firms that are currently active in
the collection, processing, sale, or other
types of transfers of bulk U.S. sensitive
personal data and that are likely to be
impacted by the proposed regulation
include those that collect sensitive
personal data (often referred to as ‘‘first
parties’’) and those that aggregate,
assemble, analyze, and sell sensitive
personal data (‘‘third parties’’). Sensitive
personal data passes through a long
supply chain of third-party vendors,
such as data brokers, that obtain the
data from first-party sources such as
doctors, hospitals, pharmacies, banks
and other financial companies,
insurance companies, internet service
providers, online and brick-and-mortar
retail chains, schools, ‘‘smart product’’
sellers, rental agencies, ancestry
agencies, software vendors, geolocation
firms, and gaming firms.400 Another
399 Exec. Off. of the President, National Security
Strategy (Oct. 12, 2022), https://
www.whitehouse.gov/wp-content/uploads/2022/10/
Biden-Harris-Administrations-NationalsecurityStrategy-10.2022.pdf [https://perma.cc/6X6U75DL].
400 See, e.g., Types of Sensitive Information: A
Complete Guide, SealPath, https://
www.sealpath.com/blog/types-of-sensitiveinformation-guide/ [https://perma.cc/7XPU-TLB6];
Nirmal Ranganathan, Understanding the
Complexities of Enterprise Data Supply Chains,
TechRadar Pro (May 1, 2023), https://
www.techradar.com/opinion/understanding-thecomplexities-of-enterprise-data-supply-chains
[https://perma.cc/AKZ4-UJAE]; Lou Rabon,
Uncovering Third-Party Risk: What Are They and
Where They Come From, Cyber Defense Group
(June 3, 2024), https://www.cdg.io/blog/third-partyrisk [https://perma.cc/645V-YUBF]. This
assessment has also considered whether the
proposed rule would result in a reasonably
measurable impact on product development and
testing. Although some commenters raised concern
PO 00000
Frm 00057
Fmt 4701
Sfmt 4702
86171
sector that may be impacted consists of
those firms that export bulk
biospecimens such as blood plasma and
other medical products, laboratory
supplies, and cosmetic products made
with human hair. The United States
supplies 70 percent of the world’s
supply of blood plasma, for example,
making it the largest exporter of blood
plasma.401 Additionally, blood plasma
has become the United States’ 11th most
valuable export.402 In 2022, China
imported more U.S. exports of
‘‘immunological medicines, plasma and
other blood fractions’’ than any other
country had in a given year.403 When it
comes to the biospecimen segment, the
proposed rule exempts items related to
clinical trials, and official United States
Government business and transactions
required or authorized by international
agreements, including United States
Government business and international
agreements related to pandemic
preparedness and surveillance.
Bulk personal data that is extracted
from different sources and then
combined and analyzed can provide
comprehensive profiles of individuals.
Comprehensive profiles typically
include a wide range of personal data,
including contact information such as
address, phone number, and email
address; demographic data, including
age, family ties, and ethnic and religious
affiliations; data on general interests,
such as charitable giving, gambling,
pets, preferred celebrities, movies and
music genres, and reading preferences;
data about a person’s home and
neighborhood, including home equity,
home size (e.g., number of rooms and
baths), and rent or loan amount and
interest rate; criminal and civil actions
about such potential impacts, none of the comments
were specific enough to identify any concrete
product development and testing involving
prohibited or restricted transactions. The comments
did not describe any specific scenarios in which
government-related data or bulk U.S. sensitive
personal data are critical to the development or
testing of some product with a significant market
the proposed rule would eliminate, for example,
because there is no substitute development or
testing market other than a country of concern or
covered person.
401 David Smith, ‘It’s gamified’: Inside America’s
Blood Plasma Donation Industry, The Guardian
(Mar. 2, 2023), https://www.theguardian.com/
books/2023/mar/02/blood-money-book-kathleenmclaughlin [https://perma.cc/7VFK-QTSL].
402 Peter Jaworski, Bloody Well Pay Them: The
Case for Voluntary Remunerated Plasma
Collections, Niskanen Center (June 14, 2020),
https://www.niskanencenter.org/bloody-well-paythem-the-case-for-voluntary-remunerated-plasmacollections/ [https://perma.cc/WVR9-ZGS9].
403 Ken Roberts, In 2022, China Dominates U.S.
Exports of Immunological Drugs, Plasma and
Vaccines, Forbes (Oct. 26, 2022), https://
www.forbes.com/sites/kenroberts/2022/10/26/in2022-china-now-dominates-us-exports-of-plasmaand-vaccines/ [https://perma.cc/X9KA-EG82].
E:\FR\FM\29OCP2.SGM
29OCP2
86172
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
background data, such as arrests and
convictions, and judgments in civil
cases; social media and technology data,
including home internet provider, social
media usage, and computer operating
systems; financial data, including credit
card usage, loans, and net worth; health
data, including alcohol or tobacco
usage, medical conditions (e.g.,
allergies), medicine preferences, and
mental health issues; and other data,
such as travel, vehicle, and behavior
data.404
companies, contains the broadest
potential set of firms that could be
found in the NAICS category for
Finance and Insurance companies. This
category contains more than 240,000
firms in total, with around 17,000 of
these firms having over 20 employees,
making them potentially more likely to
have in-house data management and
control systems.412
khammond on DSKJM1Z7X2PROD with PROPOSALS2
ii. Personal Health Data
As with human genomic data,413
many doctors, hospitals, medical
a. Sensitive Personal Data and
facilities, consumer human genetic
Government-Related Data
testing labs, insurance companies,
businesses, healthcare providers, and
i. Personal Financial Data
research institutions sell sensitive
The universe of financial institutions
health-related data (e.g., Electronic
that create bulk U.S. sensitive personal
Medical Records (‘‘EMRs’’),
data is all firms that provide financial
prescriptions, laboratory tests, insurance
services. The smallest, narrowest set is
claims). There is a large market for such
the financial firms subject to a primary
data, which generates significant profits
financial regulator. These include
for companies with the capabilities to
405
406
banks,
credit unions,
large
financial utilities,407 securities firms,408 collect, anonymize, collate, and sell the
investment companies,409 and insurance data to third parties and data brokers.
The market for these sales is at least in
companies.410 The total number of
the billions of dollars.414 With the EMR
government-regulated and -supervised
market
expected to grow at a compound
financial-services firms in this category
annual
growth
rate of 6.5 percent to
411
is around 35,000.
The total number of
$46.96 billion in 2028, it is expected
large financial-services firms is about
that the keepers of this data will take
17,000. The Department arrived at this
advantage of the increasing demand and
number by consulting the North
massive economic benefits that these
American Industry Classification
data sales can achieve.415
System (‘‘NAICS’’), which, in its
At the forefront of data sales are the
category for Finance and Insurance
hospitals, medical facilities,
pharmaceutical companies, insurers,
404 Urbano Reviglio, The Untamed and Discreet
and pharmacies that have direct access
Role of Data Brokers in Surveillance Capitalism: A
and involvement in the creation and
Transnational and Interdisciplinary Overview, 11
Internet Pol’y Rev. (Issue) 3 (Aug. 4, 2022), https://
maintenance of patient health data.
policyreview.info/articles/analysis/untamed-andHIPAA and other privacy laws help
discreet-role-data-brokers-surveillance-capitalismprotect patients from having their
transnational-and [https://perma.cc/A4NS-AF5B].
405 Bd. of Governors of the Fed. Rsrv. Sys., 110th
Annual Report of the Board of Governors of the
Federal Reserve System 26–28 (2023), https://
www.federalreserve.gov/publications/files/2023annual-report.pdf [https://perma.cc/3W34-QKYE].
406 Press Release, Nat’l Credit Union Admin.,
Credit Union Assets, Lending, Insured Shares,
Delinquencies Grow (June 2024), https://ncua.gov/
newsroom/press-release/2024/credit-union-assetslending-insured-shares-delinquencies-grow [https://
perma.cc/MK9Z-7R3Z].
407 Bd. of Governors of the Fed. Rsrv. Sys., supra
note 405.
408 Fin. Indus. Regul. Auth., 2024 FINRA Industry
Snapshot 13 (July 18, 2024), https://www.finra.org/
sites/default/files/2024-07/2024-IndustrySnapshot.pdf [ https://perma.cc/UEV6-9XVM].
409 Inv. Co. Inst., 2024 Investment Company Fact
Book 23 (2024) https://www.ici.org/system/files/
2024-05/2024-factbook.pdf [https://perma.cc/5CJ3JWHS].
410 Ron Harden, Insurance Industry Facts, Nat’l
Ass’n of Ins. Pros., Inc., https://thenaip.org/general/
insurance-industry-facts/ [https://perma.cc/U8S9BVRD].
411 This figure includes 3,794 bank holding
companies; 1,411 Federal Reserve System member
banks; 287 savings and loan holding companies; 8
financial market utilities; 4,572 credit unions; 3,298
securities firms; 16,038 investment companies; and
5,929 insurance entities.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
412 U.S. Census Bureau, U.S. & states, 6-digit
NAICS, 2021 SUSB Annual Data Tables by
Establishment Industry (Dec. 2023), https://
www.census.gov/data/tables/2021/econ/susb/2021susb-annual.html [https://perma.cc/A86S-NKHA].
413 While the NPRM proposes including human
‘omic data beyond genomic data within the scope
of the categories of sensitive personal data, the
NPRM seeks comments on how that category of
human ‘omic data (other than genomic data) should
be regulated. The Department defers consideration
of that issue until it is settled in the final rule.
Section 7(i) of the Order defines human ‘omic data
as ‘‘data generated from humans that characterizes
or quantifies human biological molecule(s), such as
human genomic data, epigenomic data, proteomic
data, transcriptomic data, microbiomic data, or
metabolomic data, as further defined by regulations
issued by the Attorney General pursuant to section
2 of this order, which may be informed by the
report described in section 6 of this order.’’ E.O.
14117, 89 FR 15429.
414 Adam Tanner, Our Bodies, Our Data: How
Companies Make Billions Selling Our Medical
Records (2017).
415 Electronic Medical Records Market to Surpass
$46.96 Billion by 2028, Lead [sic] by Asia-Pacific
Growth and AI Trends, Yahoo! Finance (Mar. 11,
2024), https://finance.yahoo.com/news/electronicmedical-records-market-surpass-192000251.html
[https://perma.cc/N45N-N5QV].
PO 00000
Frm 00058
Fmt 4701
Sfmt 4702
personal health information shared, but
nearly every State either recognizes
medical providers as the owners of
medical data or does not have any laws
conferring patients specific ownership
or property rights to their medical
records.416 The situation with clinical
trial data is similar, as any data
generated by a trial participant becomes
the property of the sponsor company.417
Furthermore, some companies in the
health sector may be able to legally sell
Americans’ health-related information,
depending on the legal requirements
applicable to their context.418 For
example, although healthcare providers
that conduct certain standard
transactions electronically may be
HIPAA-covered entities that are
generally prohibited from selling
protected health information by the
HIPAA Privacy Rule,419 many
companies that collect healthcare
information are not covered by HIPAA
and are not subject to its restrictions.
Pairing Americans’ health-related
information with publicly available
health record databases, healthcare
directories and clearinghouses,
academic or government databases (e.g.,
data.gov), and basic internet searches
makes it increasingly simple to reidentify or link information. Data
brokers have flourished by selling
packaged datasets on the sensitive
health conditions of millions of
Americans in the open market.420 As the
volume and demand for this data
increase, we may see continued growth
in the market share.
We also note that the Department of
Health & Human Services (‘‘HHS’’) is
supporting the secure sharing of clinical
information via the development of the
voluntary Trusted Exchange Framework
and Common Agreement.421
iii. Precise Geolocation Data
The proposed rule defines ‘‘precise
geolocation data’’ as ‘‘data, whether
real-time or historical, that identifies the
416 Niam Yaraghi, Who Should Profit from the
Sale of Patient Data? Brookings Inst. (Nov. 19,
2018), https://www.brookings.edu/articles/whoshould-profit-from-the-sale-of-patient-data/
[https://perma.cc/9886-AS93].
417 Paul W. Glimcher, Who Profits from Medical
Records?, Med. Econ. Oct. 2020, at 50, available at
https://www.medicaleconomics.com/view/whoprofits-from-medical-records- [https://perma.cc/
RP4S-GGZR].
418 Justin Sherman, Your Health Data Might Be
for Sale, Slate (June 22, 2022), https://slate.com/
technology/2022/06/health-data-brokersprivacy.html [https://perma.cc/39CR-4ZS3].
419 See 45 CFR 164.502(a)(5)(ii), 164.508(a)(4).
420 Sherman, supra note 418.
421 Notice of Publication of Common Agreement
for Nationwide Health Information Interoperability
(Common Agreement) Version 2.0, 89 FR 35107
(May 1, 2024).
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
physical location of an individual or a
device with a precision of within one
kilometer.’’ The parameters to be
determined are (1) the level at which to
set this precision, (2) the level of
precision necessary to support common
commercial applications of geolocation
data, and (3) the effectiveness of
applying location fuzzing to geolocation
data (decreasing its accuracy) in some
commercial applications to reduce
potential privacy impacts. These
parameters are necessary to provide
clear guidance to acquirers and sellers
of precise geolocation data.
Mobile applications (‘‘apps’’) from
smartphones are the primary sources
that directly gather location data from
consumers, although other technologies
are also collecting and transmitting data,
such as ‘‘Internet of Things’’ wearable
devices and connected vehicles. Once
they collect it, many apps share location
data with third parties, whether by
selling it to data brokers, to advertisers
who then sell it to data brokers, or
directly to buyers who intend to use the
geolocation data.422 Data brokers can
‘‘pay a mobile app developer to use the
broker’s software development kit . . .
in the developer’s app. The broker can
then sit within the app and gather data
directly on users.’’ Alternatively, many
app developers will sell location data
‘‘directly to a data broker through a
server-to-server transfer.’’ 423 As one
example, the family safety app Life360
sold location data to nearly a dozen
location data brokers in 2021—and in
fact, it had agreements to directly
transfer location data about its users to
data brokers through its own servers.424
Such practices create opportunities for
countries of concern to exert malign
influence over U.S. persons relevant to
national security.
The market for location data is large,
and many companies operate as data
brokers.425 Significantly, three major
422 The Location Data Market, Data Brokers, and
Threats to Americans’ Freedoms, Privacy, and
Safety: Hearing Before the Joint Committee on
Consumer Protection and Professional Licensure,
(Mass. 2023) (written testimony of Justin Sherman,
Senior Fellow and Research Lead, Data Brokerage
Project, Duke Univ. Sanford Sch. of Pub. Pol’y),
https://techpolicy.sanford.duke.edu/wp-content/
uploads/sites/4/2023/07/Sherman-Justin_
WrittenTestimony_MA_Legislature.pdf [https://
perma.cc/52RR-J2HY].
423 Id.
424 Alfred Ng & Jon Keegan, The Popular Family
Safety App Life360 Is Selling Precise Location Data
on Its Tens of Millions of Users, The Markup (Dec.
6, 2021), https://themarkup.org/privacy/2021/12/
06/the-popular-family-safety-app-life360-is-sellingprecise-location-data-on-its-tens-of-millions-of-user
[https://perma.cc/NTK2-CL96].
425 See The Location Data Market, Data Brokers,
and Threats to Americans’ Freedoms, Privacy, and
Safety, supra note 422, at 3 (listing some of the
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
data brokers—Acxiom, LexisNexis, and
Nielsen—sell data on current or former
U.S. military personnel, some of which
is specifically marketed as such.426 All
three firms collect and advertise
information on individuals, ranging
from their family members and friends
to their spending habits, mental health
conditions, and geolocation.427 Both
Acxiom and LexisNexis also provide
users with the ability to verify whether
someone is active duty.428
iv. Human Genomic and Human ’Omic
Data
There is value in both human
genomic and ’omic data, and there is a
large global ecosystem for buying and
selling this data for a variety of
purposes. The ’omic data market is
growing exponentially due to the use of
such data for drug discovery. There is
little current regulation that restricts the
buying and selling of this data, but there
are real risks and potential harms
associated with the misuse of such data,
ranging from the individual to the
population level.
The human genomic data ecosystem
is large and has both public and private
actors, including healthcare entities, law
enforcement, international security
agencies, and recreational personal
human genomics/biospecimen
companies.429 The global human
genomics market was valued at $28
billion in 2022 and is projected to grow
to over $164 billion by 2032, with North
America accounting for approximately
45 percent of the market’s current
size.430
Personal human genomics companies
(e.g., 23andMe, Ancestry, Ariosa
Diagnostics, Color Genomics,
FamilyTreeDNA, Ionis, GenScript,
Illumina, Genentech, My Heritage,
Navigenics, Orig3n, and Prenetics) and
human biospecimen (e.g., BioChain
‘‘significant companies in the location data
market’’).
426 Justin Sherman, Data Brokers Are Advertising
Data on U.S. Military Personnel, Lawfare (Aug. 23,
2021), https://www.lawfaremedia.org/article/databrokers-are-advertising-data-us-military-personnel
[https://perma.cc/Y9RN-WHZF].
427 Steven J. Arango, Data Brokers Are a Threat
to National Security, Vol. 148/12/1,438 U.S. Naval
Inst.: Proceedings (Dec. 2022). https://
www.usni.org/magazines/proceedings/2022/
december/data-brokers-are-threat-national security
[https://perma.cc/74W3-TCR3].
428 Id.
429 Abraham P. Schwab et al., Genomic Privacy,
64 Clinical Chemistry 1696 (2018), https://
academic.oup.com/clinchem/article/64/12/1696/
5608647 [https://perma.cc/Q89R-5WRZ].
430 Precedence Rsch., Report No. 1204, Genomics
Market—Global Industry Analysis, Size, Share,
Growth, Regional Outlook and Forecast, 2023 to
2032 (Nov. 2023), https://
www.precedenceresearch.com/genomics-market
[https://perma.cc/J9WA-RKVB].
PO 00000
Frm 00059
Fmt 4701
Sfmt 4702
86173
Institute, BioIVT, Boca Biologistics,
Creative Bioarray, Cureline, Discovery
Life Sciences, Infinity BiologiX,
Precision for Medicine) companies
collect human genomic and related data
or human biospecimens, such as tissue
and blood samples, that can be used to
extract human genomic information for
a variety of healthcare and recreational
purposes.431 It is common for
companies in these spaces, especially
direct-to-consumer firms, to be owned
by pharmaceutical companies or to sell
the human genomic data they obtain to
pharmaceutical companies. It is also
common for them to conduct health
research in collaboration with
healthcare systems and to enter into
partnerships with other industries.432
There is little readily available
information on who is purchasing or
reselling human genomic data beyond
pharmaceutical companies. Similarly,
there is little readily available
information on which entities (such as
multinational pharmaceutical
companies) are transferring human
genomic data to their subsidiaries or
vendors in countries of concern.
While many of the uses of human
genomic data are for the development of
new health technologies and
pharmaceuticals, and the health and
drug discovery environment are highly
regulated, the sale of the data appears
common and is currently virtually
unregulated. As a result, there are few
records of current transactions, and any
company that collects human genomic
data could potentially broker its sale to
other companies or interested parties.
For example, the States of Vermont and
California have data broker registration
laws, but even in those States, there is
431 Susi Geiger & Nicole Gross, A Tidal Wave of
Inevitable Data? Assetization in the Consumer
Genomics Testing Industry, 60 Bus. & Soc’y 614
(2021), https://journals.sagepub.com/doi/10.1177/
0007650319826307 [https://perma.cc/7YSC-VTEW];
Ramish Cheema, Top 20 Genomics Companies in
the World, Yahoo! Finance (Oct. 30, 2023), https://
finance.yahoo.com/news/top-20-genomicscompanies-world-194600414.html [https://
perma.cc/8WXD-KGCC]; Kayte Spector-Bagdady,
Hospitals Should Act Now to Notify Patients About
Research Use of Their Data and Biospecimens, 26
Nature Med. 306 (2020), https://www.nature.com/
articles/s41591-020-0795-6 [https://perma.cc/BEX63GCJ]; InsightAce Analytic, Report No. 1264,
Biospecimen Contract Research Services Market
Size, Share & Trends Analysis Report, 2024–2032
(2024), https://www.insightaceanalytic.com/report/
global-biospecimen-contract-research-servicesmarket/1264 [https://perma.cc/N667-TL8F].
432 Geiger & Gross, supra note 431, at 625–26,
638; Shmuel I. Becher & Andelka M. Phillips, Data
Rights and Consumer Contracts: The Case of
Personal Genomic Services, in Data Rights and
Private Law 83 (Damian Clifford et al. eds., 2023),
https://ssrn.com/abstract=4180967 [https://
perma.cc/35GE-ZQQ4].
E:\FR\FM\29OCP2.SGM
29OCP2
86174
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
not specific information regarding
genomic information sales.433
v. Biometric Identifiers
The proposed rule defines biometric
identifiers’’ as ‘‘measurable physical
characteristics or behaviors used to
recognize or verify the identity of an
individual, including facial images,
voice prints and patterns, retina and iris
scans, palm prints and fingerprints, gait,
and keyboard usage patterns that are
enrolled in a biometric system and the
templates created by the system.’’ In
recent years, such identifiers have
become increasingly ubiquitous in our
security and verification systems. A
wide variety of companies and agencies
collect this information, amassing large
datasets on everything from face shape,
eye scans, and fingerprints to voice
recordings and even heartbeats.434
There is also limited information
regarding the biometric data broker
community. Because of the highly
sensitive nature of the data (i.e.,
fingerprints cannot be changed), brokers
are not forthcoming in their advertising
or collection of available information.
vi. Covered Personal Identifiers
An individual can have personal
identifiers both assigned to them and
collected from them in a wide variety of
contexts and through a wide variety of
entities—including governments,
advertisers, and providers of technology
and communications services. This,
combined with the fact that personal
identifiers have been used in some form
for many years, means that they are a
widely available form of sensitive
personal data. The proposed rule
specifies two subcategories of covered
personal identifiers that could be used,
when combined with each other or
combined with other types of sensitive
personal data, to ‘‘identify an individual
from a data set or link data across
multiple data sets to an individual.’’ 435
These subcategories of covered personal
identifiers in the proposed rule are
listed identifiers: (1) In combination
with any other listed identifier; or (2) In
combination with other data that is
disclosed by a transacting party
pursuant to the transaction such that the
listed identifier is linked or linkable to
other listed identifiers or to other
sensitive personal data.436 See § 202.212.
b. The Data-Brokerage Market
Much of the economic impact of the
proposed rule’s restrictions on the
transfer or sale of data types described
in part VII.A.3.a of this preamble will be
borne by firms involved in the databrokerage market. The United States is
widely perceived to be the largest databrokerage market in the world, as
described below in this section. While
the proposed rule regulates databrokerage activities (i.e., transactions),
there does not appear to be any direct
measure of data-brokerage activities.
This analysis therefore uses and
examines information regarding firstparty data brokers and third-party data
brokers as a reasonable measure of databrokerage activities.
i. Companies That May Meet the
Definition of Data Brokers for the
Purposes of the Proposed Rule
Data brokers collect, aggregate, and
sell personal data.437 First-party or
primary data brokers collect and sell
information from their own customers.
Third-party data brokers purchase and
resell data. On the global scale, an
estimated 5,000 data-brokerage firms
operate worldwide.438 There may be as
many as 11,000 firms that fall under the
518210 NAICS code, which covers firms
that provide data processing, hosting,
and related services.439
ii. Market Size
Estimates of the size of the data broker
market vary widely, from $50 billion to
$300 billion, with one popular estimate
claiming that over $200 billion in
revenue is generated globally each
year.440 For the United States, which
maintains approximately 60 percent of
the global market, a likely range is
between $30 billion and $180 billion.441
Based on total revenue (U.S. and
foreign) and the number of employees at
these firms, the Department estimates
the market size as shown in Table VII–
1 of this preamble.
TABLE VII–1—SELECTED DATA BROKER REVENUE AND EMPLOYEE FIGURES
Data broker
Total revenue
U.S. revenue
Foreign revenue
Acxiom (2018) a ...................................................
LexisNexis (2021) b ..............................................
Oracle America (2023) d ......................................
Equifax (2023) e ...................................................
Experian (2022) f ..................................................
$917.4 million ...............
$974.3 million ...............
$50 billion .....................
$5.3 billion ....................
$6.6 billion ....................
$834.6 million ...............
n/a c ..............................
$31 billion .....................
$4.1 billion ....................
$4.4 billion ....................
$82.8 million .................
n/a c ..............................
$19 billion .....................
$1.2 billion ....................
$2.2 billion ....................
Employees
3,380
10,200
g 164,000
14,900
22,000
khammond on DSKJM1Z7X2PROD with PROPOSALS2
a Acxiom LLC 2018 Annual Report, AnnualReports.com (2018), https://www.annualreports.com/HostedData/AnnualReports/PDF/NASDAQ_
ACXM_2018.pdf [https://perma.cc/6BVA-DQS5].
b Latka, How LexisNexis Hit $974.3M Revenue with a 10.2K Person Team in 2021, SaaS Database, https://getlatka.com/companies/lexisnexis
[https://perma.cc/M4DM-HAC9].
c LexisNexis is owned by RELX and is folded into their annual report and therefore the annual report does not provide specific domestic and
foreign revenue numbers just for LexisNexis.
433 Both California’s and Vermont’s regulations
provide definitions of ‘‘Data Broker’’ that differ
from the definition of ‘‘data brokerage’’ provided in
Subpart C of the proposed rule. See Cal. Civ. Code
sec. 1798.99.80, supra note 62; Vt. Stat. Ann. tit. 9,
sec. 2430(4) (2024).
434 Samuel Chapman, Understanding Biometric
Data Collection in 2024, PrivacyJournal.net (Apr.
10, 2023), https://www.privacyjournal.net/
biometric-data-collection/ [https://perma.cc/RAQ2VTLZ].
435 89 FR 15428.
436 Id.
437 How to Stop Data Brokers from Selling Your
Personal Data, Kaspersky, https://
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
usa.kaspersky.com/resource-center/preemptivesafety/how-to-stop-data-brokers-from-selling-yourpersonal-information [https://perma.cc/ZLU3S7N9].
438 Susan Moore, How to Choose a Data Broker,
Gartner (June 8, 2016), https://www.gartner.com/
smarterwithgartner/how-to-choose-a-data-broker
[https://perma.cc/5FP2-RGM5].
439 U.S. Census Bureau, supra note 412.
440 How Data Brokers Sell Your Identity &
Personal Information, IDShield: Blog (Mar. 18,
2022), https://www.idshield.com/blog/internetprivacy/data-brokers-what-they-know-and-howthey-collect-your-data/ [https://perma.cc/6LRXSX79]; Catherine Tucker & Nico Neumann, Buying
Consumer Data? Tread Carefully, Harv. Bus. Rev.
PO 00000
Frm 00060
Fmt 4701
Sfmt 4702
(May 1, 2020), https://hbr.org/2020/05/buyingconsumer-data-tread-carefully [https://perma.cc/
GDY3-AWKQ]; David Lazarus, Shadowy Data
Brokers Make the Most of Their Invisibility Cloak,
L.A. Times (Nov. 5, 2019), https://
www.latimes.com/business/story/2019-11-05/
column-data-brokers [https://perma.cc/AH6CUKDA]; OnAudience.com, Global Data Market Size:
2017–2021 (Nov. 2020), https://pressmania.pl/wpcontent/uploads/2020/12/Global-Data-Market-Size2017-2021-OnAudience-Report.pdf [https://
perma.cc/KX6E-4XC6].
441 OnAudience.com, supra note 440 at 8, 11.
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
86175
d Oracle, Oracle Announces Fiscal 2023 Fourth Quarter and Fiscal Full Year Financial Results (June 12, 2023), https://investor.oracle.com/investor-news/news-details/2023/Oracle-Announces-Fiscal-2023-Fourth-Quarter-and-Fiscal-Full-Year-Financial-Results/default.aspx
[https://
perma.cc/DL8Y-H2VM]. The U.S. Revenue entry of $31 billion is for ‘‘the America’s.’’ The Foreign Revenue entry of $19 billion is for ‘‘Europe/
Middle East/Africa’’ and ‘‘Asia/Pacific.’’ Oracle, Culture and Inclusion Empowers Diversity, https://www.oracle.com/careers/culture-inclusion/bestpractices/ [https://perma.cc/3M2B-GQ7F].
e Equifax Inc., 2023 Annual Report (2024), https://investor.equifax.com/sec-filings/annual-reports##document-3666-0001308179-24-000246-2
[https://perma.cc/WU9A-NHZ2].
f Experian, Annual Report 2023 (2023), https://www.experianplc.com/content/dam/marketing/global/plc/en/assets/documents/reports/2023/annual-report/experian_annual_report_2023_web.pdf [https://perma.cc/7QRT-GN3T].
g Oracle Corp., Annual Report (Form 10–K) (June 20, 2023), https://www.sec.gov/Archives/edgar/data/1341439/000095017023028914/orcl20230531.htm [https://perma.cc/4ADX-R6EJ].
iii. Products Sold by Data Brokers
Data brokers often collect data
regarding, for example, where the
average person goes, where they shop,
and what they search for online.442
Notably, researchers from Duke
University who used a secret shopper
approach were offered access to
thousands of records of military
personnel and military veterans’ data
containing names, addresses, emails,
phone numbers, military agency or
branch, medical ailments, political
affiliations, religion, gender, age,
income, credit rating, and even details
on children in the household.443 Not all
brokers sell the same data, with many
targeting niche industries or markets to
help them gain a competitive advantage.
Brokers also trade and combine their
data with primary collectors to create
detailed profiles they can package and
commercialize.444
iv. Price Information
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Depending on its type and volume,
personal data can be purchased for
prices ranging from less than $1 for one
personal record to millions of dollars for
a large dataset. In a secret shopper
study, Duke University researchers
found that they could purchase a single
record for as little as $0.12 and spend
upwards of $10,000 for approximately
50,000 records of service members and
military veterans. The price did not
noticeably vary based on the data
subjects’ IP location (United States vs.
Singapore). The Duke University
researchers found that if one broker
could not sell the information to them,
another one could. There are estimates
that mental health datasets could range
between $15,000 and $100,000 and may
be sold for even higher prices if the
442 Public Hearing on HB 2052 Before the H.
Comm. On Bus. & Labor, 82nd Leg. Assemb. (Or.
2023) (written public testimony, Or. Dep’t of Just.,
Off. of the Att’y Gen.), https://
olis.oregonlegislature.gov/liz/2023R1/Downloads/
PublicTestimonyDocument/40843 [https://
perma.cc/XVM5-4ZEJ].
443 Sherman et al., supra note 6.
444 Henrik Twetman & Gundars Bergmanis-Korats,
Data Brokers and Security, NATO Strategic
Comm’ns Ctr. of Excellence (2021), https://
stratcomcoe.org/publications/data-brokers-andsecurity/17 [https://perma.cc/XJ4D-UQYP].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
datasets include more detailed
demographic data.445
v. Customers of Data-Brokerage Products
It is known that data brokers sell
datasets both domestically and
internationally; however, specific
transaction activities with these parties
are difficult to ascertain from available
financial reports. The U.S. Bureau of
Economic Analysis (‘‘BEA’’) faces
significant limitations for estimating the
size of the domestic and international
markets because BEA data does not
break out data brokerage separately as
an industry. Furthermore, based on
sample financial data of the databrokerage firms listed in Table VII–1 of
this preamble, the Department estimates
that the U.S. market produces over 60
percent of data broker revenue.
c. Agreements Affected by the Proposed
Regulation
It is difficult to determine an
approximate number of affected vendor
agreements, employment agreements,
and investment agreements that are
entered in any given year by a U.S.
person due to the scope and nature of
these agreements. Each of these three
types of agreements are considered
restricted transactions if they involve
access to government-related data or
bulk U.S. sensitive personal data. The
Department welcomes comments that
provide a source for the annual number
of vendor agreements, employment
agreements, and investment agreements
that might be affected by the regulation.
i. Vendor Agreements
According to the proposed rule, a
vendor agreement is defined as ‘‘any
agreement or arrangement, other than an
employment agreement, in which any
person provides goods or services to
another person, including cloudcomputing services, in exchange for
payment or other consideration.’’ See
§ 202.258(a). A potential example of a
vendor agreement covered by the
445 Joanne Kim, Data Brokers and the Sale of
Americans’ Mental Health Data (2023) https://
techpolicy.sanford.duke.edu/wp-content/uploads/
sites/4/2023/02/Kim-2023-Data-Brokers-and-theSale-of-Americans-Mental-Health-Data.pdf [https://
perma.cc/48UN-ELKG].
PO 00000
Frm 00061
Fmt 4701
Sfmt 4702
proposed rule is a medical facility in the
United States that contracts with a
company headquartered in a country of
concern to provide information
technology (‘‘IT’’) related services. The
medical facility has bulk personal
health data on its U.S. patients, and the
IT services provided under the contract
involve access to the medical facility’s
systems containing that bulk personal
health data. (See Example 2 in
§ 202.258(b)). The NPRM also discusses
additional examples of vendor
agreements pertaining to technology
services and data storage. (See Examples
3 and 4 in § 202.258(b)).
The costs of compliance with the
security requirements will vary.
Covered persons who have vendor
agreements within the scope of the
proposed rule may face costs associated
with either replacing a vendor located
in a country of concern or spending
more on compliance (e.g., implementing
the security requirements) to maintain
those vendor agreements. Furthermore,
some U.S. companies may choose to
remove vendor agreements altogether
rather than bear the cost of complying
with the security requirements. In
contrast, most Fortune 500 companies
or companies in sectors subject to
cybersecurity regulations already have
cybersecurity controls in place and
might only need minor modifications to
their existing vendor agreements and
data security controls, while companies
with less mature cybersecurity programs
may require more significant changes.
ii. Employment Agreements
This NPRM defines an employment
agreement as ‘‘any agreement or
arrangement in which an individual,
other than as an independent contractor,
performs work or performs job functions
directly for a person in exchange for
payment or other consideration,
including employment on a board or
committee, executive-level
arrangements or services, and
employment services at an operational
level.’’ See § 202.217(a). A potential
example of an employment agreement is
a U.S. company that employs a team of
individuals who are citizens of and
primarily reside in a country of concern
and have access to back-end IT services
E:\FR\FM\29OCP2.SGM
29OCP2
86176
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
and company systems that contain bulk
human genomic data (see Example 1 in
§ 202.217(b)). Similarly, the
employment of a lead project manager
or a CEO of a U.S. company who
primarily resides in a country of
concern and who has access to bulk U.S.
sensitive personal data would be
considered a restricted transaction (see
Examples 2 and 3 in § 202.217(b)).
Any employment agreements
involving government-related data or
bulk U.S. sensitive personal data
between U.S. persons and countries of
concern or covered persons would need
to comply with security requirements.
The cost of security and due diligence
requirements may drive some
companies to cease employment
agreements with these covered persons,
while other companies may incur costs
to ensure compliance or even
implement job transfers to eliminate the
potential cost of compliance with the
proposed regulation. Ultimately,
employment agreements may incur
larger upfront costs once the proposed
regulation comes into effect that may be
minimized over time as the initial
market disruptions due to the proposed
rule settle, the costs associated with job
transfers are minimized, and firms learn
how to operate in the changed
environment.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
iii. Investment Agreements
This NPRM defines an investment
agreement as ‘‘an agreement or
arrangement in which any person, in
exchange for payment or other
consideration, obtains direct or indirect
ownership interests in or rights in
relation to (1) real estate located in the
United States or (2) a U.S. legal entity.’’
See § 202.228(a). An example is when a
U.S. company intends to build a data
center located in a U.S. territory to store
bulk personal health data on U.S.
persons, and a foreign private equity
fund located in a country of concern
agrees to provide capital for the
construction of the data center in
exchange for acquiring a majority
ownership stake in the data center (see
Example 1 in § 202.227(c)). Ultimately,
investment agreements may incur larger
upfront costs once the proposed
regulation comes into effect that may be
minimized over time.
iv. Security Requirements
The proposed rule authorizes three
classes of otherwise prohibited
transactions (vendor agreements,
employment agreements, and
investment agreements) if they meet the
security requirements proposed by
CISA. The goal of the proposed security
requirements is to address national
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
security and foreign-policy threats that
arise when countries of concern and
covered persons access governmentrelated data or bulk U.S. sensitive
personal data that may be implicated by
the categories of restricted transactions.
The proposed security requirements
(incorporated by reference in § 202.402
of this NPRM) have been developed by
DHS through CISA, which has
published the proposed requirements on
its website, as announced via a Federal
Register request for comments on the
proposed security requirements, issued
concurrently with this proposed rule.
After CISA receives and considers
public input, it will revise as
appropriate and publish the security
requirements.
Regarding investment agreements, as
described in § 202.228 and § 202.508,
the proposed rule would treat
investment agreements entered into by
U.S. persons with countries of concern
or covered persons as restricted
transactions even if they are also
covered transactions subject to CFIUS
review, unless and until CFIUS issues
an interim order, enters into a
mitigation agreement, or imposes a
condition with respect to a particular
covered transaction.446 As a result, any
investment agreement that is both a
restricted transaction under the
proposed rule and a covered transaction
subject to CFIUS review would be
subject to the security requirements
under the proposed rule unless and
until the transaction is filed with CFIUS
and CFIUS takes a ‘‘CFIUS action,’’ as
defined in the proposed rule, by
entering into a mitigation agreement or
imposing mitigation measures. Because
the security requirements are likely at
least similar to and potentially less
burdensome than any bespoke
mitigation measures that CFIUS would
enter into or impose, the parties to such
a covered transaction would likely face,
as a result of the proposed rule, only the
marginal cost of complying with the
security requirements before CFIUS
takes action. Because this cost of
compliance is marginal, and because it
appears likely, based on the
Department’s experience, that many
investment agreements by countries of
concern or covered persons that involve
access to sensitive personal data would
also be covered transactions subject to
CFIUS review, it appears likely that
there will not be a meaningful cost for
446 Security requirements may only need to be
implemented while the transaction is pending
CFIUS review if the transaction is undertaken in the
interim. See, e.g., Example 9 in § 202.508.
PO 00000
Frm 00062
Fmt 4701
Sfmt 4702
investment agreements to comply with
the security requirements.
v. Due Diligence and Recordkeeping
Due diligence and recordkeeping
requirements will be important
considerations when engaging in a
restricted transaction or as a condition
of a license (general or specific) and
may be similar to certain requirements
of an IEEPA-based sanctions program
administered by OFAC. Section
202.1101 of the proposed rule requires
U.S. persons subject to these affirmative
requirements to maintain
documentation of their due diligence to
assist in inspections and enforcement,
and to maintain the results of annual
audits that verify their compliance with
the security requirements, as applicable,
and the conditions of any licenses,
where relevant, that the U.S. persons
may also have. Entities may be required
to collect, maintain, and analyze readily
available information to make
appropriate judgments regarding their
transactions and potential requirements
under the proposed regulation. They
may also be required to make available
to the Department any annual audits
that verify the U.S. person’s compliance
with the security requirements and any
conditions on a license.
vi. Audits
The proposed rule imposes certain
audit requirements on restricted
transactions to ensure compliance with
the security requirements for covered
data transactions, such as appointing a
qualified auditor to annually assess
compliance. Such audits would address
the nature of the U.S. person’s covered
data transaction and whether it is in
accordance with applicable security
requirements, the terms of any license
issued by the Attorney General, or any
other aspect of the regulations.
vii. Licenses
General and specific licenses would
be available under the proposed
regulation. Such licenses would permit
transactions that are otherwise
prohibited by the proposed regulation.
Both general and specific licenses could
include a range of requirements or
obligations as the Department deems
appropriate. The benefits of this type of
regime include giving regulated parties
the ability to bring specific concerns to
the Department and seek appropriate
regulatory relief and affording the
Department the flexibility to resolve
varied cases either generally or
individually.
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
4. Need for Regulatory Action
There are many statutes, regulations,
and programs that aim to keep America
secure by monitoring, restricting,
prohibiting, or otherwise regulating the
flow of goods, services, investments,
and information to foreign countries and
foreign nationals, especially countries
considered to be adversaries. For
example, CFIUS has the authority to
take action to mitigate any national
security risk arising from certain foreign
investments in U.S. businesses or
involving U.S. real estate, or to
recommend that the President suspend
or prohibit a transaction on national
security grounds. In addition, OFAC
‘‘administers and enforces economic
and trade sanctions based on U.S.
foreign-policy and national security
goals against targeted foreign countries
and regimes, terrorists, international
narcotics traffickers, those engaged in
activities related to the proliferation of
weapons of mass destruction, and other
threats to the national security, foreign
policy, or economy of the United
States.’’ 447
In Executive Order 13873, the
President authorized the Department of
Commerce to prohibit transactions in
the information and communications
technology and services supply chain or
to impose mitigation measures to
address an unusual and extraordinary
threat to the national security, foreign
policy, and economy of the United
States.448 The Secretary of Commerce
exercises this authority through the
Bureau of Industry and Security.449
Executive Order 14034 takes various
steps to protect sensitive personal data
from foreign adversaries.450
While existing legislation provides
the Department of Justice with authority
to promulgate this proposed rule, no
existing statute replicates the measures
undertaken here. Neither do any of the
previous executive actions set forth in
Executive Order 14117 451 broadly
empower the government to prohibit or
otherwise restrict the sale or transfer of
government-related data or bulk U.S.
sensitive personal data to countries of
concern. Therefore, the proposed
regulation will not be duplicative of any
existing regulatory regime.
As relevant here, the regulatory
philosophy of Executive Order 12866
447 U.S. Dep’t of Treas., Off. of Foreign Assets
Control, https://ofac.treasury.gov/ [https://
perma.cc/4N8E-X7XM].
448 84 FR 22689–22690.
449 Office of Information and Communications
Technology and Services (OICTS), Bureau of
Industry and Security, https://www.bis.gov/OICTS
[https://perma.cc/MFX8-MDN4].
450 86 FR 31423.
451 89 FR 15422.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
provides that agencies should issue
regulations when there is a compelling
public need, such as a market failure.452
Executive Order 12866 further directs
agencies issuing new regulations to
identify, where applicable, the specific
market failure that warrants new agency
action and to assess its significance. In
perfect, unregulated markets, supply
and demand lead to transactions that
allocate resources efficiently, fully
supply the market at prices that buyers
are willing to pay, and do not harm
third parties. However, some
transactions result in market failures
known as ‘‘negative externalities;’’ that
is, harms to parties not directly involved
in the transactions. The sale of
government-related data or bulk U.S.
sensitive personal data to adversaries is
an example. Such transactions are
mutually beneficial to the parties: U.S.
data brokers obtain monetary benefits,
and adversaries obtain possession of a
potentially strategic asset of sensitive
data that they can put to malicious use.
However, when the data can be used to
harm U.S. nationals who are not directly
involved in the transactions by
presenting a risk to national security or
foreign policy, then the transaction
creates negative externalities. These
market failures demonstrate a need for
the regulation being proposed, which
will eliminate or reduce the risk to
national security and foreign policy
from such transactions. Circular A–4
also recognizes a common need for
regulation to protect civil rights, civil
liberties, or advancing democratic
values, all of which are threatened if
government-related data or bulk U.S.
sensitive personal data end up in the
hands of adversaries.453
5. Baseline (Without the Proposed Rule)
The baseline refers to what the world
would look like without the regulatory
changes being proposed here, which is
closely related to the need for the
regulation described above. To inform
the public of the rationale behind the
agency’s proposed regulations, the
Department must analyze the
quantifiable and qualitative costs and
benefits of the proposed action. The
baseline for the proposal under
consideration is the state of the world
without the regulation, often referred to
as the ‘‘no-action alternative,’’ which
here includes the current regulatory
regime.
452 See
453 See
58 FR 51735.
Off. of Mgmt. & Budget, supra note 394,
at 15.
PO 00000
Frm 00063
Fmt 4701
Sfmt 4702
86177
a. Baseline National Security and
Foreign-Policy Risks by Category of Data
i. Human Genomic and Human ’Omic
Data
Human genomic data presents
characteristics that, under certain
circumstances, allow for misuse.
Although humans share more than 99
percent of their DNA, the remaining
differences play a significant role in
physical and mental health.454 In
addition to genomic data, which
describes a person’s DNA sequence, if
combined with other data, data
characterizing other human systems,
known as ’omic data, can also uniquely
identify individuals. For example,
transcriptomic data describes RNA
transcripts, or the expression of genes as
impacted by environmental factors;
proteomic data describes the complete
set of proteins expressed by a cell,
tissue, or organism; and metabolomic
data describes the small molecule
metabolites found within a biological
sample.
Human genomic data and human
‘omic data are therefore highly personal,
and there are both person- and
population-level risks to national
security associated with the potential
sale of such data to foreign
adversaries.455 Genomic data has been
widely acknowledged in scientific,
policy, and ethics literature to have the
potential to be used to track an
individual; breach their privacy; and
expose individuals to discrimination,
exclusion, or social embarrassment
when paired with other personally
identifiable information, such as by
coloring public perception of a person’s
competence or health. Genomic data
that is de-identified by standard
healthcare practices (i.e., removal of
name, date of birth) can, in some cases,
be potentially re-identified by methods
that combine genomic data with other
privately and publicly available
information.456 There are also other
454 The Human Genome Project, Nat’l Hum.
Genome Rsch. Inst., https://www.genome.gov/
human-genome-project [https://perma.cc/55Z4XHFN].
455 Kirsty Needham, Special Report: COVID
Opens New Doors for China’s Gene Giant, Reuters
(Aug. 5, 2020), https://www.reuters.com/article/
world/special-report-covid-opens-new-doors-forchinas-gene-giant-idUSKCN2511CD/ [https://
perma.cc/U4B2-Y4TB]; Nat’l Acads. of Scis., Eng’g
& Med., Safeguarding the Bioeconomy 296–306
(2020), https://nap.nationalacademies.org/catalog/
25525/safeguarding-the-bioeconomys [https://
perma.cc/77RH-ACKG]; Bonomi et al., supra note
237, at 647.
456 Adam Tanner, Strengthening Protection of
Patient Medical Data, Century Found. (Jan. 10,
2017), https://tcf.org/content/report/strengtheningprotection-patient-medical-data/ [https://perma.cc/
R26L-G9WP].
E:\FR\FM\29OCP2.SGM
29OCP2
86178
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
potential risks related to such data.457
For instance, the 2023 Annual Threat
Assessment of the U.S. Intelligence
Community explains that generally,
‘‘[r]apid advances in dual-use
technology, including bioinformatics,
synthetic biology, nanotechnology, and
genomic editing, could enable
development of novel biological
weapons that complicate detection,
attribution, and treatment.’’ 458
Additionally, as the National
Counterproliferation and Biosecurity
Center has stated, ‘‘[r]esearch in genome
editing by countries with different
regulatory or ethical standards than
those of Western countries probably
increases the risk of the creation of
potentially harmful biological agents or
products.’’ Furthermore, because
biological relatives share some genetic
traits, the misuse of genomic and related
information can potentially harm not
only the individual but also their
current and future biological relatives,
to some degree.
For example, Huntington’s Disease is
neurodegenerative, is frequently highly
incapacitating, has no cure, and is tied
to specific genetic variants.459 Revealing
that an individual carries the variants
for Huntington’s Disease could therefore
be used to claim that a political
candidate for office may soon become
incapacitated or to harm that person’s
family members mentally or
emotionally.
At a population level, there are
multiple examples of the risks posed by
harmful use of genomic data. For
example, the PRC has collected and
used genetic data from minority groups
and potential political dissidents to
carry out human-rights abuses against
those groups and to support state
surveillance.460 The PRC’s collection of
healthcare data from the United States
poses equally serious risks, not only to
the privacy of Americans, but also to the
economic and national security of the
United States.461
457 Jan van Aken & Edward Hammond, Genetic
Engineering and Biological Weapons: New
Technologies, Desires and Threats from Biological
Research, 4 EMBO Reports S57 (May 9, 2003),
https://doi.org/10.1038/sj.embor.embor860 [https://
perma.cc/Z95V-SWVL].
458 Off. of the Dir. of Nat’l Intel., supra note 91,
at 25; Nat’l Counterproliferation & Biosecurity Ctr.,
Biological Warfare, https://www.dni.gov/index.php/
ncbc-features/1548-features-2 [https://perma.cc/
6V8M-354G].
459 Huntington’s Disease, Nat’l Inst. of Health,
Nat’l Inst. of Neurological Disorders & Stroke,
https://www.ninds.nih.gov/health-information/
disorders/huntingtons-disease#toc-what-ishuntington-s-disease [https://perma.cc/YE7CUKN2].
460 Nat’l Counterintel. & Sec. Ctr., supra note 83,
at 3–4.
461 Id.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
It is conceivable that bulk genomic
data in the wrong hands could be used
to identify or track ethnic or racial
subgroups in the United States and to
target them for physical, mental, or
emotional harm. As the NCSC has
publicly explained, for example,
‘‘[c]oncerns over the exploitation of
healthcare and genomic data by the
[People’s Republic of China] are not
hypothetical,’’ as China ‘‘has a
documented history of exploiting DNA
for genetic surveillance and societal
control of minority populations in
Xinjiang, China.’’ 462 Specifically, China
‘‘has established a high-tech
surveillance system across Xinjiang, as
part of a province-wide apparatus of
oppression aimed primarily against
traditionally Muslim minority
groups.’’ 463 This apparatus includes an
‘‘initiative launched by the PRC
government in 2014’’ that ‘‘has been
used to justify the collection of
biometric data from all Xinjiang
residents ages 12 to 65.’’ 464 Chinese
authorities have ‘‘collected DNA
samples, fingerprints, iris scans, and
blood types’’ and linked the biometric
data ‘‘to individuals’ identification
numbers and centralized [it] in a
searchable database used by PRC
authorities.’’ 465 As NCSC has further
explained, ‘‘[s]pecific abuses by the PRC
government as part of this effort include
mass arbitrary detentions, severe
physical and psychological abuse,
forced labor, oppressive surveillance
used arbitrarily or unlawfully, religious
persecution, political indoctrination,
and forced sterilization of members of
minority groups in Xinjiang.’’ 466 In
2020, the Department of Commerce
‘‘sanctioned two subsidiaries of China’s
BGI for their role in conducting genetic
analysis used to further the PRC
government’s repression of Uyghurs and
other Muslim minority groups in
Xinjiang.’’ 467 As this example shows,
‘‘[t]he combination of stolen PII,
personal health information, and large
genomic data sets collected from abroad
affords the PRC’’—and other countries
of concern—‘‘vast opportunities to
precisely target individuals in foreign
governments, private industries, or
other sectors for potential surveillance,
manipulation, or extortion.’’ 468 The
potential exploitation of this kind of
data is not limited to targeting and
repression within the borders of a
462 Id.
at 3.
463 Id.
464 Id.
465 Id.
466 Id.
467 Id.
468 Id.
PO 00000
at 4.
Frm 00064
Fmt 4701
Sfmt 4702
country of concern, as this data could
help ‘‘not only recruit individuals
abroad, but also act against foreign
dissidents.’’ 469
There are additional risks to national
security associated with the sale of bulk
genomic data to countries of concern.
For example, BGI Group, a Chinese
company, grew exponentially during the
COVID–19 pandemic by selling COVID–
19 test kits in 180 countries around the
world, which enabled it to collect
biospecimens and DNA sequences from
the individuals tested.470 The company
also built laboratories in 18 countries,
widely distributing its genetic
sequencing/gathering technology across
the globe, and the government of China
helped to coordinate some of BGI’s
arrangements with other countries. The
human genetic samples that BGI
collected may be shared publicly on
China’s government-funded National
GeneBank, creating individual privacy
risks, and the Chinese government has
indicated that its backing of BGI is
intended to support China in
commanding a significant position in
the international biotechnology
industry.471
ii. Biometric Identifiers
As previously discussed, the
gathering and aggregating of biometric
data can be a complex process, and
much about the market for biometric
data is still unknown. The legitimate
use of biometrics across many areas of
technology is increasing rapidly, and
the exposure of biometric data to
countries of concern could prove to be
especially damaging since the physical
characteristics linked to biometrics are
often difficult or impossible to change.
The PRC already has a demonstrated
ability to collect and exploit the
biometric data of its citizens, an effort
that has been especially targeted at
oppressed groups within its population.
This has included gathering data such
as ‘‘DNA samples, fingerprints, iris
scans, and blood types’’ and creating a
database where such data is linked with
an individual’s personal identifier.472
These capabilities will likely continue
to be developed as the technology
improves and could easily be used to
undermine U.S. national security.
469 Id.
470 Needham, supra note 455 (‘‘[i]n science
journals and online, BGI is calling on international
health researchers to send in virus data generated
on its equipment, as well as patient samples that
have tested positive for COVID–19, to be shared
publicly via China’s government-funded National
GeneBank.’’).
471 Id.
472 Nat’l Counterintel. & Sec. Ctr., supra note 83.
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
iii. Precise Geolocation Data
Precise geolocation data in the hands
of foreign adversaries poses national
security risks with respect to two areas:
(1) operations, including missions,
deployments, exercises, and activities of
national security personnel; and (2)
personnel, including those in the
military and their families, as well as
nonmilitary persons with the potential
to obtain or hold information vital to
national security.473
Potentially sensitive information can
be gleaned outside direct conflict zones.
Precise geolocation data can be readily
used to identify the location and
purpose of important national securityrelated infrastructure, facilities, and
equipment, all of which could lead to
immense harm to national security.
Precise geolocation data can also be
used to coerce military personnel, State
Department officials, and anyone else
with access to sensitive national
security information, including through
the use of such data on their family
members or other close associates.474
Compromising information gleaned
from geolocation data can be used by
adversaries for surveillance and
intelligence gathering as well as to
extort, blackmail, dox, and manipulate
behavior to obtain sensitive national
security information. With all the
information that is readily available
from data brokers, it is quite feasible to
develop effective strategies to identify
national security personnel and
diplomatic/foreign-policy personnel
working with specific sensitive
information and to track their
movements and behavior.
Adversaries could use these datasets
to identify where national security
personnel work, then use the
personnel’s health or financial
information to bribe or blackmail them
into providing the adversaries with
access to restricted systems, sensitive
information, or critical programs or
infrastructure. Precise geolocation data
could also allow these countries to track
service members’ and other national
security personnel’s movements,
impersonate personnel online or in
email, and identify personnel working
on specific tasks within the national
security community.
Countries of concern can also exploit
access to government-related data,
regardless of its volume. As one report
has explained, for example, locationtracking data on individuals (e.g.,
military members, government
employees and contractors, or senior
473 Hazelrig, supra note 4; Sherman et al., supra
note 6.
474 Sherman et al., supra note 6 at 14.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
government officials) can ‘‘reveal
sensitive locations—such as visits to a
place of worship, a gambling venue, a
health clinic, or a gay bar[,]’’ or
‘‘reputationally damaging lifestyle
characteristics, such as infidelity[,]’’
which ‘‘could be used for profiling,
coercion, blackmail, or other
purposes[.]’’ 475
In addition, these geolocation
capabilities, combined with
photography, ‘‘can expose personal
information, locations, routines and
numbers of [Department of Defense
(DOD)] personnel, and potentially create
unintended security consequences and
increased risk to the joint force and
mission.’’ 476
iv. Personal Health Data
Personal health data also presents
threats in the hands of foreign
adversaries. There are a few
documented cases of data brokers
selling sensitive health information to
foreign governments, including those in
part IV.D.1.a of this preamble.
Purchasers may have direct, indirect, or
undisclosed ties to foreign officials that
provide these entities with access to
otherwise prohibited data. The presence
of foreign adversaries in the U.S. health
data market makes the variety and
amount of American health data
available in the data-brokerage
ecosystem risky. Notably, the types of
sensitive personal data (e.g., mental
health or HIV/AIDS diagnoses)
available, paired with the increasing
speed and ease with which artificial
intelligence and other technologies can
re-identify individuals using as few as
15 demographic attributes (e.g., ZIP
code, date of birth, gender, citizenship,
race, occupation) from another dataset,
have the potential to produce harmful
outcomes for the American public if
placed in the wrong hands.477
Currently, health data brokers collect
and sell a wealth of information
encompassing everything from general
health conditions to addiction and
prescription drug use. Additional
discussion of these risks associated with
personal health data can be found in
part V.A.4 of this preamble.
475 Sherman
et al., supra note 6, at 15.
Release, Def. Logistics Agency, New
Policy Prohibits DoD Employees from Using GPS
Services in Operational Areas, (Aug. 8, 2018)
(quotation omitted), https://www.dla.mil/AboutDLA/News/News-Article-View/Article/1597116/
new-policy-prohibits-dod-employees-from-usinggps-services-in-operational-areas/ (quoting a
defense department official) [https://perma.cc/
8BNE-WU65].
477 Adam Tanner, supra note 456; Rocher et al.,
supra note 45.
476 Press
PO 00000
Frm 00065
Fmt 4701
Sfmt 4702
86179
v. Personal Financial Data
Financial data tied to individuals can
pose associated national security threats
in the hands of foreign adversaries.
There is also an associated threat to
national security to U.S. persons who
might be targeted for recruitment by a
foreign adversary through the use of
financial data as leverage over such U.S.
persons. Data about an individual’s
credit, charge, or debit card, or bank
account, including purchases and
payment history; data in a bank, credit,
or other financial statement, including
assets, liabilities and debts, and
transactions; or data in a credit or
‘‘consumer report’’ expose that
individual to more than monetary
losses.478 The threat of exposing an
individual’s spending habits,
particularly spending that may be
embarrassing, can render that person
open to extortion or blackmail.479 In
instances where a threatened individual
has access to especially sensitive
information, national security may be at
risk.
vi. Covered Personal Identifiers
Covered personal identifiers are a
form of sensitive personal data that are
both widely available and highly
variable in nature. For example, covered
personal identifiers may include
demographic or contact data (e.g., first
and last name, birthplace, ZIP code,
residential street or postal address,
phone number, and email address and
similar public account identifiers) that
is linked to financial account numbers.
Many types of covered personal
identifiers can be used effectively in
combination with other typers of
sensitive personal data. The versatility
of this data could make covered
personal identifiers a valuable target for
foreign adversaries attempting to
increase the effectiveness of the bulk
sensitive personal data in their
possession by linking together separate
datasets. For example, the PRC has both
stolen data on U.S. persons that has
included covered personal identifiers
(e.g., names and Social Security
numbers, as evidenced in the 2015 hack
of the health insurer Anthem, Inc.) and
has effectively used personal identifiers
within internal datasets on their citizens
as a way to more effectively surveil
marginalized groups.480
478 Ctr. for Democracy & Tech., Docket No. CFPB–
2023–0020, Response to Request for Information
Regarding Data Brokers, at 3–5 (July 15, 2023),
https://cdt.org/wp-content/uploads/2023/07/CDTComment-to-CFPB-on-Data-Brokers-CFPB-2023002054.pdf [https://perma.cc/YTJ8-QMVW].
479 Arango, supra note 428.
480 Nat’l Counterintel. & Sec. Ctr., supra note 83.
E:\FR\FM\29OCP2.SGM
29OCP2
86180
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
vii. Government-Related Data
It has become increasingly evident in
recent years that government-related
location data is at risk of being exploited
by countries of concern through location
information collected from electronic
devices, including cell phones and
fitness apps.481 Such data can be used
to not only track the movements of
targeted government associates but also
to link them with sensitive activities
and vices, such as gambling or
prostitution. This information can then
be used to pressure these persons to
reveal sensitive information, thereby
compromising U.S. national security.
Methods include malicious cyberenabled activities, espionage, and
blackmail.482
b. Baseline: Total Potential U.S.
Population Affected by Risks
Part IV.A.1 of this preamble explains
how adversaries can use their access to
Americans’ bulk sensitive personal data
to engage in malicious cyber-enabled
activities and malign foreign influence
and to track and build profiles on U.S.
individuals, including members of the
military and government employees and
contractors, for illicit purposes such as
blackmail and espionage. As of July
2021, one of the largest data brokers,
Acxiom, sold products that purported to
cover 45.5 million current and former
U.S. military personnel and 21.3 million
current and former government
employees.483 The proposed rule also
observes that countries of concern can
exploit their access to Americans’ bulk
sensitive personal data to collect
information on activists, academics,
journalists, dissidents, political figures,
and members of nongovernmental
organizations or marginalized
communities to intimidate them; curb
political opposition; limit the freedoms
of expression, peaceful assembly, or
association; or enable other forms of
suppression of civil liberties. Even
family members of primary targets can
be ensnared in such malicious activity.
Finally, individuals with access to
advanced intellectual property, such as
semiconductor designs, could be highvalue targets of countries of concern.
Tables VII–2 and VII–3 of this
preamble provide estimates of the size
of these targeted populations, but these
figures should not be added together to
calculate a single population figure,
since a single individual could be a
member of more than one of the
communities.
Several of the estimates presented in
Table VII–2 of this preamble required
calculations based on certain
assumptions. Because data on the
number of current Federal employees
provided by the Office of Personnel
Management does not include
employees of the U.S. Postal Service,
Office of the Director of National
Intelligence, or Central Intelligence
Agency, data on those groups was
obtained from other sources and added
in separate lines. The estimated number
of former Federal Government
contractors was calculated by applying
the economy-wide labor turnover rate
from 2001 to 2023 to the number of
current Federal Government contractors;
the Department assumed that half of the
labor turnover involved workers staying
in Federal Government contracting, and
half involved workers leaving the
industry. The estimated number of
family members of military veterans was
calculated by applying the current
average number of family members for
current military members to the military
veteran population.
TABLE VII–2—AFFECTED POPULATION—GOVERNMENT-RELATED GROUPS
Category
Population
Current Federal Government employees (excluding employees of the U.S. Postal Service, director of National Intelligence,
and Central Intelligence Agency) a ...........................................................................................................................................
U.S. Postal Service employees b .................................................................................................................................................
Office of the Director of National Intelligence employees c .........................................................................................................
Central Intelligence Agency employees d ....................................................................................................................................
Former Federal Government employees e ..................................................................................................................................
Current Federal Government contractors f ..................................................................................................................................
Former Federal Government contractors f g ................................................................................................................................
Department of Defense active duty h ...........................................................................................................................................
Coast Guard active duty h ............................................................................................................................................................
Ready Reserve h ..........................................................................................................................................................................
Standby Reserve h .......................................................................................................................................................................
Retired Reserve h .........................................................................................................................................................................
Current military family members h ...............................................................................................................................................
Military veterans i .........................................................................................................................................................................
Former military family members h i ...............................................................................................................................................
2,271,498
525,469
1,750
20,000
4,103,208
4,100,000
1,715,850
1,304,720
39,485
994,860
5,253
183,728
2,482,499
17,680,000
21,188,328
a U.S.
Off. of Pers. Mgmt., Status Data: Employment, Federal Workforce Data (Feb. 2024), https://perma.cc/7NF9-CTSC.
of Postal Employees Since 1926, U.S. Postal Service (Feb. 2024), https://about.usps.com/who/profile/history/employees-since1926.htm [https://perma.cc/6W5W-VJJ6].
c Charles C. Clark, Lifting the Lid, Gov’t Exec. (Sept. 1, 2012), https://www.govexec.com/magazine/features/2012/09/lifting-lid/57807/ [https://
perma.cc/N8Z8-GEL8].
d Michael J. O’Neal, CIA, Formation and History, Encylopedia.com, https://www.encyclopedia.com/politics/encyclopedias-almanacs-transcriptsand-maps/cia-formation-and-history [https://perma.cc/RZ24-YJAE].
khammond on DSKJM1Z7X2PROD with PROPOSALS2
b Number
481 Def.
Logistics Agency, supra note 476.
et al., supra note 6 at 15.
482 Sherman
VerDate Sep<11>2014
19:36 Oct 28, 2024
Jkt 265001
483 Justin Sherman, Data Brokers and Sensitive
Data on U.S. Individuals (2021), https://
techpolicy.sanford.duke.edu/wp-content/uploads/
PO 00000
Frm 00066
Fmt 4701
Sfmt 4702
sites/4/2021/08/Data-Brokers-and-Sensitive-Dataon-US-Individuals-Sherman-2021.pdf [https://
perma.cc/Q3QL-PK7K].
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
86181
e U.S. Off. of Pers. Mgmt., Dynamics Data: Separations, FY 20052005–FY 2009 (data cube), Federal Workforce Data (Feb. 2024), https://
www.fedscope.opm.gov/ibmcognos/bi/v1/disp?b_action=powerPlayService&m_encoding=UTF-8&BZ=1AAABv9rMvcF42p
VOQW6DQAz8jE2SQyOvYRM4cFjYRcmhkAYuPVXbZFNFpRAB∼1cFqEraW2dkyR6PR∼bKYl1WxdHsddwPbef2eonMVxOQkYFKhJbb
gEIZCl9xsNlkyt8mUhAyr7zx1qhjujuoahcjZ6e2GVwzIGeXtj67DmWCATX2y6GvFwd7_rQfrn8r3c12dri2Tb9AqZGz27z67X_
wIVPVueaMTMvsFZmYSCLTEzL9zNFqDPN0ma7TIs9NWu2LPFfPJv53kJe8xBciEEQkBAEAgSRggpEA90BkQh7TVF0jR
doO7o8EyCGyT8hOIL8jR7Mg7gJMQPZH_wPExKmbn5lqfmHGNxVvb8I%3D [https://perma.cc/L42Z-AFAA]; U.S. Off. of Pers. Mgmt., Dynamics
Data, Separations, FY 2010–FY 2014 (data cube), Federal Workforce Data (Feb. 2024), https://www.fedscope.opm.gov/ibmcognos/bi/v1/disp?b_
action=powerPlayService&m_encoding=UTF-8&BZ=1AAABv4ldgp142pVOwW6CQBD9mR3UQ83sg1U4cAB2iR4KVrj01FBdG1MKBvj∼
NEAabW99L5PMvHnzMk6Rr4syP5q9Dvuh7exeLwm4GqmiTZAoX_vAg_∼HasNbTwdBbCL4W0PAyhlvTXRMdoeo
3IWE9NQ2g20GQnpp67PtSMXkcVN9WXL14lCdPqsP278V9lZ11XBtm35BShPS27z67X_wEbjsbHMm8DJ9JTBYMoGfCPwze6sxz
NFFsk7yLDNJuc_zLHo24b_DnPglvDALycxSshCChWIBFiOFuAcSmDCmRXVNHOhqsH8kQfAJLhOsJLwTglmQd0FMILij∼QFy4tTNz0w1vzDjG
3wAb∼w%3D [https://perma.cc/5D43-3SY8]; U.S. Off. of Pers. Mgmt., Dynamics Data, Separations, FY 2015–FY 2019 (data cube), Federal
Workforce Data (Feb. 2024), https://www.fedscope.opm.gov/ibmcognos/bi/v1/disp?b_action=powerPlayService&m_encoding=UTF-8&BZ=
1AAABv6ePmJp42pVOQW6DQAz8jE2SQyOvFyI4cFjYReFQSAOXnqptsqmiUoiA∼6sCVCXtrTOyZI∼HI3tVua3q8mhyHQ9j17tcr5H5GpJvRCg
CtVPCJyOjROosldpPDCU7Qci88aZbo47p∼qDqfYycnbp2dO2InF265ux6DBL0qbVfDqVeHezp03644a1yN9vb8dq1wwoDjZzdltVv
∼4MNmeretWdkWmevyMQkAmR6QqafOdpMYZ6u0m1aFoVJ67wsCvVs4n8HeclLfCECQURCEAAQBARMMBHgHohMy
FOaahqkSNvR∼ZEAOUSWhOwE8jtytAjiLsAMZDnZHyBmzt3yzFzLCwu_AVRTb_0%3D [https://perma.cc/646G-6NBA]; U.S. Off. of Pers. Mgmt.,
Dynamics Data, Separations, FY 2020–FY 2024 (data cube), Federal Workforce Data (Feb. 2024), https://www.fedscope.opm.gov/ibmcognos/bi/
v1/disp?b_action=powerPlayService&m_encoding=UTF-8&BZ=1AAABv3dM77542pVOwW6DMAz9GZu2h1WOAa05
cIAkqD0MusKlpylr06kagwr4f00BTe1223uyZD8%7EPzmoynVVlwez08kwdr3b6SUyX2PJmeFYylCrSD9HKemNyFiQkkJpEyHzKvC3Jj2o
7T6ttwlyfura0bUjcn7pmrPrMc4wotZ_OQz1Ym9Pn%7EbDDW_Vu9nejteuHRYYa_T8Nq9__x9syFT3rj0j0zI%7EIpMnMj0h088crXx
YoCu1VmVRGFXvyqJIX0zy76Age00uRCCISAgCAIKYgAk8Ae6B6K99Wto0SFLb0f2RAHmDHBKyE8jvyHIWxF2ACcihtz9ATJy6_
Zmp5hdmfANkKW%7Ev [https://perma.cc/58FZ-T7VA].
f David Welna & Marisa Peñaloza, Not Expecting Back Pay, Government Contractors Collect Unemployment, Dip into Savings, NPR (Jan. 7,
2019), https://www.npr.org/2019/01/07/682821224/most-contractors-do-not-expect-to-get-back-pay-when-the-shutdown-ends [https://perma.cc/
K4AW-ARFW].
g U.S. Bureau of Labor Stat., Total Separations Rate, Total Nonfarm, Not Seasonally Adjusted (JTU000000000000000TSR), Job Openings and
Labor Turnover Survey, https://data.bls.gov/toppicks?survey=jt [https://perma.cc/VQQ3-7AT3] (data extracted Sept. 2024) (select ‘‘Total separations rate, Total nonfarm, not seasonally adjusted’’ from list; then click ‘‘Retrieve data’’). Estimate is based on the average annual separations
rate from 2000 to 2022. The estimate of former government officials is based on the average turnover rate for all employees in the economy.
h U.S. Dep’t of Def., ICF, 022 Demographics: Profile of the Military Community (2022), https://download.militaryonesource.mil/12038/MOS/Reports/2022-demographics-report.pdf [https://perma.cc/TP2G-UADR].
i U.S. Bureau of Labor Stat., Population Level—Total Veterans, 18 Years and Over (LNU00049526), Labor Force Statistics from the Current
Population Survey, https://beta.bls.gov/dataViewer/view/timeseries/LNU00049526 [https://perma.cc/P396-7M3A] (data extracted Feb. 2024).
The proposed rule highlights data
associated with ‘‘activists, academics,
journalists, dissidents, political figures,
or members of nongovernmental
organizations or marginalized
communities’’ that could be used to
‘‘intimidate such persons; curb political
opposition; limit freedoms of
expression, peaceful assembly, or
association; or enable other forms of
suppression of civil liberties.’’ 484 Table
VII–3 of this preamble describes the size
of these populations.
Table VII–3 of this preamble also
contains several figures that required
calculations based on certain
assumptions. The estimated number of
activists was calculated using a survey
from the Washington Post and Kaiser
Family Foundation that asked
respondents whether they considered
themselves activists; the percentage that
answered ‘‘yes’’ was then applied to the
current adult population. No data was
available on the number of people
residing in the United States who would
be considered dissidents, so an estimate
is provided for the size of this group.
For this analysis, marginalized
communities were assumed to include
members of the lesbian, gay, bisexual, or
transgender (‘‘LGBT’’) community;
religious minorities; and racial
minorities.485 The number of religious
minorities was calculated using the
percentage of the population that
identified as Jewish, Muslim, Buddhist,
Hindu, or another religion.486
As noted earlier in this section, the
populations affected by risks have
substantial overlap, so the Department
is unable to provide a single estimate of
the affected population. Nonetheless,
these estimates show that a substantial
portion of the U.S. population is
currently affected by the risks resulting
from adversaries’ access to bulk
sensitive personal data.
TABLE VII–3—POPULATIONS AFFECTED BY RISKS—OTHER GROUPS
Category
Population
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Activists a b ...................................................................................................................................................................................
Academics c .................................................................................................................................................................................
Journalists d ..................................................................................................................................................................................
Dissidents e f g h ............................................................................................................................................................................
Political figures i ...........................................................................................................................................................................
Members of non-governmental organizations j ............................................................................................................................
Marginalized communities—LGBT k ............................................................................................................................................
Marginalized communities—Religious b l .....................................................................................................................................
484 89
FR 15781.
groups that were assumed to be
marginalized communities are similar to the groups
most likely to be targeted in one or more countries
of concern, which differs from the definition of
underserved communities defined in Executive
Order 13985 (Advancing Racial Equity and Support
for Underserved Communities Through the Federal
Government), 89 FR 7009 (Jan. 20, 2021). For
examples of LGBT, religious, and racial minorities
being targeted in the countries of concern, see, e.g.,
485 The
VerDate Sep<11>2014
19:57 Oct 28, 2024
Jkt 265001
Bibek Bhandari & Elgar Hu, ‘Rainbow Hunters’
Target LGBTQ Chinese Students, Foreign Policy
(July 28, 2023), https://foreignpolicy.com/2023/07/
28/china-rainbow-hunters-target-lgbtq-students/
[https://perma.cc/UZ37-D48A]; Pew Rsch. Ctr.,
Government Policy Toward Religion in the People’s
Republic of China—A Brief History, Measuring
Religion in China (Aug. 30, 2023), https://
www.pewresearch.org/religion/2023/08/30/
government-policy-toward-religion-in-the-peoples-
PO 00000
Frm 00067
Fmt 4701
Sfmt 4702
46,973,153
1,380,290
44,530
127,929
519,682
715,790
13,942,200
14,352,908
republic-of-china-a-brief-history/ [https://perma.cc/
25CH-7AKH].
486 People who identify as Jewish, Muslim,
Buddhist, Hindu, or members of other religions are
non-Christian populations that each represent less
than 2 percent of the U.S. population. 2022 PRRI
Census of American Religion: Religious Affiliation
Updates and Trends, PRRI (Feb. 24, 2023), https://
www.prri.org/spotlight/prri-2022-american-valuesatlas-religious-affiliation-updates-and-trends/
[https://perma.cc/BQA7-MK2J].
E:\FR\FM\29OCP2.SGM
29OCP2
86182
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
TABLE VII–3—POPULATIONS AFFECTED BY RISKS—OTHER GROUPS—Continued
Category
Population
Marginalized communities—Race m (white Hispanic population not included) ...........................................................................
130,398,545
a Wash.
Post & Kaiser Family Found., Survey on Political Rallygoing and Activism (Apr. 2018), https://files.kff.org/attachment/Topline-Washington-Post-Kaiser-Family-Foundation-Survey-on-Political-Rallygoing-and-Activism [https://perma.cc/7ELT-NM6L].
b U.S. Census Bureau, K200104: Population by Age, American Community Survey, 1-Year Supplemental Estimates (2022), https://
data.census.gov/table/ACSSE2022.K200104 [https://perma.cc/D6KP-JTKD].
c U.S. Bureau of Labor Stat., 25–1000: Postsecondary Teachers, National Occupational Employment and Wage Estimates (May 2023), https://
www.bls.gov/oes/current/oes_nat.htm [https://perma.cc/8FTZ-FCMW].
d U.S. Bureau of Labor Stat., 27–3023: News Analysts, Reporters and Journalists, National Occupational Employment and Wage Estimates
(May 2023), https://www.bls.gov/oes/current/oes_nat.htm [https://perma.cc/8FTZ-FCMW].
e U.S. Dep’t of Homeland Sec., Off. of Immigr. Stat., 2003 Yearbook of Immigration Statistics (2004), https://www.dhs.gov/ohss/topics/immigration/yearbook/2003 [https://perma.cc/FSJ3-XRSG].
f U.S. Dep’t of Homeland Sec., Off. of Immigr. Stat., 2012 Yearbook of Immigration Statistics (2013), https://www.dhs.gov/ohss/topics/immigration/yearbook/2012 [https://perma.cc/XZG6-WL65].
g U.S. Dep’t of Homeland Sec., Off. of Immigr. Stat., 2022 Yearbook of Immigration Statistics (2023), https://www.dhs.gov/ohss/topics/immigration/yearbook/2022 [https://perma.cc/9YXU-Y2EF].
h U.S. Dep’t of Just., Exec. Off. for Immigr. Rev., Adjudication Statistics: Asylum Decision Rates by Nationality (2023), https://www.justice.gov/
eoir/page/file/1107366/dl [https://perma.cc/PJ7C-GRK4].
i How Many Politicians Are There in the USA? PoliEngine, https://poliengine.com/blog/how-many-politicians-are-there-in-the-us [https://
perma.cc/D5DG-KJHM].
j Ctr. on Nonprofits, Philanthropy, and Soc. Enter., George Mason U., Nonprofit Employment Data Project Jobs Recovery Data Dashboard
(Jan. 10, 2023), https://nonprofitcenter.schar.gmu.edu/nonprofit-employment-data-project/resources-and-dashboards/ [https://perma.cc/2XBZACDW].
k Andrew R. Flores & Kerith J. Conron, Adult LGBT Population in the United States, Williams Inst., UCLA Sch. of L. (2023), https://
williamsinstitute.law.ucla.edu/publications/adult-lgbt-pop-us/ [https://perma.cc/MZQ2-EAP9].
l 2022 PRRI Census of American Religion: Religious Affiliation Updates and Trends, PRRI (Feb. 24, 2023), https://www.prri.org/spotlight/prri2022-american-values-atlas-religious-affiliation-updates-and-trends/ [https://perma.cc/BQA7-MK2J].
m U.S. Census Bureau, K200201: Race, American Community Survey, 1-Year Supplemental Estimates (2022), https://data.census.gov/table/
ACSSE2022.K200201 [https://perma.cc/XJ3V-LH8J].
khammond on DSKJM1Z7X2PROD with PROPOSALS2
c. Summary of Baseline (Without the
Proposed Rule)
As stated in part IV.A.1 of this
preamble, the government-related data
or bulk U.S. sensitive personal data
discussed here may, under certain
conditions, be used against
individuals—such as members of the
military, government employees, and
government contractors—for illicit
purposes, including blackmail and
espionage. The risks of any particular
individual or group being targeted may
vary depending on the circumstances,
and these data illustrate the range of
such activities. Countries of concern can
also use access to government-related
data or Americans’ bulk U.S. sensitive
personal data to collect information on
activists, academics, journalists,
dissidents, political figures, and
members of nongovernmental
organizations or marginalized
communities to intimidate such
persons; curb political opposition; limit
freedoms of expression, peaceful
assembly, or association; or enable other
forms of suppression of civil liberties.
The individuals within the subgroups
most at risk of having their sensitive
personal data exploited by countries of
concern not only play important roles in
American society, but also make up a
large portion of the population. When
we consider that threats to the spouses
and children of targeted individuals
could also be made, the Department
estimates that the total population of
individuals who could potentially be
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
targeted is well over 100 million
individuals. Thus, the total number of
those who are at risk of being targeted
by foreign adversaries could exceed onethird of the entire American population.
Failing to prevent the current and future
sale or transfer of government-related
data or bulk U.S. sensitive personal data
to countries of concern effectively
forgoes all the benefits that may be
realized from such an action. Given the
nature of the benefits to be gained from
protecting national security and foreign
policy from malicious actors, these
benefits are unable to be monetized or
quantified but will be contrasted with
the estimated costs of the proposed
regulation.
6. Alternative Approaches
In addition to the proposed action, the
Department considered two alternatives.
The first alternative, the No Action
alternative, would take no regulatory
action and allow the unrestricted
transfer of bulk U.S. sensitive personal
data to any foreign company, person, or
country, including the countries of
concern. The No Action alternative
would not achieve the benefits of
reducing the risks to the targeted
populations or to U.S. national security
and foreign policy. The growing threats
related to foreign adversaries’ use of
bulk U.S. sensitive personal data,
enhanced by advancing technologies
such as artificial intelligence, for
purposes of subjecting American
citizens to exposure to blackmail and
other malicious actions would continue.
PO 00000
Frm 00068
Fmt 4701
Sfmt 4702
In addition to the sale of bulk U.S.
sensitive personal data, the vendor,
employment, and investment
agreements would also continue
without restrictions, as would the risks
that the proposed rule is intended to
reduce. Of course, the No Action
alternative would also result in no
additional costs to industry. As
explained in part VII.A.7 of this
preamble, however, the Department
considers the expected benefits of the
proposed regulation to greatly exceed
the estimated costs, resulting in net
benefits that are not realized by the No
Action alternative. Therefore, the
Department rejects the No Action
alternative.
The second alternative considered
was a prohibition of the transfer to
countries of concern of all data that
would fall within the scope of the
proposed rule. This alternative would
go further than directed by the Order,
the provisions of which were directed at
bulk U.S. sensitive personal data and
would entail more complicated and
costly enforcement efforts than the
proposed rule. Since this alternative
would prohibit not only bulk U.S.
sensitive personal data but also small
transfers of sensitive personal data that
may not present any marginal
substantial risk to national defense or
foreign policy, the small additional
benefits are not likely to justify the
much larger value of lost transactions
and compliance costs than the proposed
rule’s estimated cost of $502 million.
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Since the marginal costs of this
alternative over the costs of the
proposed regulation are expected to be
larger than the marginal benefits—if
there are any—associated with it, this
alternative would necessarily have
lower net benefits, as measured by total
benefits less total costs.
More generally, in addressing
proposals from commenters, the
Department also considered alternatives
that could broaden the scope of the rule
(and thus potentially be more costly) or
narrow its scope (and thus potentially
be less costly). These alternatives
include, for example, lowering or
increasing the proposed bulk
thresholds, prohibiting or restricting
(instead of exempting) additional
categories of transactions such as those
involving telecommunications or
clinical-trial data, expanding the list of
countries of concern, and expanding the
categories of covered persons. The
Department declined to adopt them
because they would appear not to
appropriately tailor the proposed rule to
the national security risks and could
cause unintended economic effects, for
the reasons more fully discussed with
respect to those proposals.
7. Benefits of the Proposed Rule
As mentioned in part VII.A.2 of this
preamble, the benefits of the proposed
rule associated with reducing threats to
national security and foreign policy are
difficult to measure. While these
benefits are difficult to measure, there is
a liberal opportunity for foreign
adversaries to access and exploit
Americans’ sensitive data without the
proposed rule. This situation and the
best-available information indicate that
there is a high likelihood of harm to
national security and that the harm to
national security could be high,
suggesting that the expected benefits of
the proposed rule exceed its expected
costs. Alternatively, even if the
likelihood of harm to national security
is low in some circumstances, the
potential damage to national security
remains high, suggesting that even
modest risk reductions are justified.
The proposed rule focuses on the risk
of access to government-related data or
bulk U.S. sensitive personal data by
countries of concern and covered
persons. Countries of concern can use
their access to Americans’ bulk sensitive
personal data to engage in malicious
cyber-enabled activities and malign
foreign influence as well as to track and
build profiles of U.S. individuals,
including members of the military and
Federal employees and contractors, for
illicit purposes such as blackmail and
espionage. Countries of concern can also
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
86183
exploit their access to Americans’ bulk
sensitive personal data to collect
information on activists, academics,
journalists, dissidents, political figures,
and members of nongovernmental
organizations or marginalized
communities to intimidate them; curb
political opposition; limit freedoms of
expression, peaceful assembly, or
association; or enable other forms of
suppression of civil liberties.
Nongovernmental experts have
underscored these risks.
Reducing these threats may produce
many qualitative benefits, such as
improving the security of the American
people and safeguarding democratic
values, all of which are beyond a
reasonable, reliable, and acceptable
estimate of quantified monetary value.
Other benefits may also arise, such as
the creation of new businesses to
provide vetting information to firms
seeking entrance into the restricted
transactions market, or advancements in
overall industry cybersecurity
technology that result in more secure
systems. We make no attempt to
quantify these potential benefits, but we
welcome comments that may allow us
to do so.
Similarly, the estimates of the costs of
requirements for affirmative due
diligence, security, recordkeeping,
affirmative reporting, and audits are
very preliminary in this analysis
because the size of the industry, percompany costs, and per-transaction
costs are very difficult to estimate
precisely. Furthermore, based on its
experience with similar regulations
related to economic sanctions and
export controls, the Department expects
the costs of compliance with this
proposed rule to vary significantly
across companies.
Our estimates reflect costs for firms
that currently engage in transactions
involving bulk U.S. sensitive personal
data. The universe of firms that engage
in transactions involving bulk U.S.
sensitive personal data is larger than the
subset of such firms that knowingly
transfer such data to countries of
concern or covered persons; this larger
universe of firms will need to undertake
some due diligence measures to ensure
that their typical data transfers are not
in fact going to countries of concern or
covered persons. Comments are
solicited and welcome on the estimates
that follow.
8. Costs of the Proposed Rule
a. Value of Lost and Forgone
Transactions
The economic costs of the proposed
rule are the lost economic value of the
covered transactions that are prohibited
or forgone, referred to as ‘‘direct costs,’’
and the costs of compliance (for
restricted transactions, the cost of
complying with the security
requirements established by DHS/CISA,
affirmative due diligence requirements,
audit requirements, and affirmative
reporting requirements).
Other provisions included in the
regulations—including regulations of
investment, employment, and vendor
agreements through the imposition of
security requirements—will have a
mixture of economic impacts, such as
one-time costs of switching to
approaches that will comply with new
regulations, and economic benefits,
such as improved cybersecurity
controls.
The challenge of estimating the
economic impact with any degree of
precision is that, because there are no
regulations prohibiting cross-border
bulk U.S. sensitive personal data
transactions, currently available data
provides incomplete, unreliable, or
irrelevant estimates of the types,
volume, and value of the bulk U.S.
sensitive personal data transfer activity
and thus creates uncertainty in
estimates of lost value due to the
proposed rule.
PO 00000
Frm 00069
Fmt 4701
Sfmt 4702
The costs of the proposed rule would
include the economic value of lost or
forgone transactions related to the sale,
transfer, and licensing of bulk U.S.
sensitive personal data, as well as
biospecimens, to the six countries of
concern. These lost or forgone
transactions would include transactions
that are prohibited as well as covered
data transactions that are forgone
because an entity decides not to bear the
costs of complying with the due
diligence and security requirements
necessary to engage in a restricted
transaction.
The total economic value of lost and
forgone transactions should not exceed
the total economic value of such exports
to these countries of concern, as, all else
equal, an entity would forgo a
transaction if its expected compliance
costs exceed the expected economic
value of the transaction. The anticipated
value of potentially regulated
transactions with all countries of
concern except China is negligible,
given the lack of general cross-border
transactions involving bulk sensitive
personal data and the existing
impediments to trade, such as economic
sanctions. More specifically, in recent
years, the proportions of U.S.
bidirectional trade and investment
E:\FR\FM\29OCP2.SGM
29OCP2
86184
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
represented by trade with Iran,487 North
Korea,488 and Cuba,489 respectively,
have been negligible or unknown. Trade
with Venezuela represents 0.1 percent
of U.S. totals.490
Trade with Russia averaged about 0.5
percent of all U.S. trade from 2014 to
2023, dropping to 0.1 percent in
2023.491 U.S. cross-investment (i.e., twoway foreign direct investment) 492 with
Russia averaged about 0.2 percent of
total U.S. foreign cross-investment from
2013 to 2022.493 In contrast, the
respective shares of U.S. imports/
exports and cross-investment that are
conducted with China have averaged
about 12 percent and 1.3 percent,
respectively, during the same
periods.494 Given this, the estimation of
the economic costs of lost or forgone
transactions here focuses primarily on
China, although Russia is also
considered.
Similarly, foreign direct investment
into the United States from countries of
concern in the information industry is a
relatively small portion of the total level
of foreign direct investment in this
sector. Chinese investment, which has
been the highest among countries of
concern, has been steadily falling over
the past several years. Foreign direct
investment figures, based on the country
of the ultimate beneficial owner and the
country of direct foreign ownership, are
presented in Tables VII–4 and VII–5 of
this preamble.
TABLE VII–4—FOREIGN DIRECT INVESTMENT POSITION IN THE UNITED STATES ON A HISTORICAL-COST BASIS IN THE
INFORMATION INDUSTRY BY COUNTRY OF ULTIMATE BENEFICIAL OWNER
[millions of dollars]
2016
All Countries Total .......
China ............................
Hong Kong ...................
Venezuela ....................
China + Hong Kong
Share ........................
Venezuela Share .........
2017
2018
2019
2020
2021
2022
171,474
1,806
366
(*)
197,266
2,413
416
(*)
208,932
2,286
148
¥3
204,950
2,936
562
¥5
182,913
1,700
413
¥6
259,867
1,432
429
¥7
254,691
452
417
(D)
1.3%
n/a
1.4%
n/a
1.2%
0.0%
1.7%
0.0%
1.2%
0.0%
0.7%
0.0%
0.3%
n/a
Note: (*) indicates a nonzero value that rounds to zero. (D) indicates that the data in the cell have been suppressed to avoid disclosure of data
of individual companies.
Source: U.S. Bureau of Econ. Analysis, Balance of Payments and Direct Investment Position Data: Foreign Direct Investment in the U.S., Foreign Direct Investment Position in the United States on a Historical-Cost Basis, Country of UBO and Industry (NAICS) (Millions of Dollars),
https://apps.bea.gov/iTable/?ReqID=2&step=1&_gl=1*ubcfnx*_ga*MjEzMzE0NDY0Ny4xNzA1NTc5Mjcw*_ga_J4698JNNFT*MTcyM
DYzNjY0My44Mi4xLjE3MjA2MzgzMzQuNTMuMC4w#eyJhcHBpZCI6Miwic3RlcHMiOlsxLDIsMyw0LDUsNywxMF0sImRhdGEiOltbIlN0Z
XAxUHJvbXB0MSIsIjIiXSxbIlN0ZXAxUHJvbXB0MiIsIjEiXSxbIlN0ZXAyUHJvbXB0MyIsIjEiXSxbIlN0ZXAzUHJvbXB0NCIsIjIyIl0sWyJTdGVwNFByb
21wdDUiLCIyMiJdLFsiU3RlcDVQcm9tcHQ2IiwiMSJdLFsiU3RlcDdQcm9tcHQ4IixbIjI4LDI5LDMwLDMxLDMyLDMzLDM0LDM
1LDM2LDM3LDM4LDM5LDQwLDQxLDQyLDQzLDQ4LDQ5LDUyLDU1LDU2LDU4LDYwLDYxLDY1LDY2Il1dLFsiU3RlcDhQcm9tcHQ5
QSIsWyI3Il1dLFsiU3RlcDhQcm9tcHQxMEEiLFsiMSJdXV19 [https://perma.cc/X7SK-2LD8].
TABLE VII–5—FOREIGN DIRECT INVESTMENT POSITION IN THE UNITED STATES ON A HISTORICAL-COST BASIS IN THE
INFORMATION INDUSTRY BY COUNTRY OF DIRECT FOREIGN PARENT
[millions of dollars]
2016
All Countries Total .......
China ............................
Hong Kong ...................
Venezuela ....................
China + Hong Kong
Share ........................
Venezuela Share .........
2017
2018
2019
2020
2021
2022
171,474
134
(D)
¥4
197,266
(D)
(D)
(D)
208,932
4,286
¥53
¥3
204,950
4,882
389
¥2
182,913
3,480
284
¥2
259,867
2,809
282
(*)
254,691
772
196
(D)
n/a
0.0%
n/a
n/a
2.0%
0.0%
2.6%
0.0%
2.1%
0.0%
1.2%
N/A
0.5%
N/A
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Note: (*) indicates a nonzero value that rounds to zero. (D) indicates that the data in the cell have been suppressed to avoid disclosure of data
of individual companies.
Source: U.S. Bureau of Econ. Analysis, Balance of Payments and Direct Investment Position Data: Foreign Direct Investment in the U.S., Foreign Direct Investment Position in the United States on a Historical-Cost Basis, By Country and Industry (NAICS) (Millions of Dollars) https://
apps.bea.gov/iTable/?ReqID=2&step=1&_gl=1*ay559c*_ga*MTM5ODMzNTkyNy4xNzEwMjgzOTY0*_ga_J4698JNNFT*MTcyMjk0OD
k5My4yNi4xLjE3MjI5NTA2NTEuNTcuMC4w#eyJhcHBpZCI6Miwic3RlcHMiOlsxLDIsMyw0LDUsNywxMF0sImRhdGEiOltbIlN0ZXAxUH
JvbXB0MSIsIjIiXSxbIlN0ZXAxUHJvbXB0MiIsIjEiXSxbIlN0ZXAyUHJvbXB0MyIsIjEiXSxbIlN0ZXAzUHJvbXB0NCIsIjIyIl0sWyJTdGVwNF
Byb21wdDUiLCIxIl0sWyJTdGVwNVByb21wdDYiLCIxIl0sWyJTdGVwN1Byb21wdDgiLFsiNjYiLCI2NSIsIjYxIiwiNjAiLCI1OCIsIjU2Ii
wiNTUiXV0sWyJTdGVwOFByb21wdDlBIixbIjciXV0sWyJTdGVwOFByb21wdDEwQSIsWyIxIl1dXX0= [https://perma.cc/NH7V-GZNU].
487 U.S. Census Bureau, Trade in Goods with Iran,
https://www.census.gov/foreign-trade/balance/
c5070.html [https://perma.cc/EAZ7-PJU2].
488 U.S. Census Bureau, Trade in Goods with
Korea, North, https://www.census.gov/foreigntrade/balance/c5790.html [https://perma.cc/NY7XDRBA].
489 U.S. Census Bureau, Trade in Goods with
Cuba, https://www.census.gov/foreign-trade/
balance/c2390.html [https://perma.cc/CUF2FWWY].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
490 U.S. Bureau of Econ. Analysis, U.S.
International Trade in Goods and Services,
Venezuela, Venezuela—International Trade and
Investment Country Facts, https://apps.bea.gov/
international/factsheet/factsheet.html#219 [https://
perma.cc/2K9N-YGFS].
491 U.S. Bureau of Econ. Analysis, U.S.
International Trade in Goods and Services, Russia,
Russia—International Trade and Investment
Country Facts, https://apps.bea.gov/international/
factsheet/factsheet.html#341 [https://perma.cc/
GF8U-6GK2].
PO 00000
Frm 00070
Fmt 4701
Sfmt 4702
492 Mark Casson & Nigel Wadeson, CrossInvestments by Multinationals: A New Perspective,
14 Glob. Strategy J. 279, 279–80 (2023) (defining
cross-investment as ‘‘where firms conduct FDI into
each other’s home countries’’).
493 U.S. Bureau of Econ. Analysis, supra note 491.
494 U.S. International Trade in Goods and
Services, China, China—International Trade and
Investment Country Facts, https://apps.bea.gov/
international/factsheet/factsheet.html#650 [https://
perma.cc/X7QF-CYXH].
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
Note that some fraction of the lost or
forgone data transactions may be for
beneficial uses. Beneficial uses of bulk
U.S. sensitive personal data in the
countries of concern may include
consumer-choice improvements and the
use of artificial intelligence to expedite
innovation in drug discovery and
increase knowledge of patterns of, for
example, consumption, commerce,
transportation, traffic, information/news
transmission, nutrition, and health.
The following analysis relies in part
on data available from the BEA on U.S.
exports of telecommunications,
computer, and information services,
both in total and for each of the three
sub-categories, to China and Russia.
Tables VII–6 and VII–7 of this preamble
rely on an analysis of the BEA data to
approximate the value of lost
transactions.
i. Global Market Value of Genomic,
Biometric, and Location Data
Genomic data includes data that is
used in drug discovery and
development, specifically in developing
products such as systems, software, and
reagents, and in developing processes
such as cell isolation, sample
preparation, and genomic analysis.495
Biometric data is used in consumer
electronics and automotive applications
for safety, surveillance, and
identification methods, including facial,
posture, voice, fingerprint, and iris
recognition technologies.496 Location
data is used in smart devices, network
services for improved connectivity,
systems integration, monitoring, and
satellite location technology, as well as
to produce timely, relevant and
personalized offers/information for
customers.497
86185
According to market research data
from one company,498 the global
genomics market’s value is estimated at
$27.58 billion in 2021, $32.56 billion in
2022, and, given an estimated
compound annual growth rate of 18.2
percent, $38.49 billion in 2023 and
$45.49 billion in 2024.499 One estimate
of the global biometric technology
market values it at $34.27 billion in
2022 and, given an estimated 20.4
percent compound annual growth rate,
$41.26 billion in 2023 and $49.68
billion in 2024.500 Finally, one estimate
values the global location data market at
$18.52 billion in 2023 and, given an
estimated 15.6 percent compound
annual growth rate, $21.41 billion in
2024.501 Table VII–6 of this preamble
presents these global totals for genomic,
biometric, and location data
estimates.502
TABLE VII–6—GLOBAL TECHNOLOGY MARKET VALUE ESTIMATES FOR GENOMIC, BIOMETRIC, AND LOCATION DATA FOR
2021–2024 (IN BILLIONS OF 2022 DOLLARS) WITH COMPOUND ANNUAL GROWTH RATE (‘‘CAGR’’)
Data type
2021
2022
Genomic a .............................................................................
Biometric b ............................................................................
Location c ..............................................................................
$27.58
........................
........................
$32.56
34.27
........................
2023
2024
$38.49
41.26
18.52
$45.49
49.68
21.41
CAGR
(%)
18.2
20.4
15.6
a Genomics Global Market to Reach $63.5 Billion in 2026 at a CAGR of 18.2%, Globe Newswire (Sept. 6, 2022), https://
www.globenewswire.com/en/news-release/2022/09/06/2510235/28124/en/Genomics-Global-Market-to-Reach-63-5-Billion-in-2026-at-a-CAGR-of18-2.html [https://perma.cc/SUV8-VVMK].
b Grand View Research, Report ID No. 978–1–68038–299–0, Biometric Technology Market Size, Share & Trends Analysis Report, 2023–2030
(2023), https://www.grandviewresearch.com/industry-analysis/biometrics-industry [https://perma.cc/KN36-3KZW].
c Grand View Research, Report ID No. GVR–2–68038–401–7, Location Intelligence Market Size, Share & Trends Analysis Report, 2024–2030
(2024), https://www.grandviewresearch.com/industry-analysis/location-intelligence-market [https://perma.cc/WS6U-2324].
Data is available on U.S. exports in
the category of telecommunications,
computer, and information services,
both in total and for each of these three
service subcategories, to China and
Russia.503 Data on exports in a relevant
sub-category of information services—
database and other information
services—is available globally and for
both China and Russia individually.
Telecommunications, Computer, and
Information Services is one of the
eleven service categories BEA presents
in the U.S. international transactions
accounts. The Telecommunications
Services sub-category includes basic
services (e.g., transmitting messages
between destinations) as well as valueadded and support services. The
Computer Services sub-category
includes software, computing and datastorage services, hardware and software
consultancy, and licensing agreements
tied to downloading applications. The
category of information services
includes database services and web
search portals, which belong to one
subcategory, and news agency services,
which belong to the other.504 This
Database Services sub-category includes
data brokers.
Table VII–7 of this preamble presents
the value of U.S. exports of
telecommunications services, computer
services, information services, and the
database and other information services
component of information services. The
table also reports exports to China for
the three components combined and the
exports to China and Russia
individually for database and other
information services.
495 Genomics Global Market to Reach $63.5
Billion in 2026 at a CAGR of 18.2%, Globe
Newswire (Sept. 6, 2022), https://
www.globenewswire.com/en/news-release/2022/09/
06/2510235/28124/en/Genomics-Global-Market-toReach-63-5-Billion-in-2026-at-a-CAGR-of-18-2.html
[https://perma.cc/SUV8-VVMK].
496 Grand View Research, Report ID No. 978–1–
68038–299–0, Biometric Technology Market Size,
Share & Trends Analysis Report, 2023–2030 (2023),
https://www.grandviewresearch.com/industryanalysis/biometrics-industry [https://perma.cc/
KN36-3KZW].
497 Grand View Research, Report ID No. GVR–2–
68038–401–7, Location Intelligence Market Size,
Share & Trends Analysis Report, 2024–2030 (2024),
https://www.grandviewresearch.com/industryanalysis/location-intelligence-market [https://
perma.cc/WS6U-2324].
498 Genomics Global Market to Reach $63.5
Billion in 2026 at a CAGR of 18.2%, supra note 495.
499 Id.
500 Grand View Research, supra note 496.
501 Grand View Research, supra note 497.
502 The Department notes several caveats with the
Grand View Research estimates shown in Tables
VII–4 and VII–5 of this preamble, including nontransparent methods for gathering data and
producing estimates, a non-statistical sample of
firms that may not be statistically representative of
the industry, and non-response bias from
interviewees from the firms.
503 U.S. Bureau of Econ. Analysis, U.S.
International Economic Accounts: Concepts and
Methods, at 248 (June 2023), https://www.bea.gov/
system/files/2023-06/iea-concepts-methods2023.pdf [https://perma.cc/8M48-Q2ZG].
504 Id.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
ii. U.S. Exports to Relevant Specific
Categories and to Countries of Concern
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
PO 00000
Frm 00071
Fmt 4701
Sfmt 4702
E:\FR\FM\29OCP2.SGM
29OCP2
86186
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
TABLE VII–7—U.S. EXPORTS OF TELECOMMUNICATIONS, COMPUTER, AND INFORMATION SERVICES
[In billions of 2023 dollars]
Service
All
China
Russia
Components
Telecommunications Services .....................................................................................................
Computer Services ......................................................................................................................
Information Services ....................................................................................................................
$9.329
$50.328
$10.972
$0.095
$1.847
$0.318
$0.041
$0.113
$0.034
Total Value ...........................................................................................................................
$70.629
$2.260
$0.188
Percentage of Total ..............................................................................................................
100%
3.20%
0.27%
Value ............................................................................................................................................
$10.768
* $0.318
$0.032
Percentage of Total ..............................................................................................................
100%
2.94%
0.30%
Database and Other Information Services
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Source: U.S. Bureau of Econ. Analysis, International Transactions, International Services, and International Investment Position Tables, Tables
2.2, https://www.bea.gov/itable/direct-investment-multinational-enterprises [https://perma.cc/9XWQ-A8YQ] (last updated July 23, 2024).
* An upper bound for 2023 is $0.318.
The $10.768 billion Database and
Other Information Services sub-category
comprises most (98.1 percent) of the
$10.972 billion Information Services
category, with the other $0.275 billion
(2.6 percent) in the News-Agency
Services category. For the Database and
Other Information Services subcategory, U.S. exports to China are
$0.318 billion ($318 million) for 2023,
which is 2.94 percent of the U.S. export
total. U.S. exports to Russia are $0.32
billion ($32 million), which is 0.30
percent of the U.S. export total.
These U.S. export estimates are
significantly over-inclusive, as they
include many kinds of data that are
explicitly excluded from regulation
under the proposed rule, such as web
browser history and other expressive
data, in addition to services that do not
involve data transfer at all.
Consequently, the estimates of the costs
due to lost or foregone transactions
resulting from the proposed rule are
probably overstated.
Tables VII–6 and VII–7 of this
preamble comprise the ‘‘raw’’ data on
U.S. exports to countries of concern that
provide upper-bound estimates of the
value of lost or forgone transactions.
Given the available data that informs the
following analysis, the Department
welcomes comments on the use of this
data and on any alternative or
additional data that could also be
employed.
iii. Estimates of U.S. Exports of
Genomic, Biometric, and Location Data
This section provides estimates of
U.S. revenue from sales for three
categories of data covered under the
proposed rule for which data on the
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
global market are available: genomic,
biometric, and location data.
Given the lack of available published
estimates of the value of U.S. exports of
such data to China, Russia, and other
countries of concern, the Department
developed a multi-step method for
estimating the value of lost transactions
in genomic, biometric, and location data
to the countries of concern. To
summarize, we began with market
research companies’ estimates of the
size of the global markets in geometric,
biometric, and location data shown in
Table VII–6 of this preamble. Then we
derived estimates of the value of lost
transactions through a three-step
process that involved estimating the
U.S. share (domestic plus export) of the
global market, estimating the percentage
of U.S. global sales that are domestic,
and finally making some data-informed
assumptions about the share of global
sales in those industries that were to the
countries of concern.
In 2022, the total value of the U.S.
location data market was $4.20 billion,
with a projected compound annual
growth rate of 13.6 percent.505 Based on
these estimates, it can be projected that
the U.S. portion in 2023 would be $4.77
billion ($4.20 * 1.136 = $4.77). As
shown in Table VII–6 of this preamble,
the market research company estimated
that the global market value of location
data in 2023 was $18.52 billion, so the
estimated U.S. portion in 2023 would
constitute 25.76 percent of that
estimated global value ($4.77/$18.52 =
0.2576). Because the market research
company estimated the U.S. compound
annual growth rate for location data to
be 13.6 percent and the global
505 Grand
PO 00000
View Research, supra note 497.
Frm 00072
Fmt 4701
Sfmt 4702
compound annual growth rate to be 15.6
percent, it can be projected that the U.S.
portion of the global market in 2024
would fall slightly, from 25.76 percent
to 25.31 percent (($4.77 * 1.136)/($18.52
* 1.156) = 0.2531).
The market research company
estimated that the North American
revenue share of the global biometric
technology market in 2022 was 30.7
percent.506 If Canada and Mexico were
responsible for 5 percent of global
market value, then the U.S. share of the
global biometric data market in 2022
would be 25.7 percent, nearly the same
as the portion for location data in 2023.
Given the alignment in our estimates of
the U.S. market share for location and
biometric data markets, we assume that
the estimated U.S. location data market
in 2024 (25.31 percent) also applies to
the U.S. portion of global genomic and
biometric data. With that assumption,
we estimate that the U.S. genomic data
market is worth $12.57 billion in 2024
(25.31 percent of $49.68 billion (from
Table VII–6 of this preamble)), and the
U.S. market is worth $5.42 billion (25.31
percent of $21.41 billion). Table VII–8 of
this preamble provides 2024 estimates
of U.S. revenue (foreign plus domestic)
for those three industries.
Next, the Department assumes that
U.S. exports in genomic, biometric, and
location data constitute 30 percent of
total U.S. revenue (domestic sales plus
exports). This assumption is based on
market research from a U.S.-based
company,507 which estimated that in
506 Grand
View Research, supra note 496.
research data includes: Genomics
Global Market to Reach $63.5 Billion in 2026 at a
CAGR of 18.2%, supra note 495; Grand View
Research, supra note 496; Grand View Research,
supra note 497.
507 Market
E:\FR\FM\29OCP2.SGM
29OCP2
86187
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
2017, 30 percent of revenue for data
brokerage companies came from
international sales. When applying this
assumption to revenue from sales of
genomic, biometric, and location data,
we estimate that exports of U.S.
genomic data in 2023 were worth $3.454
billion for genomic data (30 percent of
$11.513 billion); exports of biometric
data were worth $3.772 billion (30
percent of $12.574 billion); and exports
of location data were worth $1.626
billion (30 percent of $5.419 billion).
Table VII–8 of this preamble presents
estimated revenue from U.S. exports
(Step 2) alongside the other estimates
from which it was derived.
TABLE VII–8—ESTIMATED REVENUE FROM INTERNATIONAL SALES OF GENOMIC, BIOMETRIC, AND LOCATION DATA IN 2023
[In billions of 2024 dollars]
Global
revenue
(from Table
VII-6) a
Category of data
U.S. revenue
(domestic
sales +
exports) b
Revenue from
U.S. exports c
Genomic .......................................................................................................................................
Biometric ......................................................................................................................................
Location .......................................................................................................................................
$45.49
$49.68
$21.41
$11.51
$12.57
$5.42
$3.45
$3.77
$1.63
Total ......................................................................................................................................
U.S. Revenue Share of Global Total ...................................................................................
U.S. Export Share of U.S. Revenue ............................................................................................
$116.58
........................
........................
$29.51
25.31%
........................
$8.85
........................
30%
a Genomics Global Market to Reach $63.5 Billion in 2026 at a CAGR of 18.2%, Globe Newswire (Sept. 6, 2022), https://
www.globenewswire.com/en/news-release/2022/09/06/2510235/28124/en/Genomics-Global-Market-to-Reach-63-5-Billion-in-2026-at-a-CAGR-of18-2.html [https://perma.cc/SUV8-VVMK]; Grand View Research, Report ID No. 978–1–68038–299–0, Biometric Technology Market Size, Share
& Trends Analysis Report, 2023–2030 (2023), https://www.grandviewresearch.com/industry-analysis/biometrics-industry [https://perma.cc/KN363KZW]; Grand View Research, Report ID No. GVR–2–68038–401–7, Location Intelligence Market Size, Share & Trends Analysis Report, 2024–
2030 (2024), https://www.grandviewresearch.com/industry-analysis/location-intelligence-market [https://perma.cc/WS6U-2324].
b Department of Justice estimates based on global revenue data from Table VII–6 of this preamble. U.S. Revenue (Domestic Sales + Exports)
is assumed to be 25.31 percent of the total global revenue for each category of data.
c Department of Justice estimates based on data in global revenue data from Table VII–6 of this preamble. Revenue from U.S. exports is assumed to be 30 percent of the U.S. revenue for each category of data.
To reiterate, the Department assumes
that U.S. exports in genomic, biometric,
and location data constitute 30 percent
of total U.S. revenue (domestic sales
plus exports). The Department uses this
assumption to inform the analysis
throughout part VII of this preamble.
iv. Estimates of U.S. Exports of
Genomic, Biometric, and Location Data
to the Six Countries of Concern
As delineated above in this section,
the current value of potentially
regulated transactions with all countries
of concern except China and, to a lesser
degree, Russia is negligible, given the
lack of general cross-border trade in data
and data-driven services and the general
impediments to trade with these
countries of concern, such as economic
sanctions. We therefore focus this part
of the analysis on China, and to a lesser
degree on Russia due to the $32 million
in U.S. exports of database and other
information services to Russia.508 The
Department lacks data on cross-border
transfers of genomic, biometric, and
location data other than sales. An
example of such cross-border transfers
may include transfer of data within
multinational companies.
As set forth in Table VII–7 of this
preamble and the subsequent discussion
in part VII.A.8.a.ii of this preamble, 3
percent (0.032 = $0.318 of $10.768
billion) of U.S. exports of database and
other information services are currently
to China and 1 percent are to Russia
(0.0106 = $0.111 of $10.768 billion).
Applying these percentages to the value
of U.S. exports of genomic, biometric,
and location data set forth in Table VII–
8 of this preamble yields estimates for
the value of U.S. exports of genomic,
biometric, and location data to China
and Russia. The estimates for U.S.
exports of genomic, biometric and
location data to China total $267 million
and to Russia total $94 million.
TABLE VII–9—ESTIMATES OF U.S. EXPORTS OF GENOMIC, BIOMETRIC, AND LOCATION DATA TO CHINA AND RUSSIA
[In billions of 2022 dollars]
U.S. exports
(from table
VII–8)
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Category of data
U.S. exports
to China a
U.S. exports
to Russia b
Genomic .......................................................................................................................................
Biometric ......................................................................................................................................
Location .......................................................................................................................................
$3.45
$3.77
$1.63
$0.10
$0.11
$0.05
$0.04
$0.04
$0.02
Total ......................................................................................................................................
China share of U.S. exports ........................................................................................................
Russia share of U.S. exports ......................................................................................................
$8.85
........................
........................
$0.27
3.02%
........................
$0.10
........................
1.06%
a Revenue
b Revenue
from U.S. exports to China is assumed to be 3.02 percent of total revenue from U.S. exports for each category of data.
from U.S. exports to Russia is assumed to be 1.06 percent of total revenue from U.S. exports for each category of data.
508 See discussion in part VII.A.8.a of this
preamble.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
PO 00000
Frm 00073
Fmt 4701
Sfmt 4702
E:\FR\FM\29OCP2.SGM
29OCP2
86188
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
Source: Department of Justice estimates based on market research data from U.S.-based company, including: Genomics Global Market to
Reach $63.5 Billion in 2026 at a CAGR of 18.2%, Globe Newswire (Sept. 6, 2022), https://www.globenewswire.com/en/news-release/2022/09/06/
2510235/28124/en/Genomics-Global-Market-to-Reach-63-5-Billion-in-2026-at-a-CAGR-of-18-2.html [https://perma.cc/SUV8-VVMK]; Grand View
Research, Report ID No. 978–1–68038–299–0, Biometric Technology Market Size, Share & Trends Analysis Report, 2023–2030 (2023), https://
www.grandviewresearch.com/industry-analysis/biometrics-industry [https://perma.cc/KN36-3KZW]; Grand View Research, Report ID No. GVR–2–
68038–401–7, Location Intelligence Market Size, Share & Trends Analysis Report, 2024–2030 (2024), https://www.grandviewresearch.com/industry-analysis/location-intelligence-market [https://perma.cc/WS6U-2324].
v. Total Estimated Value of Lost and
Forgone Transactions
To reiterate, U.S. exports of genomic,
biometric, and location data to China
and Russia totaled approximately $361
million in 2022. Some of these exports
may have been for beneficial uses, such
as consumer-choice improvement;
effective medical responses; and
increased knowledge of patterns of
consumption, commerce, transportation,
traffic, information/news transmission,
nutrition, and health. The Department’s
estimates of the value of lost
transactions do not include the potential
value of any lost positive externalities to
U.S. residents. The estimated annual
value of lost or forgone transactions is
presented in Table VII–10 of this
preamble.
TABLE VII–10—ESTIMATED ANNUAL VALUE OF LOST TRANSACTIONS: GENOMIC, BIOMETRIC, AND LOCATION DATA
[In millions of 2022 dollars]
Value of forgone
transactions
Country of concern
China ............................................................................................................................................................................................
Russia ..........................................................................................................................................................................................
$267
94
Total ......................................................................................................................................................................................
361
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Source: Department of Justice estimates based on market research data from U.S.-based company, including: Genomics Global Market to
Reach $63.5 Billion in 2026 at a CAGR of 18.2%, Globe Newswire (Sept. 6, 2022), https://www.globenewswire.com/en/news-release/2022/09/06/
2510235/28124/en/Genomics-Global-Market-to-Reach-63-5-Billion-in-2026-at-a-CAGR-of-18-2.html [https://perma.cc/SUV8-VVMK]; Grand View
Research, Report ID No. 978–1–68038–299–0, Biometric Technology Market Size, Share & Trends Analysis Report, 2023–2030 (2023), https://
www.grandviewresearch.com/industry-analysis/biometrics-industry [https://perma.cc/KN36-3KZW]; Grand View Research, Report ID No. GVR–2–
68038–401–7, Location Intelligence Market Size, Share & Trends Analysis Report, 2024–2030 (2024), https://www.grandviewresearch.com/industry-analysis/location-intelligence-market [https://perma.cc/WS6U-2324].
The Department welcomes comments
on the use of this data and on any
alternative or additional data that could
also be employed. The Department
reiterates the following limitations on
these estimates, described in further
detail in the analysis above:
1. The estimate assumes that the U.S.
share of the global market value for
location data is the same as the U.S.
share of the global market value for
genomic and biometric technology.
2. The export share of each of these
respective U.S. markets is assumed to be
the same as the share of revenue of U.S.
data-brokerage companies that comes
from international sales, which is 30
percent.
3. The estimate assumes that the
database (and other information)
services category of BEA’s data includes
most data brokers.
4. The estimate uses the share of U.S.
exports of database and other
information services that go to China
and Russia to estimate the share of U.S.
exports of genomic, biometric, and
location data that go to China and
Russia.
5. The Department assumes that the
annual economic value of lost and
forgone transactions would be equal to
the value of all U.S. exports of
biometric, location, and genomic data to
China and Russia.
vi. Alternative Methodology for
Estimating the Value of Lost and
Forgone Transactions
An alternative estimate of the value of
U.S. exports to China and Russia for this
analysis can be derived from BEA data
on the value of U.S. exports of database
and other information services. As
shown in the bottom of Table VII–7 of
this preamble, BEA’s estimates for 2023
were $318 million for China and $32
million for Russia.
Given the rapid growth of Chinese
exports, the Department projected the
2023 BEA estimate forward to 2024.
Based on the growth rates of U.S.
exports of information services to China
between 2006 and 2023,509 using an
annual growth rate of 5 percent for
China 510 would increase BEA’s $318
million estimate for 2023 to $334
million for 2024.
The Department’s alternative
estimates for the value of lost
transactions are $334 million in forgone
exports of information services to China
and $32 million in foregone exports of
information services to Russia, as shown
in Table VII–11 of this preamble.
509 U.S. Bureau of Econ. Analysis, Table 2.3. U.S.
Trade in Services, by Country or Affiliation and by
Type of Service, International Transactions,
International Services, and International Investment
Position Tables, https://apps.bea.gov/iTable/
?reqid=62&step=9&isuri=
1&product=4#eyJhcHBpZCI6NjIsIn
N0ZXBzIjpbMSw5LDEwLDcsN10sImRhd
GEiOltbInByb2R1Y3QiLCI0Il0sWy
JUYWJsZUxpc3QiLCIzMDU4MyJdLFsi
VGFibGVMaXN0U2Vjb25k
YXJ5IiwiMzA2NTYiXSxbIkZpbHRlcl
8jMSIsWyIxIiwiMiIsIjMiLCI0I
iwiNSIsIjYiLCI3IiwiOCIs
IjkiLCIxMCIsIjExIiwiMTIiLCI
xMyIsIjE0IiwiMTUiLCIxNiIs
IjE3IiwiMTgiXV0sWyJGaWx0ZXJfIz
IiLFsiMjgiLCI3MyJdXSxbIkZ
pbHRlcl8jMyIsWyIxIiwiNTUi
LCI2MSIsIjYzIl1dLFsiRmlsdGV
yXyM0IixbIjAiXV0sWyJGaWx
0ZXJfIzUiLFsiMCJdXV19 [https://perma.cc/7USSP3PL].
510 Chu Daye, China Achieves 5.2% GDP Growth
in 2023, Global Times (Jan. 17, 2024), https://
www.globaltimes.cn/page/202401/1305571.shtml
[https://perma.cc/3NGJ-RXZ7].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
PO 00000
Frm 00074
Fmt 4701
Sfmt 4702
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
86189
TABLE VII–11—ESTIMATES OF THE ANNUAL VALUE OF LOST TRANSACTIONS USING ALTERNATIVE METHODOLOGY
[In millions of 2022 dollars]
Estimated value of
U.S. exports of data
and information
services
Country of concern
China ....................................................................................................................................................................................
Russia ..................................................................................................................................................................................
$334
32
Total ..............................................................................................................................................................................
366
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Source: U.S. Bureau of Econ. Analysis, Table 2.3. U.S. Trade in Services, by Country or Affiliation and by Type of Service, International Transactions, International Services, and International Investment Position Tables, https://apps.bea.gov/iTable/?reqid=62&step=9&isuri=
1&product=4#eyJhcHBpZCI6NjIsInN0ZXBzIjpbMSw5LDEwLDcsN10sImRhdGEiOltbInByb2R1Y3QiLCI0Il0sWyJUYWJsZUxpc3Q
iLCIzMDU4MyJdLFsiVGFibGVMaXN0U2Vjb25kYXJ5IiwiMzA2NTYiXSxbIkZpbHRlcl8jMSIsWyIxIiwiMiIsIjMiLCI0IiwiNSIsI
jYiLCI3IiwiOCIsIjkiLCIxMCIsIjExIiwiMTIiLCIxMyIsIjE0IiwiMTUiLCIxNiIsIjE3IiwiMTgiXV0sWyJGaWx0ZXJfIzIiLFsiMjgiLCI3
MyJdXSxbIkZpbHRlcl8jMyIsWyIxIiwiNTUiLCI2MSIsIjYzIl1dLFsiRmlsdGVyXyM0IixbIjAiXV0sWyJGaWx0ZXJfIzUiLFsiMCJdXV19 [https://perma.cc/
7USS-P3PL].
Under this alternative methodology,
the Department’s estimate of the
economic value of transactions lost due
to the proposed rule is $366 million per
year (Table VII–11 of this preamble),
compared with the $361 million
estimate reached in the main analysis
(Table VII–10 of this preamble).
The alternative methodology may
overestimate the annual value of lost
transactions, since the BEA category for
the Database and Other Information
Services may include many kinds of
data that are explicitly excluded from
regulation under the proposed rule
(such as web-browser history and other
expressive data).511 The comparability
of the main and alternative
methodologies suggests that the main
estimate of $361 million may
underestimate the annual value of lost
transactions because it does not include
personal financial data or health
records. With these disparities in mind,
we are estimating the value of lost
transactions at the midpoint of these
estimates, $364 million, and solicit
comments on this total.
The Department estimates that the
economic value of lost or forgone
transactions would be minimal for firms
not engaged in data brokerage (i.e., for
restricted transactions). In other words,
the Department assumes that firms not
engaged in data brokerage would bear
minimal economic costs beyond those
that may be associated with
implementing and maintaining a riskbased compliance program (as described
in § 202.302 of the proposed rule). For
example, the Department assumes that
the small number of U.S.-based firms
currently using Chinese cloud-service
providers to store prohibited or
restricted data would be able to switch
to another cloud service provider at low
or no cost, given that Chinese cloud511 Sherman,
VerDate Sep<11>2014
supra note 6.
17:46 Oct 28, 2024
Jkt 265001
service providers constitute only a tiny
fraction of the cloud market for U.S.based firms. The Department assumes
that the other five countries of interest
do not sell cloud services of any
significant value to the United States.512
b. Security Costs
Data security is an important aspect of
protecting government-related data or
bulk U.S. sensitive personal data from
being improperly accessed by foreign
adversaries or in ways that could pose
a threat to national security. The
proposed rule incorporates by reference
proposed security requirements that
have been developed by DHS through
CISA, which represent conditions that
businesses must meet to engage in
restricted transactions. These security
requirements are intended to address
national security and foreign-policy
threats that arise when countries of
concern and covered persons access
government-related data or bulk U.S.
sensitive personal data that may be
implicated by the categories of restricted
transactions. Specifically, the proposed
rule would prohibit U.S. persons from
engaging in transactions unless they
comply with three categories of
requirements, the first two of which are
addressed in the proposed security
requirements, which are proposed to be
incorporated by reference:
1. Organizational and system-level
requirements for instituting
cybersecurity policies, practices, and
requirements for any covered system
(which CISA proposes to define as a
specific type of information system that
is used to conduct a number of activities
related to covered data as part of a
restricted transaction).
512 David McCabe, China’s Cloud Computing
Firms Raise Concern for U.S., N.Y. Times (June 21,
2023), https://www.nytimes.com/2023/06/21/
technology/china-cloud-computing-concern.html
[https://perma.cc/4CQJ-F6GJ].
PO 00000
Frm 00075
Fmt 4701
Sfmt 4702
2. Data-level requirements using any
combination of the following
capabilities necessary to prevent access
to covered data by covered persons or
countries of concern:
a. Data minimization and data
masking;
b. Encryption;
c. Privacy-enhancing technologies;
and
d. Denial of access.
3. Compliance-Related Requirements for
Independent Testing and Auditing
These requirements would impose
new costs on firms to the extent that
they are not already voluntarily meeting
such requirements. Any additional costs
may be offset by reducing cyber
incidents and their associated costs. The
Department estimates the new
cybersecurity-related costs imposed on
affected firms by analyzing the costs
that companies at different sizes and
levels of technological maturity face
when implementing existing security
standards and frameworks of similar
scope.
i. Similar Security Standards and
Frameworks
The proposed rule would create
cybersecurity standards that are based
on, and thus overlap with, several
similar, widely used cybersecurity
standards or frameworks. Currently,
firms engaged in transactions that are
proposed to be restricted transactions
are encouraged—but generally not
explicitly required—to comply with
existing Federal cybersecurity standards
or frameworks. Given the similarities
between the proposed rule’s security
requirements and existing cybersecurity
standards and frameworks, the costs of
complying with one of the existing,
commonly implemented sets of
cybersecurity standards or frameworks
are likely similar to the costs that would
be incurred by businesses to comply
E:\FR\FM\29OCP2.SGM
29OCP2
86190
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
with the proposed rule. Furthermore,
such costs will be offset because, as
commenters generally agreed, most
companies will already have
foundational baseline security
requirements in place.
As required by the Order, the security
requirements for firms engaged in
restricted transactions are based on the
National Institute of Standards and
Technology (‘‘NIST’’) Cybersecurity
Framework (‘‘CSF’’) 513 and the NIST
Privacy Framework (‘‘PF’’).514 CISA has
also leveraged existing performance
goals, guidance, practices, and controls,
including the CISA Cross-Sector
Cybersecurity Performance Goals
(‘‘CPGs’’),515 which are themselves
based on the NIST CSF and PF.
The CPGs, NIST CSF, and NIST PF
are sets of recommendations, based on
current best practices, that companies
can voluntarily follow. The CPGs are
themselves mapped to the CSF. In its
proposed security requirements, CISA
has included mapping to the CPGs and
NIST CSF and PF, as applicable.
Furthermore, the CSF aligns its
requirements with other similar
standards that are commonly used in
industry, including NIST SP 800–53 and
International Organization for
Standardization/International
Electrotechnical Commission (‘‘ISO’’)/
(‘‘IEC’’) 27001:2013. The ISO/IEC
27001:2013 standard, unlike the CISA
and NIST frameworks, has a more
formal certification process and has
granted certificates to 48,671 companies
globally and 1,898 companies in the
United States.516 Finally, NIST SP 800–
171 rev.3,517 a common security
513 Nat’l Inst. of Standards & Tech., Framework
for Improving Critical Infrastructure Cybersecurity
(v. 1.1, Apr. 16, 2018), https://doi.org/10.6028/
NIST.CSWP.04162018 [https://perma.cc/2FKZ3PAT].
514 Nat’l Inst. of Standards & Tech., NIST Privacy
Framework: A Tool for Improving Privacy Through
Enterprise Risk Management (v. 1.0, Jan. 16, 2020),
https://doi.org/10.6028/NIST.CSWP.01162020
[https://perma.cc/36SC-VZXN].
515 Cybersec. & Infrastructure Sec. Agency, CrossSector Cybersecurity Performance Goals: March
2023 Update (2023), https://www.cisa.gov/sites/
default/files/2023-03/CISA_CPG_report_v1.0.1_
final.pdf [https://perma.cc/4YRS-Z9UJ].
516 Int’l Org. for Standardization, ISO/IEC
27001:2013&2022 Information Technology—
Security Techniques—Information Security
Management Systems—Requirements, 1. ISO
Survey 2023 Results—Number of Certificates and
Sites per Country and the Number of Sectors
Overall (Sept. 18, 2024), https://www.iso.org/
committee/54998.html?t=KomURwikWDLiu
B1P1c7SjLMLEAgXOA7emZHKGWyn8f3KQUTU3m
287NxnpA3DIuxm&view=documents [https://
perma.cc/L43C-MVY8] (click ‘‘1. ISO Survey 2023
results—Number of certificates and sites per
country and the number of sectors overall’’ to
download spreadsheet; then open tab titled ‘‘ISO
IEC 27001’’ in that file).
517 Ron Ross & Victoria Pillitteri, Nat’l Inst. of
Standards & Tech., NIST SP 800–171r3, Protecting
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
framework, lays out security standards
for firms handling controlled
unclassified information, while the
Department of Defense’s Cybersecurity
Maturity Model Certification (‘‘CMMC’’)
program 518 includes the NIST SP 800–
171 requirements but with a more
formal auditing and certification
process.
ii. Current Industry Compliance Level
The majority of firms affected by the
proposed rule likely already comply
with some portion of the security
requirements in the proposed rule. The
level of existing adherence to the
proposed security requirements for the
average U.S. company would vary
significantly based on each firm’s size,
industry, existing regulatory landscape,
technological maturity, and internalized
priorities.519 Given the high degree of
overlap between the DHS draft security
requirements and existing standards and
frameworks discussed below, it is
possible that the level of existing
compliance among affected firms will be
high.
One survey of business expenditures
on cybersecurity conducted by IANS
Research indicates that such spending
can vary depending on industry and
business size. According to this survey,
the average firm spent nearly 10 percent
of its IT budget on cybersecurity, with
firms in industries like technology,
healthcare, and business services
spending the highest proportion at over
13 percent.520 Furthermore, in the same
report, an analysis of firm size found
that smaller businesses spend the
highest proportion of their IT budgets
on cybersecurity.521 While it is possible
that companies with larger expenditures
on cybersecurity would be closer to
compliance with the proposed rule, it is
difficult to determine with the available
data the extent to which companies are
Controlled Unclassified Information in Nonfederal
Systems and Organizations, Nat’l Inst. of Standards
& Tech. (2024), https://nvlpubs.nist.gov/nistpubs/
SpecialPublications/NIST.SP.800-171r3.pdf
[https://perma.cc/ER88-7Y8F].
518 U.S. Dep’t of Def., Office of the Undersecretary
of Defense for Acquisition & Sustainment,
Cybersecurity Maturity Model Certification (CMMC)
Model Overview Version 2.0 (2021), https://
dodcio.defense.gov/Portals/0/Documents/CMMC/
ModelOverview_V2.0_FINAL2_20211202_508.pdf
[https://perma.cc/2HAM-92TJ].
519 Deloitte, 2023 Global Future of Cyber Survey
(2023), https://www.deloitte.com/content/dam/
assets-shared/docs/services/risk-advisory/2023/gxdeloitte_future_of_cyber_2023.pdf [https://
perma.cc/B9E3-QNRW].
520 IANS Research, Benchmark Insights: Security
Budget Benchmark Summary Report 4 (2022),
https://cdn.iansresearch.com/Files/Marketing/
IANSResearch-2022SecurityBudget
BenchmarkSummaryReport.pdf [https://perma.cc/
B9SE-4YS5].
521 Id.
PO 00000
Frm 00076
Fmt 4701
Sfmt 4702
using their cybersecurity budgets to
keep up with evolving best practices
and maintain the capabilities required
by the proposed security requirements.
The level of technological and
cybersecurity maturity also varies
significantly, even among larger firms.
Recent data indicates that there is great
variability in cybersecurity practice
sophistication and maturity. In 2023,
Deloitte conducted a survey of cyber
decision makers at firms around the
world with at least 1,000 employees and
$500 million in annual revenue. The
Deloitte study determined that of these
organizations, 38 percent had low cyber
maturity (as defined in the study), 41
percent had medium cyber maturity,
and 21 percent had high cyber
maturity.522 Another survey of IT
professionals found that 45 percent of
firms did not have a designated Chief
Information Security Officer, which
would make them noncompliant with
the proposed security requirements.523
Furthermore, research suggests that
the cost of cybersecurity activities can
vary based on factors such as the size of
the company, the cybersecurity
capabilities required, and whether those
capabilities are developed in house or
by contracting with third parties.
Additionally, the Center for internet
Security provided high and low
estimates of cybersecurity budgets based
on company size, with an average
estimate of $22,000 for a small firm (1
to 10 employees) and about $800,000 for
a large firm (100 to 999 employees).524
iii. Costs of Compliance
Regarding the cost of compliance, the
Department assumes that most affected
companies will not have to build
cybersecurity capabilities from the
ground up to meet the requirements of
the proposed rule. Given that most firms
will have existing cybersecurity
protections in place, a more realistic
approach to calculating the potential
cost of the proposed rule would be to
consider the additional expenditures
that a company would have to make to
increase its cybersecurity standards. The
Department assumes, based on the
522 Deloitte,
supra note 519, at 14.
The State of Cybersecurity
Leadership and Readiness, Fall 2021 (2021), at 4,
https://lp.navisite.com/l/824543/2023-05-19/
3733vx/824543/1684513240bPrtcWBS/state_of_
cybersecurity_leadership_and_readiness_report.pdf
[https://perma.cc/6VQG-VGZG].
524 The average budget estimates for the small and
large firms were calculated by averaging the high
and low estimates from the relevant size category.
Ctr. for internet Sec., The Cost of Cyber Defense: CIS
Controls Implementation Group 1, at 8 (v. 1.0,
2023), https://learn.cisecurity.org/l/799323/202308-02/4t3qkj/799323/1694810927NC0iZQGR/CIS_
Controls__Cost_of_Cyber_Defense__2023_08.pdf
[https://perma.cc/C46G-EZFR].
523 Navisite,
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
design of the proposed rule, that added
cybersecurity compliance costs will
closely mirror the costs that companies
face when complying with similar or
more onerous/prescriptive standards,
such as NIST 800–171, NIST 800–53,
ISO/IEC 27001, and the CMMC program,
providing a helpful tool to estimate the
added compliance costs associated with
the data security requirements, though
such estimates may be conservative.
Furthermore, since some firms may
already clearly be in voluntary
compliance with more stringent
standards than the proposed security
standards, which would allow them to
forgo some of the following steps, some
of the costs may not be incurred by all
firms.
The first step that most firms engaging
in restricted transactions will take
toward compliance is completing an
assessment of their current capabilities
and shortcomings. For example, it
would cost a small to medium-sized
firm that is working toward compliance
with NIST 800–171 and NIST 800–53
around $30,000 to $35,000 to build inhouse assessment capabilities.525 Along
the same lines, another source estimates
that an assessment for a CMMC
certification for a firm with 250
employees could cost up to $35,000.526
For the initial assessment stage of the
ISO/IEC 27001 certification process, a
small business would expect to spend
$25,000 to $40,000 to complete the
process internally and around $30,000
to hire a consultant.527 However, a
company with more complicated
compliance issues could expect to pay
as much as $130,000 for the consulting
and assessment.528 Thus, the
Department finds that an assessment
will cost between $25,000 and $130,000
for most firms, depending on the scale
of the compliance needs involved.
The next step in the compliance
process is remediating the issues found
in the initial assessment. It is likely that
remediation would involve a
combination of fixed and recurring
costs. One-time remediation costs could
involve revising security policies or
patching vulnerabilities in covered
systems, while recurring costs could
include subscriptions to services that
provide data encryption, multifactor
authentication, or password
management services, as well as costs
associated with maintaining access
controls or required documentation.
Estimates for remediation costs for NIST
800–171 compliance range between
$35,000 and $115,000.529 Another
estimate suggests that midsized
companies with lower levels of
technological maturity can expect to pay
approximately $100,000 to correct any
compliance issues.530
In accordance with the security
requirements with which U.S. persons
engaged in restricted transactions must
comply under the proposed rule, every
firm, regardless of its initial compliance
level, will need to annually verify its
compliance through audits and testing.
This is a common cost that firms incur
86191
to comply with existing frameworks or
standards. For a small company with 50
employees, the annual recertification
audit for ISO/IEC 27001 compliance
costs an estimated $6,000 to $7,500.531
The continuous monitoring costs
associated with NIST 800–171
compliance for small businesses are
estimated to be around $6,500 to
$13,000.532 However, annual
surveillance audits to ensure
compliance with ISO/IEC 27001
standards can cost as much as
$40,000.533
Table VII–12 of this preamble
summarizes the high and low estimates
for the costs—both one-time and
ongoing—that an average U.S. company
engaged in restricted transactions may
face under the proposed rule. A firm
may find itself in the higher-cost
category based on either greater size and
complexity or a lower level of
technological maturity. For this
analysis, it is assumed that even firms
in the low-cost scenario will have added
costs in each category. Furthermore,
based on the Department’s experience,
half of the added one-time remediation
costs in both the high and low estimates
are assumed to recur annually. Finally,
for the added training costs, the low
estimate was taken from the small
business low-cost figure in a report by
the Center for internet Security, and the
high estimate was taken from the
midsized business high-cost figure in
the same report.534
TABLE VII–12—COSTS OF COMPLYING WITH THE PROPOSED SECURITY REQUIREMENTS
Category
Cost—Low
Initial Assessment ......................................................................................
Remediation ...............................................................................................
Ongoing Remediation ................................................................................
Compliance Audits .....................................................................................
Training ......................................................................................................
c. Costs Associated With Compliance
Program: Due Diligence, Recordkeeping,
and Auditing
khammond on DSKJM1Z7X2PROD with PROPOSALS2
In addition to security requirements,
the proposed rule also introduces
affirmative due diligence,
525 Estimated Costs Associated with NIST 800–53
and NIST 800–171 Security Risk Assessments,
GoldSky Security (Apr. 29, 2021), https://
www.goldskysecurity.com/estimated-costsassociated-with-nist-800-53-and-nist-800-171security-risk-assessments/ [https://perma.cc/87V6FZ4N].
526 CMMC Certification Cost: The Price of
Compliance, Cuick Trac, https://
www.cuicktrac.com/blog/cmmc-certification-cost/
[https://perma.cc/KR79-AWLA].
527 How Much Does ISO 27001 Certification Cost?,
OneTrust: Blog (Sept. 21, 2022), https://
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
Cost—High
$25,000
35,000
17,500
6,000
120
Type
$130,000
115,000
57,500
40,000
3,660
One-time.
One-time.
Annually recurring.
Annually recurring.
Annually recurring.
recordkeeping, affirmative reporting,
and auditing requirements as conditions
of a license or for U.S. persons engaged
in restricted transactions, each of which
would likely impose added costs. In this
section, the Department estimates costs
for affirmative due diligence,
recordkeeping, and auditing for firms
engaged in licensed or restricted
transactions.
The compliance program for
affirmative due diligence,
www.onetrust.com/blog/iso-27001-certification/
[https://perma.cc/G5UU-P62E].
528 Cost of Compliance with CMMC and NIST–
171, Hyper Vigilance, https://
blog.hypervigilance.com/cost-of-cmmc-nistcompliance [https://perma.cc/PF8Z-QVTM].
529 Navigate NIST 800–171 with Confidence,
Fortified Services, https://
nist171.fortifiedservices.com/ [https://perma.cc/
K92U-UCAY]; Cost of Compliance with CMMC and
NIST–171, supra note 528.
530 Cost of Compliance with CMMC and NIST–
171, supra note 528.
531 How Much Does ISO 27001 Certification Cost?,
supra note 527.
532 Navigate NIST 800–171 with Confidence,
supra note 529.
533 Srividhya Karthik, ISO 27001 Certification
Cost: Plan Your Compliance Budget Better, Sprinto
(Mar. 1, 2024), https://sprinto.com/blog/iso-27001certification-cost/ [https://perma.cc/YP75-YW6G].
534 Ctr. for internet Sec., supra note 524, at 22.
PO 00000
Frm 00077
Fmt 4701
Sfmt 4702
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86192
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
recordkeeping, and auditing would
consist partly of risk-based procedures
for verifying the data flows involved in
any restricted transaction. Further
requirements would include a policy
describing the compliance program and
process, a policy describing the
implementation of any applicable
security requirements or other
conditions, annual certification of such
compliance policies, maintenance
records documenting the due diligence
performed in implementing the
compliance policy with respect to data
transactions, and an annual certification
of the completeness and accuracy of the
records documenting due diligence as
supported by an audit.
With regard to due diligence,
recordkeeping, and auditing costs for
U.S. companies, precise numbers on the
number of affected firms, their sizes,
and per-company or per-transaction
costs are very difficult to estimate.
Further, the compliance costs for firms
that have established programs relative
to existing Federal and State regulations
may be minimal, as their compliance
approach can be modified at low or no
cost to address the proposed security
requirements, whereas firms without
such compliance programs would likely
incur higher costs.
In particular, many firms may have
existing compliance programs targeted
at three notable provisions that were
passed and implemented in recent
years: the California Consumer Privacy
Act of 2018 (‘‘CCPA’’) 535 the EU’s
General Data Protection Regulation
(‘‘GDPR’’),536 and the APEC CBPR.537
More than 10 other U.S. States have also
recently passed data privacy legislation,
and many others are considering such
laws.538 Due to these laws and existing
Federal export-related regulations, it is
possible that some expected due
diligence costs imposed by the proposed
rule may have already been incurred by
affected businesses. However, given that
the definitions under the proposed rule
do not fully align with the definitions
used in these frameworks, there are
likely to be separate due diligence costs.
The Department has estimated upperand lower-bound costs to firms from the
proposed rule related to due diligence,
recordkeeping, and auditing based on
our analysis of the literature regarding
the CCPA, GDPR, and other data privacy
rules and related research. These upperand lower-bound estimates and the
supporting literature are discussed in
this part VII.A.8.c of this preamble. In
summary, part VII.A.8.c.i of this
preamble estimates that Know Your
Customer/Know Your Vendor (‘‘KYC’’/
‘‘KYV’’) costs for verifying one’s
business and its executives are between
$150 (lower bound) and $4,230 (upper
bound). In addition, parts VII.A.8.c.ii
through VII.A.8.c.iv of this preamble
estimate that the combined annual
recordkeeping and auditing costs per
firm are between a lower bound of
$1,260 ($300 for auditing + $960 for
recordkeeping) and an upper bound of
$232,500 ($7,500 for auditing +
$225,000 for recordkeeping). These
estimates are based on the Department’s
analysis, but could be different
depending on industry and context. The
Department welcomes additional input
from stakeholders on this point.
The proposed rule requires entities
engaged in restricted transactions to
perform due diligence that includes
KYC/KYV activities, which may involve
verifications to confirm the legitimacy
and eligibility of customers and
vendors. Costs would generally be
incurred one time per customer or
vendor, but they could be repetitive if
there is reason to believe that a
customer or vendor’s legitimacy or
eligibility has changed. The Department
estimates the due diligence (i.e., KYC/
KYV) costs for verifying one business
and its executives at between $150
(lower bound) and $4,230 (upper
bound).
The upper-bound estimate assumes
that the background check costs for one
customer or vendor business would
include a background check for the
business and three background checks
for executives residing outside the
United States. The Department
estimates an upper-bound cost of $1,200
per business background check based on
a study showing an upper-bound range
of more than $1,000 for a due diligence
background check of a business.539 The
Department estimates an upper-bound
cost of $1,010 per executive background
check based on the highest cost for a
background check of an executive
residing in a country of concern (which
is associated with Venezuela) from
Table VII–13 of this preamble.540
Therefore, the upper-bound background
check costs for one customer business
with three executives could be as high
as $4,230 ($1,200 per business 541 +
($1,010 per executive 542 * 3)).
One company, Global Background
Screening, charges $150 to $250 for
business background checks, with the
higher end for businesses headquartered
outside the United States.543 These
business background checks include
documentation on directorship,
financials, registration, judgments, liens,
bankruptcies, and credit risk.544
Screenings for firm executives appear to
be separate costs, which vary by country
of residence and type of background
check, as summarized in Table VII–13 of
this preamble. Countries identified in
the proposed rule as countries of
concern (see § 202.209) are included in
Table VII–13 of this preamble where
sufficient data is available. Santoni also
advertises due diligence business
background checks, which appear to
include foreign firms and officers,
ranging from $395 to more than
$1,000.545
535 California Consumer Privacy Act of 2018,
supra note 28.
536 Regulation (EU) 2016/679, supra note 28.
537 Asia-Pac. Econ. Coop., APEC Cross-Border
Privacy Enforcement Arrangement (CPEA) (Feb.
2024), https://www.apec.org/groups/committee-ontrade-and-investment/digital-economy-steeringgroup/cross-border-privacy-enforcementarrangement# [https://perma.cc/GRA3-8UQX].
538 US State Privacy Legislation Tracker, Int’l
Ass’n of Privacy Pros. (July 22, 2024), https://
iapp.org/media/pdf/resource_center/State_Comp_
Privacy_Law_Chart.pdf [https://perma.cc/WF3APJ5K].
539 Tim Santoni, So What’s the Difference
Between Background Checks and Investigations?,
Santoni, https://santoniservices.com/whats-new-atsantoni/whats-the-difference-between-background-
checks-and-investigations/ [https://perma.cc/
WM9X-5YMY].
540 International Screening Checkout Portal,
Global Background Screening, https://
www.globalbackgroundscreening.com/onlinebackground-check/International-EmployeeScreening-Select-Country-For-Pricing-p303546142
[https://perma.cc/3AUN-84R4] (select most
expensive options for all Venezuelan searches and
verifications from dropdowns).
541 Santoni, supra note 539 (estimating that a due
diligence background check for a business may cost
over $1,000).
542 International Screening Checkout Portal,
supra note 540.
543 Background Check on a Business, Global
Background Screening, https://
www.globalbackgroundscreening.com/online-
background-check/background-check-on-abusiness-p316742635 [https://perma.cc/3AUN84R4].
544 Carlos Crameri, Business Credit Reports for
Informed Decision-Making, Global Background
Screening (Mar. 21, 2023), https://
www.globalbackgroundscreening.com/onlinebackground-check/BACKGROUND-CHECK-ON-ABUSINESS-p316742635 [https://perma.cc/QE6UFFMR]; for more detailed pricing, see Background
Check on a Business, Global Background Screening,
https://www.globalbackgroundscreening.com/
online-background-check/background-check-on-abusiness-p316742635 [https://perma.cc/3AUN84R4].
545 Santoni, supra note 539.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
i. Due Diligence Costs
PO 00000
Frm 00078
Fmt 4701
Sfmt 4702
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
86193
TABLE VII–13—ESTIMATED INTERNATIONAL SCREENING COSTS FOR INDIVIDUALS BY COUNTRY OF RESIDENCE
Type of screening
China
Russia
Cuba
Venezuela
All nations
low
All nations
high
Criminal background ................................
Civil judgements .......................................
Identity verification ...................................
Bankruptcy records ..................................
Credit history ............................................
Employment verification ...........................
Education verification ...............................
Worldscan (global databases) .................
Social media scan ....................................
$80–$110
80
25
50
80
35–99
35
11–65
50–70
$129
145
25
........................
127
35–99
35
11–65
50–70
$169
239
25
........................
274
35–99
35
11–65
50–70
$135
159
25
188
234
35–99
35
11–65
50–70
$59
45
25
23
50
35
35
11
50
$260
279
25
188
532
99
35
65
70
Totals ................................................
446–614
557–695
838–976
872–1,010
333
1,553
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Source: International Screening Checkout Portal, Global Background Screening, https://www.globalbackgroundscreening.com/online-background-check/International-Employee-Screening-Select-Country-For-Pricing-p303546142 (reflecting costs of services at the time the Department
drafted the proposed rule).
The remainder of this section
summarizes additional research on
background check costs for foreign firms
and for individuals residing outside the
United States, which is broadly
consistent with the Department’s upperand lower-bound estimates discussed so
far in this section.
The U.S. International Trade
Administration (‘‘ITA’’) provides basic
background check and in-depth data on
foreign firms to help U.S. companies
determine the suitability of possible
business partners. To be eligible for the
service, companies must be exportready and endeavoring to export goods
or services of U.S. origin with at least
51-percent U.S. content. The ITA
provides partial profiles that include
general business information,
background and product data, pertinent
executives, reputation information, brief
analysis of information collected, and
identities of the references used. Fees
for these partial profiles range from
$150 to $450 depending on the size of
the inquiring firm. Full business profiles
add onsite visits and interviews of
company executives, with costs ranging
from $700 to $2,000. Costs could
increase if ITA staff are required to
travel more than 80 kilometers or 2
hours from an ITA office.546
Diligentia, Inc. categorizes
background checks on individuals based
on the thoroughness of the
investigation. An individual or red flag
investigation is designed to identify
adverse issues predominantly via online
searches, at a cost of $500 to $1,500. A
professional background investigation is
a more thorough review that adds onsite
records depository visits and analysis of
documents there, at a cost of $1,500 to
$2,500. A comprehensive background
546 Int’l
Trade Admin., International Company
Profile (Full and Partial), https://www.trade.gov/
international-company-profile-0 [https://perma.cc/
N3PX-4DEZ].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
investigation goes even further, with
additional analyses, reviews of business
interests, the use of other intelligence
sources, financial investigation, and a
credit history, at a cost of more than
$2,500. This provider does not advertise
a price difference between domestic and
foreign background investigations.547
Checkr states that international
background checks can range from $30
to $500, with their fees varying from $32
to $300 and covering more than 200
countries. Checkr asserts that a global
background check may include searches
for criminal history, watchlist posting,
education/employment verification, and
media checks.548
An ITA partial or full profile of
foreign businesses would likely be
preferable for U.S. companies due to the
real or perceived credibility of a
government agency and the
comparatively reasonable costs.
Accordingly, for verifying one business
and its executives, the Department
relied on ITA’s pricing for the estimated
lower-bound cost of $150.
The sources supporting our cost
estimates do not discuss whether the
costs include extensive investigations
that involve foreign travel or contracting
with third parties in foreign locations to
547 Brian Willingham, How Much Does a
Background Investigation Cost?, Diligentia Group
(Apr. 23, 2024), https://diligentiagroup.com/
background-investigations/how-much-does-abackground-investigation-cost/ [https://perma.cc/
2RGF-LH5G].
548 Simple, Transparent Pricing: Background
Check Pricing for Businesses of All Sizes, Checkr,
https://checkr.com/pricing?utm_
medium=ppc&utm_source=google&utm_
campaign=pricing_sitelink&utm_
term=checkr&utm_campaign=FM_Brand_Search_
LP_Control_1122&utm_source=google&utm_
medium=ppc&utm_content=677534444565&_
bm=p&_bn=g&device=c&utm_adgroup=Brand_
Core&gad_source=1&gclid=Cj0KCQjwyL24
BhCtARIsALo0fSAQPeVlfGXfAo
N59kjZI4TEpIchvwY7u4ZdX3iPL0Sg8Z0_
ZVLLjPwaApKyEALw_wcB [https://perma.cc/7U3RT8R5].
PO 00000
Frm 00079
Fmt 4701
Sfmt 4702
perform onsite visits, inquiries,
interviews, and other in-depth
activities. The Department estimates
that it is unlikely that firms would
allocate resources for these kinds of
investigations, particularly when the
ITA service is available. However, some
firms may not meet the ITA’s eligibility
criteria for their services. Thus, it is
possible that KYC/KYV activities may
need to be performed via a private
vendor, such as one of the vendors just
described. Again, based on the analysis,
the Department estimates the due
diligence costs for verifying one
business and its executives at between
$150 (lower bound) and $4,230 (upper
bound).
These estimates are based on
Department analysis but could be
different depending on the industry and
context. The DOJ welcomes additional
input from stakeholders on this point.
ii. Recordkeeping Costs
The proposed rule’s recordkeeping
requirements would include generating
or maintaining documents pertinent to
various data transactions details,
verifications of transaction partners,
transactions agreements, licenses,
exemptions, advisory opinions, annual
due diligence certifications, and
supporting documentation, as
applicable. Data brokers incorporated in
the United States market and sell data
on individuals not only domestically
but from many other countries; 549 for
example, Acxiom markets data coverage
for more than 62 countries.550 Assuming
that this data on foreign persons
includes individuals protected by EU
549 Sherman,
supra note 483.
LLC, Global Data Navigator (2018),
https://marketing.acxiom.com/rs/982-LRE-196/
images/Acxiom%20Global%20Data.pdf [https://
perma.cc/4NX5-M8P6].
550 Acxiom
E:\FR\FM\29OCP2.SGM
29OCP2
86194
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
law, these data brokers are subject to the
GDPR.
Since 2018, the GDPR has required all
organizations that target or collect data
relative to persons in the EU to abide by
privacy and security standards outlined
in that law. One of the seven data
protection principles in the GDPR is
accountability or due diligence.
Accordingly, data controllers (i.e.,
holders of data) must be able to
demonstrate compliance relative to
accountability by (1) designating data
protection responsibilities as
appropriate; (2) maintaining
comprehensive records of collected
data, its use, and those responsible for
it; (3) training staff and executing
technical and organizational security
measures; (4) implementing contracts
with third parties that process data on
their behalf; and (5) appointing a data
protection officer (if a public authority
or regularly processing personal data on
a large scale).551 Thus, a portion of
covered persons subject to the proposed
rule are already complying with GDPR
recordkeeping requirements and would
arguably not incur the full magnitude of
these new costs.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
iii. Executive Order on Modernizing
Regulatory Review Recordkeeping and
Related Costs
As shown in the following analysis,
the annual recordkeeping and related
costs per firm are estimated to be
between $960 (lower bound) and
$225,000 (upper bound).
The Department calculates a lowerbound estimate of annual recordkeeping
costs per firm by starting with the
average annual incremental compliance
costs/administrative burdens from the
EU impact assessment of GDPR.
According to the EU’s impact
assessment of the GDPR, average annual
incremental compliance costs/
administrative burdens for small and
medium-sized enterprises (‘‘SMEs’’) 552
are approximately $9,624 (in 2024
dollars).553 The Department assumes
551 Ben Wolford, What Is GDPR, the EU’s New
Data Protection Law?, GDPR.eu, https://gdpr.eu/
what-is-gdpr/ [https://perma.cc/ECS2-P67N].
552 According to the European Commission, SMEs
consist of the following company types: medium
with <250 employees, ≤Ö50 million turnover, or a
balance sheet total ≤Ö43 million; small with <50
employees, ≤Ö10 million turnover, or a balance
sheet total ≤Ö10 million; and micro with <10
employees, ≤Ö2 million turnover, or a balance sheet
total ≤Ö2 million. See European Comm’n, SME
definition, Internal Market, Industry,
Entrepreneurship and SMEs, https://single-marketeconomy.ec.europa.eu/smes/sme-definition_en
[https://perma.cc/N4UX-WV5V].
553 Ö5.258 billion/926,272 active cross-border
firms = Ö5,676 per SME per year = $7,068 at July
2012 average exchange rate (Ö1.00 = $1.24).
European Comm’n, Doc. 52012SC0072, Commission
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
that the incremental recordkeeping costs
of the proposed rule would only be
about 10 percent of the estimated
incremental annual costs for GDPR
compliance. This assumption is based
on the facts that the GDPR includes
extensive recordkeeping
requirements 554 and that many of the
proposed rule’s recordkeeping
requirements are similar in scope to the
obligations of existing data protection
regulations.555 Furthermore, the EU’s
impact assessment of the GDPR includes
costs of compliance beyond
recordkeeping costs. Based on these
considerations and input from SMEs,
the Department estimates that 1,400
small to medium-sized firms will incur
recordkeeping costs of $960 per firm per
year.
An upper-bound estimate of annual
recordkeeping costs per firm is also
based on estimates of company privacy
protection annual costs, which for large
firms were estimated at $4.5 million per
firm.556 The Department further
estimates that the incremental
recordkeeping costs of the proposed rule
for large firms would be approximately
5 percent of the estimated annual costs
for privacy protections. This assumption
is based on the same factors as those
described for the lower-bound annual
recordkeeping cost estimate as well as
the fact that the prior study included
additional necessary costs (e.g., IT
upgrades) beyond recordkeeping alone.
Further, the Department believes that
larger firms predominantly have the
added benefit of possessing additional
sophistication in complying with
existing data privacy and security
regimes and already have significant
compliance programs and mechanisms
in place. Thus, based on this analysis
and subject-matter expert input, the
Department estimates that 100 firms
will incur the higher recordkeeping
costs of $225,000 per firm.
To provide context on these upperand lower-bound recordkeeping costs,
this section summarizes additional
studies.
Staff Working Paper Impact Assessment, Annex 9
(Jan. 25, 2012), https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=CELEX%3A52012SC0072&
qid=1713360200812 [https://perma.cc/W3FZGQ9Z].
554 Regulation (EU) 2016/679, supra note 28, at
art. 30.
555 Id.; see infra note 557 and accompanying text.
556 This cost figure was converted into 2024
dollars. Cisco, Data Privacy Benchmark Study,
Forged by the Pandemic: The Age of Privacy 9
(2021), https://www.cisco.com/c/dam/en_us/about/
doing_business/trust-center/docs/cisco-privacybenchmark-study-2021.pdf [https://perma.cc/6UTB48C3]. Note that large firms were assumed to be the
complement of the aforementioned small to
medium-sized firms.
PO 00000
Frm 00080
Fmt 4701
Sfmt 4702
The CCPA mandated that businesses
in California update privacy policies,
develop mechanisms for providing
notice to consumers when collecting
personal information (‘‘PI’’), and
adequately respond to consumer wishes
regarding the handling of such data. The
State of California Department of
Justice, Office of the Attorney General’s
(‘‘CDOJAG’’) standardized regulatory
impact assessment for the CCPA
regulations estimated the following ruleimposed costs per firm: $959 in onetime operational costs (e.g., establishing
workflows/plans), $7,500 for
technological systems development
(assumed one-time), $615 per year for
training, $984 per year to abide by
record-keeping requirements (one data
privacy professional at $61.50 per hour
* 16 hours),557 and $492 (assumed per
year) to provide financial incentives or
differential services/prices to promote
non-discriminatory practices in their
treatment of consumers exercising their
CCPA rights. Apart from the $984 in
compliance-related costs, the CDOJAG
assumed that there were no incremental
costs for collecting the information
subject to the CCPA’s recordkeeping
requirement, as affected businesses
likely already had mature mechanisms
for identifying, processing, and
analyzing PI from their data-mapping
and consumer response practices. The
CDOJAG’s total estimated costs per firm
to comply with the CCPA were about
$29,000 ($2,900 annually) for the period
from 2020 to 2030.558
Christensen et al. estimated GDPR
compliance costs at between $5,065 and
$12,157 (2024 dollars) 559 per year per
SME, which represents a 16- to 40percent increase in annual IT budgets.
These presumably would align with the
aforementioned GDPR accountability
557 Off. of Att’y Gen., Cal. Dep’t of Just,
Standardized Regulatory Impact Assessment:
California Consumer Privacy Act of 2018
Regulations 24 (2019), https://dof.ca.gov/wpcontent/uploads/sites/352/Forecasting/Economics/
Documents/CCPA_Regulations-SRIA-DOF.pdf
[https://perma.cc/5J5S-7DNA]. The record-keeping
requirements contained in the CCPA consist mainly
of documenting business practices when processing
consumer requests on how their particular data is
handled. Businesses are required to compile metrics
on these requests and their responses. These
metrics include the number of requests to know,
delete, and opt out that were received, complied
with, and denied.
558 Id. Ten-year costs per firm: $959 + $7,500 +
$6,150 + $9,840 ($61.50 × 16 hrs. × 10 yrs.) + $4,920
= $29,369 for 10 years (Id., at 24–28).
559 Ö3,000 ($3,720 in 2012 dollars) to Ö7,200
($8,929 in 2012 dollars) per SME per year; Laurits
R. Christensen et al., The Impact of the Data
Protection Regulation in the E.U. (Feb. 13, 2013),
https://www.analysisgroup.com/globalassets/
insights/publishing/2013_data_protection_reg_in_
eu_christensen_rafert_etal.pdf [https://perma.cc/
4K3B-DF2R].
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
elements identified by Wolford,560
which are generally consistent with
those of the proposed rule.
A 2018 International Association of
Privacy Professionals and Ernst & Young
(‘‘IAPP’’/‘‘EY’’) study/survey identified
much higher average expected spending
of about $3 million per firm on GDPR
compliance, or $300,000 annually if
assumed over 10 years. This included
$1,276,000 already spent, another
$822,000 expected for adaptation of
products and services, and $989,000 for
other adaptation activities. However, the
average annual costs per firm due to
GDPR were unclear based on the IAPP/
EY 2018 and 2019 surveys. Company
annual mean and median privacyrelated spending ranged from $128 to
$147 on a per-employee basis. Survey
respondents were a mix of company
sizes ranging from under 100 employees
to more than 75,000.561
A 2021 Cisco annual global survey of
all major industries found that annual
privacy budgets doubled from the
previous year to an average of $2.4
million (with smaller firms at a lower
end of $1.6 million and larger firms at
an upper end of $3.7 million, as
reported in 2020).562 This average figure
of $2.4 million is comparable to a highend estimate found in another study
that aimed to project the costs to
businesses incurred by possible Florida
consumer privacy legislation; that study
had a lower-bound estimate of about
$733,000 in one-time costs per firm and
subsequent ongoing annual costs
ranging from about $542,000 to $1.5
million.563 Organizations may spend an
average of about $1,406 per subject
rights request by consumers pursuant to
privacy regulations.564 According to one
estimate, data processing agreements
may have an average cost of $785.565
560 Wolford,
supra note 551.
Ass’n of Privacy Pros. & Ernst & Young,
IAPP–EY Annual Privacy Governance Report 2018
(2018), https://iapp.org/media/pdf/resource_center/
IAPP_EY_Governance_Report_2018.pdf [https://
perma.cc/SA8P-QV3G]; Int’l Ass’n of Privacy Pros.
& Ernst & Young, IAPP–EY Annual Privacy
Governance Report 2019 (2019), https://iapp.org/
media/pdf/resource_center/IAPP_EY_Governance_
Report_2019.pdf [https://perma.cc/DG8X-3W5G].
562 Cisco, supra note 556.
563 Florida TaxWatch, Who Knows What? An
Independent Analysis of the Potential Effects of
Consumer Data Privacy Legislation in Florida,
TaxWatch Research Blog (Oct. 11, 2021), https://
floridataxwatch.org/Research/Blog/who-knowswhatanalysis-of-data-privacy-legislation-in-florida
[https://perma.cc/2TD9-RLBR].
564 Rob van der Meulen, 4 Key Trends in the
Gartner Hype Cycle for Legal and Compliance
Technologies, 2020, Gartner (Sept. 21, 2020),
https://www.gartner.com/smarterwithgartner/4-keytrends-in-the-gartner-hype-cycle-for-legal-andcompliance-technologies-2020 [https://perma.cc/
2AN5-PDTJ].
565 Data Processing Agreement Cost,
ContractsCounsel, https://
khammond on DSKJM1Z7X2PROD with PROPOSALS2
561 Int’l
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
Though privacy budgets, including
some of their underlying elements, are
different in scope and detail from the
proposed rule they nonetheless have
relevance for estimating the costs of the
proposed rule as these budgets often
serve similar objectives and require
companies to undertake similar
processes to protect sensitive data.
The relatively new APEC CBPR is a
voluntary accountability framework
regulating data transfers between
member nations that is somewhat
similar to the EU’s GDPR, but based on
Organisation for Economic Co-operation
and Development (‘‘OECD’’) privacy
principles.566 In the United States,
APEC CBPR annual certification costs
range from $15,000 to $40,000.567 The
APEC CBPR’s data security 568 due
diligence mechanism is another
requirement with which firms may
already be complying and thus could
reduce incremental costs of the
proposed rule due to comparable or
related requirements.
In summary, available sources show
variations regarding the compliance
costs for data privacy and cybersecurity
regulations specific to recordkeeping.
The Department estimates that it is very
likely that incremental recordkeeping
costs for at least some firms impacted by
the proposed rule are zero, as the
CDOJAG discussed in its cost estimates
for the CCPA. Conversely, the
possibility exists that larger firms have
not been subject to the EU’s GDPR and
would be impacted by the proposed
rule, resulting in their incurring some
portion of the $4.5 million in 2024 in
estimated annual recordkeeping costs
documented by Cisco for such firms.569
These ranges, along with the other data
and analysis discussed throughout this
subpart, were taken into consideration
for the calculations of the proposed
rule’s average annual lower- and upperbound costs per firm of $960 and
$225,000. Part VII.F of this preamble
estimates that costs due to the proposed
annual reporting requirements for
certain categories of U.S. persons
www.contractscounsel.com/b/data-processingagreement-cost [https://perma.cc/PDW6-LFZN].
566 Clare Sullivan, EU GDPR or APEC CBPR? A
Comparative Analysis of the Approach of the EU
and APEC to Cross Border Data Transfers and
Protection of Personal Data in the IoT Era, 35
Comput. L. & Sec. Rev. 380 (2019), https://doi.org/
10.1016/j.clsr.2019.05.004 [https://perma.cc/EGH9D7ER].
567 ISO 27701 vs. APEC CBPR, nccgroup (July 20,
2023), https://www.nccgroup.com/us/iso-27701-vsapec-cbpr/ [https://perma.cc/8VVW-FYMB].
568 Asia-Pac. Econ. Coop., APEC Privacy
Framework ¶ 32 (2015), https://www.apec.org/docs/
default-source/Publications/2017/8/APEC-PrivacyFramework-(2015)/217_ECSG_2015-APEC-PrivacyFramework.pdf [https://perma.cc/C8RN-V2ND].
569 Cisco, supra note 556, at 9.
PO 00000
Frm 00081
Fmt 4701
Sfmt 4702
86195
engaged in certain subsets of restricted
transactions would range from $821,100
(lower bound) to $1,642,200 (upper
bound).
iv. Auditing Costs
As shown in the following analysis,
annual auditing costs per firm are
estimated to be between $300 (lower
bound) and $7,500 (upper bound).
Auditing costs for restricted
transactions would be incurred in the
form of independent examinations to
support the due diligence certifications.
TrustNet offers services to help firms
determine their compliance with the
CCPA. One such service is a CCPA gap
assessment, which covers scope, project
management, risk assessment, controls
identification, testing/analysis,
remediation roadmap, and reporting.
The cost of this service starts at $10,000.
TrustNet also offers a CCPA compliance
assessment with costs starting at
$15,000, which covers similar
elements.570
According to Neumetric, a
cybersecurity products and services
company, GDPR accreditation or
certification is not offered by the EU or
any of its member states. Firms do not
need to certify that they are GDPR
compliant; however, there are thirdparty certification bodies/consultants
that offer GDPR certification services for
consultant fees ranging from $3,000 to
$11,000, on average.571 This does not
include internal costs to prepare for
certification or other prerequisites for
obtaining ISO/IEC 27001 and ISO 27701
certification, which could cost between
$1,000 and $4,000.572 Another source
estimated that costs for GDPR
certification range from about $5,000 to
$20,000 or more (excluding ISO/IEC
27001 and ISO 27701 certification).573
The American Institute of Certified
Public Accountants has developed a
cybersecurity compliance framework
known as Service Organization Control
2 (‘‘SOC 2’’). Cybersecurity audit costs
can be divided into SOC 2 Type 1 audits
and SOC 2 Type 2 audits. Type 1 audits
evaluate the suitability of controls at a
specific point in time and can cost
between $5,000 and $25,000. Type 2
audits gauge the effectiveness of
controls over a more extended
570 CCPA Assessment Cost, TrustNet, https://
trustnetinc.com/california-consumer-privacy-actcost/ [https://perma.cc/V88J-WW5M].
571 GDPR Certification Cost: Factors, Examples
and Benefits, Neumetric (May 15, 2023), https://
www.neumetric.com/gdpr-certification-cost/
[https://perma.cc/X8ZM-HW32].
572 Id.
573 Ayush Saxena, Compliance Q&A: How Much
Does GDPR Compliance Cost?, Sprinto (Apr. 3,
2024), https://sprinto.com/blog/gdpr-compliancecost/ [https://perma.cc/NA35-YAQP].
E:\FR\FM\29OCP2.SGM
29OCP2
86196
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
timeframe and can range in costs from
$30,000 to $100,000.574 The latter is
more appropriate for firms processing
highly sensitive personal data on a
regular basis.575 ‘‘Dunkelberger provides
a slightly different range for SOC 2 Type
1 audits, estimating that they can cost
$15,000 to $50,000 for small to mediumsized businesses and between $50,000
to $100,000 for large businesses; and for
SOC 2 Type 2 Audits, estimating that
they can cost $30,000 to $75,000 for
small to medium-sized businesses and
$75,000 to $150,000 for large
businesses. These costs include the
price of a readiness assessment, audit,
remediation, and consultant fees.576
As these estimates show, the costs of
annual audits for compliance with
CCPA, GDPR, and SOC 2 range from
$3,000 to $150,000, depending on audit
type and firm size. The Department
expects that such examiners may not
always charge these full rates separately
just to certify compliance with the
proposed rule, due to redundancies
with existing legislation and efficiencies
of conducting simultaneous audits
pursuant to multiple rules.
Nevertheless, there would be increased
costs, as there are likely to be variations
in addition to the redundancies. For
purposes of this analysis, the
Department assumes that for all small
firms, the proposed rule would result in
audit costs that are 10 percent of the
estimated cost of an audit from the
reviewed literature, or $300 ($3,000 * 10
percent incremental cost). The
Department assumes that for all large
firms, the proposed rule would result in
audit costs that are 5 percent of the
estimated cost of an audit from the
reviewed literature, or $7,500 ($150,000
* 5 percent incremental cost).
khammond on DSKJM1Z7X2PROD with PROPOSALS2
v. Estimated Recordkeeping Costs From
the Reviewed Literature
The wide-ranging estimates of
recordkeeping costs in the studies
reviewed, and the entwinement of the
former with other costs, demonstrate the
difficulty in determining specific costs
for each due to the proposed rule.
Further, the literature is not specific to
compliance with this proposed rule.
Rather, the literature relates to the
business costs of protecting personal
574 Tim Mektrakarn, How Much Does a SOC2
Audit Cost in 2024?, Bright Defense (Aug. 7, 2024),
https://www.brightdefense.com/resources/soc-2audit-costs/ [ https://perma.cc/G7FD-28Y6].
575 Meeba Gracy, SOC 2 Type 1 vs Type 2 (A
Detailed Comparison), Sprinto (Mar. 16, 2024),
https://sprinto.com/blog/soc-2-type-1-vs-type-2/
[https://perma.cc/BZL4-GJY4].
576 David Dunkelberger, SOC 2 Budgeting: How
Much Does a SOC 2 Audit Cost?, I.S. Partners: Blog
(Nov. 6, 2023), https://www.ispartnersllc.com/blog/
soc-2-audit-cost/ [https://perma.cc/KCJ8-SMNA].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
information from unauthorized
dissemination while establishing
procedures for its processing and
transfer, in addition to protocols for
responding to consumer preferences
regarding handling of their own
personal information. In recent years,
privacy and protection laws affecting
the entities that will likely be impacted
by the proposed rule have proliferated.
Thus, the recordkeeping costs
contemplated under the proposed rule
have already been incurred to some
extent.
vi. Summary of a Compliance Program:
Due Diligence, Recordkeeping, and
Auditing
From this examination of the
available literature, the due diligence,
recordkeeping, and auditing
requirements are likely to unevenly
impact firms that must comply with the
proposed rule, depending on the size of
each firm and how much it currently
spends on the components of due
diligence. Although the means by which
firms will comply is uncertain, the
Department has relied on a variety of
research in the topic areas to make
preliminary estimates of costs due to the
proposed rule.
Uncertainty is prevalent in these
restricted transactions and databrokerage market cost estimates for
several reasons. In particular, the
estimates of recordkeeping costs based
on the percentage of the costs of
compliance with GDPR and other data
protection regimes reported in various
studies are highly speculative. Estimates
of the proposed rule-imposed
incremental costs above and beyond
similar compliance activities already
taking place are also speculative.
Consequently, the Department
welcomes comments on these cost
calculations from affected industries
and stakeholders to better inform
decision making relative to the
proposed rule.
Beyond the cost impacts of the
proposed regulation, there could
possibly be adjustments and market
movements in reaction to changes in the
threshold levels that are being proposed.
This analysis assumes that all the
current bulk U.S. sensitive personal data
transactions are above the lower
threshold levels as defined by the
proposed rule. If the threshold levels are
set at the higher level in the final rule,
it is possible that there may be less
immediate market disruption but also a
greater risk of more data falling into
malicious hands, including through
evasion techniques such as structuring
and smurfing (i.e., conducting smaller
and more frequent transactions using
PO 00000
Frm 00082
Fmt 4701
Sfmt 4702
additional individuals). Since there is
no available data on the number of
transactions by volume of personal data
being transferred, the impacts of
selecting one bulk threshold over
another within the ranges in the NPRM
are uncertain at the time of the proposal,
and the Department welcomes
comments on this subject.
Note that the recordkeeping costs
discussed here (part VII.A of this
preamble) are also included in part VII.F
of this preamble (Paperwork Reduction
Act), which presents cost estimates for
the six new information collection
requests introduced by the proposed
rule. The costs of affirmative annual
reporting are also discussed above. In
addition to recordkeeping costs and the
cost of affirmative annual reporting, part
VII.F of this preamble presents estimates
for the applications for specific licenses,
reports of rejected prohibited
transactions, requests for advisory
opinions, petitions for removal from the
Covered Persons List, and reports of
known or suspected violations of
onward transfers prohibition. All of
those information collections affect a
relatively small number of firms.
Additional detail on those annual costs
is available in the Information
Collection Request submitted for Office
of Management and Budget review
under the Paperwork Reduction Act and
publicly available on reginfo.gov.
9. Summary of Regulatory Analysis
Regulatory analysis in the areas of
national security and foreign policy is
often not easily quantifiable or
monetizable due to an array of factors,
such as inadequate information,
inaccessibility of sensitive or
proprietary data; and the absence of a
good measure of the effectiveness of the
regulations.
The purpose of the Preliminary RIA is
to gather and analyze enough adequate
information to inform agency decision
makers about whether a proposed
rulemaking is in the public’s interest.
The analysis should describe the
impacts on firms in the market and in
the supply chain, remembering that the
intermediate firms in the chain are
customers of the suppliers. To the
extent possible, the impacts on the
general public should be considered, as
well as—in the case of this proposed
rulemaking—the impact on national
security and foreign policy and the
impact of data-brokerage restrictions on
the positive uses of bulk data. The
precision of estimates depends on the
availability of data, the confidence in
the accuracy of the data, and the degree
of understanding of the impacted
markets.
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
These economic impact estimates lack
precision due to significant gaps in the
available data on the number of firms
and data transactions that would be
affected by the proposed rule and by the
lack of confidence in much of the
available data. Due to relatively recent
and emerging developments in studying
the market for data, relevant, reliable,
and representative size, sales,
employment, and other descriptive
information on the data-brokerage
market and other entities that will be
subject to the proposed rule does not
appear to be currently available. The
Department is not aware of reliable data
on the exact number of firms that
currently engage in prohibited databrokerage transactions, the size
distribution of these firms, or the
numbers of firms that sell above or
below the threshold levels that would
bring them under the proposed rule’s
umbrella. The Department welcomes
additional input on this point. The low
and high threshold levels for the
different categories of sensitive personal
data or government-related data vary by
factors of 10 to 1 for human genomic
data and 1,000 to 1 for personal health
data and personal financial data.
Furthermore, the Department lacks data
on the broader universe of firms that
transact in government-related data or
bulk U.S. sensitive personal data in the
context of restricted transactions. As
noted in the NPRM, firms that transact
in bulk U.S. sensitive personal data
above the proposed thresholds, as laid
out in part V.C of this preamble, will
need to ensure that their typical data
transfers are not in fact going to
countries of concern or covered persons
(for prohibited transactions) and to
comply with the security and due
diligence requirements for restricted
transactions.
This analysis leverages the limited
available data on the number of databrokerage firms and the volume of databrokerage exports, along with estimates
of security and due diligence costs from
studies of similar policies and
guidelines. The Department finds that,
based on certain assumptions, the
proposed rule will have at least some
measurable economic impacts. From
Table VII–10 of this preamble, the
Department estimates that the total
annual value of lost transactions is $361
million, or an estimated $80,222 per
firm for 4,500 firms (3,000 data brokers
+ 1,500 firms engaged in restricted
transactions).
Table VII–14 of this preamble
presents estimates of security
compliance costs derived from data
86197
shown in part VII.B.2 of this preamble
and estimates of due diligence,
recordkeeping, and auditing costs
derived from data shown in part
VII.A.8.c of this preamble. The
variations in costs are due to firm size
and other factors. As explained in part
VII.A.8.c of this preamble, the
Department estimates the KYC/KYV
(i.e., due diligence) costs for verifying
one business and its executives to be
between a lower bound of $150 and an
upper bound of $4,230. There is no
information on how many verifications
a firm will do, but the Department
assumes for purposes of this analysis 10
verifications per firm per year, for a total
cost of between $1,500 and $42,300.
Adding the lower bounds of due
diligence costs ($1,500), auditing costs
($300), and recordkeeping costs ($960)
per firm, the resulting costs at a lower
bound are $2,760 per firm for other
compliance costs. Adding the upper
bound of due diligence costs ($42,300),
audit costs ($7,500), and recordkeeping
costs ($225,000) per firm, the resulting
costs are $274,800 for total compliance
annual costs per large firm. Table VII–
14 of this preamble shows annual
compliance costs per firm. The
Department welcomes additional input
on this point.
TABLE VII–14—ANNUAL COMPLIANCE COSTS PER FIRM
[For Firms Engaged in Restricted Transactions]
Low
(small firms)
Cost category
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Security: One-Time Costs .......................................................................................................................................
Security: Recurring Costs ........................................................................................................................................
Other Compliance Costs (Due Diligence, Audits, Recordkeeping) .........................................................................
When the proposed rule is finalized
and becomes effective, market dynamics
will set in, and firms will exit and enter
the market as they adjust to the new
regulatory environment. As noted in
part VII.A.3.b of this preamble, the U.S.
data-brokerage market ranges from
around $30 billion to $180 billion per
year, suggesting average revenues per
firm at around $10 million to $60
million per year, assuming an estimated
3,000 firms. The compliance costs per
firm will determine whether firms
pursue restricted transactions.
For the purposes of this estimate, the
Department assumes that 1,500 firms
will engage in restricted transactions,
the largest 100 will incur the high costs,
and the remaining 1,400 will incur the
lower costs. Although it is estimated
that there are a relatively few U.S.-based
firms conducting business with Chinese
cloud-service providers that may
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
continue these activities under the
restrictions, it is expected that a large—
but unknown—number of other firms
will pursue the restricted transaction
opportunities involving employment
and investment agreements. Under these
conditions, the Department assumes
that about 1,500 firms beyond the 3,000
data brokers will be active in pursuing
vendor, employment, and investment
agreement opportunities in the
restricted transactions market, the 100
largest of which will be at the high cost
and 1,400 of which will incur the lower
costs.
The annualized costs of the proposed
rule are determined by deriving the 10year projections for three cost
components: the economic value of lost
transactions, security costs, and other
compliance costs (due diligence,
auditing, and recordkeeping). Our
analysis assumes that 4,500 firms,
PO 00000
Frm 00083
Fmt 4701
Sfmt 4702
$60,000
23,620
2,760
High
(large firms)
$245.000
101,160
274,800
including 3,000 data brokers and 1,500
other firms engaged in restricted
transactions, will incur economic costs.
The analyses also assume that 4,300 of
those firms are small firms (including
2,900 data brokers and 1,400 firms
engaged in restricted transactions) and
200 of those firms are large firms (100
data brokers and 100 firms engaged in
restricted transactions). The analysis
also assumes that the data-brokerage
industry affected by the proposed rule is
growing at a 5-percent annual rate.
Turning to compliance costs, our
analyses assume that 1,500 firms will
incur compliance costs as a result of the
proposed rule. The Department assumes
that security costs have one-time
components—initial assessment and
remediation—that are only realized in
the first year, as well as recurring
components—ongoing remediation,
compliance audits, and training—that
E:\FR\FM\29OCP2.SGM
29OCP2
86198
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
are present for all 10 years. In addition,
it is assumed that the other compliance
costs, including affirmative due
diligence, auditing, and recordkeeping
costs, will decline as firms become more
efficient and learn to pursue lower-cost
compliance options. These due
diligence, auditing, and recordkeeping
costs are presented as annually
decreasing, but at a decreasing rate. As
companies move away from reliance on
employees in countries of concern or
vendors in countries of concern, the
Department assumes that these costs
will decrease over time. Further, since
the security measures are all reliant on
existing NIST standards and CISA
performance goals to which many
companies already align their security
posture, the Department assumes that
due diligence, auditing, and
recordkeeping costs will decrease 15
percent in the second year, 12 percent
in the third year, 9 percent in the fourth
year, 7 percent in the fifth year, and
then 5 percent, 4 percent, 3 percent, 2
percent, and 1 percent in each of the
sixth through tenth years. The costs are
presented undiscounted (0-percent rate)
and at discounted by 2 percent.
In sum, the parameter assumptions of
the 10-year projections are:
1. The annual growth rate of the
economic value of lost transactions is 5
percent, compounded annually.
2. Due diligence, auditing, and
recordkeeping costs in Year 1 are taken
from Table VII–14 of this preamble.
Costs in Years 2 through 10 decrease,
but at a decreasing rate of 15 percent, 12
percent, 9 percent, 7 percent, 5 percent,
4 percent, 3 percent, 2 percent, and 1
percent.
3. Security costs have both one-time
and recurring components in Year 1 and
only recurring components in Years 2
through 10 (as shown in Table VII–14 of
this preamble).
4. The analysis assumes either
undiscounted costs or a 2-percent
annual discount rate.
5. The value of lost transactions is
from Table VII–10 of this preamble.
6. Small firms will bear ‘‘low’’ costs
shown in the security cost and lost
transaction totals, and large firms will
bear the ‘‘high’’ costs shown in the
security cost and lost transaction totals
in Tables VII–15 and VII–16 of this
preamble.
7. One thousand five hundred (1,500)
firms will incur compliance costs as a
result of the proposed rule, and a
broader group of 4,500 firms will incur
costs due to lost transactions.
The 10-year annualized cost analysis
(undiscounted and for a 2-percent
discount rate) for security and other
compliance costs (due diligence,
auditing, and recordkeeping costs) is
presented in Table VII–15 of this
preamble for the 1,400 small firms and
in Table VII–16 of this preamble for the
100 large firms. These estimates for
security, due diligence, auditing, and
recordkeeping costs for both small and
large firms engaged in restricted
transactions are combined with the
industry-wide estimates for the
economic value of lost transactions to
obtain total costs for all firms, which are
presented in Table VII–17 of this
preamble.
TABLE VII–15—10-YEAR ANNUALIZED COST ANALYSIS FOR SECURITY, DUE DILIGENCE, AUDITING (AND RECORDKEEPING)
FOR (THE 1,400) SMALL FIRMS
[Millions of dollars]
Cost category
Year 1
Year 2
Year 3
Year 4
Year 5
Year 6
Year 7
Year 8
Year 9
Year 10
Total
Annualized
Undiscounted
Security ....................
Due Diligence, Audits, and Recordkeeping .................
$117
$35
$36
$38
$40
$42
$44
$47
$49
$51
$500
$50
4
3
3
3
3
3
3
3
3
3
33
3.3
Total ..................
121
38
40
41
43
45
47
50
52
55
532
53
Discount Rate: 2 Percent
Security ....................
Due Diligence, Audits, and Recordkeeping .................
Total ..................
I
117
34
35
36
37
38
39
41
42
43
463
46
4
3
3
3
3
3
3
3
3
3
30
3.0
121
I
37
I
38
I
39
I
40
I
41
I
42
I
43
I
45
I
46
I
493
I
49
Key Assumptions: Industry growth rate of 5 percent; due diligence, auditing, and recordkeeping costs decreasing at a decreasing rate of 15–12–9–7–5–4–3–2–1
percent over years 2–10.
These year-to-year changes are the
same in percentage terms for the
analysis of large firms in Table VII–16
of this preamble.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
TABLE VII–16—10-YEAR ANNUALIZED COST ANALYSIS FOR SECURITY AND DUE DILIGENCE (AND RECORDKEEPING) FOR
(THE 100) LARGE FIRMS
[Millions of dollars]
Cost category
Year 1
Year 2
Year 3
Year 4
Year 5
Year 6
Year 7
Year 8
Year 9
Year 10
Total
Annualized
Undiscounted
Security ....................
Due Diligence, Audits, and Recordkeeping .................
VerDate Sep<11>2014
$35
I
27
17:46 Oct 28, 2024
$11
I
25
Jkt 265001
$11
I
23
PO 00000
$12
I
22
$12
I
Frm 00084
22
Fmt 4701
$13
I
22
$14
I
Sfmt 4702
22
$14
I
22
$15
I
E:\FR\FM\29OCP2.SGM
23
$16
I
29OCP2
24
$152
I
232
$15
I
23
86199
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
TABLE VII–16—10-YEAR ANNUALIZED COST ANALYSIS FOR SECURITY AND DUE DILIGENCE (AND RECORDKEEPING) FOR
(THE 100) LARGE FIRMS—Continued
[Millions of dollars]
Cost category
Total ..................
Year 1
I
62
Year 2
I
35
Year 3
I
34
Year 4
I
34
Year 5
I
34
Year 6
I
35
Year 7
I
35
Year 8
I
Year 9
37
I
38
Year 10
I
40
Total
I
383
Annualized
I
38
Discount Rate: 2 Percent
Security ....................
Due Diligence, Audits, and Recordkeeping .................
Total ..................
I
35
10
11
11
11
12
12
12
13
13
140
14
27
24
22
21
20
19
19
19
19
20
212
21
62
I
35
I
33
I
32
I
31
I
31
I
31
I
32
I
32
I
33
I
352
I
35
Key Assumptions: Industry growth rate of 5 percent; due diligence, auditing, and recordkeeping costs decreasing at a decreasing rate of 15–12–9–7–5–4–3–2–1
percent over years 2–10.
The total annualized costs of the
proposed rule for small and large firms
are combined and presented in Table
VII–17 of this preamble, estimated at
$549 million undiscounted and $502
million discounted at 2 percent (any
differences are due to rounding). Tables
VII–15 and VII–16 of this preamble only
include the costs of the security, due
diligence, and recordkeeping
requirements of the proposed rule,
while Table VII–17 of this preamble also
includes the costs associated with the
value of lost transactions.
TABLE VII–17—10-YEAR ANNUALIZED COST ANALYSIS FOR ALL FIRMS
[Millions of dollars]
Cost category
Year 1
Year 2
Year 3
Year 4
Year 5
Year 6
Year 7
Year 8
Year 9
Year 10
Total
Annualized
Undiscounted
Lost Transactions .....
Security ....................
Due Diligence, Audits, and Recordkeeping .................
$364
152
$382
45
$401
48
$421
50
$442
52
$465
55
$488
58
$512
61
$538
64
$565
67
$4,578
652
$458
65
31
28
26
25
25
25
25
25
26
27
264
26
Total ..................
547
456
475
497
520
544
571
598
628
659
5,494
549
Discount Rate: 2 Percent
Lost Transactions .....
Security ....................
Due Diligence, Audits, and Recordkeeping .................
364
152
375
44
22
46
398
47
410
49
422
50
435
52
448
53
461
55
475
56
4,173
604
417
60
31
28
25
24
23
22
22
22
22
23
241
24
Total ..................
547
447
93
469
481
494
508
523
538
554
5,018
502
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Key Assumptions: Industry growth rate of 5 percent; due diligence, auditing, and recordkeeping costs decreasing at a decreasing rate of 15–12–9–7–5–4–3–2–1
percent over years 2–10.
Table VII–18 of this preamble
summarizes the 10-year annualized cost
analysis (presented in Tables VII–15,
VII–16, and VII–17 of this preamble) for
small and large firms separately and in
total, both undiscounted and with a
discount rate of 2 percent.
This cost estimate reflects the
likelihood that a number of smaller
firms will drop out of the market if the
costs of compliance are greater than
expected revenues (i.e., if marginal costs
exceed marginal revenues). Of course,
this could also be true of larger firms
that lack the infrastructure or financial
resources to comply with the proposed
rules and therefore choose to forgo
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
certain transactions or business
operations in that market altogether.
In addition to the potential decrease
in the number of firms in the industry,
another related effect is that the
proposed rule may create a barrier to
entry for potential data brokers. That is,
the same compliance burdens that affect
marginal current brokers will also affect
potential ones.
PO 00000
Frm 00085
Fmt 4701
Sfmt 4702
TABLE VII–18—SUMMARY OF TOTAL
10-YEAR ANNUALIZED COSTS
[Undiscounted and for a 2-Percent Discount
Rate]
Discount rate
Undiscounted ........................
2 Percent ..............................
Total cost
$549,000,000
502,000,000
These preliminary estimated costs of
the proposed rule appear to be
reasonable when balanced against the
expected benefits of preventing the
potential risk and harms to national
security and foreign policy that are
possible when government-related data
or bulk U.S. sensitive personal data is
transferred to foreign adversaries. These
E:\FR\FM\29OCP2.SGM
29OCP2
86200
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
benefits are beyond monetary
calculation but suggest that the
proposed rule will have very large net
benefits, including protections to well
over 100 million American individuals
who are potential targets of adversaries
using government-related data or bulk
U.S. sensitive personal data. A wide
range of benefits of the regulation will
also be realized by firms, including the
savings associated with potentially
reducing the likelihood of data breaches
thanks to improved security, which are
estimated to cost an average of $4.88
million per breach.577 And firms that
sell data to, or buy data from, brokers
will have increased confidence in the
security and due diligence arrangements
associated with the regulation.
Both the benefits to be realized and
the costs to the economy and
government will be determined, to some
extent, by the effectiveness of
compliance and enforcement activities
and by the methods that market
participants use to attempt to avoid
detection of prohibited or restricted
activities. For example, ‘‘back doors’’
are used to circumvent economic
sanctions, and digital assets are used to
hide sanctioned transactions
themselves. The countries of concern
are known to conduct commercial and
military operations through proxies. As
shown in parts IV.D.1.b and IV.D.1.f of
this preamble, Cuba and Venezuela have
acted as third parties to promote
malicious acts by other countries of
concern. Unless the due diligence
requirements are fully complied with
and the due diligence procedures and
inquiries provide accurate information,
the effectiveness of the proposed rule
may be weakened, leading to reduced
expected benefits.
One commenter suggested that the
Department conduct a retrospective
review of the impact after the final rule
becomes effective. The Order already
requires such a review. Under section 5
of the Order, within 1 year after the final
rule becomes effective, the Department
must submit a report to the President
that addresses, to the extent practicable,
the effectiveness of the measures
imposed under the Order in addressing
threats to the national security of the
United States described in the Order
and the economic impact of the
implementation of the Order, including
on the international competitiveness of
U.S. industry. The Order requires the
Department to solicit public comment in
evaluating the economic impact. The
Department also intends to regularly
monitor the effectiveness and impact of
the regulations once they become
effective.
TABLE VII–19—OMB CIRCULAR A–4 ACCOUNTING STATEMENT PROVISIONS PERTAINING TO PREVENTING ACCESS TO
U.S. SENSITIVE PERSONAL DATA AND GOVERNMENT-RELATED DATA BY COUNTRIES OF CONCERN OR COVERED PERSONS NPRM
Estimate
Units
Category
Primary
Low
I
Dollar
year
High
I
I
Discount rate
I
Notes
Time
horizon
Benefits
Annualized monetized benefits ...........
Annualized quantified, but non-monetized, benefits.
Unquantified benefits ...........................
The benefits of the proposal include the security of the American people, economic prosperity and opportunity, and
democratic values, all of which are beyond a reasonable, reliable, and acceptable estimate of quantified monetary value.
Details in NPRM.
The Department did not identify any benefits that were quantified.
Discussed in NPRM.
Cost
Annualized monetized costs ................
Annualized quantified, but non-monetized, costs.
Unquantified costs ...............................
$549,000,000
................
................
................
undiscounted
Years 1–10
$502,000,000
........................
................
................
................
................
................
................
2%
........................
Years 1–10
....................
........................
................
................
................
........................
....................
........................
....................
........................
....................
The primary costs of the proposed
rule are the lost value of transactions due to the prohibitions and
costs related to the restrictions that
will require due diligence expenditures for enhanced security, KYC/
KYV verifications, recordkeeping,
reporting, and audits.
Transfers
Annualized monetized Federal budgetary transfers.
From/To:.
Other annualized monetized transfers
From/To:.
........................
................
........................
................
................
I
................
................
I
................
I
I
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Effects
Effects on State, local, or Tribal governments.
Effects on small businesses ................
Effects on wages .................................
The proposed rule would not have Tribal implications warranting the application of Executive Order 13175. It would not have
substantial direct effects on one or more Indian Tribes, on the relationship between the Federal Government and Indian
Tribes, or on the distribution of power and responsibilities between the Federal Government and Indian Tribes.
This analysis assumes that the small entities affected by the proposed rule will incur compliance costs of around $32,380 per
firm annually, compared with an annual compliance cost of $400,460 for the largest affected firms. Both cost figures are
undiscounted. The Department estimates that the proposed rule will impact just over 4,000 small entities, and that the
highest-cost scenario will apply to approximately 100 firms.
The Department did not estimate any impacts on wages.
577 Cost of a Data Breach Report 2024, IBM,
https://www.ibm.com/reports/data-breach [https://
perma.cc/8GNL-YEUX].
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
PO 00000
Frm 00086
Fmt 4701
Sfmt 4702
E:\FR\FM\29OCP2.SGM
29OCP2
86201
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
TABLE VII–19—OMB CIRCULAR A–4 ACCOUNTING STATEMENT PROVISIONS PERTAINING TO PREVENTING ACCESS TO
U.S. SENSITIVE PERSONAL DATA AND GOVERNMENT-RELATED DATA BY COUNTRIES OF CONCERN OR COVERED PERSONS NPRM—Continued
Estimate
Units
Category
Primary
Effects on growth .................................
khammond on DSKJM1Z7X2PROD with PROPOSALS2
The Department is proposing this rule
to address the growing threat posed by
the efforts of foreign adversaries to
access and exploit the governmentrelated data or Americans’ bulk U.S.
sensitive personal data. On February 28,
2024, the President issued Executive
Order 14117 on ‘‘Preventing Access to
Americans’ Bulk Sensitive Personal
Data and United States GovernmentRelated Data by Countries of Concern.’’
This Order directs the Attorney General
to, among other things, determine which
classes of data transactions ought to be
prohibited due to the unacceptable risk
they pose by allowing countries of
concern or covered persons to access
government-related data or bulk U.S.
sensitive personal data. The Order also
directs the Attorney General to work
with relevant agencies to identify
countries of concern and classes of
covered persons, establish a process to
issue licenses authorizing transactions
that would otherwise be prohibited or
restricted transactions, address the need
for requirements for recordkeeping and
reporting transactions, and determine
which classes of transactions will be
required to comply with separate
security requirements.
The need for the proposed rule stems
from the increased efforts that countries
of concern are making to obtain
sensitive personal data of Americans
and to utilize it in a way that
undermines national security and
foreign policy. Advances in computing
technology, artificial intelligence, and
methods for processing large datasets
allow countries of concern to more
effectively leverage collected data for
malicious purposes. The capability
currently exists to allow those who
government-related data or Americans’
bulk U.S. sensitive personal data to
combine and manipulate it in ways that
could identify sensitive personal data,
including personal identifiers and
precise geolocation information.
578 518210—Computing Infrastructure Providers,
Data Processing, Web Hosting, and Related
17:46 Oct 28, 2024
Low
I
High
Dollar
year
I
Discount rate
I
Time
horizon
Notes
The Department did not estimate any impacts on growth.
B. Regulatory Flexibility Act
VerDate Sep<11>2014
I
Jkt 265001
2. Description of and, Where Feasible,
an Estimate of the Number of Small
Entities to Which the Proposed Rule
Will Apply
The proposed rule would affect databrokerage firms and other firms engaged
in covered data transactions that pose a
risk of exposing government-related
data or bulk U.S. sensitive personal data
to countries of concern or covered
persons. The Department has estimated
that about 4,500 firms, just over 90
percent of which are small businesses
(hereafter referred to as ‘‘small
entities’’), would be impacted by the
proposed rule. Therefore, the
Department estimates that this proposed
rule would impact approximately 4,050
small entities and approximately 450
firms that would not be classified as
small entities.
Small entities, as defined by the
Regulatory Flexibility Act, include
small businesses, small nonprofit
organizations, and small governmental
jurisdictions. The definition of ‘‘small
entities’’ includes the definition of
‘‘small businesses’’ pursuant to section
3 of the Small Business Act of 1953, as
amended: ‘‘A small business concern
. . . shall be deemed to be one which
is independently owned and operated,
and which is not dominant in its field
of operation.’’ The definition of ‘‘small
business’’ varies from industry to
industry (as specified by NAICS code
and found in 13 CFR 121.201) to reflect
the typical company size in each
industry.
NAICS code 518210, ‘‘Computing
Infrastructure Providers, Data
Processing, Web Hosting, and Related
Services,’’ contains all the affected data
brokers as well as some of the other
entities engaged in one or more of the
classes of restricted data transactions.578
The number of small entities affected by
the proposed rule was estimated by
using the Small Business
Administration (‘‘SBA’’) small business
size standard for the NAICS code to
calculate the proportion of firms that are
considered small entities. Data brokers
are only a subset of the total firms
contained in the identified NAICS code;
however, for this analysis, it was
assumed that the proportion of small
entities was the same for both the
broader NAICS industry and the specific
data broker industry. Because more than
90 percent of impacted firms across all
relevant industries can be considered
small entities, the proposed rule would
have an impact on a substantial number
of small entities.
Services, North American Industry Classification
System, https://www.naics.com/naics-code-
description/?v=2022&code=518210 [https://
perma.cc/5PWG-AQWL].
1. Succinct Statement of the Objectives
of, and Legal Basis for, the Proposed
Rule
Through the Order, the President used
his authority under IEEPA and the
National Emergencies Act to declare
national emergencies and regulate
certain types of economic transactions
in order to protect the country against
foreign threats. The Order expands upon
the national emergency previously
declared by Executive Order 13873 of
May 15, 2019 (Securing the Information
and Communications Technology and
Services Supply Chain), which was
modified by Executive Order 14034 of
June 9, 2021 (Protecting Americans’
Sensitive Data from Foreign
Adversaries). Furthermore, the
President, under title 3, section 301 of
the U.S. Code, authorized the Attorney
General, in consultation with the heads
of relevant executive agencies, to
employ the President’s powers granted
by IEEPA as may be necessary or
appropriate to carry out the purposes of
the Order.
IEEPA empowers the President to
‘‘investigate, regulate, or prohibit’’
foreign exchanges in cases where there
is a threat coming from outside the
United States that threatens the
country’s ‘‘national security, foreign
policy, or economy.’’ Existing IEEPAbased programs include those
administered by OFAC, which enforces
economic and trade sanctions, and the
Department of Commerce’s Bureau of
Industry and Security, which is
responsible for information and
communications technology and
services supply chain security.
PO 00000
Frm 00087
Fmt 4701
Sfmt 4702
E:\FR\FM\29OCP2.SGM
29OCP2
86202
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
TABLE VII–20—SMALL BUSINESS SIZE STANDARD AND AFFECTED FIRMS
Number of affected firms
Share of affected firms that are small
4,500 ..................................................................
Approximately 90 percent ................................
Approximately 4,050.
This analysis assumes that the small
entities affected by the proposed rule
will incur compliance costs of around
$32,380 per firm per year, compared
with an annual compliance cost of
$400,460 for the largest affected firms.
The Department is not aware of
reliable revenue data by firm size for the
data broker industry, but a reasonable
assumption is that if a firm’s revenues
from data sales are not sufficient to
cover the compliance costs, then that
firm will have an incentive to exit that
market. Furthermore, calculating the
proportion of the costs associated with
the proposed rule that falls on small
firms is complicated by the fact that
several of the proposed rule’s
provisions—specifically the
requirements related to cybersecurity,
due diligence, recordkeeping, and
reporting—likely involve high fixed
costs. Even if small entities have less
complex business operations, leading to
fewer complications related to
compliance, they may still face a higher
cost burden from the proposed rule than
larger firms. Large entities will likely
already have a greater portion of the
fixed costs associated with the proposed
rule covered by existing capabilities.
Therefore, while the costs associated
with the security and due diligence
requirements will be smaller in absolute
terms for smaller entities, such entities
will likely need to pay a higher
proportion of their overall budgets to
comply. Due to the unknowns and the
large number of small entities, it is
possible that a substantial number of
small firms will experience a significant
impact. The Department welcomes
comments on this topic.
level requirements developed by DHS
through CISA in coordination with the
Department. See § 202.402. Those
requirements, which CISA will release
through a separate Request For
Information, overlap with several
similar, widely used cybersecurity
standards or frameworks. In addition,
the security requirements developed by
CISA would require firms to protect the
data associated with restricted
transactions using combinations of the
following capabilities necessary to
prevent access to covered data by
covered persons or countries of concern:
1. data minimization and data
masking;
2. encryption;
3. privacy-enhancing technologies;
and
4. denial of access.
Firms will also be required to undergo
annual independent testing and
auditing to ensure their continuing
compliance with the security
requirements.
Additionally, in order to ensure that
government-related data or Americans’
bulk U.S. sensitive personal data are not
accessible by countries of concern or
covered persons, firms will be required
to engage in due diligence before
pursuing restricted transactions, which
involves utilizing KYC/KYV programs
to complete background checks on
potential partners. Furthermore, firms
will be required to keep records that
contain extensive details of their
restricted transactions as well as the
details of the other parties involved.
They will also be required to undergo
annual audits of their records to ensure
compliance and assess potential risks.
3. Description of the Projected
Reporting, Recordkeeping, and Other
Compliance Requirements of the
Proposed Rule
The proposed rule would require
firms engaged in restricted transactions
to adhere to certain standards for data
security, due diligence, recordkeeping,
and reporting. See § 202.401. To
mitigate the risk of sharing governmentrelated data or bulk U.S. sensitive
personal data with countries of concern
or covered persons through restricted
transactions, organizations engaged in
restricted transactions would be
required to institute organizational and
system-level cybersecurity policies,
practices, and requirements and data-
4. Identification of All Relevant Federal
Rules That May Duplicate, Overlap, or
Conflict With the Proposed Rule
As discussed in part IV.K of this
preamble, while the PADFAA seeks to
address some of the same national
security risks of the proposed rule, there
are clear differences between the
PADFAA, the Order, and this proposed
rule, including the scope of regulated
data brokerage activities, the types of
bulk sensitive personal data that are
covered, and the relevant countries of
concern. Further, while the PADFAA
allows the FTC to investigate certain
data-brokerage activities involving
countries of concern as unfair trade
practices consistent with the FTC’s
existing jurisdiction, the proposed rule
establishes a new set of consistent
regulatory requirements that apply
across multiple types of commercial
transactions and sectors. Finally, as
stated in part IV.K of this preamble, the
Department will coordinate closely with
the FTC to ensure consistency in how
both authorities are implemented.
Some restricted transactions under
the proposed rule could also end up
being subject to review and action by
CFIUS. The Foreign Investment Risk
Review Modernization Act of 2018 gave
CFIUS the authority to review certain
non-controlling foreign investments that
may pose a risk to national security by
allowing the sensitive personal data of
U.S. citizens to be exploited.579
However, while CFIUS acts on a
transaction-by-transaction basis, the
proposed rule would create restrictions
and prohibitions on covered data
transactions that would apply to
categories of data transactions involving
the six countries of concern. In a
situation where a covered data
transaction regulated by the proposed
rule was later subject to a CFIUS review,
it would be exempt from the proposed
rule to the extent that CFIUS takes any
of the actions identified in the proposed
rule. See §§ 202.207; 202.508.
Furthermore, the categories of covered
data transactions covered by the
proposed rule extend beyond the scope
of CFIUS, including the provision of
government-related data or bulk U.S.
sensitive personal data through data
brokerage, vendor agreements, and
employment agreements. The proposed
rule also covers investment agreements
that may not be covered by CFIUS as
well as cases where the relevant risks do
not result from the covered transaction
or may occur before a CFIUS action
takes place.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
PO 00000
Frm 00088
Fmt 4701
Sfmt 4702
Number of affected small firms
C. Executive Order 13132 (Federalism)
The proposed rule would not have
federalism implications warranting the
application of Executive Order 13132.
The proposed rule does not have
substantial direct effects on the States,
on the relationship between the national
government and the States, or on the
distribution of power and
responsibilities among the various
levels of government.
579 See Foreign Investment Risk Review
Modernization Act of 2018, supra note 11.
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
D. Executive Order 13175 (Consultation
and Coordination With Indian Tribal
Governments)
The proposed rule would not have
Tribal implications warranting the
application of Executive Order 13175. It
does not have substantial direct effects
on one or more Indian Tribes, on the
relationship between the Federal
Government and Indian Tribes, or on
the distribution of power and
responsibilities between the Federal
Government and Indian Tribes.
E. Executive Order 12988 (Civil Justice
Reform)
This proposed rule meets the
applicable standards set forth in
sections 3(a) and 3(b)(2) of Executive
Order 12988.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
F. Paperwork Reduction Act
The collections of information
contained in this notice of proposed
rulemaking have been submitted to the
Office of Management and Budget for
review in accordance with the
Paperwork Reduction Act of 1995, 44
U.S.C. 3507(d), under control number
1124–AA01.
Written comments on this collection
can be submitted by visiting
www.reginfo.gov/public/do/PRAMain.
Find this document by selecting
‘‘Currently Under Review—Open for
Public Comments’’ or by using the
search function. Comments on the
collection of information should be
received by November 29, 2024.
The Department of Justice is soliciting
comments from members of the public
concerning this collection of
information to:
• Evaluate whether the proposed
collection of information is necessary
for the proper performance of the
functions of the agency, including
whether the information will have
practical utility;
• Evaluate the accuracy of the
agency’s estimate of the burden of the
proposed collection of information;
• Enhance the quality, utility, and
clarity of the information to be
collected; and
• Minimize the burden of the
collection of information on those who
are to respond, including through the
use of appropriate automated collection
techniques or other forms of information
technology.
The proposed rule includes seven
new collections of information: annual
reports; applications for specific
licenses; reports on rejected prohibited
transactions; requests for advisory
opinions; petitions for removal from the
designated Covered Persons List; reports
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
of known or suspected violations of the
onward transfers prohibition; and
recordkeeping requirements for
restricted transactions.
Based on wage rates from the Bureau
of Labor Statistics and lower- and
upper-bound estimates (used because
this is a new program and there is
uncertainty in the estimated number of
potential respondents for each of the
forms), the following are the estimated
burdens of the proposed collections:
• Annual reports. The Department
estimates that 375 to 750 filers will send
an average of one annual report per
year, spending an estimated average of
40 hours to prepare and submit each
annual report. The Department
estimates the aggregated costs for all
filers at $821,100 to $1,642,200 annually
for annual reports.
• Applications for specific licenses.
The Department estimates that 15 to 25
filers will send an average of one
application for a specific license per
year, spending an estimated average of
10 hours to prepare and submit each
application for a specific license. The
Department estimates the aggregated
costs for all filers at $8,211 to $13,685
annually for applications for specific
licenses.
• Reports on rejected prohibited
transactions. The Department estimates
that 15 to 25 filers will send an average
of one report on a rejected prohibited
transaction per year, spending an
estimated average of 2 hours to prepare
and submit each application for a
specific license. The Department
estimates the aggregated costs for all
filers at $1,642 to $2,737 annually for
reports on rejected prohibited
transactions.
• Requests for advisory opinions. The
Department estimates that 50 to 100
filers will send an average of one
request for an advisory opinion per year,
spending an estimated average of 2
hours to prepare and submit each
request for an advisory opinion. The
Department estimates the aggregated
costs for all filers at $5,474 to $10,948
annually for requests for advisory
opinions.
• Petitions for removal from covered
persons list. The Department estimates
that 15 to 25 filers will send an average
of one petition for removal from the
Covered Persons List per year, spending
an estimated average of 5 hours to
prepare and submit each petition for
removal from the Covered Persons List.
The Department estimates the
aggregated costs for all filers at $4,106
to $6,843 annually for petitions for
removal from the Covered Persons List.
• Reports of known or suspected
violations of onward transfers
PO 00000
Frm 00089
Fmt 4701
Sfmt 4702
86203
prohibition. The Department estimates
that 300 to 450 filers will send an
average of one report of known or
suspected violations of the onward
transfers prohibition per year, spending
an estimated average of 2 hours to
prepare and submit each report of
known or suspected violations of the
onward transfers prohibition. The
Department estimates the aggregated
costs for all filers at $32,844 to $49,266
annually for reports of known or
suspected violations of the onward
transfers prohibition.
• Recordkeeping requirements for
restricted transactions. The Department
estimates that 1,400 small to mediumsized firms will incur a total of
$1,344,000 in recordkeeping costs per
year. Also, the Department estimates
that 100 large firms will incur a total of
$84,844,000 in recordkeeping costs per
year.
Under the Paperwork Reduction Act,
an agency may not conduct or sponsor,
and a person is not required to respond
to, a collection of information unless it
displays a valid control number
assigned by the Office of Management
and Budget.
G. Unfunded Mandates Reform Act
The Unfunded Mandates Reform Act
requires that Federal agencies prepare a
written statement assessing the effects of
any Federal mandate in a proposed or
final agency rule that may directly result
in the expenditure of $100 million or
more in 1995 dollars (adjusted annually
for inflation) in any 1 year by State,
local, and Tribal governments, in the
aggregate, or by the private sector (2
U.S.C. 1532(a)). However, the Unfunded
Mandates Reform Act does not apply to
‘‘any provision’’ in a proposed or final
rule that is ‘‘necessary for the national
security’’ (2 U.S.C. 1503(5)).
In the Order, the President explained
that ‘‘[t]he continuing effort of certain
countries of concern to access
Americans’ sensitive personal data and
United States Government-related data
constitutes an unusual and
extraordinary threat, which has its
source in whole or substantial part
outside the United States, to the
national security and foreign policy of
the United States.’’ The Order expanded
the scope of the national emergency
declared in Executive Order 13873 of
May 15, 2019 (Securing the Information
and Communications Technology and
Services Supply Chain), and further
addressed with additional measures in
Executive Order 14034 of June 9, 2021
(Protecting Americans’ Sensitive Data
From Foreign Adversaries). Section 2(a)
of the Order thus requires the Attorney
General to issue the regulations in this
E:\FR\FM\29OCP2.SGM
29OCP2
86204
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
part, subject to public notice and
comment, ‘‘[t]o assist in addressing the
national security emergency described’’
in the Order. Because the entirety of this
proposed rule and every provision in it
addresses the national emergency
described by the President in the Order,
the Department has concluded that the
Unfunded Mandates Reform Act does
not apply to this proposed rule.
List of Subjects in 28 CFR Part 202
Computer technology, Health records,
Incorporation by reference, Investments,
Military personnel, National security,
Personally identifiable information,
Privacy, Reporting and recordkeeping
requirements, Security measures.
■ Under the rulemaking authority
vested in the Attorney General in 5
U.S.C. 301; 28 U.S.C. 509, 510 and
delegated to the Assistant Attorney
General for National Security by A.G.
Order No. 6067–2024, and for the
reasons set forth in the preamble, the
Department of Justice proposes to add
part 202 to chapter I of title 28 of the
Code of Federal Regulations to read as
follows:
PART 202—ACCESS TO U.S.
SENSITIVE PERSONAL DATA AND
GOVERNMENT–RELATED DATA BY
COUNTRIES OF CONCERN OR
COVERED PERSONS
Sec.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Subpart A—General
202.101 Scope.
202.102 Rules of construction and
interpretation.
202.103 Relation of this part to other laws
and regulations.
202.104 Delegation of authorities.
202.105 Amendment, modification, or
revocation.
202.106 Severability.
Subpart B—Definitions
202.201 Access.
202.202 Attorney General.
202.203 Assistant Attorney General.
202.204 Biometric identifiers.
202.205 Bulk.
202.206 Bulk U.S. sensitive personal data.
202.207 CFIUS action.
202.208 China.
202.209 Country of concern.
202.210 Covered data transaction.
202.211 Covered person.
202.212 Covered personal identifiers.
202.213 Cuba.
202.214 Data brokerage.
202.215 Directing.
202.216 Effective date.
202.217 Employment agreement.
202.218 Entity.
202.219 Exempt transaction.
202.220 Former senior official.
202.221 Foreign person.
202.222 Government-related data.
202.223 Human biospecimens.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
202.224 Human genomic data.
202.225 IEEPA.
202.226 Information or informational
materials.
202.227 Interest.
202.228 Investment agreement.
202.229 Iran.
202.230 Knowingly.
202.231 Licenses; general and specific.
202.232 Linked.
202.233 Linkable.
202.234 Listed identifier.
202.235 National Security Division.
202.236 North Korea.
202.237 Order.
202.238 Person.
202.239 Personal communications.
202.240 Personal financial data.
202.241 Personal health data.
202.242 Precise geolocation data.
202.243 Prohibited transaction.
202.244 Property; property interest.
202.245 Recent former employees or
contractors.
202.246 Restricted transaction.
202.247 Russia.
202.248 Security requirements.
202.249 Sensitive personal data.
202.250 Special Administrative Region of
Hong Kong.
202.251 Special Administrative Region of
Macau.
202.252 Telecommunications service.
202.253 Transaction.
202.254 Transfer.
202.255 United States.
202.256 United States person or U.S.
person.
202.257 U.S. device.
202.258 Vendor agreement.
202.259 Venezuela.
Subpart C—Prohibited Transactions and
Related Activities
202.301 Prohibited data-brokerage
transactions.
202.302 Other prohibited data-brokerage
transactions involving potential onward
transfer to countries of concern or
covered persons.
202.303 Prohibited human genomic data
and human biospecimen transactions.
202.304 Prohibited evasions, attempts,
causing violations, and conspiracies.
202.305 Knowingly directing prohibited or
restricted transactions.
Subpart D—Restricted Transactions
202.401 Authorization to conduct restricted
transactions.
202.402 Incorporation by reference.
Subpart E—Exempt Transactions
202.501 Personal communications.
202.502 Information or informational
materials.
202.503 Travel.
202.504 Official business of the United
States Government.
202.505 Financial services.
202.506 Corporate group transactions.
202.507 Transactions required or
authorized by Federal law or
international agreements, or necessary
for compliance with Federal law.
202.508 Investment agreements subject to a
CFIUS action.
PO 00000
Frm 00090
Fmt 4701
Sfmt 4702
202.509 Telecommunications services.
202.510 Drug, biological product, and
medical device authorizations.
202.511 Other clinical investigations and
post-marketing surveillance data.
Subpart F—Determination of Countries of
Concern
202.601 Determination of countries of
concern.
Subpart G—Covered Persons
202.701 Designation of covered persons.
202.702 Procedures governing removal from
the Covered Persons List.
Subpart H—Licensing
202.801 General licenses.
202.802 Specific licenses.
202.803 General provisions.
Subpart I—Advisory Opinions
202.901 Inquiries concerning application of
this part.
Subpart J—Due Diligence and Audit
Requirements
202.1001 Due diligence for restricted
transactions.
202.1002 Audits for restricted transactions.
Subpart K—Reporting and Recordkeeping
Requirements
202.1101 Records and recordkeeping
requirements.
202.1102 Reports to be furnished on
demand.
202.1103 Annual reports.
202.1104 Reports on rejected prohibited
transactions.
Subpart L—Submitting Applications,
Requests, Reports, and Responses
202.1201 Procedures.
Subpart M—Penalties and Finding of
Violation
202.1301 Penalties for violations.
202.1302 Process for pre-penalty notice.
202.1303 Penalty imposition.
202.1304 Administrative collection and
litigation.
202.1305 Finding of violation.
202.1306 Opportunity to respond to a prepenalty notice or finding of violation.
Subpart N—Government-Related Location
Data List
202.1401 Government-Related Location
Data List.
Authority: 50 U.S.C. 1701 et seq.; 50 U.S.C.
1601 et seq.; E.O. 14117, 89 FR 15421.
Subpart A—General
§ 202.101
Scope.
(a) Executive Order 14117 of February
28, 2024 (Preventing Access to
Americans’ Bulk Sensitive Personal
Data and United States GovernmentRelated Data by Countries of Concern)
(‘‘the Order’’), directs the Attorney
General to issue regulations that
prohibit or otherwise restrict United
States persons from engaging in any
acquisition, holding, use, transfer,
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
transportation, or exportation of, or
dealing in, any property in which a
foreign country or national thereof has
any interest (‘‘transaction’’), where the
transaction: involves United States
Government-related data (‘‘governmentrelated data’’) or bulk U.S. sensitive
personal data, as defined by final rules
implementing the Order; falls within a
class of transactions that has been
determined by the Attorney General to
pose an unacceptable risk to the
national security of the United States
because the transactions may enable
access by countries of concern or
covered persons to government-related
data or bulk U.S. sensitive personal
data; and meets other criteria specified
by the Order.
(b) This part contains regulations
implementing the Order and addressing
the national emergency declared in
Executive Order 13873 of May 15, 2019
(Securing the Information and
Communications Technology and
Services Supply Chain), and further
addressed with additional measures in
Executive Order 14034 of June 9, 2021
(Protecting Americans’ Sensitive Data
from Foreign Adversaries) and
Executive Order 14117.
§ 202.102 Rules of construction and
interpretation.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
(a) The examples included in this part
are provided for informational purposes
and should not be construed to alter the
meaning of the text of the regulations in
this part.
(b) As used in this part, the term
‘‘including’’ means ‘‘including but not
limited to.’’
(c) All references to ‘‘days’’ in this
part mean calendar days. In computing
any time period specified in this part:
(1) Exclude the day of the event that
triggers the period;
(2) Count every day, including
Saturdays, Sundays, and legal holidays;
and
(3) Include the last day of the period,
but if the last day is a Saturday, Sunday,
or Federal holiday, the period continues
to run until the end of the next day that
is not a Saturday, Sunday, or Federal
holiday.
§ 202.103 Relation of this part to other
laws and regulations.
Nothing in this part shall be
construed as altering or affecting any
other authority, process, regulation,
investigation, enforcement measure, or
review provided by or established under
any other provision of Federal law,
including the International Emergency
Economic Powers Act.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
§ 202.104
Delegation of authorities.
Any action that the Attorney General
is authorized to take pursuant to the
Order or pursuant to this part may be
taken by the Assistant Attorney General
for National Security or by any other
person to whom the Attorney General or
Assistant Attorney General for National
Security in writing delegates authority
so to act.
§ 202.105 Amendment, modification, or
revocation.
Except as otherwise provided by law,
any determinations, prohibitions,
decisions, licenses (whether general or
specific), guidance, authorizations,
instructions, orders, or forms issued
pursuant to this part may be amended,
modified, or revoked, in whole or in
part, at any time.
§ 202.106
Severability.
If any provision of this part is held to
be invalid or unenforceable by its terms,
or as applied to any person or
circumstance, or stayed pending further
agency action or judicial review, the
provision is to be construed so as to
continue to give the maximum effect to
the provision permitted by law, unless
such holding will be one of utter
invalidity or unenforceability, in which
event the provision will be severable
from this part and will not affect the
remainder thereof.
Subpart B—Definitions
§ 202.201
Access.
The term access means logical or
physical access, including the ability to
obtain, read, copy, decrypt, edit, divert,
release, affect, alter the state of, or
otherwise view or receive, in any form,
including through information systems,
information technology systems, cloudcomputing platforms, networks, security
systems, equipment, or software.
§ 202.202
Attorney General.
The term Attorney General means the
Attorney General of the United States or
the Attorney General’s designee.
§ 202.203
Assistant Attorney General.
The term Assistant Attorney General
means the Assistant Attorney General,
National Security Division, United
States Department of Justice, or the
Assistant Attorney General’s designee.
§ 202.204
Biometric identifiers.
The term biometric identifiers means
measurable physical characteristics or
behaviors used to recognize or verify the
identity of an individual, including
facial images, voice prints and patterns,
retina and iris scans, palm prints and
fingerprints, gait, and keyboard usage
PO 00000
Frm 00091
Fmt 4701
Sfmt 4702
86205
patterns that are enrolled in a biometric
system and the templates created by the
system.
§ 202.205
Bulk.
The term bulk means any amount of
sensitive personal data that meets or
exceeds the following thresholds at any
point in the preceding 12 months,
whether through a single covered data
transaction or aggregated across covered
data transactions involving the same
U.S. person and the same foreign person
or covered person:
(a) Human genomic data collected
about or maintained on more than 100
U.S. persons;
(b) Biometric identifiers collected
about or maintained on more than 1,000
U.S. persons;
(c) Precise geolocation data collected
about or maintained on more than 1,000
U.S. devices;
(d) Personal health data collected
about or maintained on more than
10,000 U.S. persons;
(e) Personal financial data collected
about or maintained on more than
10,000 U.S. persons;
(f) Covered personal identifiers
collected about or maintained on more
than 100,000 U.S. persons; or
(g) Combined data, meaning any
collection or set of data that contains
more than one of the categories in
paragraphs (a) through (g) of this
section, or that contains any listed
identifier linked to categories in
paragraphs (a) through (e) of this
section, where any individual data type
meets the threshold number of persons
or devices collected or maintained in
the aggregate for the lowest number of
U.S. persons or U.S. devices in that
category of data.
§ 202.206
data.
Bulk U.S. sensitive personal
The term bulk U.S. sensitive personal
data means a collection or set of bulk
data relating to U.S. persons, in any
format, regardless of whether the data is
anonymized, pseudonymized, deidentified, or encrypted.
§ 202.207
CFIUS action.
The term CFIUS action means any
agreement or condition the Committee
on Foreign Investment in the United
States has entered into or imposed
pursuant to 50 U.S.C. 4565(l)(1), (3), or
(5) to resolve a national security risk
involving access by a country of concern
or covered person to sensitive personal
data that the Committee on Foreign
Investment in the United States has
explicitly designated, in the agreement
or document containing the condition,
as a CFIUS action, including:
E:\FR\FM\29OCP2.SGM
29OCP2
86206
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
(a) Suspension of a proposed or
pending transaction, as authorized
under 50 U.S.C. 4565(l)(1);
(b) Entry into or imposition of any
agreement or condition with any party
to a covered transaction, as authorized
under 50 U.S.C. 4565(l)(3); and
(c) The establishment of interim
protections for covered transactions
withdrawn before CFIUS’s review or
investigation is completed, as
authorized under 50 U.S.C. 4565(l)(5).
§ 202.208
China.
The term China means the People’s
Republic of China, including the Special
Administrative Region of Hong Kong
and the Special Administrative Region
of Macau, as well as any political
subdivision, agency, or instrumentality
thereof.
§ 202.209
Country of concern.
The term country of concern means
any foreign government that, as
determined by the Attorney General
with the concurrence of the Secretary of
State and the Secretary of Commerce, (1)
has engaged in a long-term pattern or
serious instances of conduct
significantly adverse to the national
security of the United States or security
and safety of United States persons, and
(2) poses a significant risk of exploiting
government-related data or bulk U.S.
sensitive personal data to the detriment
of the national security of the United
States or security and safety of U.S.
persons.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.210
Covered data transaction.
(a) Definition. A covered data
transaction is any transaction that
involves any access to any governmentrelated data or bulk U.S. sensitive
personal data and that involves:
(1) Data brokerage;
(2) A vendor agreement;
(3) An employment agreement; or
(4) An investment agreement.
(b) Examples. (1) Example 1. A U.S.
institution conducts medical research at
its own laboratory in a country of
concern, including sending several U.S.citizen employees to that laboratory to
perform and assist with the research.
The U.S. institution does not engage in
data brokerage or a vendor,
employment, or investment agreement
that gives a covered person or country
of concern access to government-related
data or bulk U.S. sensitive personal
data. Because the U.S. institution does
not engage in any data brokerage or
enter into a vendor, employment, or
investment agreement, the U.S.
institution’s research activity is not a
covered data transaction.
(2) [Reserved]
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
§ 202.211
Covered person.
(a) Definition. The term covered
person means:
(1) A foreign person that is an entity
that is 50 percent or more owned,
directly or indirectly, by a country of
concern, or that is organized or
chartered under the laws of, or has its
principal place of business in, a country
of concern;
(2) A foreign person that is an entity
that is 50 percent or more owned,
directly or indirectly, by an entity
described in paragraph (a)(1) of this
section or a person described in
paragraphs (a)(3), (4), or (5) of this
section;
(3) A foreign person that is an
individual who is an employee or
contractor of a country of concern or of
an entity described in paragraphs (a)(1),
(2), or (5) of this section;
(4) A foreign person that is an
individual who is primarily a resident
in the territorial jurisdiction of a
country of concern; or
(5) Any person, wherever located,
determined by the Attorney General:
(i) To be, to have been, or to be likely
to become owned or controlled by or
subject to the jurisdiction or direction of
a country of concern or covered person;
(ii) To act, to have acted or purported
to act, or to be likely to act for or on
behalf of a country of concern or
covered person; or
(iii) To have knowingly caused or
directed, or to be likely to knowingly
cause or direct a violation of this part.
(b) Examples—(1) Example 1. Foreign
persons primarily resident in Cuba, Iran,
or another country of concern would be
covered persons.
(2) Example 2. Chinese or Russian
citizens located in the United States
would be treated as U.S. persons and
would not be covered persons (except to
the extent individually designated).
They would be subject to the same
prohibitions and restrictions as all other
U.S. persons with respect to engaging in
covered data transactions with countries
of concern or covered persons.
(3) Example 3. Citizens of a country
of concern who are primarily resident in
a third country, such as Russian citizens
primarily resident in a European Union
country or Cuban citizens primarily
resident in a South American country
that is not a country of concern, would
not be covered persons except to the
extent they are individually designated
or to the extent that they are employees
or contractors of a country of concern
government or a covered person that is
an entity.
(4) Example 4. A foreign person is
located abroad and is employed by a
company headquartered in China.
PO 00000
Frm 00092
Fmt 4701
Sfmt 4702
Because the company is a covered
person that is an entity and the
employee is located outside the United
States, the employee is a covered
person.
(5) Example 5. A foreign person is
located abroad and is employed by a
company that has been designated as a
covered person. Because the foreign
person is the employee of a covered
person that is an entity and the
employee is a foreign person, the person
is a covered person.
§ 202.212
Covered personal identifiers.
(a) Definition. The term covered
personal identifiers means any listed
identifier:
(1) In combination with any other
listed identifier; or
(2) In combination with other data
that is disclosed by a transacting party
pursuant to the transaction such that the
listed identifier is linked or linkable to
other listed identifiers or to other
sensitive personal data.
(b) Exclusion. The term covered
personal identifiers excludes:
(1) Demographic or contact data that
is linked only to other demographic or
contact data (such as first and last name,
birthplace, ZIP code, residential street
or postal address, phone number, and
email address and similar public
account identifiers); and
(2) A network-based identifier,
account-authentication data, or calldetail data that is linked only to other
network-based identifier, accountauthentication data, or call-detail data
as necessary for the provision of
telecommunications, networking, or
similar service.
(c) Examples of listed identifiers in
combination with other listed
identifiers—(1) Example 1. A standalone
listed identifier in isolation (i.e., that is
not linked to another listed identifier,
sensitive personal data, or other data
that is disclosed by a transacting party
pursuant to the transaction such that the
listed identifier is linked or linkable to
other listed identifiers or to other
sensitive personal data)—such as a
Social Security Number or account
username—would not constitute a
covered personal identifier.
(2) Example 2. A listed identifier
linked to another listed identifier—such
as a first and last name linked to a
Social Security number, a driver’s
license number linked to a passport
number, a device Media Access Control
(‘‘MAC’’) address linked to a residential
address, an account username linked to
a first and last name, or a mobile
advertising ID linked to an email
address—would constitute covered
personal identifiers.
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
(3) Example 3. Demographic or
contact data linked only to other
demographic or contact data—such as a
first and last name linked to a
residential street address, an email
address linked to a first and last name,
or a customer loyalty membership
record linking a first and last name to
a phone number—would not constitute
covered personal identifiers.
(4) Example 4. Demographic or
contact data linked to other
demographic or contact data and to
another listed identifier—such as a first
and last name linked to an email
address and to an IP address—would
constitute covered personal identifiers.
(5) Example 5. Account usernames
linked to passwords as part of a sale of
a dataset would constitute covered
personal identifiers. Those pieces of
account-authentication data are not
linked as a necessary part of the
provision of telecommunications,
networking, or similar services. This
combination would constitute covered
personal identifiers.
(d) Examples of a listed identifier in
combination with other data disclosed
by a transacting party—(1) Example 1.
A foreign person who is a covered
person asks a U.S. company for a list of
Media Access Control (‘‘MAC’’)
addresses from devices that have
connected to the wireless network of a
U.S. fast-food restaurant located in a
particular government building. The
U.S. company then sells the list of MAC
addresses, without any other listed
identifiers or sensitive personal data, to
the covered person. The disclosed MAC
addresses, when paired with the other
data disclosed by the covered person—
that the devices ‘‘have connected to the
wireless network of a U.S. fast-food
restaurant located in a particular
government building’’—makes it so that
the MAC addresses are linked or
linkable to other sensitive personal data,
in this case precise geolocation data of
the location of the fast-food restaurant
that the national security-related
individuals frequent with their devices.
This combination of data therefore
meets the definition of covered personal
identifiers.
(2) Example 2. A U.S. company sells
to a country of concern a list of
residential addresses that the company
describes (whether in a heading on the
list or separately to the country of
concern as part of the transaction) as
‘‘addresses of members of a country of
concern’s opposition political party in
New York City’’ or as ‘‘addresses of
active-duty military officers who live in
Howard County, Maryland’’ without any
other listed identifiers or sensitive
personal data. The data disclosed by the
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
U.S. company’s description, when
paired with the disclosed addresses,
makes the addresses linked or linkable
to other listed identifiers or to other
sensitive personal data of the U.S.
individuals associated with them. This
combination of data therefore meets the
definition of covered personal
identifiers.
(3) Example 3. A covered person asks
a U.S. company for a bulk list of birth
dates for ‘‘any American who visited a
Starbucks in Washington, DC, in
December 2023.’’ The U.S. company
then sells the list of birth dates, without
any other listed identifiers or sensitive
personal data, to the covered person.
The other data disclosed by the covered
person—‘‘any American who visited a
Starbucks in Washington, DC, in
December 2023’’—does not make the
birth dates linked or linkable to other
listed identifiers or to other sensitive
personal data. This combination of data
therefore does not meet the definition of
covered personal identifiers.
(4) Example 4. Same as Example 3,
but the covered person asks the U.S.
company for a bulk list of names (rather
than birth dates) for ‘‘any American who
visited a Starbucks in Washington, DC,
in December 2023.’’ The other data
disclosed by the covered person—‘‘any
American who visited a Starbucks in
Washington, DC, in December 2023’’—
does not make the list of names, without
more, linked or linkable to other listed
identifiers or to other sensitive personal
data. This combination of data therefore
does not meet the definition of covered
personal identifiers.
(5) Example 5. A U.S. company sells
to a covered person a list of residential
addresses that the company describes
(in a heading in the list or to the covered
person as part of the transaction) as
‘‘households of Americans who watched
more than 50% of episodes’’ of a
specific popular TV show, without any
other listed identifiers or sensitive
personal data. The other data disclosed
by the U.S. company—‘‘Americans who
watched more than 50% of episodes’’ of
a specific popular TV show—does not
increase the extent to which the
addresses are linked or linkable to other
listed identifiers or to other sensitive
personal data. This combination of data
therefore does not meet the definition of
covered personal identifiers.
§ 202.213
Cuba.
The term Cuba means the Republic of
Cuba, as well as any political
subdivision, agency, or instrumentality
thereof.
PO 00000
Frm 00093
Fmt 4701
Sfmt 4702
§ 202.214
86207
Data brokerage.
(a) Definition. The term data
brokerage means the sale of data,
licensing of access to data, or similar
commercial transactions involving the
transfer of data from any person (the
provider) to any other person (the
recipient), where the recipient did not
collect or process the data directly from
the individuals linked or linkable to the
collected or processed data.
(b) Examples—(1) Example 1. A U.S.
company sells bulk U.S. sensitive
personal data to an entity headquartered
in a country of concern. The U.S.
company engages in prohibited data
brokerage.
(2) Example 2. A U.S. company enters
into an agreement that gives a covered
person a license to access governmentrelated data held by the U.S. company.
The U.S. company engages in prohibited
data brokerage.
(3) Example 3. A U.S. organization
maintains a database of bulk U.S.
sensitive personal data and offers
annual memberships for a fee that
provide members a license to access that
data. Providing an annual membership
to a covered person that includes a
license to access government-related
data or bulk U.S. sensitive personal data
would constitute prohibited data
brokerage.
(4) Example 4. A U.S. company owns
and operates a mobile app for U.S. users
with available advertising space. As part
of selling the advertising space, the U.S.
company provides the bulk precise
geolocation data, IP address, and
advertising IDs of its U.S. users’ devices
to an advertising exchange based in a
country of concern. The U.S. company’s
provision of this data as part of the sale
of advertising space is data brokerage
and a prohibited transaction.
(5) Example 5. Same as Example 4,
but the U.S. company provides the data
to an advertising exchange based in the
United States. As part of the sale of the
advertising space, the U.S. advertising
exchange provides the data to
advertisers headquartered in a country
of concern. The U.S. company’s
provision of the data to the U.S.
advertising exchange would not be a
transaction because it is between U.S.
persons. The advertising exchange’s
provision of this data to the country of
concern-based advertisers is data
brokerage because it is a commercial
transaction involving the transfer of data
from the U.S. advertising exchange to
the advertisers headquartered in the
country of concern, where those
country-of-concern advertisers did not
collect or process the data directly from
the individuals linked or linkable to the
collected or processed data.
E:\FR\FM\29OCP2.SGM
29OCP2
86208
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
Furthermore, the U.S. advertising
exchange’s provision of this data to the
country of concern-based advertisers is
a prohibited transaction.
(6) Example 6. A U.S. information
technology company operates an
autonomous driving platform that
collects the precise geolocation data of
its cars operating in the United States.
The U.S. company sells or otherwise
licenses this bulk data to its parent
company headquartered in a country of
concern to help develop artificial
intelligence technology and machine
learning capabilities. The sale or license
is data brokerage and a prohibited
transaction.
§ 202.215
Directing.
The term directing means having any
authority (individually or as part of a
group) to make decisions for or on
behalf of an entity and exercising that
authority.
§ 202.216
Effective date.
The term effective date refers to the
effective date of the applicable
prohibitions and directives contained in
this part, which is 12:01 a.m. ET on
[date to be determined].
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.217
Employment agreement.
(a) Definition. The term employment
agreement means any agreement or
arrangement in which an individual,
other than as an independent contractor,
performs work or performs job functions
directly for a person in exchange for
payment or other consideration,
including employment on a board or
committee, executive-level
arrangements or services, and
employment services at an operational
level.
(b) Examples—(1) Example 1. A U.S.
company that conducts consumer
human genomic testing collects and
maintains bulk human genomic data
from U.S. consumers. The U.S. company
has global IT operations, including
employing a team of individuals who
are citizens of and primarily resident in
a country of concern to provide backend services. The agreements related to
employing these individuals are
employment agreements. Employment
as part of the global IT operations team
includes access to the U.S. company’s
systems containing the bulk human
genomic data. These employment
agreements would be prohibited
transactions (because they involve
access to bulk human genomic data).
(2) Example 2. A U.S. company
develops its own mobile games and
social media apps that collect the bulk
U.S. sensitive personal data of its U.S.
users. The U.S. company distributes
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
these games and apps in the United
States through U.S.-based digital
distribution platforms for software
applications. The U.S. company intends
to hire as CEO an individual designated
by the Attorney General as a covered
person because of evidence the CEO acts
on behalf of a country of concern. The
agreement retaining the individual as
CEO would be an employment
agreement. The individual’s authorities
and responsibilities as CEO involve
access to all data collected by the apps,
including the bulk U.S. sensitive
personal data. The CEO’s employment
would be a restricted transaction.
(3) Example 3. A U.S. company has
derived U.S. persons’ biometric
identifiers by scraping public photos
from social media platforms. The U.S.
company stores the derived biometric
identifiers in bulk, including face-data
scans, for the purpose of training or
enhancing facial-recognition software.
The U.S. company intends to hire a
foreign person, who primarily resides in
a country of concern, as a project
manager responsible for the database.
The agreement retaining the project
manager would be an employment
agreement. The individual’s
employment as the lead project manager
would involve access to the bulk
biometric identifiers. The project
manager’s employment would be a
restricted transaction.
(4) Example 4. A U.S. financialservices company seeks to hire a data
scientist who is a citizen of a country of
concern who primarily resides in that
country of concern and who is
developing a new artificial intelligencebased personal assistant that could be
sold as a standalone product to the
company’s customers. The arrangement
retaining the data scientist would be an
employment agreement. As part of that
individual’s employment, the data
scientist would have administrator
rights that allow that individual to
access, download, and transmit bulk
quantities of personal financial data not
ordinarily incident to and part of the
company’s underlying provision of
financial services to its customers. The
data scientist’s employment would be a
restricted transaction.
(5) Example 5. A U.S. company sells
goods and collects bulk personal
financial data about its U.S. customers.
The U.S. company appoints a citizen of
a country of concern, who is located in
a country of concern, to its board of
directors. This director would be a
covered person, and the arrangement
appointing the director would be an
employment agreement. In connection
with the board’s data security and
cybersecurity responsibilities, the
PO 00000
Frm 00094
Fmt 4701
Sfmt 4702
director could access the bulk personal
financial data. The director’s
employment would be a restricted
transaction.
§ 202.218
Entity.
The term entity means a partnership,
association, trust, joint venture,
corporation, group, subgroup, or other
organization.
§ 202.219
Exempt transaction.
The term exempt transaction means a
data transaction that is subject to one or
more exemptions described in subpart E
of this part.
§ 202.220
Former senior official.
The term former senior official means
either a ‘‘former senior employee’’ or a
‘‘former very senior employee,’’ as those
terms are defined in 5 CFR 2641.104.
§ 202.221
Foreign person.
The term foreign person means any
person that is not a U.S. person.
§ 202.222
Government-related data.
(a) Definition. The term governmentrelated data means the following:
(1) Any precise geolocation data,
regardless of volume, for any location
within any area enumerated on the
Government-Related Location Data List
in § 202.1401 which the Attorney
General has determined poses a
heightened risk of being exploited by a
country of concern to reveal insights
about locations controlled by the
Federal Government, including insights
about facilities, activities, or
populations in those locations, to the
detriment of national security, because
of the nature of those locations or the
personnel who work there. Such
locations may include:
(i) The worksite or duty station of
Federal Government employees or
contractors who occupy a national
security position as that term is defined
in 5 CFR 1400.102(a)(4);
(ii) A military installation as that term
is defined in 10 U.S.C. 2801(c)(4); or
(iii) Facilities or locations that
otherwise support the Federal
Government’s national security,
defense, intelligence, law enforcement,
or foreign policy missions.
(2) Any sensitive personal data,
regardless of volume, that a transacting
party markets as linked or linkable to
current or recent former employees or
contractors, or former senior officials, of
the United States Government,
including the military and Intelligence
Community.
(b) Examples of government-related
data marketed by a transacting party—
(1) Example 1. A U.S. company
advertises the sale of a set of sensitive
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
personal data as belonging to ‘‘active
duty’’ personnel, ‘‘military personnel
who like to read,’’ ‘‘DoD’’ personnel,
‘‘government employees,’’ or
‘‘communities that are heavily
connected to a nearby military base.’’
The data is government-related data.
(2) Example 2. In discussing the sale
of a set of sensitive personal data with
a covered person, a U.S. company
describes the dataset as belonging to
members of a specific named
organization. The identified
organization restricts membership to
current and former members of the
military and their families. The data is
government-related data.
§ 202.223
Human biospecimens.
The term human biospecimens means
a quantity of tissue, blood, urine, or
other human-derived material,
including such material classified under
any of the following 10-digit
Harmonized System-based Schedule B
numbers:
(a) 0501.00.0000 Human hair,
unworked, whether or not washed or
scoured; waste of human hair
(b) 3001.20.0000 Extracts of glands or
other organs or of their secretions
(c) 3001.90.0115 Glands and other
organs, dried, whether or not powdered
(d) 3002.12.0010 Human blood
plasma
(e) 3002.12.0020 Normal human blood
sera, whether or not freeze-dried
(f) 3002.12.0030 Human immune
blood sera
(g) 3002.12.0090 Antisera and other
blood fractions, Other
(h) 3002.51.0000 Cell therapy
products
(i) 3002.59.0000 Cell cultures,
whether or not modified, Other
(j) 3002.90.5210 Whole human blood
(k) 3002.90.5250 Blood, human/
animal, other
(l) 9705.21.0000 Human specimens
and parts thereof
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.224
Human genomic data.
The term human genomic data means
data representing the nucleic acid
sequences that constitute the entire set
or a subset of the genetic instructions
found in a human cell, including the
result or results of an individual’s
‘‘genetic test’’ (as defined in 42 U.S.C.
300gg–91(d)(17)) and any related human
genetic sequencing data.
§ 202.225
IEEPA.
The term IEEPA means the
International Emergency Economic
Powers Act (50 U.S.C. 1701 et seq.).
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
§ 202.226 Information or informational
materials.
(a) Definition. The term information
or informational materials is limited to
expressive material and includes
publications, films, posters, phonograph
records, photographs, microfilms,
microfiche, tapes, compact disks, CD
ROMs, artworks, and news wire feeds.
It does not include data that is
technical, functional, or otherwise nonexpressive.
(b) Exclusions. The term information
or informational materials does not
include:
(1) Information or informational
materials not fully created and in
existence at the date of the data
transaction, or the substantive or artistic
alteration or enhancement of
information or informational materials,
or the provision of marketing and
business consulting services, including
to market, produce or co-produce, or
assist in the creation of information or
informational materials;
(2) Items that were, as of April 30,
1994, or that thereafter become,
controlled for export to the extent that
such controls promote the
nonproliferation or antiterrorism
policies of the United States, or with
respect to which acts are prohibited by
18 U.S.C. chapter 37.
(c) Examples—(1) Example 1. A U.S.
person enters into an agreement to
create a customized dataset of bulk U.S.
sensitive personal data that meets a
covered person’s specifications (such as
the specific types and fields of data,
date ranges, and other criteria) and to
sell that dataset to the covered person.
This customized dataset is not fully
created and in existence at the date of
the agreement, and therefore is not
information or informational materials.
(2) Example 2. A U.S. company has
access to several pre-existing databases
of different bulk sensitive personal data.
The U.S. company offers, for a fee, to
use data analytics to link the data across
these databases to the same individuals
and to sell that combined dataset to a
covered person. This service constitutes
a substantive alteration or enhancement
of the data in the pre-existing databases
and therefore is not information or
informational materials.
§ 202.227
Interest.
Except as otherwise provided in this
part, the term interest, when used with
respect to property (e.g., ‘‘an interest in
property’’), means an interest of any
nature whatsoever, direct or indirect.
§ 202.228
Investment agreement.
(a) Definition. The term investment
agreement means an agreement or
PO 00000
Frm 00095
Fmt 4701
Sfmt 4702
86209
arrangement in which any person, in
exchange for payment or other
consideration, obtains direct or indirect
ownership interests in or rights in
relation to:
(1) Real estate located in the United
States; or
(2) A U.S. legal entity.
(b) Exclusion for passive investments.
The term investment agreement
excludes any investment that:
(1) Is made:
(i) Into a publicly traded security,
with ‘‘security’’ defined in section
3(a)(10) of the Securities Exchange Act
of 1934 (15 U.S.C. 78c(a)(10)),
denominated in any currency that trades
on a securities exchange or through the
method of trading that is commonly
referred to as ‘‘over-the-counter,’’ in any
jurisdiction;
(ii) Into a security offered by:
(A) Any ‘‘investment company’’ (as
defined in section 3(a)(1) of the
Investment Company Act of 1940 (15
U.S.C. 80a–3(a)(1)) that is registered
with the United States Securities and
Exchange Commission, such as index
funds, mutual funds, or exchange traded
funds; or
(B) Any company that has elected to
be regulated or is regulated as a business
development company pursuant to
section 54(a) of the Investment
Company Act of 1940 (15 U.S.C. 80a–
53), or any derivative of either of the
foregoing; or
(iii) As a limited partner into a
venture capital fund, private equity
fund, fund of funds, or other pooled
investment fund, if the limited partner’s
contribution is solely capital and the
limited partner cannot make managerial
decisions, is not responsible for any
debts beyond its investment, and does
not have the formal or informal ability
to influence or participate in the fund’s
or a U.S. person’s decision making or
operations;
(2) Gives the covered person less than
10% in total voting and equity interest
in a U.S. person; and
(3) Does not give a covered person
rights beyond those reasonably
considered to be standard minority
shareholder protections, including (a)
membership or observer rights on, or the
right to nominate an individual to a
position on, the board of directors or an
equivalent governing body of the U.S.
person, or (b) any other involvement,
beyond the voting of shares, in
substantive business decisions,
management, or strategy of the U.S.
person.
(c) Examples—(1) Example 1. A U.S.
company intends to build a data center
located in a U.S. territory. The data
center will store bulk personal health
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86210
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
data on U.S. persons. A foreign private
equity fund located in a country of
concern agrees to provide capital for the
construction of the data center in
exchange for acquiring a majority
ownership stake in the data center. The
agreement that gives the private equity
fund a stake in the data center is an
investment agreement. The investment
agreement is a restricted transaction.
(2) Example 2. A foreign technology
company that is subject to the
jurisdiction of a country of concern and
that the Attorney General has
designated as a covered person enters
into a shareholders’ agreement with a
U.S. business that develops mobile
games and social media apps, acquiring
a minority equity stake in the U.S.
business. The shareholders’ agreement
is an investment agreement. These
games and apps developed by the U.S.
business systematically collect bulk U.S.
sensitive personal data of its U.S. users.
The investment agreement explicitly
gives the foreign technology company
the ability to access this data and is
therefore a restricted transaction.
(3) Example 3. Same as Example 2,
but the investment agreement either
does not explicitly give the foreign
technology company the right to access
the data or explicitly forbids that access.
The investment agreement nonetheless
provides the foreign technology
company with the sufficient ownership
interest, rights, or other involvement in
substantive business decisions,
management, or strategy such that the
investment does not constitute a passive
investment. Because it is not a passive
investment, the ownership interest,
rights, or other involvement in
substantive business decisions,
management, or strategy gives the
foreign technology company the ability
to obtain logical or physical access,
regardless of how the agreement
formally distributes those rights. The
investment agreement therefore involves
access to bulk U.S. sensitive personal
data. The investment agreement is a
restricted transaction.
(4) Example 4. Same as Example 3,
but the U.S. business does not maintain
or have access to any governmentrelated data or bulk U.S. sensitive
personal data (e.g., a pre-commercial
company or startup company). Because
the data transaction cannot involve
access to any government-related data or
bulk U.S. sensitive personal data, this
investment agreement does not meet the
definition of a covered data transaction
and is not a restricted transaction.
§ 202.229
Iran.
The term Iran means the Islamic
Republic of Iran, as well as any political
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
subdivision, agency, or instrumentality
thereof.
§ 202.230
Knowingly.
(a) Definition. The term knowingly,
with respect to conduct, a circumstance,
or a result, means that a person has
actual knowledge, or reasonably should
have known, of the conduct, the
circumstance, or the result.
(b) Examples—(1) Example 1. A U.S.
company sells DNA testing kits to U.S.
consumers and maintains bulk human
genomic data collected from those
consumers. The U.S. company enters
into a contract with a foreign cloudcomputing company (which is not a
covered person) to store the U.S.
company’s database of human genomic
data. The foreign company hires
employees from other countries,
including citizens of countries of
concern who primarily reside in a
country of concern, to manage databases
for its customers, including the U.S.
company’s human genomic database.
There is no indication of evasion, such
as the U.S. company knowingly
directing the foreign company’s
employment agreements with covered
persons, or the U.S. company engaging
in and structuring these transactions to
evade the regulations. The cloudcomputing services agreement between
the U.S. company and the foreign
company would not be prohibited or
restricted, because that covered data
transaction is between a U.S. person and
a foreign company that does not meet
the definition of a covered person. The
employment agreements between the
foreign company and the covered
persons would not be prohibited or
restricted because those agreements are
between foreign persons.
(2) Example 2. A U.S. company
transmits the bulk U.S. sensitive
personal data of U.S. persons to a
country of concern, in violation of this
part, using a fiber optic cable operated
by another U.S. company. The U.S.
cable operator has not knowingly
engaged in a prohibited transaction or a
restricted transaction solely by virtue of
operating the fiber optic cable because
the U.S. cable operator does not know,
and reasonably should not know, the
content of the traffic transmitted across
the fiber optic cable.
(3) Example 3. A U.S. service provider
provides a software platform on which
a U.S. company processes the bulk U.S.
sensitive personal data of its U.S.person customers. While the U.S.
service provider is generally aware of
the nature of the U.S. company’s
business, the U.S. service provider is
not aware of the kind or volume of data
that the U.S. company processes on the
PO 00000
Frm 00096
Fmt 4701
Sfmt 4702
platform, how the U.S. company uses
the data, or whether the U.S. company
engages in data transactions. The U.S.
company also primarily controls access
to its data on the platform, with the U.S.
service provider accessing the data only
for troubleshooting or technical support
purposes, upon request by the U.S.
company. Subsequently, without the
actual knowledge of the U.S. service
provider and without providing the U.S.
service provider with any information
from which the service provider should
have known, the U.S. company grants
access to the data on the U.S. service
provider’s software platform to a
covered person through a covered data
transaction, in violation of this part. The
U.S. service provider itself, however,
has not knowingly engaged in a
restricted transaction by enabling the
covered persons’ access via its software
platform.
(4) Example 4. Same as Example 3,
but in addition to providing the
software platform, the U.S. company’s
contract with the U.S. service provider
also outsources the U.S. company’s
processing and handling of the data to
the U.S. service provider. As a result,
the U.S. service provider primarily
controls access to the U.S. company’s
bulk U.S. sensitive personal data on the
platform. The U.S. service provider
employs a covered person and grants
access to this data as part of this
employment. Although the U.S.
company’s contract with the U.S.
service provider is not a restricted
transaction, the U.S. service provider’s
employment agreement with the
covered person is a restricted
transaction. The U.S. service provider
has thus knowingly engaged in a
restricted transaction by entering into an
employment agreement that grants
access to its employee because the U.S.
service provider knew or should have
known of its employee’s covered person
status and, as the party responsible for
processing and handling the data, the
U.S. service provider was aware of the
kind and volume of data that the U.S.
company processes on the platform.
(5) Example 5. A U.S. company
provides cloud storage to a U.S.
customer for the encrypted storage of
the customer’s bulk U.S. sensitive
personal data. The U.S. cloud-service
provider has an emergency back-up
encryption key for all its customers’
data, but the company is contractually
limited to using the key to decrypt the
data only at the customer’s request. The
U.S. customer’s systems and access to
the key become disabled, and the U.S.
customer requests that the cloud-service
provider use the back-up encryption key
to decrypt the data and store it on a
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
backup server while the customer
restores its own systems. By having
access to and using the backup
encryption key to decrypt the data in
accordance with the contractual
limitation, the U.S. cloud-service
provider does not and reasonably
should not know the kind and volumes
of the U.S. customer’s data. If the U.S.
customer later uses the cloud storage to
knowingly engage in a prohibited
transaction, the U.S. cloud-service
provider’s access to and use of the
backup encryption key does not mean
that the U.S. cloud-service provider has
also knowingly engaged in a restricted
transaction.
(6) Example 6. A prominent human
genomics research clinic enters into a
cloud-services contract with a U.S.
cloud-service provider that specializes
in storing and processing healthcare
data to store bulk human genomic
research data. The cloud-service
provider hires IT personnel in a country
of concern, who are thus covered
persons. While the data that is stored is
encrypted, the IT personnel can access
the data in encrypted form. The
employment agreement between the
U.S. cloud-service provider and the IT
professionals in the country of concern
is a prohibited transaction because the
agreement involves giving the IT
personnel access to the encrypted data
and constitutes a transfer of human
genomic data. Given the nature of the
research institution’s work and the
cloud-service provider’s expertise in
storing healthcare data, the cloudservice provider reasonably should have
known that the encrypted data is bulk
U.S. sensitive personal data covered by
the regulations. The cloud-service
provider has therefore knowingly
engaged in a prohibited transaction
(because it involves access to human
genomic data).
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.231
Licenses; general and specific.
(a) General license. The term general
license means a written license issued
pursuant to this part authorizing a class
of transactions and not limited to a
particular person.
(b) Specific license. The term specific
license means a written license issued
pursuant to this part to a particular
person or persons, authorizing a
particular transaction or transactions in
response to a written license
application.
§ 202.232
Linked.
(a) Definition. The term linked means
associated.
(b) Examples—(1) Example 1. A U.S.
person transfers two listed identifiers in
a single spreadsheet—such as a list of
VerDate Sep<11>2014
18:28 Oct 28, 2024
Jkt 265001
names of individuals and associated
MAC addresses for those individuals’
devices. The names and MAC addresses
would be considered linked.
(2) Example 2. A U.S. person transfers
two listed identifiers in different
spreadsheets—such as a list of names of
individuals in one spreadsheet and
MAC addresses in another
spreadsheet—to two related parties in
two different covered data transactions.
The names and MAC addresses would
be considered linked, provided that
some correlation existed between the
names and MAC addresses (e.g.,
associated employee ID number is also
listed in both spreadsheets).
(3) Example 3. A U.S. person transfers
a standalone list of MAC addresses,
without any additional listed identifiers.
The standalone list does not include
covered personal identifiers. That
standalone list of MAC addresses would
not become covered personal identifiers
even if the receiving party is capable of
obtaining separate sets of other listed
identifiers or sensitive personal data
through separate covered data
transactions with unaffiliated parties
that would ultimately permit the
association of the MAC addresses to
specific persons. The MAC addresses
would not be considered linked or
linkable to those separate sets of other
listed identifiers or sensitive personal
data.
§ 202.233
The term linkable means reasonably
capable of being linked.
Note to § 202.233. Data is considered
linkable when the identifiers involved
in a single covered data transaction, or
in multiple covered data transactions or
a course of dealing between the same or
related parties, are reasonably capable of
being associated with the same
person(s). Identifiers are not linked or
linkable when additional identifiers or
data not involved in the relevant
covered data transaction(s) would be
necessary to associate the identifiers
with the same specific person(s).
§ 202.234
Listed identifier.
The term listed identifier means any
piece of data in any of the following
data fields:
(a) Full or truncated government
identification or account number (such
as a Social Security number, driver’s
license or State identification number,
passport number, or Alien Registration
Number);
(b) Full financial account numbers or
personal identification numbers
associated with a financial institution or
financial-services company;
PO 00000
Frm 00097
Fmt 4701
(c) Device-based or hardware-based
identifier (such as International Mobile
Equipment Identity (‘‘IMEI’’), Media
Access Control (‘‘MAC’’) address, or
Subscriber Identity Module (‘‘SIM’’)
card number);
(d) Demographic or contact data (such
as first and last name, birth date,
birthplace, ZIP code, residential street
or postal address, phone number, email
address, or similar public account
identifiers);
(e) Advertising identifier (such as
Google Advertising ID, Apple ID for
Advertisers, or other mobile advertising
ID (‘‘MAID’’));
(f) Account-authentication data (such
as account username, account password,
or an answer to security questions);
(g) Network-based identifier (such as
internet Protocol (‘‘IP’’) address or
cookie data); or
(h) Call-detail data (such as Customer
Proprietary Network Information
(‘‘CPNI’’)).
§ 202.235
Sfmt 4702
National Security Division.
The term National Security Division
means the National Security Division of
the United States Department of Justice.
§ 202.236
North Korea.
The term North Korea means the
Democratic People’s Republic of North
Korea, and any political subdivision,
agency, or instrumentality thereof.
§ 202.237
Linkable.
86211
Order.
The term Order means Executive
Order 14117 of February 28, 2024
(Preventing Access to Americans’ Bulk
Sensitive Personal Data and United
States Government-Related Data by
Countries of Concern), 89 FR 15421
(March 1, 2024).
§ 202.238
Person.
The term person means an individual
or entity.
§ 202.239
Personal communications.
The term personal communications
means any postal, telegraphic,
telephonic, or other personal
communication that does not involve
the transfer of anything of value, as set
out under 50 U.S.C. 1702(b)(1).
§ 202.240
Personal financial data.
The term personal financial data
means data about an individual’s credit,
charge, or debit card, or bank account,
including purchases and payment
history; data in a bank, credit, or other
financial statement, including assets,
liabilities, debts, or trades in a securities
portfolio; or data in a credit report or in
a ‘‘consumer report’’ (as defined in 15
U.S.C. 1681a(d)).
E:\FR\FM\29OCP2.SGM
29OCP2
86212
§ 202.241
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
Personal health data.
The term personal health data means
health information that relates to the
past, present, or future physical or
mental health or condition of an
individual; the provision of healthcare
to an individual; or the past, present, or
future payment for the provision of
healthcare to an individual. This term
includes basic physical measurements
and health attributes (such as bodily
functions, height and weight, vital signs,
symptoms, and allergies); social,
psychological, behavioral, and medical
diagnostic, intervention, and treatment
history; test results; logs of exercise
habits; immunization data; data on
reproductive and sexual health; and
data on the use or purchase of
prescribed medications.
§ 202.245 Recent former employees or
contractors.
The terms recent former employees or
recent former contractors mean
employees or contractors who worked
for or provided services to the United
States Government, in a paid or unpaid
status, within the past 2 years of a
potential covered data transaction.
§ 202.246
The term restricted transaction means
a data transaction that is subject to
subpart D of this part.
§ 202.247
Precise geolocation data.
Security requirements.
The term precise geolocation data
means data, whether real-time or
historical, that identifies the physical
location of an individual or a device
with a precision of within 1,000 meters.
The term security requirements means
the Cybersecurity and Infrastructure
Agency (‘‘CISA’’) Security Requirements
for Restricted Transactions
(incorporated by reference, see
§ 202.402).
§ 202.243
§ 202.249
Prohibited transaction.
The term prohibited transaction
means a data transaction that is subject
to one or more of the prohibitions
described in subpart C of this part.
§ 202.244
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Russia.
The term Russia means the Russian
Federation, and any political
subdivision, agency, or instrumentality
thereof.
§ 202.248
§ 202.242
Restricted transaction.
Property; property interest.
The terms property and property
interest include money; checks; drafts;
bullion; bank deposits; savings
accounts; debts; indebtedness;
obligations; notes; guarantees;
debentures; stocks; bonds; coupons; any
other financial instruments; bankers
acceptances; mortgages, pledges, liens,
or other rights in the nature of security;
warehouse receipts, bills of lading, trust
receipts, bills of sale, or any other
evidences of title, ownership, or
indebtedness; letters of credit and any
documents relating to any rights or
obligations thereunder; powers of
attorney; goods; wares; merchandise;
chattels; stocks on hand; ships; goods on
ships; real estate mortgages; deeds of
trust; vendors’ sales agreements; land
contracts, leaseholds, ground rents, real
estate and any other interest therein;
options; negotiable instruments; trade
acceptances; royalties; book accounts;
accounts payable; judgments; patents;
trademarks or copyrights; insurance
policies; safe deposit boxes and their
contents; annuities; pooling agreements;
services of any nature whatsoever;
contracts of any nature whatsoever; any
other property, real, personal, or mixed,
tangible or intangible, or interest or
interests therein, present, future, or
contingent.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
Sensitive personal data.
(a) Definition. The term sensitive
personal data means covered personal
identifiers, precise geolocation data,
biometric identifiers, human genomic
data, personal health data, personal
financial data, or any combination
thereof.
(b) Exclusions. The term sensitive
personal data excludes:
(1) Public or nonpublic data that does
not relate to an individual, including
such data that meets the definition of a
‘‘trade secret’’ (as defined in 18 U.S.C.
1839(3)) or ‘‘proprietary information’’
(as defined in 50 U.S.C. 1708(d)(7));
(2) Data that is, at the time of the
transaction, lawfully available to the
public from a Federal, State, or local
government record (such as court
records) or in widely distributed media
(such as sources that are generally
available to the public through
unrestricted and open-access
repositories);
(3) Personal communications; and
(4) Information or informational
materials.
§ 202.250 Special Administrative Region of
Hong Kong.
The term Special Administrative
Region of Hong Kong means the Special
Administrative Region of Hong Kong,
and any political subdivision, agency, or
instrumentality thereof.
§ 202.251
Macau.
Special Administrative Region of
The term Special Administrative
Region of Macau means the Special
PO 00000
Frm 00098
Fmt 4701
Sfmt 4702
Administrative Region of Macau, and
any political subdivision, agency, or
instrumentality thereof.
§ 202.252
Telecommunications service.
The term telecommunications service
means ‘‘telecommunications service’’ as
defined in 47 U.S.C. 153(53).
§ 202.253
Transaction.
The term transaction means any
acquisition, holding, use, transfer,
transportation, exportation of, or dealing
in any property in which a foreign
country or national thereof has an
interest.
§ 202.254
Transfer.
The term transfer means any actual or
purported act or transaction, whether or
not evidenced by writing, and whether
or not done or performed within the
United States, the purpose, intent, or
effect of which is to create, surrender,
release, convey, transfer, or alter,
directly or indirectly, any right, remedy,
power, privilege, or interest with respect
to any property. Without limitation on
the foregoing, it shall include the
making, execution, or delivery of any
assignment, power, conveyance, check,
declaration, deed, deed of trust, power
of attorney, power of appointment, bill
of sale, mortgage, receipt, agreement,
contract, certificate, gift, sale, affidavit,
or statement; the making of any
payment; the setting off of any
obligation or credit; the appointment of
any agent, trustee, or fiduciary; the
creation or transfer of any lien; the
issuance, docketing, filing, or levy of or
under any judgment, decree,
attachment, injunction, execution, or
other judicial or administrative process
or order, or the service of any
garnishment; the acquisition of any
interest of any nature whatsoever by
reason of a judgment or decree of any
foreign country; the fulfillment of any
condition; the exercise of any power of
appointment, power of attorney, or
other power; or the acquisition,
disposition, transportation, importation,
exportation, or withdrawal of any
security.
§ 202.255
United States.
The term United States means the
United States, its territories and
possessions, and all areas under the
jurisdiction or authority thereof.
§ 202.256
person.
United States person or U.S.
(a) Definition. The terms United
States person and U.S. person mean any
United States citizen, national, or lawful
permanent resident; any individual
admitted to the United States as a
refugee under 8 U.S.C. 1157 or granted
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
asylum under 8 U.S.C. 1158; any entity
organized solely under the laws of the
United States or any jurisdiction within
the United States (including foreign
branches); or any person in the United
States.
(b) Examples—(1) Example 1. An
individual is a citizen of a country of
concern and is in the United States. The
individual is a U.S. person.
(2) Example 2. An individual is a U.S.
citizen. The individual is a U.S. person,
regardless of location.
(3) Example 3. An individual is a dual
citizen of the United States and a
country of concern. The individual is a
U.S. person, regardless of location.
(4) Example 4. An individual is a
citizen of a country of concern, is not a
permanent resident alien of the United
States, and is outside the United States.
The individual is a foreign person.
(5) Example 5. A company is
organized under the laws of the United
States and has a foreign branch in a
country of concern. The company,
including its foreign branch, is a U.S.
person.
(6) Example 6. A parent company is
organized under the laws of the United
States and has a subsidiary organized
under the laws of a country of concern.
The subsidiary is a foreign person
regardless of the degree of ownership by
the parent company; the parent
company is a U.S. person.
(7) Example 7. A company is
organized under the laws of a country
of concern and has a branch in the
United States. The company, including
its U.S. branch, is a foreign person.
(8) Example 8. A parent company is
organized under the laws of a country
of concern and has a subsidiary
organized under the laws of the United
States. The subsidiary is a U.S. person
regardless of the degree of ownership by
the parent company; the parent
company is a foreign person.
§ 202.257
U.S. device.
The term U.S. device means any
device with the capacity to store or
transmit data that is linked or linkable
to a U.S. person.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.258
Vendor agreement.
(a) Definition. The term vendor
agreement means any agreement or
arrangement, other than an employment
agreement, in which any person
provides goods or services to another
person, including cloud-computing
services, in exchange for payment or
other consideration.
(b) Examples—(1) Example 1. A U.S.
company collects bulk precise
geolocation data from U.S. users
through an app. The U.S. company
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
enters into an agreement with a
company headquartered in a country of
concern to process and store this data.
This vendor agreement is a restricted
transaction.
(2) Example 2. A medical facility in
the United States contracts with a
company headquartered in a country of
concern to provide IT-related services.
The contract governing the provision of
services is a vendor agreement. The
medical facility has bulk personal
health data on its U.S. patients. The IT
services provided under the contract
involve access to the medical facility’s
systems containing the bulk personal
health data. This vendor agreement is a
restricted transaction.
(3) Example 3. A U.S. company,
which is owned by an entity
headquartered in a country of concern
and has been designated a covered
person, establishes a new data center in
the United States to offer managed
services. The U.S. company’s data
center serves as a vendor to various U.S.
companies to store bulk U.S. sensitive
personal data collected by those
companies. These vendor agreements
are restricted transactions.
(4) Example 4. A U.S. company
develops mobile games that collect bulk
precise geolocation data and biometric
identifiers of U.S.-person users. The
U.S. company contracts part of the
software development to a foreign
person who is primarily resident in a
country of concern and is a covered
person. The contract with the foreign
person is a vendor agreement. The
software-development services provided
by the covered person under the
contract involve access to the bulk
precise geolocation data and biometric
identifiers. This is a restricted
transaction.
(5) Example 5. A U.S. multinational
company maintains bulk U.S. sensitive
personal data of U.S. persons. This
company has a foreign branch, located
in a country of concern, that has access
to this data. The foreign branch
contracts with a local company located
in the country of concern to provide
cleaning services for the foreign
branch’s facilities. The contract is a
vendor agreement, the foreign branch is
a U.S. person, and the local company is
a covered person. Because the services
performed under this vendor agreement
do not ‘‘involve access to’’ the bulk U.S.
sensitive personal data, the vendor
agreement would not be a covered data
transaction.
§ 202.259
Venezuela.
The term Venezuela means the
Bolivarian Republic of Venezuela, and
PO 00000
Frm 00099
Fmt 4701
Sfmt 4702
86213
any political subdivision, agency, or
instrumentality thereof.
Subpart C—Prohibited Transactions
and Related Activities
§ 202.301 Prohibited data-brokerage
transactions.
(a) Prohibition. Except as otherwise
authorized pursuant to subparts E or H
of this part or any other provision of this
part, no U.S. person, on or after the
effective date, may knowingly engage in
a covered data transaction involving
data brokerage with a country of
concern or covered person.
(b) Examples—(1) Example 1. A U.S.
subsidiary of a company headquartered
in a country of concern develops an
artificial intelligence chatbot in the
United States that is trained on the bulk
U.S. sensitive personal data of U.S.
persons. While not its primary
commercial use, the chatbot is capable
of reproducing or otherwise disclosing
the bulk sensitive personal health data
that was used to train the chatbot when
responding to queries. The U.S.
subsidiary knowingly licenses
subscription-based access to that
chatbot worldwide, including to
covered persons such as its parent
entity. Although licensing use of the
chatbot itself may not necessarily
‘‘involve access’’ to bulk U.S. sensitive
personal data, the U.S. subsidiary
knows or should know that the license
can be used to obtain access to the U.S.
persons’ bulk sensitive personal training
data if prompted. The licensing of
access to this bulk U.S. sensitive
personal data is data brokerage because
it involves the transfer of data from the
U.S. company (i.e., the provider) to
licensees (i.e., the recipients), where the
recipients did not collect or process the
data directly from the individuals
linked or linkable to the collected or
processed data. Even though the license
did not explicitly provide access to the
data, this is a prohibited transaction
because the U.S. company knew or
should have known that the use of the
chatbot pursuant to the license could be
used to obtain access to the training
data, and because the U.S. company
licensed the product to covered persons.
(2) [Reserved]
§ 202.302 Other prohibited data-brokerage
transactions involving potential onward
transfer to countries of concern or covered
persons.
(a) Prohibition. Except as otherwise
authorized pursuant to this part, no U.S.
person, on or after the effective date,
may knowingly engage in a covered data
transaction involving data brokerage
with any foreign person that is not a
covered person unless the U.S. person:
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86214
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
(1) Contractually requires that the
foreign person refrain from engaging in
a subsequent covered data transaction
involving data brokerage of the same
data with a country of concern or
covered person; and
(2) Reports any known or suspected
violations of this contractual
requirement in accordance with
paragraph (b) of this section.
(b) Reporting known or suspected
violations—(1) When reports are due.
U.S. persons shall file reports within 14
days of the U.S. person becoming aware
of a known or suspected violation.
(2) Contents of reports. Reports on
known or suspected violations shall
include the following, to the extent the
information is known and available to
the person filing the report at the time
of the report:
(i) The name and address of the U.S.
person reporting the known or
suspected violation of the contractual
requirement in accordance with
paragraph (b) of this section;
(ii) A description of the known or
suspected violation, including:
(A) Date of known or suspected
violation;
(B) Description of the data-brokerage
transaction referenced in paragraph (a)
of this section;
(C) Description of the contractual
provision prohibiting the onward
transfer of the same data to a country of
concern or covered person;
(D) Description of the known or
suspected violation of the contractual
obligation prohibiting the foreign person
from engaging in a subsequent covered
data transaction involving the same data
with a country of concern or a covered
person;
(E) Any persons substantively
participating in the transaction
referenced in paragraph (a) of this
section;
(F) Information about the known or
suspected persons involved in the
onward data transfer transaction,
including the name and location of any
covered persons or countries of concern;
(G) A copy of any relevant
documentation received or created in
connection with the transaction; and
(iii) Any other information that the
Department of Justice may require or
any other information that the U.S.
person filing the report believes to be
pertinent to the known or suspected
violation or the implicated covered
person.
(3) Additional contents; format and
method of submission. Reports required
by this section must be submitted in
accordance with this section and with
subpart L of this part.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
(c) Examples—(1) Example 1. A U.S.
business knowingly enters into an
agreement to sell bulk human genomic
data to a European business that is not
a covered person. The U.S. business is
required to include in that agreement a
limitation on the European business’
right to resell or otherwise engage in a
covered data transaction involving data
brokerage of that data to a country of
concern or covered person. Otherwise,
the agreement would be a prohibited
transaction.
(2) Example 2. A U.S. company owns
and operates a mobile app for U.S. users
with available advertising space. As part
of selling the advertising space, the U.S.
company provides the bulk precise
geolocation data, IP address, and
advertising IDs of its U.S. users’ devices
to an advertising exchange based in
Europe that is not a covered person. The
U.S. company’s provision of this data to
the advertising exchange is data
brokerage and a prohibited transaction
unless the U.S. company obtains a
contractual commitment from the
advertising exchange not to engage in
any covered data transactions involving
data brokerage of that same data with a
country of concern or covered person.
§ 202.303 Prohibited human genomic data
and human biospecimen transactions.
Except as otherwise authorized
pursuant to this part, no U.S. person, on
or after the effective date, may
knowingly engage in any covered data
transaction with a country of concern or
covered person that involves access by
that country of concern or covered
person to bulk U.S. sensitive personal
data that involves bulk human genomic
data, or to human biospecimens from
which bulk human genomic data could
be derived.
§ 202.304 Prohibited evasions, attempts,
causing violations, and conspiracies.
(a) Prohibition. Any transaction on or
after the effective date that has the
purpose of evading or avoiding, causes
a violation of, or attempts to violate any
of the prohibitions set forth in this part
is prohibited. Any conspiracy formed to
violate the prohibitions set forth in this
part is prohibited.
(b) Examples—(1) Example 1. A U.S.
data broker seeks to sell bulk U.S.
sensitive personal data to a foreign
person who primarily resides in China.
With knowledge that the foreign person
is a covered person and with the intent
to evade the regulations, the U.S. data
broker invites the foreign person to
travel to the United States to
consummate the data transaction and
transfer the bulk U.S. sensitive personal
data in the United States. After
PO 00000
Frm 00100
Fmt 4701
Sfmt 4702
completing the transaction, the person
returns to China with the bulk U.S.
sensitive personal data. The transaction
in the United States is not a covered
data transaction because the person who
resides in China is a U.S. person while
in the United States (unless that person
was individually designated as a
covered person pursuant to
§ 202.211(a)(5), in which case their
covered person status would remain,
even while in the United States, and the
transaction would be a covered data
transaction). However, the U.S. data
broker has structured the transaction to
evade the regulation’s prohibitions on
covered data transactions with covered
persons. As a result, this transaction has
the purpose of evading the regulations
and is prohibited.
(2) Example 2. A Russian national,
who is employed by a corporation
headquartered in Russia, travels to the
United States to conduct business with
the Russian company’s U.S. subsidiary,
including with the purpose of obtaining
bulk U.S. sensitive personal data from
the U.S. subsidiary. The U.S. subsidiary
is a U.S. person, the Russian corporation
is a covered person, and the Russian
employee is a covered person while
outside the United States but a U.S.
person while temporarily in the United
States (unless that Russian employee
was individually designated as a
covered person pursuant to
§ 202.211(a)(5), in which case their
covered person status would remain,
even while in the United States, and the
transaction would be a covered data
transaction). With knowledge of these
facts, the U.S. subsidiary licenses access
to bulk U.S. sensitive personal data to
the Russian employee while in the
United States, who then returns to
Russia. This transaction has the purpose
of evading the regulations and is
prohibited.
(3) Example 3. A U.S. subsidiary of a
company headquartered in a country of
concern collects bulk precise
geolocation data from U.S. persons. The
U.S. subsidiary is a U.S. person, and the
parent company is a covered person.
With the purpose of evading the
regulations, the U.S. subsidiary enters
into a vendor agreement with a foreign
company that is not a covered person.
The vendor agreement provides the
foreign company access to the data. The
U.S. subsidiary knows (or reasonably
should know) that the foreign company
is a shell company, and knows that it
subsequently outsources the vendor
agreement to the U.S. subsidiary’s
parent company. This transaction has
the purpose of evading the regulations
and is prohibited.
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
(4) Example 4. A U.S. company
collects bulk personal health data from
U.S. persons. With the purpose of
evading the regulations, the U.S.
company enters into a vendor agreement
with a foreign company that is not a
covered person. The agreement provides
the foreign company access to the data.
The U.S. company knows (or reasonably
should know) that the foreign company
is a front company staffed primarily by
covered persons. The U.S. company has
not complied with either the security
requirements in § 202.248 or other
applicable requirements for conducting
restricted transactions as detailed in
subpart J of this part. This transaction
has the purpose of evading the
regulations and is prohibited.
(6) Example 6. A U.S. online gambling
company uses an artificial intelligence
algorithm to analyze collected bulk
covered personal identifiers to identify
users based on impulsivity for targeted
advertising. For the purpose of evasion,
a U.S. subsidiary of a company
headquartered in a country of concern
licenses the derivative algorithm from
the U.S. online gambling company for
the purpose of accessing bulk sensitive
personal identifiers from the training
data contained in the algorithm that
would not otherwise be accessible to the
parent company and shares the
algorithm with the parent company so
that the parent company can obtain the
bulk covered personal identifiers. The
U.S. subsidiary’s licensing transaction
with the parent company has the
purpose of evading the regulations and
is prohibited.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.305 Knowingly directing prohibited
or restricted transactions.
(a) Prohibition. Except as otherwise
authorized pursuant to this part, no U.S.
person, on or after the effective date,
may knowingly direct any covered data
transaction that would be a prohibited
transaction or restricted transaction that
fails to comply with the requirements of
subpart D and all other applicable
requirements under this part, if engaged
in by a U.S. person.
(b) Examples—(1) Example 1. A U.S.
person is an officer, senior manager, or
equivalent senior-level employee at a
foreign company that is not a covered
person, and the foreign company
undertakes a covered data transaction at
that U.S. person’s direction or with that
U.S. person’s approval when the
covered data transaction would be
prohibited if performed by a U.S.
person. The U.S. person has knowingly
directed a prohibited transaction.
(2) Example 2. Several U.S. persons
launch, own, and operate a foreign
company that is not a covered person,
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
and that foreign company, under the
U.S. persons’ operation, undertakes
covered data transactions that would be
prohibited if performed by a U.S.
person. The U.S. persons have
knowingly directed a prohibited
transaction.
(3) Example 3. A U.S. person is
employed at a U.S.-headquartered
multinational company that has a
foreign affiliate that is not a covered
person. The U.S. person instructs the
U.S. company’s compliance unit to
change (or approve changes to) the
operating policies and procedures of the
foreign affiliate with the specific
purpose of allowing the foreign affiliate
to undertake covered data transactions
that would be prohibited if performed
by a U.S. person. The U.S. person has
knowingly directed prohibited
transactions.
(4) Example 4. A U.S. bank processes
a payment from a U.S. person to a
covered person, or from a covered
person to a U.S. person, as part of that
U.S. person’s engagement in a
prohibited transaction. The U.S. bank
has not knowingly directed a prohibited
transaction, and its activity would not
be prohibited (although the U.S.
person’s covered data transaction would
be prohibited).
(5) Example 5. A U.S. financial
institution underwrites a loan or
otherwise provides financing for a
foreign company that is not a covered
person, and the foreign company
undertakes covered data transactions
that would be prohibited if performed
by a U.S. person. The U.S. financial
institution has not knowingly directed a
prohibited transaction, and its activity
would not be prohibited.
(6) Example 6. A U.S. person, who is
employed at a foreign company that is
not a covered person, signs paperwork
approving the foreign company’s
procurement of real estate for its
operations. The same foreign company
separately conducts data transactions
that use or are facilitated by operations
at that real estate location and that
would be prohibited transactions if
performed by a U.S. person, but the U.S.
employee has no role in approving or
directing those separate data
transactions. The U.S. person has not
knowingly directed a prohibited
transaction, and the U.S. person’s
activity would not be prohibited.
(7) Example 7. A U.S. company owns
or operates a submarine
telecommunications cable with one
landing point in a foreign country that
is not a country of concern and one
landing point in a country of concern.
The U.S. company leases capacity on
the cable to U.S. customers that transmit
PO 00000
Frm 00101
Fmt 4701
Sfmt 4702
86215
bulk U.S. sensitive personal data to the
landing point in the country of concern,
including transmissions as part of
prohibited transactions. The U.S.
company’s ownership or operation of
the cable does not constitute knowingly
directing a prohibited transaction, and
its ownership or operation of the cable
would not be prohibited (although the
U.S. customers’ covered data
transactions would be prohibited).
(8) Example 8. A U.S. person engages
in a vendor agreement involving bulk
U.S. sensitive personal data with a
foreign person who is not a covered
person. Such vendor agreement is not a
restricted or prohibited transaction. The
foreign person then employs an
individual who is a covered person and
grants them access to bulk U.S. sensitive
personal data without the U.S. person’s
knowledge or direction. There is no
covered data transaction between the
U.S. person and the covered person, and
there is no indication that the parties
engaged in these transactions with the
purpose of evading the regulations (such
as the U.S. person having knowingly
directed the foreign person’s
employment agreement with the
covered person or the parties knowingly
structuring a restricted transaction into
these multiple transactions with the
purpose of evading the prohibition). The
U.S. person has not knowingly directed
a restricted transaction.
(9) Example 9. A U.S. company sells
DNA testing kits to U.S. consumers and
maintains bulk human genomic data
collected from those consumers. The
U.S. company enters into a contract
with a foreign cloud-computing
company (which is not a covered
person) to store the U.S. company’s
database of human genomic data. The
foreign company hires employees from
other countries, including citizens of
countries of concern who primarily
reside in a country of concern, to
manage databases for its customers,
including the U.S. company’s human
genomic database. There is no
indication of evasion, such as the U.S.
company knowingly directing the
foreign company’s employment
agreements or the U.S. company
knowingly engaging in and structuring
these transactions to evade the
regulations. The cloud-computing
services agreement between the U.S.
company and the foreign company
would not be prohibited or restricted
because that transaction is between a
U.S. person and a foreign company that
does not meet the definition of a
covered person. The employment
agreements between the foreign
company and the covered persons
would not be prohibited or restricted
E:\FR\FM\29OCP2.SGM
29OCP2
86216
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
because those agreements are between
foreign persons.
Subpart D—Restricted Transactions
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.401 Authorization to conduct
restricted transactions.
(a) Restricted transactions. Except as
otherwise authorized pursuant to
subparts E or H of this part or any other
provision of this part, no U.S. person,
on or after the effective date, may
knowingly engage in a covered data
transaction involving a vendor
agreement, employment agreement, or
investment agreement with a country of
concern or covered person unless the
U.S. person complies with the security
requirements required by subpart D of
this part and all other applicable
requirements under this part.
(b) This subpart does not apply to
covered data transactions involving
access to bulk human genomic data or
human biospecimens from which such
data can be derived that is subject to the
prohibition in § 202.303 of this part.
(c) Examples—(1) Example 1. A U.S.
company engages in an employment
agreement with a covered person to
provide information technology
support. As part of their employment,
the covered person has access to
personal financial data. The U.S.
company implements and complies
with the security requirements. The
employment agreement is authorized as
a restricted transaction because the
company has complied with the
security requirements.
(2) Example 2. A U.S. company
engages in a vendor agreement with a
covered person to store bulk personal
health data. Instead of implementing the
security requirements as identified by
reference in this subpart, the U.S.
company implements different controls
that it believes mitigate the covered
person’s access to the bulk personal
health data. Because the U.S. person has
not complied with the security
requirements, the vendor agreement is
not authorized and thus is a prohibited
transaction.
(3) Example 3. A U.S. person engages
in a vendor agreement involving bulk
U.S. sensitive personal data with a
foreign person who is not a covered
person. The foreign person then
employs an individual who is a covered
person and grants them access to bulk
U.S. sensitive personal data without the
U.S. person’s knowledge or direction.
There is no covered data transaction
between the U.S. person and the
covered person, and there is no
indication that the parties engaged in
these transactions with the purpose of
evading the regulations (such as the U.S.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
person having knowingly directed the
foreign person’s employment agreement
with the covered person or the parties
knowingly structuring a prohibited
transaction into these multiple
transactions with the purpose of
evading the prohibition). As a result,
neither the vendor agreement nor the
employment agreement would be a
restricted transaction.
§ 202.402
Incorporation by reference.
(a) Incorporation by reference. Certain
material is incorporated by reference
into this part with the approval of the
Director of the Federal Register under 5
U.S.C. 552(a) and 1 CFR part 51. This
incorporation by reference (‘‘IBR’’)
material is available for inspection at
the Department of Justice and at the
National Archives and Records
Administration (‘‘NARA’’). Please
contact the Foreign Investment Review
Section, National Security Division,
U.S. Department of Justice, 175 N St.
NE, Washington, DC 20002, telephone:
202–514–8648, NSD.FIRS.datasecurity@
usdoj.gov. You may also obtain the
material from the National Security
Division at https://www.justice.gov/nsd.
For information on the availability of
this material at NARA, visit
www.archives.gov/federal-register/cfr/
ibr-locations.html or email
fr.inspection@nara.gov. The material
may also be obtained from the sources
in the following paragraphs of this
section.
(b) Other sources. The Cybersecurity
and Infrastructure Security Agency,
Mail Stop 0380, Department of
Homeland Security, 245 Murray Lane,
Washington, DC 20528–0380, central@
cisa.gov, 888–282–0870, https://
www.cisa.gov. You may also obtain the
material from the Cybersecurity and
Infrastructure Security Agency at
https://www.cisa.gov/.
(1) The Cybersecurity and
Infrastructure Agency (‘‘CISA’’),
Security Requirements for Restricted
Transactions; (Final edition 202X Draft),
IBR approved for §§ 202.248;
202.304(b)(4); 202.401(a); 202.401(c)(1);
202.401(c)(2); 202.508(b)(8);
202.508(b)(10); 202.508(b)(11);
202.1001(b)(4); 202.1002(b)(1);
202.1002(e)(4); 202.1002(f)(2)(iv);
202.1002(f)(2)(v); 202.1002(f)(2)(vi);
202.1101(b)(2); 202.1101(b)(3).
(2) [Reserved]
personal communication that does not
involve the transfer of anything of value.
§ 202.502 Information or informational
materials.
Subparts C and D of this part do not
apply to data transactions to the extent
that they involve the importation from
any country, or the exportation to any
country, whether commercial or
otherwise, regardless of format or
medium of transmission, of any
information or informational materials.
§ 202.503
Travel.
Subparts C and D of this part do not
apply to data transactions to the extent
that they are ordinarily incident to
travel to or from any country, including
importation of accompanied baggage for
personal use; maintenance within any
country, including payment of living
expenses and acquisition of goods or
services for personal use; and
arrangement or facilitation of such
travel, including nonscheduled air, sea,
or land voyages.
§ 202.504 Official business of the United
States Government.
Subpart E—Exempt Transactions
(a) Exemption. Subparts C and D of
this part do not apply to data
transactions to the extent that they are
for the conduct of the official business
of the United States Government by its
employees, grantees, or contractors; any
authorized activity of any United States
Government department or agency
(including an activity that is performed
by a Federal depository institution or
credit union supervisory agency in the
capacity of receiver or conservator); or
transactions conducted pursuant to a
grant, contract, or other agreement
entered into with the United States
Government.
(b) Examples—(1) Example 1. A U.S.
hospital receives a Federal grant to
conduct human genomic research on
U.S. persons. As part of that federally
funded human genomic research, the
U.S. hospital contracts with a foreign
laboratory that is a covered person, hires
a researcher that is a covered person,
and gives the laboratory and researcher
access to the human biospecimens and
human genomic data in bulk. The
contract with the foreign laboratory and
the employment of the researcher are
exempt transactions but would be
prohibited transactions if they were not
part of the federally funded research.
(2) [Reserved]
§ 202.501
§ 202.505
Personal communications.
Subparts C and D of this part do not
apply to data transactions to the extent
that they involve any postal,
telegraphic, telephonic, or other
PO 00000
Frm 00102
Fmt 4701
Sfmt 4702
Financial services.
(a) Exemption. Subparts C and D of
this part do not apply to data
transactions, to the extent that they are
ordinarily incident to and part of the
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
provision of financial services,
including:
(1) Banking, capital-markets
(including investment-management
services), or financial-insurance
services;
(2) A financial activity authorized for
national banks by 12 U.S.C. 24
(Seventh) and rules and regulations and
written interpretations of the Office of
the Comptroller of the Currency
thereunder;
(3) An activity that is ‘‘financial in
nature or incidental to such financial
activity’’ or ‘‘complementary to a
financial activity,’’ section (k)(1), as set
forth in section (k)(4) of the Bank
Holding Company Act of 1956 (12
U.S.C. 1843(k)(4)) and rules and
regulations and written interpretations
of the Board of Governors of the Federal
Reserve System thereunder;
(4) The transfer of personal financial
data or covered personal identifiers
incidental to the purchase and sale of
goods and services (such as the
purchase, sale, or transfer of consumer
products and services through online
shopping or e-commerce marketplaces);
(5) The provision or processing of
payments or funds transfers (such as
person-to-person, business-to-person,
and government-to-person funds
transfers) involving the transfer of
personal financial data or covered
personal identifiers, or the provision of
services ancillary to processing
payments and funds transfers (such as
services for payment dispute resolution,
payor authentication, tokenization,
payment gateway, payment fraud
detection, payment resiliency,
mitigation and prevention, and
payment-related loyalty point program
administration); and
(6) The provision of investmentmanagement services that manage or
provide advice on investment portfolios
or individual assets for compensation
(such as devising strategies and
handling financial assets and other
investments for clients) or provide
services ancillary to investmentmanagement services (such as brokerdealers executing trades within a
securities portfolio based upon
instructions from an investment
advisor).
(b) Examples—(1) Example 1. A U.S.
company engages in a data transaction
to transfer personal financial data in
bulk to a financial institution that is
incorporated in, located in, or subject to
the jurisdiction or control of a country
of concern to clear and settle electronic
payment transactions between U.S.
individuals and merchants in a country
of concern where both the U.S.
individuals and the merchants use the
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
U.S. company’s infrastructure, such as
an e-commerce platform. Both the U.S.
company’s transaction transferring bulk
personal financial data and the payment
transactions by U.S. individuals are
exempt transactions.
(2) Example 2. As ordinarily incident
to and part of securitizing and selling
asset-backed obligations (such as
mortgage and nonmortgage loans) to a
covered person, a U.S. bank provides
bulk U.S. sensitive personal data to the
covered person. The data transfers are
exempt transactions.
(3) Example 3. A U.S. bank or other
financial institution, as ordinarily
incident to and part of facilitating
payments to U.S. persons in a country
of concern, stores and processes the
customers’ bulk financial data using a
data center operated by a third-party
service provider in the country of
concern. The use of this third-party
service provider is a vendor agreement,
but it is an exempt transaction that is
ordinarily incident to and part of
facilitating payment.
(4) Example 4. Same as Example 3,
but the underlying payments are
between U.S. persons in the United
States and do not involve a country of
concern. The use of this third-party
service provider is a vendor agreement,
but it is not an exempt transaction
because it is not ordinarily incident to
facilitating this type of financial
activity.
(5) Example 5. As part of operating an
online marketplace for the purchase and
sale of goods, a U.S. company, as
ordinarily incident to and part of U.S.
consumers’ purchase of goods on that
marketplace, transfers bulk contact
information, payment information (e.g.,
credit-card account number, expiration
data, and security code), and delivery
address to a merchant in a country of
concern. The data transfers are exempt
transactions because they are ordinarily
incident to and part of U.S. consumers’
purchase of goods.
(6) Example 6. A U.S. investment
adviser purchases securities of a
company incorporated in a country of
concern for the accounts of its clients.
The investment adviser engages a
broker-dealer located in a country of
concern to execute the trade, and, as
ordinarily incident to and part of the
transaction, transfers to the brokerdealer its clients’ covered personal
identifiers and financial account
numbers in bulk. This provision of data
is an exempt transaction because it is
ordinarily incident to and part of the
provision of investment-management
services.
(7) Example 7. A U.S. company that
provides payment-processing services
PO 00000
Frm 00103
Fmt 4701
Sfmt 4702
86217
sells bulk U.S. sensitive personal data to
a covered person. This sale is prohibited
data brokerage and is not an exempt
transaction because it is not ordinarily
incident to and part of the paymentprocessing services provided by the U.S.
company.
(8) Example 8. A U.S. bank facilitates
international funds transfers to foreign
persons not related to a country of
concern, but through intermediaries or
locations subject to the jurisdiction or
control of a country of concern. These
transfers result in access to bulk
financial records by some covered
persons to complete the transfers and
manage associated risks. Providing this
access as part of these transfers is
ordinarily incident to the provision of
financial services and is exempt.
(9) Example 9. A U.S. insurance
company underwrites personal
insurance to U.S. persons residing in
foreign countries in the same region as
a country of concern. The insurance
company relies on its own business
infrastructure and personnel in the
country of concern to support its
financial activity in the region, which
results in access to the bulk sensitive
personal data of some U.S.-person
customers residing in the region, to
covered persons at the insurance
company supporting these activities.
Providing this access is ordinarily
incident to the provision of financial
services and is exempt.
(10) Example 10. A U.S. bank operates
a foreign branch in a country of concern
and provides financial services to U.S.
persons living within the country of
concern. The bank receives a lawful
request from the regulator in the country
of concern to review the financial
activity conducted in the country,
which includes providing access to the
bulk sensitive personal data of U.S.
persons resident in the country or U.S.
persons conducting transactions
through the foreign branch. Responding
to the regulator’s request, including
providing access to this bulk sensitive
personal data, is ordinarily incident to
the provision of financial services and is
exempt.
(11) Example 11. A U.S. bank
voluntarily shares information,
including relevant bulk sensitive
personal data, with financial
institutions organized under the laws of
a country of concern for the purposes of,
and consistent with industry practices
for, fraud identification, combatting
money laundering and terrorism
financing, and U.S. sanctions
compliance. Sharing this data for these
purposes is ordinarily incident to the
provision of financial services and is
exempt.
E:\FR\FM\29OCP2.SGM
29OCP2
86218
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
(12) Example 12. A U.S. company
provides wealth-management services
and collects bulk personal financial data
on its U.S. clients. The U.S. company
appoints a citizen of a country of
concern, who is located in a country of
concern, to its board of directors. In
connection with the board’s data
security and cybersecurity
responsibilities, the director could
access the bulk personal financial data.
The appointment of the director, who is
a covered person, is a restricted
employment agreement and is not
exempt because the board member
access to the bulk personal financial
data is not ordinarily incident to the
U.S. company’s provision of wealthmanagement services.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.506
Corporate group transactions.
(a) Subparts C and D of this part do
not apply to data transactions to the
extent they are:
(1) Between a U.S. person and its
subsidiary or affiliate located in (or
otherwise subject to the ownership,
direction, jurisdiction, or control of) a
country of concern; and
(2) Ordinarily incident to and part of
administrative or ancillary business
operations, including:
(i) Human resources;
(ii) Payroll, expense monitoring and
reimbursement, and other corporate
financial activities;
(iii) Paying business taxes or fees;
(iv) Obtaining business permits or
licenses;
(v) Sharing data with auditors and law
firms for regulatory compliance;
(vi) Risk management;
(vii) Business-related travel;
(viii) Customer support;
(ix) Employee benefits; and
(x) Employees’ internal and external
communications.
(b) Examples—(1) Example 1. A U.S.
company has a foreign subsidiary
located in a country of concern, and the
U.S. company’s U.S.-person contractors
perform services for the foreign
subsidiary. As ordinarily incident to
and part of the foreign subsidiary’s
payments to the U.S.-person contractors
for those services, the U.S. company
engages in a data transaction that gives
the subsidiary access to the U.S.-person
contractors’ bulk personal financial data
and covered personal identifiers. This is
an exempt corporate group transaction.
(2) Example 2. A U.S. company
aggregates bulk personal financial data.
The U.S. company has a subsidiary that
is a covered person because it is
headquartered in a country of concern.
The subsidiary is subject to the country
of concern’s national security laws
requiring it to cooperate with and assist
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
the country’s intelligence services. The
exemption for corporate group
transactions would not apply to the U.S.
parent’s grant of a license to the
subsidiary to access the parent’s
databases containing the bulk personal
financial data for the purpose of
complying with a request or order by
the country of concern under those
national security laws to provide access
to that data because granting of such a
license is not ordinarily incident to and
part of administrative or ancillary
business operations.
(3) Example 3. A U.S. company’s
affiliate operates a manufacturing
facility in a country of concern for one
of the U.S. company’s products. The
affiliate uses employee fingerprints as
part of security and identity verification
to control access to that facility. To
facilitate its U.S. employees’ access to
that facility as part of their job
responsibilities, the U.S. company
provides the fingerprints of those
employees in bulk to its affiliate. The
transaction is an exempt corporate
group transaction.
(4) Example 4. A U.S. company has a
foreign subsidiary located in a country
of concern that conducts research and
development for the U.S. company. The
U.S. company sends bulk personal
financial data to the subsidiary for the
purpose of developing a financial
software tool. The transaction is not an
exempt corporate group transaction
because it is not ordinarily incident to
and part of administrative or ancillary
business operations.
(5) Example 5. Same as Example 4,
but the U.S. company has a foreign
branch located in a country of concern
instead of a foreign subsidiary. Because
the foreign branch is a U.S. person as
part of the U.S. company, the
transaction occurs within the same U.S.
person and is not subject to the
prohibitions or restrictions. If the
foreign branch allows employees who
are covered persons to access the bulk
personal financial data to develop the
financial software tool, the foreign
branch has engaged in restricted
transactions.
§ 202.507 Transactions required or
authorized by Federal law or international
agreements, or necessary for compliance
with Federal law.
(a) Required or authorized by Federal
law or international agreements.
Subparts C and D of this part do not
apply to data transactions to the extent
they are required or authorized by
Federal law or pursuant to an
international agreement to which the
United States is a party, including
relevant provisions in the following:
PO 00000
Frm 00104
Fmt 4701
Sfmt 4702
(1) Annex 9 to the Convention on
International Civil Aviation,
International Civil Aviation
Organization Doc. 7300 (2022);
(2) Section 2 of the Convention on
Facilitation of International Maritime
Traffic (1965);
(3) Articles 1, 12, 14, and 16 of the
Postal Payment Services Agreement
(2021);
(4) Articles 63, 64, and 65 of the
Constitution of the World Health
Organization (1946);
(5) Article 2 of the Agreement
Between the Government of the United
States of America and the Government
of the People’s Republic of China
Regarding Mutual Assistance in
Customs Matters (1999);
(6) Article 7 of the Agreement
Between the Government of the United
States of America and the Government
of the People’s Republic of China on
Mutual Legal Assistance in Criminal
Matters (2000);
(7) Article 25 of the Agreement
Between the Government of the United
States of America and the Government
of the People’s Republic of China for the
Avoidance of Double Taxation and the
Prevention of Tax Evasion with Respect
to Taxes on Income (1987);
(8) Article 2 of the Agreement
Between the United States of America
and the Macao Special Administrative
Region of the People’s Republic of
China for Cooperation to Facilitate the
Implementation of FATCA (2021);
(9) Articles II, III, VII of the Protocol
to Extend and Amend the Agreement
Between the Department of Health and
Human Services of the United States of
America and the National Health and
Family Planning Commission of the
People’s Republic of China for
Cooperation in the Science and
Technology of Medicine and Public
Health (2013);
(10) Article III of the Treaty Between
the United States and Cuba for the
Mutual Extradition of Fugitives from
Justice (1905);
(11) Articles 3, 4, 5, 7 of the
Agreement Between the Government of
the United States of America and the
Government of the Russian Federation
on Cooperation and Mutual Assistance
in Customs Matters (1994);
(12) Articles 1, 2, 5, 7, 13, and 16 of
the Treaty Between the United States of
America and the Russian Federation on
Mutual Legal Assistance in Criminal
Matters (1999);
(13) Articles I, IV, IX, XV, and XVI of
the Treaty Between the Government of
the United States of America and the
Government of the Republic of
Venezuela on Mutual Legal Assistance
in Criminal Matters (1997); and
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
(14) Articles 5, 6, 7, 9, 11, 19, 35, and
45 of the International Health
Regulations (2005).
(b) Global health and pandemic
preparedness. Subparts C and D of this
part do not apply to data transactions to
the extent they are required or
authorized by the following:
(1) The Pandemic Influenza
Preparedness and Response Framework;
(2) The Global Influenza Surveillance
and Response System; and
(3) The Agreement between the
Government of the United States of
America and the Government of the
People’s Republic of China on
Cooperation in Science and Technology
(1979).
(c) Compliance with Federal law.
Subparts C and D of this part do not
apply to data transactions to the extent
that they are ordinarily incident to and
part of ensuring compliance with any
Federal laws and regulations, including
the Bank Secrecy Act, 12 U.S.C. 1829b,
1951 through 1960, 31 U.S.C. 310, 5311
through 5314, 5316 through 5336; the
Securities Act of 1933, 15 U.S.C. 77a et
seq.; the Securities Exchange Act of
1934, 15 U.S.C. 78a et seq.; the
Investment Company Act of 1940, 15
U.S.C. 80a–1 et seq.; the Investment
Advisers Act of 1940, 15 U.S.C. 80b–1
et seq.; the International Emergency
Economic Powers Act, 50 U.S.C. 1701 et
seq.; the Export Administration
Regulations, 15 CFR 730 et seq.; or any
notes, guidance, orders, directives, or
additional regulations related thereto.
(d) Examples—(1) Example 1. A U.S.
bank or other financial institution
engages in a covered data transaction
with a covered person that is ordinarily
incident to and part of ensuring
compliance with U.S. laws and
regulations (such as OFAC sanctions
and anti-money laundering programs
required by the Bank Secrecy Act). This
is an exempt transaction.
(2) [Reserved]
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.508 Investment agreements subject
to a CFIUS action.
(a) Exemption. Subparts C and D of
this part do not apply to data
transactions to the extent that they
involve an investment agreement that is
subject to a CFIUS action.
(b) Examples—(1) Example 1. A U.S.
software provider is acquired in a
CFIUS covered transaction by a foreign
entity in which the transaction parties
sign a mitigation agreement with CFIUS.
The agreement has provisions governing
the acquirer’s ability to access the data
of the U.S. software provider and their
customers. The mitigation agreement
contains a provision stating that it is a
CFIUS action for purposes of this part.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
Before the effective date of the CFIUS
mitigation agreement, the investment
agreement is not subject to a CFIUS
action and remains subject to these
regulations to the extent otherwise
applicable. Beginning on the effective
date of the CFIUS mitigation agreement,
the investment agreement is subject to a
CFIUS action and exempt from this part.
(2) Example 2. Same as Example 1,
but CFIUS issues an interim order
before entering a mitigation agreement.
The interim order states that it
constitutes a CFIUS action for purposes
of this part. Before the effective date of
the interim order, the investment
agreement is not subject to a CFIUS
action and remains subject to these
regulations to the extent otherwise
applicable. Beginning on the effective
date of the interim order, the investment
agreement is subject to a CFIUS action
and is exempt from this part. The
mitigation agreement also states that it
constitutes a CFIUS action for purposes
of this part. After the effective date of
the mitigation agreement, the
investment agreement remains subject
to a CFIUS action and is exempt from
this part.
(3) Example 3. A U.S. biotechnology
company is acquired by a foreign
multinational corporation. CFIUS
reviews this acquisition and concludes
action without mitigation. This
acquisition is not subject to a CFIUS
action, and the acquisition remains
subject to this part to the extent
otherwise applicable.
(4) Example 4. A U.S. manufacturer is
acquired by a foreign owner in which
the transaction parties sign a mitigation
agreement with CFIUS. The mitigation
agreement provides for supply
assurances and physical access
restrictions but does not address data
security, and it does not contain a
provision explicitly designating that it is
a CFIUS action. This acquisition is not
subject to a CFIUS action, and the
acquisition remains subject to this part
to the extent otherwise applicable.
(5) Example 5. As a result of CFIUS’s
review and investigation of a U.S.
human genomic company’s acquisition
by a foreign healthcare company, CFIUS
refers the transaction to the President
with a recommendation to require the
foreign acquirer to divest its interest in
the U.S. company. The President issues
an order prohibiting the transaction and
requiring divestment of the foreign
healthcare company’s interests and
rights in the human genomic company.
The presidential order itself does not
constitute a CFIUS action. Unless CFIUS
takes action, such as by entering into an
agreement or imposing conditions to
address risk prior to completion of the
PO 00000
Frm 00105
Fmt 4701
Sfmt 4702
86219
divestment, the transaction remains
subject to this part to the extent
otherwise applicable for as long as the
investment agreement remains in
existence following the presidential
order and prior to divestment.
(6) Example 6. A U.S. healthcare
company and foreign acquirer announce
a transaction that they believe will be
subject to CFIUS jurisdiction and
disclose that they intend to file a joint
voluntary notice soon. No CFIUS action
has occurred yet, and the transaction
remains subject to this part to the extent
otherwise applicable.
(7) Example 7. Same as Example 6,
but the transaction parties file a joint
voluntary notice with CFIUS. No CFIUS
action has occurred yet, and the
transaction remains subject to this part
to the extent otherwise applicable.
(8) Example 8. Company A, a covered
person, acquires 100% of the equity and
voting interest of Company B, a U.S.
business that maintains bulk U.S.
sensitive personal data of U.S. persons.
After completing the transaction, the
parties fail to implement the security
requirements and other conditions
required under this part. Company A
and Company B later submit a joint
voluntary notice to CFIUS with respect
to the transaction. Upon accepting the
notice, CFIUS determines that the
transaction is a covered transaction and
takes measures to mitigate interim risk
that may arise as a result of the
transaction until such time that the
Committee has completed action,
pursuant to 50 U.S.C. 4565(l)(3)(A)(iii).
The interim order states that it
constitutes a CFIUS action for purposes
of this part. Beginning on the effective
date of these measures imposed by the
interim order, the security requirements
and other applicable conditions under
this part no longer apply to the
transaction. The Department of Justice,
however, may take enforcement action
under this part, in coordination with
CFIUS, with respect to the violations
that occurred before the effective date of
the interim order issued by CFIUS.
(9) Example 9. Same as Example 8,
but before engaging in the investment
agreement for the acquisition, Company
A and Company B submit the joint
voluntary notice to CFIUS, CFIUS
determines that the transaction is a
CFIUS covered transaction, CFIUS
identifies a risk related to data security
arising from the transaction, and CFIUS
negotiates and enters into a mitigation
agreement with the parties to resolve
that risk. The mitigation agreement
contains a provision stating that it is a
CFIUS action for purposes of this part.
Because a CFIUS action has occurred
before the parties engage in the
E:\FR\FM\29OCP2.SGM
29OCP2
86220
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
investment agreement, the acquisition is
exempt from this part.
(10) Example 10. Same as Example 8,
but before engaging in the investment
agreement for the acquisition, the
parties implement the security
requirements and other conditions
required under these regulations.
Company A and Company B then
submit a joint voluntary notice to
CFIUS, which determines that the
transaction is a CFIUS covered
transaction. CFIUS identifies a risk
related to data security arising from the
transaction but determines that the
regulations in this part adequately
resolve the risk. CFIUS concludes action
with respect to the transaction without
taking any CFIUS action. Because no
CFIUS action has occurred, the
transaction remains subject to this part.
(11) Example 11. Same facts as
Example 10, but CFIUS determines that
the security requirements and other
conditions applicable under this part
are inadequate to resolve the national
security risk identified by CFIUS. CFIUS
negotiates a mitigation agreement with
the parties to resolve the risk, which
contains a provision stating that it is a
CFIUS action for purposes of this part.
The transaction is exempt from this part
beginning on the effective date of the
CFIUS mitigation agreement.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.509
Telecommunications services.
(a) Exemption. Subparts C and D of
this part do not apply to data
transactions, other than those involving
data brokerage, to the extent that they
are ordinarily incident to and part of the
provision of telecommunications
services, including international calling,
mobile voice, and data roaming.
(b) Examples—(1) Example 1. A U.S.
telecommunications service provider
collects covered personal identifiers
from its U.S. subscribers. Some of those
subscribers travel to a country of
concern and use their mobile phone
service under an international roaming
agreement. The local
telecommunications service provider in
the country of concern shares these
covered personal identifiers with the
U.S. service provider for the purposes of
either helping provision service to the
U.S. subscriber or receiving payment for
the U.S. subscriber’s use of the country
of concern service provider’s network
under that international roaming
agreement. The U.S. service provider
provides the country of concern service
provider with network or device
information for the purpose of
provisioning services and obtaining
payment for its subscribers’ use of the
local telecommunications service
provider’s network. Over the course of
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
12 months, the volume of network or
device information shared by the U.S.
service provider with the country of
concern service provider for the purpose
of provisioning services exceeds the
applicable bulk threshold. These
transfers of bulk U.S. sensitive personal
data are ordinarily incident to and part
of the provision of telecommunications
services and are thus exempt
transactions.
(2) Example 2. A U.S.
telecommunications service provider
collects precise geolocation data on its
U.S. subscribers. The U.S.
telecommunications service provider
sells this precise geolocation data in
bulk to a covered person for the purpose
of targeted advertising. This sale is not
ordinarily incident to and part of the
provision of telecommunications
services and remains a prohibited
transaction.
§ 202.510 Drug, biological product, and
medical device authorizations.
(a) Exemption. Subparts C and D of
this part do not apply to a data
transaction that
(1) Involves ‘‘regulatory approval
data’’ as defined in this section and
(2) Is necessary to obtain or maintain
regulatory approval to market a drug,
biological product, device, or a
combination product in a country of
concern, provided that the U.S. person
complies with the recordkeeping and
reporting requirements set forth in
§§ 202.1101(a) and 202.1102 with
respect to such transaction.
(b) Regulatory approval data. For
purposes of this section, the term
regulatory approval data means deidentified sensitive personal data that is
required to be submitted to a country of
concern regulatory entity to obtain or
maintain authorization or approval to
research or market a drug, biological
product, device, or combination
product, including in relation to postmarketing studies and post-marketing
product surveillance activities, and
supplemental product applications for
additional uses. The term excludes
sensitive personal data not reasonably
necessary for a regulatory entity to
assess the safety and effectiveness of the
drug, biological product, device, or
combination product.
(c) Other terms. For purposes of this
section, the terms ‘‘drug,’’ ‘‘biological
product,’’ ‘‘device,’’ and ‘‘combination
product’’ have the meanings given to
them in 21 U.S.C. 321(g)(1), 42 U.S.C.
262(i)(1), 21 U.S.C. 321(h)(1), and 21
CFR 3.2(e), respectively.
(d) Examples—(1) Example 1. A U.S.
pharmaceutical company seeks to
market a new drug in a country of
PO 00000
Frm 00106
Fmt 4701
Sfmt 4702
concern. The company submits a
marketing application to the regulatory
entity in the country of concern with
authority to approve the drug in the
country of concern. The marketing
application includes the safety and
effectiveness data reasonably necessary
to obtain regulatory approval in that
country. The transfer of data to the
country of concern’s regulatory entity is
exempt from the prohibitions in this
part.
(2) Example 2. Same as Example 1,
except the regulatory entity in the
country of concern requires that the data
be de-anonymized. The transfer of data
is not exempt under this section,
because the data includes sensitive
personal data that is identified to an
individual.
(3) Example 3. Same as Example 1,
except the U.S. company enters a
vendor agreement with a covered person
located in the country of concern to
store, organize, and prepare the bulk
U.S. sensitive personal data for
submission to the regulatory agency.
The transaction is not exempt under this
section, because the use of a covered
person to prepare the regulatory
submission is not necessary to obtain
regulatory approval.
§ 202.511 Other clinical investigations and
post-marketing surveillance data.
(a) Exemption. Subparts C and D of
this part do not apply to data
transactions to the extent that those
transactions are:
(1) Ordinarily incident to and part of
clinical investigations regulated by the
U.S. Food and Drug Administration
(‘‘FDA’’) under sections 505(i) and
520(g) of the Federal Food, Drug, and
Cosmetic Act (‘‘FD&C Act’’) or clinical
investigations that support applications
to the FDA for research or marketing
permits for drugs, biological products,
devices, combination products, or infant
formula; or
(2) Ordinarily incident to and part of
the collection or processing of clinical
care data indicating real-world
performance or safety of products, or the
collection or processing of postmarketing surveillance data (including
pharmacovigilance and post-marketing
safety monitoring), and necessary to
support or maintain authorization by
the FDA, provided the data is
deidentified.
(b) [Reserved]
Subpart F—Determination of Countries
of Concern
§ 202.601
concern.
Determination of countries of
(a) Countries of concern. Solely for
purposes of the Order and this part, the
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
Attorney General has determined, with
the concurrence of the Secretaries of
State and Commerce, that the following
foreign governments have engaged in a
long-term pattern or serious instances of
conduct significantly adverse to the
national security of the United States or
security and safety of U.S. persons and
pose a significant risk of exploiting
government-related data or bulk U.S.
sensitive personal data to the detriment
of the national security of the United
States or security and safety of U.S.
persons:
(1) China;
(2) Cuba;
(3) Iran;
(4) North Korea;
(5) Russia; and
(6) Venezuela.
(b) Effective date of amendments. Any
amendment to the list of countries of
concern will apply to any covered data
transaction that is initiated, pending, or
completed on or after the effective date
of the amendment.
Subpart G—Covered Persons
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.701
Designation of covered persons.
(a) Designations. The Attorney
General may designate any person as a
covered person for purposes of this part
if, after consultation with other agencies
as the Attorney General deems
appropriate, the Attorney General
determines the person meets any of the
criteria set forth in § 202.211(a)(5) of
this part.
(b) Information considered. In
determining whether to designate a
person as a covered person, the
Attorney General may consider any
information or material the Attorney
General deems relevant and appropriate,
classified or unclassified, from any
Federal department or agency or from
any other source.
(c) Covered Persons List. The names of
persons designated as a covered person
for purposes of this part, transactions
with whom are prohibited or restricted
pursuant to this part, are published in
the Federal Register and incorporated
into the National Security Division’s
Covered Persons List. The Covered
Persons List is accessible through the
following page on the National Security
Division’s website at https://
www.justice.gov/nsd.
(d) Non-exhaustive. The list of
designated covered persons described in
this section is not exhaustive of all
covered persons and supplements the
categories in the definition of covered
persons in § 202.211.
(e) Effective date; actual and
constructive knowledge. (1) Designation
as a covered person will be effective
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
from the date of any public
announcement by the Department.
Except as otherwise authorized in this
part, a U.S. person with actual
knowledge of a designated person’s
status is prohibited from knowingly
engaging in a covered data transaction
with that person on or after the date of
the Department’s public announcement.
(2) Publication in the Federal Register
is deemed to provide constructive
knowledge of a person’s status as a
covered person.
§ 202.702 Procedures governing removal
from the Covered Persons List.
(a) Requests for removal from the
Covered Persons List. A person may
petition to seek administrative
reconsideration of their designation, or
may assert that the circumstances
resulting in the designation no longer
apply, and thus seek to be removed from
the Covered Persons List pursuant to the
following administrative procedures:
(b) Content of requests. A covered
person designated under paragraph (a)
of this section may submit arguments or
evidence that the person believes
establish that insufficient basis exists for
the designation. Such a person also may
propose remedial steps on the person’s
part, such as corporate reorganization,
resignation of persons from positions in
a listed entity, or similar steps, that the
person believes would negate the basis
for designation.
(c) Additional content; form and
method of submission. Requests for
removal from the Covered Persons List
must be submitted in accordance with
this section and with subpart L of this
part.
(d) Requests for more information.
The information submitted by the listed
person seeking removal will be
reviewed by the Attorney General, who
may request clarifying, corroborating, or
other additional information.
(e) Meetings. A person seeking
removal may request a meeting with the
Attorney General; however, such
meetings are not required, and the
Attorney General may, in the Attorney
General’s discretion, decline to conduct
such a meeting prior to completing a
review pursuant to this section.
(f) Decisions. After the Attorney
General has conducted a review of the
request for removal, and after
consultation with other agencies as the
Attorney General deems appropriate,
the Attorney General will provide a
written decision to the person seeking
removal. A covered person’s status as a
covered person—including its
associated prohibitions and restrictions
under this part—remains in effect
during the pendency of any request to
PO 00000
Frm 00107
Fmt 4701
Sfmt 4702
86221
be removed from the Covered Persons
List.
Subpart H—Licensing
§ 202.801
General licenses.
(a) General course of procedure. The
Department may, as appropriate, issue
general licenses to authorize, under
appropriate terms and conditions,
transactions that are subject to the
prohibitions or restrictions in this part.
In determining whether to issue a
general license, the Attorney General
may consider any information or
material the Attorney General deems
relevant and appropriate, classified or
unclassified, from any Federal
department or agency or from any other
source.
(b) Relationship with specific licenses.
It is the policy of the Department not to
grant applications for specific licenses
authorizing transactions to which the
provisions of a general license are
applicable.
(c) Reports. Persons availing
themselves of certain general licenses
may be required to file reports and
statements in accordance with the
instructions specified in those licenses,
this part or the Order. Failure to file
timely all required information in such
reports or statements may nullify the
authorization otherwise provided by the
general license and result in apparent
violations of the applicable prohibitions
that may be subject to enforcement
action.
§ 202.802
Specific licenses.
(a) General course of procedure.
Transactions subject to the prohibitions
or restrictions in this part or the Order,
and that are not otherwise permitted
under this part or a general license, may
be permitted only under a specific
license, under appropriate terms and
conditions.
(b) Content of applications for specific
licenses. Applications for specific
licenses shall include, at a minimum, a
description of the nature of the
transaction, including each of the
following requirements:
(1) The types and volumes of
government-related data or bulk U.S.
sensitive personal data involved in the
transactions;
(2) The identity of the transaction
parties, including any ownership of
entities or citizenship or primary
residence of individuals;
(3) The end-use of the data and the
method of data transfer; and
(4) Any other information that the
Attorney General may require.
(c) Additional content; form and
method of submissions. Requests for
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
86222
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
specific licenses must be submitted in
accordance with this section and with
subpart L of this part.
(d) Additional conditions. Applicants
should submit only one copy of a
specific license application to the
Department; submitting multiple copies
may result in processing delays. Any
person having an interest in a
transaction or proposed transaction may
file an application for a specific license
authorizing such a transaction.
(e) Further information to be supplied.
Applicants may be required to furnish
such further information as the
Department deems necessary to assist in
making a determination. Any applicant
or other party-in-interest desiring to
present additional information
concerning a specific license
application may do so at any time before
or after the Department makes its
decision with respect to the application.
In unique circumstances, the
Department may determine, in its
discretion, that an oral presentation
regarding a license application would
assist in the Department’s review of the
issues involved. Any requests to make
such an oral presentation must be
submitted electronically by emailing the
National Security Division at
NSD.FIRS.datasecurity@usdoj.gov or
using another official method to make
such requests, in accordance with any
instructions on the National Security
Division’s website.
(f) Decisions. In determining whether
to issue a specific license, the Attorney
General may consider any information
or material the Attorney General deems
relevant and appropriate, classified or
unclassified, from any Federal
department or agency or from any other
source. The Department will advise
each applicant of the decision
respecting the applicant’s filed
application. The Department’s decision
with respect to a license application
shall constitute final agency action.
(g) Time to issuance. The Department
shall endeavor to respond to any request
for a specific license within 45 days
after receipt of the request and of any
requested additional information and
documents.
(h) Scope. (1) Unless otherwise
specified in the license, a specific
license authorizes the transaction:
(i) Only between the parties identified
in the license;
(ii) Only with respect to the data
described in the license; and
(iii) Only to the extent the conditions
specified in the license are satisfied.
The applicant must inform any other
parties identified in the license of the
license’s scope and of the specific
conditions applicable to them.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
(2) The Department will determine
whether to grant specific licenses in
reliance on representations the
applicant made or submitted in
connection with the license application,
letters of explanation, and other
documents submitted. Any license
obtained based on a false or misleading
representation in the license
application, in any document submitted
in connection with the license
application, or during an oral
presentation under this section shall be
deemed void as of the date of issuance.
(i) Reports under specific licenses. As
a condition for the issuance of any
specific license, the licensee may be
required to file reports or statements
with respect to the transaction or
transactions authorized by the specific
license in such form and at such times
as may be prescribed in the license.
Failure to file timely all required
information in such reports or
statements may nullify the authorization
otherwise provided by the specific
license and result in apparent violations
of the applicable prohibitions that may
be subject to enforcement action.
(j) Effect of denial. The denial of a
specific license does not preclude the
reconsideration of an application or the
filing of a further application. The
applicant or any other party-in-interest
may at any time request, by written
correspondence, reconsideration of the
denial of an application based on new
facts or changed circumstances.
§ 202.803
General provisions.
(a) Effect of license. (1) No license
issued under this subpart, or otherwise
issued by the Department, authorizes or
validates any transaction effected prior
to the issuance of such license or other
authorization, unless specifically
provided for in such license or
authorization.
(2) No license issued under this
subpart authorizes or validates any
transaction prohibited under or subject
to this part unless the license is
properly issued by the Department and
specifically refers to this part.
(3) Any license authorizing or
validating any transaction that is
prohibited under or otherwise subject to
this part has the effect of removing or
amending those prohibitions or other
requirements from the transaction, but
only to the extent specifically stated by
the terms of the license. Unless the
license otherwise specifies, such an
authorization does not create any right,
duty, obligation, claim, or interest in, or
with respect to, any property that would
not otherwise exist under ordinary
principles of law.
PO 00000
Frm 00108
Fmt 4701
Sfmt 4702
(4) Nothing contained in this part
shall be construed to supersede the
requirements established under any
other provision of law or to relieve a
person from any requirement to obtain
a license or authorization from another
department or agency of the United
States Government in compliance with
applicable laws and regulations subject
to the jurisdiction of that department or
agency. For example, issuance of a
specific license authorizing a
transaction otherwise prohibited by this
part does not operate as a license or
authorization to conclude the
transaction that is otherwise required
from the U.S. Department of Commerce,
U.S. Department of State, U.S.
Department of the Treasury, or any
other department or agency of the
United States Government.
(b) Amendment, modification, or
rescission. Except as otherwise provided
by law, any licenses (whether general or
specific), authorizations, instructions, or
forms issued thereunder may be
amended, modified, or rescinded at any
time.
(c) Consultation. The Department will
issue, amend, modify, or rescind a
general or specific license in
concurrence with the Departments of
State, Commerce, and Homeland
Security and in consultation with other
relevant agencies.
(d) Exclusion from licenses and other
authorizations. The Attorney General
reserves the right to exclude any person,
property, or transaction from the
operation of any license or from the
privileges conferred by any license. The
Attorney General also reserves the right
to restrict the applicability of any
license to particular persons, property,
transactions, or classes thereof. Such
actions are binding upon all persons
receiving actual or constructive notice
of the exclusions or restrictions.
Subpart I—Advisory Opinions
§ 202.901 Inquiries concerning application
of this part.
(a) General. Any U.S. person party to
a transaction potentially regulated
under the Order and this part, or an
agent of the party to such a transaction
on the party’s behalf, may request from
the Attorney General a statement of the
present enforcement intentions of the
Department of Justice under the Order
with respect to that transaction that may
be subject to the prohibitions or
restrictions in the Order and this part
(‘‘advisory opinion’’).
(b) Anonymous, hypothetical, nonparty and ex post facto review requests
excluded. The entire transaction that is
the subject of the advisory opinion
E:\FR\FM\29OCP2.SGM
29OCP2
khammond on DSKJM1Z7X2PROD with PROPOSALS2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
request must be an actual, as opposed to
hypothetical, transaction and involve
disclosed, as opposed to anonymous,
parties to the transaction. Advisory
opinion requests must be submitted by
a U.S. person party to the transaction or
that party’s agent and have no
application to a party that does not join
the request. The transaction need not
involve only prospective conduct, but
an advisory opinion request will not be
considered unless that portion of the
transaction for which an opinion is
sought involves only prospective
conduct.
(c) Contents. Each advisory opinion
request shall be specific and must be
accompanied by all material
information bearing on the conduct for
which an advisory opinion is requested,
and on the circumstances of the
prospective conduct, including
background information, complete
copies of any and all operative
documents, and detailed statements of
all collateral or oral understandings, if
any. Each request must include, at a
minimum:
(1) The identities of the transaction
parties, including any ownership of
entities or citizenship or primary
residence of individuals;
(2) A description of the nature of the
transaction, including the types and
volumes of government-related data or
bulk U.S. sensitive personal data
involved in the transaction, the end-use
of the data, the method of data transfer,
and any restrictions or requirements
related to a party’s right or ability to
control, access, disseminate, or dispose
of the data; and
(3) Any potential basis for exempting
or excluding the transaction from the
prohibitions or restrictions imposed in
the Order and this part.
(d) Additional contents; format and
method of submissions. Requests for
advisory opinions must be submitted in
accordance with this section and with
subpart L of this part.
(e) Further information to be supplied.
Each party shall provide any additional
information or documents that the
Department of Justice may thereafter
request in its review of the matter. Any
information furnished orally shall be
confirmed promptly in writing; signed
by or on behalf of the party that
submitted the initial review request; and
certified to be a true, correct, and
complete disclosure of the requested
information. A request will not be
deemed complete until the Department
of Justice receives such additional
information. In connection with an
advisory opinion request, the
Department of Justice may conduct any
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
independent investigation it believes
appropriate.
(f) Outcomes. After submission of an
advisory opinion request, the
Department, in its discretion, may state
its present enforcement intention under
the Order and this part with respect to
the proposed conduct; may decline to
state its present enforcement intention;
or, if circumstances warrant, may take
such other position or initiate such
other action as it considers appropriate.
Any requesting party or parties may
withdraw a request at any time prior to
issuance of an advisory opinion. The
Department remains free, however, to
submit such comments to the requesting
party or parties as it deems appropriate.
Failure to take action after receipt of a
request, documents, or information,
whether submitted pursuant to this
procedure or otherwise, shall not in any
way limit or stop the Department from
taking any action at such time thereafter
as it deems appropriate. The
Department reserves the right to retain
any advisory opinion request,
document, or information submitted to
it under this procedure or otherwise, to
disclose any advisory opinion and
advisory opinion request, including the
identities of the requesting party and
foreign parties to the transaction, the
general nature and circumstances of the
proposed conduct, and the action of the
Department in response to any advisory
opinion request, consistent with
applicable law, and to use any such
request, document, or information for
any governmental purpose.
(g) Time for response. The
Department shall endeavor to respond
to any advisory opinion request within
30 days after receipt of the request and
of any requested additional information
and documents.
(h) Written decisions only. The
requesting party or parties may rely only
upon a written advisory opinion signed
by the Attorney General.
(i) Effect of advisory opinion. Each
advisory opinion can be relied upon by
the requesting party or parties to the
extent the disclosures made pursuant to
this subpart were accurate and complete
and to the extent the disclosures
continue accurately and completely to
reflect circumstances after the date of
the issuance of the advisory opinion. An
advisory opinion will not restrict
enforcement actions by any agency
other than the Department of Justice. It
will not affect a requesting party’s
obligations to any other agency or under
any statutory or regulatory provision
other than those specifically discussed
in the advisory opinion.
(j) Amendment or revocation of
advisory opinion. An advisory opinion
PO 00000
Frm 00109
Fmt 4701
Sfmt 4702
86223
may be amended or revoked at any time
after it has been issued. Notice of such
will be given in the same manner as
notice of the advisory opinion was
originally given or in the Federal
Register. Whenever possible, a notice of
amendment or revocation will state
when the Department will consider a
party’s reliance on the superseded
advisory opinion to be unreasonable,
and any transition period that may be
applicable.
(k) Compliance. Neither the
submission of an advisory opinion
request, nor its pendency, shall in any
way alter the responsibility or obligation
of a requesting party to comply with the
Order, this part, or any other applicable
law.
Subpart J—Due Diligence and Audit
Requirements
§ 202.1001 Due diligence for restricted
transactions.
(a) Data compliance program. By the
effective date of this part, U.S. persons
engaging in any restricted transactions
shall develop and implement a data
compliance program.
(b) Requirements. The data
compliance program shall include, at a
minimum, each of the following
requirements:
(1) Risk-based procedures for
verifying data flows involved in any
restricted transaction, including
procedures to verify and log, in an
auditable manner, the following:
(i) The types and volumes of
government-related data or bulk U.S.
sensitive personal data involved in the
transaction;
(ii) The identity of the transaction
parties, including any ownership of
entities or citizenship or primary
residence of individuals; and
(iii) The end-use of the data and the
method of data transfer;
(2) For restricted transactions that
involve vendors, risk-based procedures
for verifying the identity of vendors;
(3) A written policy that describes the
data compliance program and that is
annually certified by an officer,
executive, or other employee
responsible for compliance;
(4) A written policy that describes the
implementation of the security
requirements as defined in § 202.248 of
this part and that is annually certified
by an officer, executive, or other
employee responsible for compliance;
and
(5) Any other information that the
Attorney General may require.
E:\FR\FM\29OCP2.SGM
29OCP2
86224
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.1002 Audits for restricted
transactions.
(a) Audit required. U.S. persons that
engage in any restricted transactions
under § 202.401 of this part shall
conduct an audit that complies with the
requirements of this section.
(b) Who may conduct the audit. The
auditor:
(1) Must be qualified and competent
to examine, verify, and attest to the U.S.
person’s compliance with and the
effectiveness of the security
requirements, as defined in § 202.248 of
this part, and all other applicable
requirements, as defined in § 202.401 of
this part, implemented for restricted
transactions;
(2) Must be independent and external;
and
(3) Cannot be a covered person or a
country of concern.
(c) When required. The audit must be
performed once for each calendar year
in which the U.S. person engages in any
restricted transactions.
(d) Timeframe. The audit must cover
the preceding 12 months.
(e) Scope. The audit must:
(1) Examine the U.S. person’s data
transactions;
(2) Examine the U.S. person’s data
compliance program required under
§ 202.1001 of this part and its
implementation;
(3) Examine relevant records required
under § 202.1101 of this part;
(4) Examine the U.S. person’s security
requirements, as defined by § 202.248 of
this part; and
(5) Use a reliable methodology to
conduct the audit.
(f) Report. (1) The auditor must
prepare and submit a written report to
the U.S. person within 60 days of the
completion of the audit.
(2) The audit report must:
(i) Describe the nature of any
prohibited transactions, restricted
transactions, and exempt transactions
engaged in by the U.S. person;
(ii) Describe the methodology
undertaken, including the policies and
other documents reviewed, personnel
interviewed, and any facilities,
equipment, networks, or systems
examined;
(iii) Describe the effectiveness of the
U.S. person’s data compliance program
and its implementation;
(iv) Describe any vulnerabilities or
deficiencies in the implementation of
the security requirements that have
affected or could affect access to
government-related data or bulk U.S.
sensitive personal data by a country of
concern or covered person;
(v) Describe any instances in which
the security requirements failed or were
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
otherwise not effective in mitigating
access to government-related data or
bulk U.S. sensitive personal data by a
country of concern or covered person;
and
(vi) Recommend any improvements or
changes to policies, practices, or other
aspects of the U.S. person’s business to
ensure compliance with the security
requirements.
(3) U.S. persons engaged in restricted
transactions must retain the audit report
for a period of at least 10 years,
consistent with the recordkeeping
requirements in § 202.1101.
Subpart K—Reporting and
Recordkeeping Requirements
§ 202.1101 Records and recordkeeping
requirements.
(a) Records. Except as otherwise
provided, U.S. persons engaging in any
transaction subject to the provisions of
this part shall keep a full and accurate
record of each such transaction engaged
in, and such record shall be available for
examination for at least 10 years after
the date of such transaction.
(b) Additional recordkeeping
requirements. U.S. persons engaging in
any restricted transaction shall create
and maintain, at a minimum, the
following records in an auditable
manner:
(1) A written policy that describes the
data compliance program and that is
certified annually by an officer,
executive, or other employee
responsible for compliance;
(2) A written policy that describes the
implementation of any applicable
security requirements as defined in
§ 202.248 of this part and that is
certified annually by an officer,
executive, or other employee
responsible for compliance;
(3) The results of any annual audits
that verify the U.S. person’s compliance
with the security requirements and any
conditions on a license;
(4) Documentation of the due
diligence conducted to verify the data
flow involved in any restricted
transaction, including:
(i) The types and volumes of
government-related data or bulk U.S.
sensitive personal data involved in the
transaction;
(ii) The identity of the transaction
parties, including any direct and
indirect ownership of entities or
citizenship or primary residence of
individuals; and
(iii) A description of the end-use of
the data;
(5) Documentation of the method of
data transfer;
(6) Documentation of the dates the
transaction began and ended;
PO 00000
Frm 00110
Fmt 4701
Sfmt 4702
(7) Copies of any agreements
associated with the transaction;
(8) Copies of any relevant licenses or
advisory opinions;
(9) The document reference number
for any original document issued by the
Attorney General, such as a license or
advisory opinion;
(10) A copy of any relevant
documentation received or created in
connection with the transaction; and
(11) An annual certification by an
officer, executive, or other employee
responsible for compliance of the
completeness and accuracy of the
records documenting due diligence.
§ 202.1102
demand.
Reports to be furnished on
(a) Reports. Every person is required
to furnish under oath, in the form of
reports or otherwise, from time to time
and at any time as may be required by
the Department of Justice, complete
information relative to any act or
transaction or covered data transaction,
regardless of whether such act,
transaction, or covered data transaction
is effected pursuant to a license or
otherwise, subject to the provisions of
this part. The Department of Justice may
require that such reports include the
production of any books, contracts,
letters, papers, or other hard copy or
electronic documents relating to any
such act, transaction, or covered data
transaction, in the custody or control of
the persons required to make such
reports. Reports may be required either
before, during, or after such acts,
transactions, or covered data
transactions. The Department of Justice
may, through any person or agency,
conduct investigations, hold hearings,
administer oaths, examine witnesses,
receive evidence, take depositions, and
require by subpoena the attendance and
testimony of witnesses and the
production of any books, contracts,
letters, papers, and other hard copy or
electronic documents relating to any
matter under investigation, regardless of
whether any report has been required or
filed in connection therewith.
(b) Definition of the term ‘‘document.’’
For purposes of paragraph (a) of this
section, the term document includes
any written, recorded, or graphic matter
or other means of preserving thought or
expression (including in electronic
format), and all tangible things stored in
any medium from which information
can be processed, transcribed, or
obtained directly or indirectly,
including correspondence, memoranda,
notes, messages, contemporaneous
communications such as text and
instant messages, letters, emails,
spreadsheets, metadata, contracts,
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
bulletins, diaries, chronological data,
minutes, books, reports, examinations,
charts, ledgers, books of account,
invoices, air waybills, bills of lading,
worksheets, receipts, printouts, papers,
schedules, affidavits, presentations,
transcripts, surveys, graphic
representations of any kind, drawings,
photographs, graphs, video or sound
recordings, and motion pictures or other
film.
(c) Format. Persons providing
documents to the Department of Justice
pursuant to this section must produce
documents in a usable format agreed
upon by the Department of Justice. For
guidance, see the Department of
Justice’s data delivery standards
available on the National Security
Division’s website at https://
www.justice.gov/nsd.
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.1103
Annual reports.
(a) Who must report. An annual report
must be filed by any U.S. person that is
engaged in a restricted transaction
involving cloud-computing services,
and that has 25% or more of the U.S.
person’s equity interests owned
(directly or indirectly, through any
contract, arrangement, understanding,
relationship, or otherwise) by a country
of concern or covered person.
(b) Primary responsibility to report. A
report may be filed on behalf of a U.S.
person engaging in the data transaction
described in § 202.1103(a) by an
attorney, agent, or other person. Primary
responsibility for reporting, however,
rests with the actual U.S. person
engaging in the data transaction. No
U.S. person is excused from filing a
report by reason of the fact that another
U.S. person has submitted a report with
regard to the same data transaction,
except where the U.S. person has actual
knowledge that the other U.S. person
filed the report.
(c) When reports are due. A report on
the data transactions described in
§ 202.1103(a) engaged in as of December
31 of the previous year shall be filed
annually by March 1 of the subsequent
year.
(d) Contents of reports. Annual
reports on the data transactions
described in § 202.1103(a) shall include
the following:
(1) The name and address of the U.S.
person engaging in the covered data
transaction, and the name, telephone
number, and email address of a contact
from whom additional information may
be obtained;
(2) A description of the covered data
transaction, including:
(i) The date of the transaction;
(ii) The types and volumes of
government-related data or bulk U.S.
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
sensitive personal data involved in the
transaction;
(iii) The method of data transfer; and
(iv) Any persons participating in the
data transaction and their respective
locations, including the name and
location of each data recipient, the
ownership of entities or citizenship or
primary residence of individuals, the
name and location of any covered
persons involved in the transaction, and
the name of any countries of concern
involved in the transaction;
(3) A copy of any relevant
documentation received or created in
connection with the transaction; and
(4) Any other information that the
Department of Justice may require.
(e) Additional contents; format and
method of submission. Reports required
by this section must be submitted in
accordance with this section and with
subpart L of this part.
§ 202.1104 Reports on rejected prohibited
transactions.
(a) Who must report. A report must be
filed by any U.S. person that has
received and affirmatively rejected
(including automatically rejected using
software, technology, or automated
tools) an offer from another person to
engage in a prohibited transaction
involving data brokerage.
(b) When reports are due. U.S.
persons shall file reports within 14 days
of rejecting a transaction prohibited by
this part.
(c) Contents of reports. Reports on
rejected transactions shall include the
following, to the extent known and
available to the person filing the report
at the time the transaction is rejected:
(1) The name and address of the U.S.
person that rejected the prohibited
transaction, and the name, telephone
number, and email address of a contact
from whom additional information may
be obtained;
(2) A description of the rejected
transaction, including:
(i) The date the transaction was
rejected;
(ii) The types and volumes of
government-related data or bulk U.S.
sensitive personal data involved in the
transaction;
(iii) The method of data transfer;
(iv) Any persons attempting to
participate in the transaction and their
respective locations, including the name
and location of each data recipient, the
ownership of entities or citizenship or
primary residence of individuals, the
name and location of any covered
persons involved in the transaction, and
the name of any countries of concern
involved in the transaction;
PO 00000
Frm 00111
Fmt 4701
Sfmt 4702
86225
(v) A copy of any relevant
documentation received or created in
connection with the transaction; and
(vi) Any other information that the
Department of Justice may require.
(d) Additional contents; format and
method of submission. Reports required
by this section must be submitted in
accordance with this section and with
subpart L of this part.
Subpart L—Submitting Applications,
Requests, Reports, and Responses
§ 202.1201
Procedures.
(a) Application of this subpart. This
subpart applies to any submissions
required or permitted by this part,
including reports of known or suspected
violations submitted pursuant to
§ 202.302, requests for removal from the
Covered Persons List submitted
pursuant to subpart G of this part,
requests for specific licenses submitted
pursuant to § 202.802, advisory opinion
requests submitted pursuant to subpart
I of this part, annual reports submitted
pursuant to § 202.1103, reports on
rejected prohibited transactions
submitted pursuant to § 202.1104, and
responses to pre-penalty notices and
findings of violations submitted
pursuant to § 202.1306 (collectively,
‘‘submissions’’).
(b) Form of submissions. Submissions
must follow the instructions in this part
and any instructions on the National
Security Division’s website. With the
exception of responses to pre-penalty
notices or findings of violations
submitted pursuant to subpart M of this
part, submissions must use the forms on
the National Security Division’s website
or another official reporting option as
specified by the National Security
Division.
(c) Method of submissions.
Submissions must be made to the
National Security Division
electronically by emailing the National
Security Division at
NSD.FIRS.datasecurity@usdoj.gov or
using another official electronic
reporting option, in accordance with
any instructions on the National
Security Division’s website.
(d) Certification. If the submitting
party is an individual, the submission
must be signed by the individual or the
individual’s attorney. If the submitting
party is not an individual, the
submission must be signed on behalf of
each submitting party by an officer,
director, a person performing the
functions of an officer or a director of,
or an attorney for, the submitting party.
Annual reports submitted pursuant to
§ 202.1103, and reports on rejected
transactions submitted pursuant to
E:\FR\FM\29OCP2.SGM
29OCP2
86226
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
§ 202.1104, must be signed by an officer,
a director, a person performing the
functions of an officer or a director, or
an employee responsible for
compliance. In appropriate cases, the
Department of Justice may require the
chief executive officer of a requesting
party to sign the request. Each such
person signing a submission must
certify that the submission is true,
accurate, and complete.
Subpart M—Penalties and Finding of
Violation
khammond on DSKJM1Z7X2PROD with PROPOSALS2
§ 202.1301
Penalties for violations.
(a) Civil and criminal penalties.
Section 206 of IEEPA, 50 U.S.C. 1705,
is applicable to violations of the
provisions of any license, ruling,
regulation, order, directive, or
instruction issued by or pursuant to the
direction or authorization of the
Attorney General pursuant to this part
or otherwise under IEEPA.
(1) A civil penalty not to exceed the
amount set forth in section 206 of IEEPA
may be imposed on any person who
violates, attempts to violate, conspires
to violate, or causes a violation of any
license, order, regulation, or prohibition
issued under IEEPA.
(2) IEEPA provides for a maximum
civil penalty not to exceed the greater of
$368,136 or an amount that is twice the
amount of the transaction that is the
basis of the violation with respect to
which the penalty is imposed.
(3) A person who willfully commits,
willfully attempts to commit, willfully
conspires to commit, or aids or abets in
the commission of a violation of any
license, order, regulation, or prohibition
issued under IEEPA shall, upon
conviction, be fined not more than
$1,000,000, or if a natural person, may
be imprisoned for not more than 20
years, or both.
(b) Adjustment of civil penalties. The
civil penalties provided in IEEPA are
subject to adjustment pursuant to the
Federal Civil Penalties Inflation
Adjustment Act of 1990 (Public Law
101–410, as amended, 28 U.S.C. 2461
note).
(c) Adjustment of criminal penalties.
The criminal penalties provided in
IEEPA are subject to adjustment
pursuant to 18 U.S.C. 3571.
(d) False statements. Pursuant to 18
U.S.C. 1001, whoever, in any matter
within the jurisdiction of the executive,
legislative, or judicial branch of the
Government of the United States,
knowingly and willfully falsifies,
conceals, or covers up by any trick,
scheme, or device a material fact; or
makes any materially false, fictitious, or
fraudulent statement or representation;
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
or makes or uses any false writing or
document knowing the same to contain
any materially false, fictitious, or
fraudulent statement or entry shall be
fined under title 18, United States Code,
imprisoned, or both.
(e) Other applicable laws. Violations
of this part may also be subject to other
applicable laws.
§ 202.1302
Process for pre-penalty notice.
(a) When and how issued. (1) If the
Department of Justice has reason to
believe that there has occurred a
violation of any provision of this part or
a violation of the provisions of any
license, ruling, regulation, order,
directive, or instruction issued by or
pursuant to the direction or
authorization of the Attorney General
pursuant to this part or otherwise under
IEEPA and determines that a civil
monetary penalty is warranted, the
Department of Justice will issue a prepenalty notice informing the alleged
violator of the agency’s intent to impose
a monetary penalty.
(2) The pre-penalty notice shall be in
writing.
(3) The pre-penalty notice may be
issued whether or not another agency
has taken any action with respect to the
matter.
(4) The Department shall provide the
alleged violator with the relevant
information that is not privileged,
classified, or otherwise protected, and
that forms the basis for the pre-penalty
notice, including a description of the
alleged violation and proposed penalty
amount.
(b) Opportunity to respond. An
alleged violator has the right to respond
to a pre-penalty notice in accordance
with § 202.1306 of this part.
(c) Settlement. Settlement discussion
may be initiated by the Department of
Justice, the alleged violator, or the
alleged violator’s authorized
representative.
(d) Representation. A representative
of the alleged violator may act on behalf
of the alleged violator, but any oral
communication with the Department of
Justice prior to a written submission
regarding the specific allegations
contained in the pre-penalty notice
must be preceded by a written letter of
representation, unless the pre-penalty
notice was served upon the alleged
violator in care of the representative.
§ 202.1303
Penalty imposition.
If, after considering any written
response to the pre-penalty notice and
any relevant facts, the Department of
Justice determines that there was a
violation by the alleged violator named
in the pre-penalty notice and that a civil
PO 00000
Frm 00112
Fmt 4701
Sfmt 4702
monetary penalty is appropriate, the
Department of Justice may issue a
penalty notice to the violator containing
a determination of the violation and the
imposition of the monetary penalty. The
Department shall provide the violator
with any relevant, non-classified
information that forms the basis of the
penalty. The issuance of the penalty
notice shall constitute final agency
action. The violator has the right to seek
judicial review of that final agency
action in Federal district court.
§ 202.1304
litigation.
Administrative collection and
In the event that the violator does not
pay the penalty imposed pursuant to
this part or make payment arrangements
acceptable to the Department of Justice,
the Department of Justice may refer the
matter to the Department of the
Treasury for administrative collection
measures or take appropriate action to
recover the penalty in any civil suit in
Federal district court.
§ 202.1305
Finding of violation.
(a) When and how issued. (1) The
Department of Justice may issue an
initial finding of violation that identifies
a violation if the Department of Justice:
(i) Determines that there has occurred
a violation of any provision of this part,
or a violation of the provisions of any
license, ruling, regulation, order,
directive, or instruction issued by or
pursuant to the direction or
authorization of the Attorney General
pursuant to this part or otherwise under
IEEPA;
(ii) Considers it important to
document the occurrence of a violation;
and
(iii) Concludes that an administrative
response is warranted but that a civil
monetary penalty is not the most
appropriate response.
(2) An initial finding of violation shall
be in writing and may be issued
whether or not another agency has taken
any action with respect to the matter.
(3) The Department shall provide the
alleged violator with the relevant
information that is not privileged,
classified, or otherwise protected, that
forms the basis for the finding of
violation, including a description of the
alleged violation.
(b) Opportunity to respond. An
alleged violator has the right to contest
an initial finding of violation in
accordance with § 202.1306 of this part.
(c) Determination—(1) Determination
that a finding of violation is warranted.
If, after considering the response, the
Department of Justice determines that a
final finding of violation should be
issued, the Department of Justice will
E:\FR\FM\29OCP2.SGM
29OCP2
Federal Register / Vol. 89, No. 209 / Tuesday, October 29, 2024 / Proposed Rules
issue a final finding of violation that
will inform the violator of its decision.
The Department shall provide the
violator with the relevant information
that is not privileged, classified, or
otherwise protected, that forms the basis
for the finding of violation. A final
finding of violation shall constitute final
agency action. The violator has the right
to seek judicial review of that final
agency action in Federal district court.
(2) Determination that a finding of
violation is not warranted. If, after
considering the response, the
Department of Justice determines a
finding of violation is not warranted,
then the Department of Justice will
inform the alleged violator of its
decision not to issue a final finding of
violation. A determination by the
Department of Justice that a final
finding of violation is not warranted
does not preclude the Department of
Justice from pursuing other enforcement
actions.
(d) Representation. A representative
of the alleged violator may act on behalf
of the alleged violator, but any oral
communication with the Department of
Justice prior to a written submission
regarding the specific alleged violations
contained in the initial finding of
violation must be preceded by a written
letter of representation, unless the
initial finding of violation was served
upon the alleged violator in care of the
representative.
§ 202.1306 Opportunity to respond to a
pre-penalty notice or finding of violation.
(a) Right to respond. An alleged
violator has the right to respond to a
pre-penalty notice or finding of
violation by making a written
presentation to the Department of
Justice.
(b) Deadline for response. A response
to a pre-penalty notice or finding of
violation must be electronically
submitted within 30 days of electronic
service of the notice or finding. The
failure to submit a response within 30
days shall be deemed to be a waiver of
the right to respond.
(c) Extensions of time for response.
Any extensions of time will be granted,
Area ID
at the discretion of the Department of
Justice, only upon specific request to the
Department of Justice.
(d) Contents of response. Any
response should set forth in detail why
the alleged violator either believes that
a violation of the regulations did not
occur or why a finding of violation or
penalty is otherwise unwarranted under
the circumstances. The response should
include all documentary or other
evidence available to the alleged
violator that supports the arguments set
forth in the response. The Department of
Justice will consider all relevant
materials submitted in the response.
Subpart N—Government-Related
Location Data List
§ 202.1401
Data List.
Government-Related Location
For each Area ID listed in this section,
each of the latitude/longitude
coordinate pairs forms a corner of the
geofenced area.
Latitude/longitude coordinates of geofenced area
1 ...............................................................................................
2 ...............................................................................................
3 ...............................................................................................
4 ...............................................................................................
5 ...............................................................................................
6 ...............................................................................................
7 ...............................................................................................
8 ...............................................................................................
38.935624,
¥77.207888
38.950446,
¥77.125592
38.953191,
¥77.372792
39.113546,
¥76.777053
33.416299,
¥82.172772
21.525093,
¥158.019139
21.475012,
¥158.061844
29.449322,
¥98.646174
38.931674,
¥77.199387
38.952077,
¥77.120947
38.953174,
¥77.369764
39.131086,
¥76.758527
33.416666,
¥82.164366
21.525362,
¥158.002575
21.483357,
¥158.057568
29.452872,
¥98.637623
38.929289,
¥77.203229
38.947468,
¥77.120060
38.951148,
¥77.369759
39.100086,
¥76.749715
33.406350,
¥82.163645
21.518161,
¥158.002233
21.479226,
¥158.049881
29.448069,
¥98.637303
Dated: October 18, 2024.
Matthew G. Olsen,
Assistant Attorney General for National
Security, U.S. Department of Justice.
[FR Doc. 2024–24582 Filed 10–22–24; 4:15 pm]
khammond on DSKJM1Z7X2PROD with PROPOSALS2
BILLING CODE 4410–PF–P
VerDate Sep<11>2014
17:46 Oct 28, 2024
Jkt 265001
86227
PO 00000
Frm 00113
Fmt 4701
Sfmt 9990
E:\FR\FM\29OCP2.SGM
29OCP2
38.932939,
¥77.209328
38.947135,
¥77.122809
38.951152,
¥77.372781
39.093304,
¥76.760882
33.406261,
¥82.172947
21.518010,
¥158.018364
21.472695,
¥158.052371
29.444547,
¥98.640607
Agencies
[Federal Register Volume 89, Number 209 (Tuesday, October 29, 2024)]
[Proposed Rules]
[Pages 86116-86227]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-24582]
[[Page 86115]]
Vol. 89
Tuesday,
No. 209
October 29, 2024
Part II
Department of Justice
-----------------------------------------------------------------------
28 CFR Part 202
Provisions Pertaining to Preventing Access to U.S. Sensitive Personal
Data and Government-Related Data by Countries of Concern or Covered
Person; Proposed Rule
Federal Register / Vol. 89 , No. 209 / Tuesday, October 29, 2024 /
Proposed Rules
[[Page 86116]]
-----------------------------------------------------------------------
DEPARTMENT OF JUSTICE
28 CFR Part 202
[Docket No. NSD 104]
RIN 1124-AA01
Provisions Pertaining to Preventing Access to U.S. Sensitive
Personal Data and Government-Related Data by Countries of Concern or
Covered Persons
AGENCY: National Security Division, Department of Justice.
ACTION: Proposed rule; request for comments.
-----------------------------------------------------------------------
SUMMARY: The Department of Justice proposes a rule to implement
Executive Order 14117 of February 28, 2024 (Preventing Access to
Americans' Bulk Sensitive Personal Data and United States Government-
Related Data by Countries of Concern), by prohibiting and restricting
certain data transactions with certain countries or persons.
DATES: Written comments on this notice of proposed rulemaking (NPRM)
must be received by November 29, 2024.
ADDRESSES: You may send comments, identified by Docket No. NSD 104, by
either of the following methods:
Federal eRulemaking Portal: https://www.regulations.gov.
Follow the instructions for sending comments.
Mail: U.S. Department of Justice, National Security
Division, Foreign Investment Review Section, 175 N Street NE, 12th
Floor, Washington, DC 20002.
FOR FURTHER INFORMATION CONTACT: Email (preferred):
[email protected]. Otherwise, please contact: Lee Licata,
Deputy Chief for National Security Data Risks, Foreign Investment
Review Section, National Security Division, U.S. Department of Justice,
175 N Street NE, Washington, DC 20002; Telephone: 202-514-8648.
SUPPLEMENTARY INFORMATION: In accordance with 5 U.S.C. 553(b)(4), a
plain language summary of the proposed rule is available at
www.regulations.gov.
Public Participation
Instructions: We encourage comments to be submitted via https://www.regulations.gov. Please submit comments only, include your name and
company name (if any), and cite ``Provisions Pertaining to Preventing
Access to U.S. Sensitive Personal Data and Government-Related Data by
Countries of Concern or Covered Persons'' in all correspondence. Anyone
submitting business confidential information should clearly identify
the business confidential portion at the time of submission, file a
statement justifying nondisclosure and referring to the specific legal
authority claimed, and provide a non-confidential version of the
submission. For comments submitted electronically containing business
confidential information, the file name of the business confidential
version should begin with the characters ``BC.'' Any page containing
business confidential information must be clearly marked ``BUSINESS
CONFIDENTIAL'' at the top of that page. The corresponding non-
confidential version of those comments must be clearly marked
``PUBLIC.'' The file name of the nonconfidential version should begin
with the character ``P.'' Any submissions with file names that do not
begin with a ``BC'' will be assumed to be public and will be posted
without change, including any business or personal information
provided, such as names, addresses, email addresses, or telephone
numbers.
To facilitate an efficient review of submissions, the Department of
Justice encourages but does not require commenters to: (1) submit a
short executive summary at the beginning of all comments; (2) provide
supporting material, including empirical data, findings, and analysis
in reports or studies by established organizations or research
institutions; (3) describe the relative benefits and costs of the
approach contemplated in this NPRM and any alternative approaches; and
(4) refer to the specific proposed subpart or defined term to which
each comment is addressed. The Department of Justice welcomes
interested parties' submissions of written comments discussing relevant
experiences, information, and views. Parties wishing to supplement
their written comments with a follow-up meeting may request to do so,
and the Department of Justice may accommodate such requests as
resources permit.
Table of Contents
I. Executive Summary
II. Background
III. Advance Notice of Proposed Rulemaking and Comments
IV. Discussion of the Proposed Rule
A. Subpart C--Prohibited Transactions and Related Activities
1. Section 202.210--Covered Data Transactions
2. Section 202.301--Prohibited Data-Brokerage Transactions
3. Section 202.201--Access
4. Section 202.249--Sensitive Personal Data
5. Section 202.212--Covered Personal Identifiers
6. Section 202.234--Listed Identifier
7. Section 202.242--Precise Geolocation Data
8. Section 202.204--Biometric Identifiers
9. Section 202.224--Human Genomic Data
10. Other Human `Omic Data
11. Section 202.240--Personal Financial Data
12. Section 202.241--Personal Health Data
13. Section 202.206--Bulk U.S. Sensitive Personal Data
14. Section 202.205--Bulk
15. Section 202.222--Government-Related Data
16. Section 202.302--Other Prohibited Data-Brokerage
Transactions Involving Potential Onward Transfer to Countries of
Concern or Covered Persons
17. Section 202.303--Prohibited Human Genomic Data and Human
Biospecimen Transactions
18. Section 202.304--Prohibited Evasions, Attempts, Causing
Violations, and Conspiracies
19. Section 202.305--Knowingly Directing Prohibited Transactions
20. Section 202.215--Directing
21. Section 202.230--Knowingly
B. Subpart D--Restricted Transactions
1. Section 202.401--Authorization To Conduct Restricted
Transactions; Section 202.402--Incorporation by Reference
2. Section 202.258--Vendor Agreement
3. Section 202.217--Employment Agreement
4. Section 202.228--Investment Agreement
C. Subpart E--Exempt Transactions
1. Section 202.501--Personal Communications; Section 202.502--
Information or Informational Materials; and Section 402.503--Travel
2. Section 202.504--Official Business of the United States
Government
3. Section 202.505--Financial Services
4. Section 202.506--Corporate Group Transactions
5. Section 202.507--Transactions Required or Authorized by
Federal Law or International Agreements, or Necessary for Compliance
With Federal Law
6. Section 202.508--Investment Agreements Subject to a CFIUS
Action
7. Section 202.509--Telecommunications Services
8. Section 202.510--Drug, Biological Product, and Medical Device
Authorizations
9. Section 202.511--Other Clinical Investigations and Post-
Marketing Surveillance Data
10. Other Exemptions
D. Subpart F--Determination of Countries of Concern
1. Section 202.601--Determination of Countries of Concern
a. China
b. Cuba
c. Iran
d. North Korea
e. Russia
f. Venezuela
E. Subpart G--Covered Persons
1. Section 202.211--Covered Person
2. Section 202.701--Designation of Covered Persons
F. Subpart H--Licensing
[[Page 86117]]
1. Section 202.801--General Licenses
2. Section 202.802--Specific Licenses
3. Conditions on General and Specific Licenses
G. Subpart I--Advisory Opinions
1. Section 202.901--Inquiries Concerning Application of This
Part
H. Subpart J--Due Diligence and Audit Requirements
1. Section 202.1001--Due Diligence for Restricted Transactions
2. Section 202.1002--Audits for Restricted Transactions
I. Subpart K--Reporting and Recordkeeping Requirements
1. Section 202.1101--Records and Recordkeeping Requirements
2. Section 202.1102--Reports To Be Furnished on Demand
3. Section 202.1103--Annual Reports
4. Section 202.1104--Reports on Rejected Prohibited Transactions
J. Subpart M--Penalties and Finding of Violation
1. Section 202.1301--Penalties for Violations
2. Section 202.1305--Finding of Violation
K. Coordination With Other Regulatory Regimes
L. Severability
V. Analysis for Proposed Bulk Thresholds
A. Analysis of Sensitivity of Each Category of Sensitive
Personal Data
1. Human Genomic Data
2. Biometric Identifiers
3. Precise Geolocation Data
4. Personal Health Data
5. Personal Financial Data
6. Covered Personal Identifiers
B. Grouping the Categories Into Tiers by Similar Sensitivity
C. Proposed Bulk Thresholds for Each Tier
VI. Interpretation of ``Information or Informational Materials'' in
IEEPA
A. The Berman Amendment Is Intended To Protect the Free Exchange
of Ideas
B. The Berman Amendment Does Not Reach Transactions Involving
Sensitive Personal Data Under This Proposed Rule
C. Exclusion for Materials Already Created and in Existence
VII. Regulatory Requirements
A. Executive Orders 12866 (Regulatory Planning and Review) as
Amended by Executive Orders 13563 (Improving Regulation and
Regulatory Review) and 14094 (Modernizing Regulatory Review)
1. Executive Summary
2. Introduction
3. Market Sectors Impacted by the Proposed Regulation
a. Sensitive Personal Data and Government-Related Data
i. Personal Financial Data
ii. Personal Health Data
iii. Precise Geolocation Data
iv. Human Genomic and Human `Omic Data
v. Biometric Identifiers
vi. Covered Personal Identifiers
b. The Data-Brokerage Market
i. Companies That May Meet the Definition of Data Brokers for
the Purposes of the Proposed Rule
ii. Market Size
iii. Products Sold by Data Brokers
iv. Price Information
v. Customers of Data-Brokerage Products
c. Agreements Affected by the Proposed Regulation
i. Vendor Agreements
ii. Employment Agreements
iii. Investment Agreements
iv. Security Requirements
v. Due Diligence and Recordkeeping
vi. Audits
vii. Licenses
4. Need for Regulatory Action
5. Baseline (Without the Proposed Rule)
a. Baseline National Security and Foreign-Policy Risks by
Category of Data
i. Human Genomic and Human `Omic Data
ii. Biometric Identifiers
iii. Precise Geolocation Data
iv. Personal Health Data
v. Personal Financial Data
vi. Covered Personal Identifiers
vii. Government-Related Data
b. Baseline: Total Potential U.S. Population Affected by Risks
c. Summary of Baseline (Without the Proposed Rule)
6. Alternative Approaches
7. Benefits of the Proposed Rule
8. Costs of the Proposed Rule
a. Value of Lost and Forgone Transactions
i. Global Market Value of Genomic, Biometric, and Location Data
ii. U.S. Exports to Relevant Specific Categories and to
Countries of Concern
iii. Estimates of U.S. Exports of Genomic, Biometric, and
Location Data
iv. Estimates of U.S. Exports of Genomic, Biometric, and
Location Data to the Six Countries of Concern
v. Total Estimated Value of Lost and Forgone Transactions
vi. Alternative Methodology for Estimating the Value of Lost and
Forgone Transactions
b. Security Costs
i. Similar Security Standards and Frameworks
ii. Current Industry Compliance Level
iii. Costs of Compliance
c. Costs Associated With Compliance Program: Due Diligence,
Recordkeeping, and Auditing
i. Due Diligence Costs
ii. Recordkeeping Costs
iii. Executive Order on Modernizing Regulatory Review
Recordkeeping and Related Costs
iv. Auditing Costs
v. Estimated Recordkeeping Costs From the Reviewed Literature
vi. Summary of a Compliance Program: Due Diligence,
Recordkeeping, and Auditing
9. Summary of Regulatory Analysis
B. Regulatory Flexibility Act
1. Succinct Statement of the Objectives of, and Legal Basis for,
the Proposed Rule
2. Description of and, Where Feasible, an Estimate of the Number
of Small Entities to Which The Proposed Rule Will Apply
3. Description of the Projected Reporting, Recordkeeping, and
Other Compliance Requirements of the Proposed Rule
4. Identification of all Relevant Federal Rules That May
Duplicate, Overlap, or Conflict With the Proposed Rule
C. Executive Order 13132 (Federalism)
D. Executive Order 13175 (Consultation and Coordination With
Indian Tribal Governments)
E. Executive Order 12988 (Civil Justice Reform)
F. Paperwork Reduction Act
G. Unfunded Mandates Reform Act
I. Executive Summary
Executive Order 14117 of February 28, 2024, ``Preventing Access to
Americans' Bulk Sensitive Personal Data and United States Government-
Related Data by Countries of Concern'' (``the Order''), directs the
Attorney General to issue regulations that prohibit or otherwise
restrict United States persons from engaging in any acquisition,
holding, use, transfer, transportation, or exportation of, or dealing
in, any property in which a foreign country or national thereof has any
interest (``transaction''), where the transaction: involves United
States Government-related data (``government-related data'') or bulk
U.S. sensitive personal data, as defined by final rules implementing
the Order; falls within a class of transactions that has been
determined by the Attorney General to pose an unacceptable risk to the
national security of the United States because it may enable access by
countries of concern or covered persons to government-related data or
Americans' bulk U.S. sensitive personal data; and meets other criteria
specified by the Order. On March 5, 2024, the National Security
Division of the Department of Justice (``DOJ'' or ``the Department'')
issued an Advance Notice of Proposed Rulemaking (``ANPRM'') seeking
public comment on various topics related to implementation of the
Order.\1\
---------------------------------------------------------------------------
\1\ 89 FR 15780 (Mar. 5, 2024).
---------------------------------------------------------------------------
This Notice of Proposed Rulemaking (``NPRM'') addresses the public
comments received on the ANPRM, sets forth a proposed rule to implement
the Order, and seeks public comment. The proposed rule identifies
classes of prohibited and restricted transactions; identifies countries
of concern and classes of covered persons with whom the regulations
would prohibit or restrict transactions involving government-related
data or bulk U.S. sensitive personal data; establishes a process to
issue (including to modify or rescind) licenses authorizing otherwise
prohibited or restricted transactions and to issue advisory opinions;
and addresses recordkeeping and reporting of transactions to inform
investigative, enforcement, and regulatory efforts of the Department of
Justice.
[[Page 86118]]
II. Background
On February 28, 2024, the President issued Executive Order 14117
(Preventing Access to Americans' Bulk Sensitive Personal Data and
United States Government-Related Data by Countries of Concern) (``the
Order''), pursuant to his authority under the Constitution and the laws
of the United States, including the International Emergency Economic
Powers Act (50 U.S.C. 1701 et seq.) (``IEEPA''); the National
Emergencies Act (50 U.S.C. 1601 et seq.) (``NEA''); and title 3,
section 301 of the United States Code. In the Order, the President
expanded the scope of the national emergency declared in Executive
Order 13873 of May 15, 2019 (Securing the Information and
Communications Technology and Services Supply Chain), and further
addressed with additional measures in Executive Order 14034 of June 9,
2021 (Protecting Americans' Sensitive Data From Foreign Adversaries).
The President determined that additional measures are necessary to
counter the unusual and extraordinary threat to U.S. national security
posed by the continuing efforts of certain countries of concern to
access and exploit government-related data or Americans' bulk U.S.
sensitive personal data.
The Order directs the Attorney General, pursuant to the President's
delegation of his authorities under IEEPA, to issue regulations that
prohibit or otherwise restrict United States persons from engaging in
certain transactions in which a foreign country of concern or national
thereof has an interest. Restricted and prohibited transactions include
transactions that involve government-related data or bulk U.S.
sensitive personal data, are a member of a class of transactions that
the Attorney General has determined poses an unacceptable risk to the
national security of the United States because the transactions may
enable countries of concern or covered persons to access government-
related data or bulk U.S. sensitive personal data, and are not
otherwise exempted from the Order or its implementing regulations. The
Order directs the Attorney General to issue regulations that identify
classes of prohibited and restricted transactions; identify countries
of concern and classes of covered persons whose access to government-
related data or bulk U.S. sensitive personal data poses the national
security risk described in the Order; establish a process to issue
(including to modify or rescind) licenses authorizing otherwise
prohibited or restricted transactions; further define terms used in the
Order; address recordkeeping and reporting of transactions to inform
investigative, enforcement, and regulatory efforts of the Department of
Justice; and to take whatever additional actions, including
promulgating additional regulations, as may be necessary to carry out
the purposes of the Order.
The Order and this proposed rule fill an important gap in the
United States Government's authorities to address the threat posed by
countries of concern accessing government-related data or Americans'
bulk U.S. sensitive personal data. As the President determined in the
Order, ``[a]ccess to Americans' bulk sensitive personal data or United
States Government-related data increases the ability of countries of
concern to engage in a wide range of malicious activities.'' As the
ANPRM explained, countries of concern can use their access to
government-related data or Americans' bulk U.S. sensitive personal data
to engage in malicious cyber-enabled activities and malign foreign
influence activities and to track and build profiles on U.S.
individuals, including members of the military and other Federal
employees and contractors, for illicit purposes such as blackmail and
espionage. And countries of concern can exploit their access to
government-related data or Americans' bulk U.S. sensitive personal data
to collect information on activists, academics, journalists,
dissidents, political figures, or members of nongovernmental
organizations or marginalized communities to intimidate them; curb
political opposition; limit freedoms of expression, peaceful assembly,
or association; or enable other forms of suppression of civil
liberties.
As the 2024 National Counterintelligence Strategy explains, ``as
part of a broader focus on data as a strategic resource, our
adversaries are interested in personally identifiable information (PII)
about U.S. citizens and others, such as biometric and genomic data,
health care data, geolocation information, vehicle telemetry
information, mobile device information, financial transaction data, and
data on individuals' political affiliations and leanings, hobbies, and
interests.'' \2\ These and other kinds of sensitive personal data ``can
be especially valuable, providing adversaries not only economic and
[research and development] benefits, but also useful
[counterintelligence] information, as hostile intelligence services can
use vulnerabilities gleaned from such data to target and blackmail
individuals.'' \3\
---------------------------------------------------------------------------
\2\ Nat'l Counterintel. & Sec. Ctr., National
Counterintelligence Strategy 2024 13 (Aug. 1, 2024), https://www.dni.gov/files/NCSC/documents/features/NCSC_CI_Strategy-pages-20240730.pdf [https://perma.cc/9L2T-VXSU].
\3\ Id.
---------------------------------------------------------------------------
Nongovernmental experts have underscored these risks. For example,
a recent study by the MITRE Corporation summarized open-source
reporting, highlighting the threat of blackmail, coercion,
identification of high-risk government personnel and sensitive
locations, and improved targeting of offensive cyber operations and
network exploitation posed by hostile actors' access to Americans' data
derived from advertising technology.\4\
---------------------------------------------------------------------------
\4\ Kirsten Hazelrig, Ser. No. 14, Intelligence After Next:
Surveillance Technologies Are Imbedded Into the Fabric of Modern
Life--The Intelligence Community Must Respond, The MITRE Corporation
2 (Jan. 5, 2023), https://www.mitre.org/sites/default/files/2023-01/PR-22-4107-INTELLIGENCE-AFTER-NEXT-14-January-2023.pdf [https://perma.cc/3WA2-PGM2].
---------------------------------------------------------------------------
The development of artificial intelligence (``AI''), high-
performance computing, big-data analytics, and other advanced
technological capabilities by countries of concern amplifies the threat
posed by these countries' access to government-related data or
Americans' bulk U.S. sensitive personal data. For instance, the U.S.
National Intelligence Council assessed in 2020 that ``access to
personal data of other countries' citizens, along with [artificial
intelligence]-driven analytics, will enable [the People's Republic of
China] to automate the identification of individuals and groups beyond
China's borders to target with propaganda or censorship.'' \5\
---------------------------------------------------------------------------
\5\ Nat'l Intel. Council, Assessment: Cyber Operations Enabling
Expansive Digital Authoritarianism 4 (Apr. 7, 2020), https://www.dni.gov/files/ODNI/documents/assessments/NICM-Declassified-Cyber-Operations-Enabling-Expansive-Digital-Authoritarianism-20200407-2022.pdf [https://perma.cc/ZKJ4-TBU6].
---------------------------------------------------------------------------
Countries of concern can also exploit their access to government-
related data regardless of volume to threaten U.S. national security.
One academic study explained that ``[f]oreign and malign actors could
use location datasets to stalk or track high-profile military or
political targets,'' revealing ``sensitive locations--such as visits to
a place of worship, a gambling venue, a health clinic, or a gay bar--
which again could be used for profiling, coercion, blackmail, or other
purposes.'' \6\ The MITRE report further explained that location
datasets could reveal ``U.S. military bases and undisclosed
intelligence sites'' or ``be used to
[[Page 86119]]
estimate military population or troop buildup in specific areas around
the world or even identify areas of off-base congregation to target.''
\7\ As another example of these data risks and the relative ease with
which they can be exploited, journalists were able to commercially
acquire from a data broker a continuous stream of 3.6 billion
geolocation data points that were lawfully collected on millions of
people from advertising IDs.\8\ The journalists were then able to
create ``movement profiles'' for tens of thousands of national security
and military officials, and from there, could determine where they
lived and worked as well as their names, education levels, family
situations, and hobbies.\9\
---------------------------------------------------------------------------
\6\ Justin Sherman et al., Duke Sanford Sch. of Pub. Pol'y, Data
Brokers and the Sale of Data on U.S. Military Personnel 15 (Nov.
2023), https://techpolicy.sanford.duke.edu/wp-content/uploads/sites/4/2023/11/Sherman-et-al-2023-Data-Brokers-and-the-Sale-of-Data-on-US-Military-Personnel.pdf [https://perma.cc/BBJ9-44UH].
\7\ Id.
\8\ Suzanne Smalley, US Company's Geolocation Data Transaction
Draws Intense Scrutiny in Germany, The Record (July 18, 2024),
https://therecord.media/germany-geolocation-us-data-broker [https://perma.cc/ME9F-TAQ7] (citing joint reporting by the German public
broadcaster Bayerische Rundfunk and digital civil rights opinion
news site netzpolitik.org).
\9\ Id.
---------------------------------------------------------------------------
The Order and this proposed rule seek to mitigate these and other
national security threats that arise from countries of concern
accessing government-related data or Americans' bulk U.S. sensitive
personal data.
No current Federal legislation or rule categorically prohibits or
imposes security requirements to prevent U.S. persons from providing
countries of concern or covered persons access to sensitive personal
data or government-related data through data brokerage, vendor,
employment, or investment agreements. For example, the scope and
structure of the Protecting Americans' Data from Foreign Adversaries
Act of 2024 (see Pub. L. 118-50, div. I, 118th Cong. (2024)) do not
create a comprehensive regulatory scheme that adequately and
categorically addresses these national security risks, as explained in
part IV.K of this preamble. Likewise, the Committee on Foreign
Investment in the United States (``CFIUS'') has authority to assess the
potential national security risks of certain investments by foreign
persons in certain United States businesses that ``maintain[] or
collect[] sensitive personal data of United States citizens that may be
exploited in a manner that threatens national security.'' \10\ CFIUS
only reviews certain types of investments in U.S. businesses; it does
so on a transaction-by-transaction basis, instead of prescribing
prospective and categorical rules regulating all such transactions; and
its authorities do not extend to other activities that countries of
concern may use to gain access to government-related data or Americans'
bulk U.S. sensitive personal data, such as through purchases of such
data on the commercial market or through vendor or employment
agreements.\11\
---------------------------------------------------------------------------
\10\ 50 U.S.C. 4565(a)(4)(B)(iii)(III).
\11\ See generally Foreign Investment Risk Review Modernization
Act of 2018, Public Law 115-232, tit. XVII, secs. 1701-28, 132 Stat.
1636, 2173.
---------------------------------------------------------------------------
Similarly, Executive Order 13873 prohibits any acquisition,
importation, transfer, installation, dealing in or use of by U.S.
persons from acquiring certain information and communication
technologies and services (``ICTS'') designed, developed, manufactured,
or supplied by foreign adversaries where, among other things, the
Secretary of Commerce determines that the transaction poses an
``unacceptable risk to the national security of the United States or
the security and safety of United States persons.'' \12\ In building
upon the national emergency declared in Executive Order 13873, the
President, in Executive Order 14034, determined that connected software
applications operating on U.S. ICTS ``can access and capture vast
swaths of . . . personal information and proprietary business
information,'' a practice that ``threatens to provide foreign
adversaries with access to that information.'' \13\ However, as with
CFIUS legal authorities, the orders do not broadly empower the United
States Government to prohibit or otherwise restrict the sale of
government-related data or Americans' bulk U.S. sensitive personal
data, and the orders do not broadly restrict other commercial
transactions, such as investment, employment, or vendor agreements,
that may provide countries of concern access to government-related data
or Americans' bulk U.S. sensitive personal data.
---------------------------------------------------------------------------
\12\ E.O. 13873 of May 15, 2019, 84 FR 22689, 22690 (May 15,
2019).
\13\ E.O. 14034, 86 FR 31423, 31423 (June 9, 2021).
---------------------------------------------------------------------------
The proposed rule would complement these statutory and regulatory
authorities. It prescribes forward-looking, categorical rules that
prevent U.S. persons from providing countries of concern or covered
persons access to government-related data or Americans' bulk U.S.
sensitive personal data through commercial data-brokerage transactions.
The proposed rule also imposes security requirements on other kinds of
commercial transactions, such as investment, employment, and vendor
agreements, that involve government-related data or Americans' bulk
U.S. sensitive personal data to mitigate the risk that a country of
concern could access such data. The proposed rule would address risks
to government-related data or Americans' bulk U.S. sensitive personal
data that current authorities leave vulnerable to access and
exploitation by countries of concern and provide predictability and
regulatory certainty by prescribing categorical rules regulating
certain kinds of data transactions that could give countries of concern
or covered persons access to government-related data or Americans' bulk
U.S. sensitive personal data.
III. Advance Notice of Proposed Rulemaking and Comments
The National Security Division of the Department published an ANPRM
on March 5, 2024 (former RIN: 1105-AB72), soliciting public comment on
various topics related to the Order.\14\ The Department received and
carefully reviewed 64 timely comments in response to the ANPRM from
trade associations, public interest advocacy groups, think tanks,
private individuals, and companies, as well as comments from several
foreign governments. The Department also received two additional ex
parte comments after the comment period closed, which DOJ publicly
posted on regulations.gov.
---------------------------------------------------------------------------
\14\ 89 FR 15780 (Mar. 5, 2024).
---------------------------------------------------------------------------
During the comment period, the Department of Justice, both on its
own and with other agencies, met with businesses, trade groups, and
other stakeholders potentially interested in or impacted by the
contemplated regulations to discuss the ANPRM. For example, the
Department discussed the ANPRM with the Consumer Technology
Association, the Information Industry Technology Council,
Pharmaceutical Research and Manufacturers of America, the Biotechnology
Innovation Organization, the Bioeconomy Information Sharing Analysis
Center, the U.S. Chamber of Commerce, Tesla, Workday, Anthropic, and
the Special Competitive Studies Project, and it provided briefings to
the Secretary of Commerce and Industry Trade Advisory Committees 6, 10,
and 12 administered by the Office of the U.S. Trade Representative and
the Department of Commerce. The Department also discussed the Order and
contemplated regulations with stakeholders at events open to the
public, including ones hosted by the American Conference Institute, the
American Bar Association, the Center for Strategic and International
Studies, and the R Street Institute, and through other public
engagements such as the Lawfare Podcast, ChinaTalk Podcast, CyberLaw
Podcast, and the Center for
[[Page 86120]]
Cybersecurity Policy & Law's Distilling Cyber Policy podcast.
After the comment period closed, the Department of Justice, along
with the Department of Commerce, followed up with commenters who
provided feedback regarding the bulk thresholds to discuss that topic
in more detail, including the Council on Government Relations Industry
Association, Association of American Medical Colleges, Airlines for
America, Bank Policy Institute, the Business Roundtable, Information
Technology Industry Council, Centre for Information Policy Leadership,
Biotechnology Innovation Organization, Software and Information
Industry Association, Cellular Telephone Industries Association, the
internet and Television Association, US Telecom, Ford Motor Company,
Bioeconomy Information Sharing and Analysis Center, Coalition of
Services Industries, Enterprise Cloud Coalition, Electronic Privacy
Information Center, Center for Democracy and Technology, Business
Software Alliance, Global Data Alliance, Interactive Advertising
Bureau, U.S.-China Business Council, IBM, Workday, and individuals
Justin Sherman, Mark Febrizio, and Charlie Lorthioir. The Department
has also discussed the Order and the ANPRM with foreign partners to
ensure that they understood the Order and contemplated program and how
they fit into broader national security, economic, and trade policies.
The Department considered each comment submitted, including the ex
parte comments that have since been publicly posted. Many of the
comments were general in nature and supported the Department's efforts
and approach with respect to the proposed rule. Overall, commenters
were generally supportive of the intent of the proposed rule. However,
several commentators representing industry questioned the effectiveness
of the proposed rule as compared to the passage of a holistic federal
privacy law, proposed revisions, and highlighted areas where the
proposed rule would benefit from further clarity. The Department
discusses comments, and any edits or revisions made in response to the
comments, in the discussion of the proposed rule in part IV of this
preamble.
IV. Discussion of the Proposed Rule
The proposed rule implements the Order through categorical rules
that regulate certain data transactions involving government-related
data or bulk U.S. sensitive personal data that could give countries of
concern or covered persons access or the ability to access such data
and present an unacceptable risk to U.S. national security. The
proposed rule (1) identifies certain classes of highly sensitive
transactions with countries of concern or covered persons that the
proposed rule would prohibit in their entirety (``prohibited
transactions'') and (2) identifies other classes of transactions that
would be prohibited except to the extent they comply with predefined
security requirements (``restricted transactions'') to mitigate the
risk of access to bulk U.S. sensitive personal data by countries of
concern. The Attorney General has determined that the prohibited and
restricted transactions set forth in the proposed rule pose an
unacceptable risk to the national security of the United States because
they may enable countries of concern or covered persons to access and
exploit government-related data or bulk U.S. sensitive personal data.
In addition to identifying classes of prohibited and restricted
transactions that pose an unacceptable risk to national security, the
proposed rule identifies certain classes of transactions that are
exempt from the proposed rule. For example, the proposed rule exempts
transactions for the conduct of the official business of the United
States Government by employees, grantees, or contractors thereof, and
transactions conducted pursuant to a grant, contract, or other
agreement entered into with the United States Government, including
those for outbreak and pandemic prevention, preparedness, and response.
The proposed rule also defines relevant terms; identifies countries of
concern; defines covered persons; and creates processes for the
Department to issue general and specific licenses, to issue advisory
opinions, and to designate entities or individuals as covered persons.
The proposed rule also establishes a compliance and enforcement regime.
The Department relied upon unclassified and classified sources to
support the proposed rule. Although the unclassified record fully and
independently supports the proposed rule without the need to rely on
the classified record, the classified record provides supplemental
information that lends additional support to the proposed rule. The
proposed rule would be the same even without the classified record.
Some commenters offered overarching comments. A few commenters made
suggestions that addressed issues unrelated to the proposed rule, such
as expressing views on U.S. positions in certain international
negotiations over digital trade. No change was made in response to
these comments. These comments addressed unrelated issues that are not
relevant to the scope of the proposed rule and that are directed to
other agencies and forums, and they generally did not suggest any
specific changes to the contemplated program. To the extent that these
comments intended to suggest that the Order's and proposed rule's
restrictions on access to sensitive personal data are inconsistent with
international commitments by the United States, the Department
disagrees.
The proposed rule's prohibitions and restrictions on access to U.S.
sensitive personal data and government-related data by countries of
concern are consistent with access restrictions on sensitive personal
data that have long been imposed in other national security contexts,
including for some transactions reviewed by CFIUS and the Committee for
the Assessment of Foreign Participation in the United States
Telecommunications Services Sector (``Team Telecom'').\15\ Those access
restrictions, in turn, are consistent with or otherwise permissible
under trade and other international agreements.\16\ For example, the
World Trade Organization's (``WTO'') General Agreement on Trade in
Services (``GATS''), like other trade agreements to which the United
States is a party, includes an essential security interests exception
that states that nothing in the agreement shall be construed to prevent
a party to such an agreement from taking any action that it considers
necessary for the protection of its essential security interests. As a
result, rather than prohibiting such access restrictions, GATS and
other relevant international agreements to which the United States is a
party explicitly authorize national security-based restrictions on data
access and data flows through the longstanding essential security
exception. The proposed rule, like conditions restricting access in
CFIUS or Team Telecom mitigation
[[Page 86121]]
agreements to address identified national security risks, is necessary
to protect the essential security interests of the United States and is
thus consistent with such international agreements to which the United
States is a party.\17\ Notably, consistent with the United States
Government's long-standing support of cross-border data flows, the
proposed rule does not require data localization or wholly restrict
data flows to any specific country. Rather, the proposed rule only
limits data transfers in narrow, specifically defined circumstances
necessary to safeguard security interests, and it is being developed
through a process that enables stakeholder consultation and input. The
proposed rule is also consistent with the United States' longstanding
support for Data Free Flows Trust (``DFFT''). The categories of
prohibited and restricted transactions in the proposed rule identify
circumstances that present an unacceptable national security risk of
enabling countries of concern to access and exploit Americans'
sensitive personal data--circumstances that lack the trust required for
free data flows.
---------------------------------------------------------------------------
\15\ See Foreign Investment Risk Review Modernization Act of
2018, supra note 11 (CFIUS); E.O. 13913, 85 FR 19643 (Apr. 4, 2020)
(Team Telecom); see, e.g., FCC, New Pacific Light Cable Network GU
Holdings-Google National Security Agreement 20-044 Enclosure 1 (Dec.
16, 2021), https://licensing.fcc.gov/cgi-bin/ws.exe/prod/ib/forms/reports/related_filing.hts?f_key=-448225&f_number=SCLLIC2020082700038 [https://perma.cc/PD5E-BYWS].
\16\ See, e.g., Agreement on Trade-Related Aspects of
Intellectual Property Rights art. 73, Apr. 15, 1994, amended Jan.
23, 2017, Marrakesh Agreement Establishing the World Trade
Organization, Annex 1C, 1869 U.N.T.S. 299, https://www.wto.org/english/docs_e/legal_e/31bis_trips_09_e.htm [https://perma.cc/FSP4-BBZQ]; General Agreement on Tariffs and Trade art. XXI, Oct. 30,
1947, 61 Stat. A--11, 55 U.N.T.S. 194, https://www.wto.org/english/docs_e/legal_e/31bis_trips_e.pdf [https://perma.cc/LE7M-ZM4F].
\17\ See Press Release, Off. of the U.S. Trade Representative,
Statements by the United States at the Meeting of the WTO Dispute
Settlement Body (Jan. 27, 2023), https://ustr.gov/about-us/policy-offices/press-office/press-releases/2023/january/statements-united-states-meeting-wto-dispute-settlement-body [https://perma.cc/CQG5-9AZ5] (emphasizing the United States' commitment to protect its
essential security interests in the context of World Trade
Organization disputes); General Agreement on Tariffs and Trade art.
XXI, supra note 16.
---------------------------------------------------------------------------
Several commenters suggested various revisions to borrow or
incorporate aspects of international or State privacy laws into this
proposed rule. The Department generally declines to adopt these
suggestions, except on a discrete issue discussed in part IV.A.7 of
this preamble. The Department supports privacy measures and national
security measures as complementary protections for Americans' sensitive
personal data. Despite some overlap, privacy protections and national
security measures generally focus on different challenges associated
with sensitive personal data. General privacy protections focus on
addressing individual rights and preventing individual harm, such as
protecting the rights of individuals to control the use of their own
data and reducing the potential harm to individuals by minimizing the
collection of data on the front end and limiting the permissible uses
of that data on the back end. National security measures, by contrast,
focus on collective risks and externalities that may result from how
individuals and businesses choose to sell and use their data, including
in lawful and legitimate ways.
For example, some commenters suggested adding a new exemption for
transactions in which a U.S. individual consents to the sale or
disclosure of their data to a country of concern or covered person. The
proposed rule declines to adopt this exemption. Such a consent-based
exemption would leave unaddressed the threat to national security by
allowing U.S. individuals and companies to choose to share government-
related data or Americans' bulk U.S. sensitive personal data with
countries of concern or covered persons. It is precisely those choices
that, in aggregate, help create the national security risk of access by
countries of concern or covered persons, and the purpose of the Order
and the proposed rule is to address the negative externality that is
created by individuals' and companies' choices in the market in the
first place. It would also be inconsistent with other national security
regulations to leave it up to market choices to decide whether to give
American technology, capital, or data to a country of concern or
covered person. Export controls do not allow U.S. companies to
determine whether their sensitive technology can be sent to a foreign
adversary, and sanctions do not allow U.S. persons to determine whether
their capital and material support can be given to terrorists and other
malicious actors. Likewise, the proposed rule would not allow U.S.
individuals to determine whether to give countries of concern or
covered persons access to their sensitive personal data or government-
related data. One of the reasons that the public is not in a position
to assess and make decisions about the national security interests of
the United States is that the public typically does not have all of the
information available to make a fully informed decision about the
national security interests of the United States.
Each subpart of the proposed rule, including any relevant comments
received on the corresponding part of the ANPRM, is discussed below in
the remaining sections of this preamble.
A. Subpart C--Prohibited Transactions and Related Activities
The proposed rule identifies transactions that are categorically
prohibited unless the proposed rule otherwise authorizes them pursuant
to an exemption or a general or specific license or, for the categories
of restricted transactions, in compliance with security requirements
and other requirements set forth in the proposed rule.
1. Section 202.210--Covered Data Transactions
The Order authorizes the Attorney General to issue regulations that
prohibit or otherwise restrict U.S. persons from engaging in a
transaction where, among other things, the Attorney General has
determined that a transaction ``is a member of a class of transactions
. . . [that] pose an unacceptable risk to the national security of the
United States because the transactions may enable countries of concern
or covered persons to access bulk sensitive personal data or United
States Government-related data in a manner that contributes to the
national emergency declared in this [O]rder.'' \18\ Pursuant to the
Order, the proposed rule categorically prohibits or, for the categories
of restricted transactions, imposes security and other requirements on
certain covered data transactions with U.S. persons and countries of
concern or covered persons because the covered data transactions may
otherwise enable countries of concern or covered persons to access
government-related data or bulk U.S. sensitive personal data to harm
U.S. national security.
---------------------------------------------------------------------------
\18\ 89 FR 15423.
---------------------------------------------------------------------------
The proposed rule defines a ``covered data transaction'' as any
transaction that involves any access to any government-related data or
bulk U.S. sensitive personal data and that involves: (1) data
brokerage, (2) a vendor agreement, (3) an employment agreement, or (4)
an investment agreement. See Sec. 202.210. The Department has
determined that these categories of covered data transactions pose an
unacceptable risk to U.S. national security because they may enable
countries of concern or covered persons to access government-related
data or bulk U.S. sensitive personal data to engage in malicious cyber-
enabled activities, track and build profiles on United States
individuals for illicit purposes, including blackmail or espionage, and
to intimidate, curb political dissent or political opposition, or
otherwise limit civil liberties of U.S. persons opposed to countries of
concern, among other harms to U.S. national security. For instance, one
study has demonstrated that foreign malign actors can purchase bulk
quantities of sensitive personal data about U.S. military personnel
from data brokers ``for coercion, reputational damage, and blackmail.''
\19\ Countries of
[[Page 86122]]
concern or covered persons could also exploit vendor, employment, or
investment agreements to obtain access to government-related data or
bulk U.S. sensitive personal data to harm U.S. national security.\20\
---------------------------------------------------------------------------
\19\ Justin Sherman et al., supra note 6, at 14.
\20\ See, e.g., Dep't of Commerce, Final Determination: Case No.
ICTS-20121-002, Kaspersky Lab, Inc., 89 FR 52434, 52436 (June 24,
2024), https://www.govinfo.gov/content/pkg/FR-2024-06-24/pdf/2024-13532.pdf [https://perma.cc/LAS7-S7HF] (describing how Kaspersky
employees gained access to sensitive U.S. person data through their
provision of anti-virus and cybersecurity software); see generally
OFAC, U.S. Dep't of Treas., Guidance on the Democratic People's
Republic of Korea Information Technology Workers (May 16, 2022),
https://ofac.treasury.gov/media/923131/download?inline [https://perma.cc/8DTV-Q34S]; E.O. 14083, 87 FR 57369, 57373 (Sept. 15,
2022).
---------------------------------------------------------------------------
In response to the ANPRM, commenters asked that the Department
clarify when a transaction ``involves'' government-related data or bulk
U.S. sensitive personal data. The Department has responded to those
comments by revising the definition of a ``covered data transaction''
to any transaction that involves any access to the data by the
counterparty to a transaction (rather than any transaction that
involves government-related data or bulk U.S. sensitive personal data).
2. Section 202.301--Prohibited Data-Brokerage Transactions
The proposed rule prohibits any U.S. person from knowingly engaging
in a covered data transaction involving data brokerage with a country
of concern or a covered person. The proposed rule defines ``data
brokerage'' as the sale of data, licensing of access to data, or
similar commercial transactions involving the transfer of data from any
person (``the provider'') to any other person (``the recipient''),
where the recipient did not collect or process the data directly from
the individuals linked or linkable to the collected or processed data.
See Sec. 202.214.
Because the data brokerage prohibition, along with the other
prohibitions and restrictions, center around data transactions
involving access to government-related data or bulk U.S. sensitive
personal data, the Department addresses each of those key terms and
related terms in detail in the following discussion.
3. Section 202.201--Access
Adopting the approach contemplated in the ANPRM without change, the
proposed rule defines ``access'' as logical or physical access,
including the ability to obtain, read, copy, decrypt, edit, divert,
release, affect, alter the state of, or otherwise view or receive, in
any form, including through information systems, information technology
systems, cloud-computing platforms, networks, security systems,
equipment, or software.
One commenter suggested that the Department remove the term
``divert'' from the definition of ``access'' to avoid unintentionally
capturing activities that do not involve actual access to data and
that, according to the commenter, do not pose a risk to national
security. The Department declines to do so. The definition of
``access'' is intentionally broad. It includes the term ``divert'' to
ensure that the proposed rule covers data transactions that would
enable a covered person to divert government-related data or bulk U.S.
sensitive personal data from an intended recipient to a country of
concern or a covered person, either for their own use or for the use of
countries of concern or other covered persons, and to prevent countries
of concern or covered persons from amassing data (including anonymized,
encrypted, aggregated, or pseudonymized data), as discussed in part
IV.A.13 of this preamble.
4. Section 202.249--Sensitive Personal Data
As previewed in the ANPRM, the proposed rule builds on the Order by
further defining the six categories of ``sensitive personal data'' that
could be exploited by a country of concern to harm U.S. national
security if that data is linked or linkable to any identifiable U.S.
individual or to a discrete and identifiable group of U.S. persons.
These six categories are: (1) covered personal identifiers; (2) precise
geolocation data; (3) biometric identifiers; (4) human genomic data;
(5) personal health data; and (6) personal financial data. The proposed
rule also categorically excludes certain categories of data from the
definition of the term ``sensitive personal data.'' These exclusions
include public or nonpublic data that does not relate to an individual,
including trade secrets and proprietary information, and data that is,
at the time of the transaction, lawfully publicly available from
government records or widely distributed media, personal communications
as defined in Sec. 202.239, and information or informational materials
as defined in Sec. 202.226. Nothing in the proposed rule shall be
construed to affect the obligations of U.S. Government departments and
agencies under the Foundations for Evidence-Based Policymaking Act of
2018, Public Law 115-435 (2019), 44 U.S.C. 3501 et seq.
5. Section 202.212--Covered Personal Identifiers
The Order defines ``covered personal identifiers'' as
``specifically listed classes of personally identifiable data that are
reasonably linked to an individual, and that--whether in combination
with each other, with other sensitive personal data, or with other data
that is disclosed by a transacting party pursuant to the transaction
and that makes the personally identifiable data exploitable by a
country of concern--could be used to identify an individual from a data
set or link data across multiple data sets to an individual,'' subject
to certain exclusions.\21\ The ANPRM thus contemplated three
subcategories of covered personal identifiers: (1) listed identifiers
in combination with any other listed identifier; (2) listed identifiers
in combination with other sensitive personal data; and (3) listed
identifiers in combination with other data that are disclosed by a
transacting party pursuant to the transaction that makes the listed
identifier exploitable by a country of concern, if they could be used
to identify an individual from a dataset or to link data across
multiple datasets to an individual.\22\ The ANPRM also contemplated two
exceptions: (1) demographic or contact data that is linked only to
other demographic or contact data; and (2) a network-based identifier,
account-authentication data, or call-detail data that is linked only to
other network-based identifiers, account-authentication data, or call-
detail data as necessary for the provision of telecommunications,
networking, or similar services. The proposed rule expands the approach
described in the ANPRM by making the exceptions applicable to all
subcategories of covered personal identifiers, instead of being
applicable only to listed identifiers in combination with any other
listed identifiers. The listed identifiers are described in more detail
in the next section.
---------------------------------------------------------------------------
\21\ E.O. 14117, 89 FR 15421,15428 (Feb 28, 2024).
\22\ 89 FR 15784-85.
---------------------------------------------------------------------------
With respect to the first subcategory, listed identifiers in
combination with any other listed identifier: The ANPRM contemplated a
list-based approach that would identify a comprehensive list of eight
classes of data determined by the Attorney General to be reasonably
linked to an individual under the Order's definition of ``covered
personal identifiers.'' \23\
---------------------------------------------------------------------------
\23\ Id.
---------------------------------------------------------------------------
With respect to the second subcategory, listed identifiers in
combination with other sensitive
[[Page 86123]]
personal data: The ANPRM contemplated treating these combinations as
combined data subject to the lowest bulk threshold applicable to the
categories of data present.\24\ The proposed rule generally adopts the
approach described in the ANPRM, but instead of addressing this
category in the definition of ``listed identifiers,'' the proposed rule
incorporates this category as part of the definition of ``bulk.''
---------------------------------------------------------------------------
\24\ Id. at 15785.
---------------------------------------------------------------------------
With respect to the third subcategory, listed identifiers in
combination with other data that are disclosed by a transacting party
pursuant to the transaction that makes the listed identifier
exploitable by a country of concern: The ANPRM indicated that the
Department did not intend to impose an obligation on transacting
parties to independently determine whether particular combinations of
data would be ``exploitable by a country of concern.'' \25\ The ANPRM
provided several examples intended to be within the scope of this
subcategory and several examples intended to be outside the scope of
this subcategory and sought comment on ways in which this subcategory
could be further defined.\26\ In response, multiple commenters
suggested anchoring this subcategory to the reasonable foreseeability
that the other data could be used to link the listed identifier to a
U.S. individual. As these commenters explained, without the connection
to foreseeability, nearly any public data could become covered personal
identifiers, because it is possible that the transacting party
receiving the data could find some way of linking any public data point
to an individual using the listed identifier.
---------------------------------------------------------------------------
\25\ Id.
\26\ Id.
---------------------------------------------------------------------------
The proposed rule largely adopts this suggestion. Rather than
requiring companies to determine when linkage is reasonably foreseeable
on a case-by-case basis, the proposed rule would define a category of
data for which the Department believes it is reasonably foreseeable
that the other data could be used to link the listed identifier to a
U.S. individual: other data that makes the listed identifier linked or
linkable to other listed identifiers or to other sensitive personal
data. The proposed rule thus narrows the third subcategory to any
listed identifier in combination with other data that is disclosed by a
transacting party such that the listed identifier is linked or linkable
to other listed identifiers or to other sensitive personal data. See
Sec. 202.212(a)(2). The proposed rule also incorporates the examples
described in the ANPRM and additional examples to illustrate how this
subcategory would and would not apply.
6. Section 202.234--Listed Identifier
Adopting the approach contemplated in the ANPRM,\27\ the proposed
rule defines a ``listed identifier'' as any piece of data in any of the
following data fields: (1) full or truncated government identification
or account number (such as a Social Security Number, driver's license
or State identification number, passport number, or Alien Registration
Number); (2) full financial account numbers or personal identification
numbers associated with a financial institution or financial-services
company; (3) device-based or hardware-based identifier (such as
International Mobile Equipment Identity (``IMEI''), Media Access
Control (``MAC'') address, or Subscriber Identity Module (``SIM'') card
number); (4) demographic or contact data (such as first and last name,
birth date, birthplace, ZIP code, residential street or postal address,
phone number, email address, or similar public account identifiers);
(5) advertising identifier (such as Google Advertising ID, Apple ID for
Advertisers, or other mobile advertising ID (``MAID'')); (6) account-
authentication data (such as account username, account password, or an
answer to a security question); (7) network-based identifier (such as
internet Protocol (``IP'') address or cookie data); or (8) call-detail
data (such as Customer Proprietary Network Information (``CPNI'')). See
Sec. 202.234.
---------------------------------------------------------------------------
\27\ Id. at 15784.
---------------------------------------------------------------------------
Under this definition, the term ``covered personal identifiers''
refers to a much narrower set of material than that covered by certain
laws and policies aimed generally at protecting personal privacy.\28\
It encompasses only the types of data and combinations thereof that are
expressly listed. For example, the proposed rule's definition of
``covered personal identifiers'' would not include an individual's
employment history, educational history, organizational memberships,
criminal history, or web-browsing history. Some commenters suggested
that the Department adopt a broader definition that aligns with the
definition of ``personally identifiable information'' used in State or
European Union (''EU'') privacy laws to ease the burden of compliance.
The Department declines to adopt this approach, and the proposed rule
retains the definition stated in the ANPRM without change. Although it
may be true that ``personally identifiable information'' is a familiar
term in laws and guidance addressing the privacy and security of data
held by the private sector and government, it is such a broad term that
adopting a definition akin to it would significantly expand the scope
of the regulations and therefore require that the Department regulate
more commercial transactions or relationships than seem necessary, at
least at this time, to mitigate the highest priority national security
risks articulated in the Order. Furthermore, the commenters supplied no
data to suggest that any cost savings realized from adopting an
existing definition would outweigh the added burdens of regulating a
larger swath of transactions.
---------------------------------------------------------------------------
\28\ C.f., e.g., California Consumer Privacy Act of 2018, Cal.
Civ. Code sec. 1798.140(v)(1) (West 2024) (defining ``personal
information'' in the context of a generalized privacy-focused
regime); Regulation (EU) 2016/679 of the European Parliament and of
the Council of Apr. 27, 2016, On the Protection of Natural Persons
with Regard to the Processing of Personal Data and on the Free
Movement of Such Data, and Repealing Directive 95/46/EC, art. 4(1)
(defining ``personal data'' in the context of a generalized data
privacy regime).
---------------------------------------------------------------------------
Similarly, another commenter suggested broadening the definition of
``covered personal identifiers'' to add categories of data from State
and EU privacy laws, such as web-browsing data and data that identifies
or could lead to inferences about membership in protected classes such
as race, religion, and national origin. The proposed rule makes no
change in response to this comment. As previewed in the ANPRM, the
proposed rule's definition of ``covered personal identifiers'' is
tailored to address the national security risks identified in the
Order, and the Department is establishing the program by issuing
proposed rulemakings in tranches based on priority. Also, the
Department intends to regularly monitor the effectiveness and impact of
the regulations once they become effective. Absent more specific
information from commenters on this topic about the cross-border use of
these additional kinds of identifiers by foreign governments in ways
that could harm Americans, the proposed rule retains the definition
stated in the ANPRM without change at this time.
One commenter suggested that the Department remove basic contact
information from the listed identifiers. The proposed rule maintains
the approach in the ANPRM without change.\29\ The Order already
contains an exception to the definition of ``covered personal
identifiers'' for demographic or contact data that is linked only to
other demographic or contact data. The proposed rule implements the
exception articulated in the Order and previewed
[[Page 86124]]
in the ANPRM, which excludes such data from the definition of ``covered
personal identifiers.'' \30\
---------------------------------------------------------------------------
\29\ 89 FR 15784.
\30\ Id.
---------------------------------------------------------------------------
By contrast, another commenter recommended that ``covered personal
identifiers'' be expanded to include demographic or contact data that
is linked only to other demographic or contact data, because most
Americans believe that information to be deserving of privacy
protections. The Department declines to adopt this addition to the
definition of ``covered personal identifiers.'' Such an expansion of
the definition would be contrary to the Order, which specifically
exempts this kind of data from its scope.\31\ Additionally, as the
commenter acknowledges, a significant amount of this information is
already publicly available to countries of concern, and therefore
country of concern access to this type of information does not carry
the same national security risk as access to the other covered personal
identifiers identified in these regulations, even if it may raise
separate privacy considerations.
---------------------------------------------------------------------------
\31\ 89 FR 15428.
---------------------------------------------------------------------------
A few commenters advocated removing truncated government
identification and account numbers from the definition of ``listed
identifiers,'' given their widescale use. One commenter supported the
inclusion of these truncated identifiers because they are regularly
used to identify individuals. The proposed rule continues to include
these truncated identifiers as contemplated in the ANPRM because, as
one commenter points out, they could be, and are, ``used to identify an
individual from a data set or link data across multiple data sets to an
individual[.]'' They therefore fall within the Order's definition of
``covered personal identifiers'' when they are combined with certain
other categories of data. Although these truncated numbers may be used
widely, the proposed rule would not regulate how they are used in most
transactions. Specifically, it would not regulate how these truncated
numbers are used domestically, a company's internal use of that data
(other than with respect to covered persons who are employees), or
transactions abroad involving third countries (other than with respect
to certain conditions for the data brokerage to address onward sale).
The proposed rule also contains a non-substantive change in
language designed to be more technically accurate and to clarify that
any piece of data in any of the listed classes of data constitutes a
listed identifier. See Sec. 202.234. This change remains consistent
with the examples previewed in the ANPRM and in the proposed rule
showing that multiple pieces of data (such as account username and
account password) in the same data field (account-authentication data)
each count as separate listed identifiers.\32\
---------------------------------------------------------------------------
\32\ 89 FR 15785.
---------------------------------------------------------------------------
7. Section 202.242--Precise Geolocation Data
The proposed rule defines ``precise geolocation data'' as data,
whether real-time or historical, that identifies the physical location
of an individual or a device with a precision of within 1,000 meters.
Examples of ``precise geolocation data'' include GPS coordinates and IP
address geolocation. To help develop this definition, the Department
examined the settings available to software developers in Android and
iOS, the two most popular mobile device operating systems, for the
precision of geolocation readings. Available options included accuracy
to within 10 meters, 100 meters, 1,000 meters, 3,000 meters, and
10,000+ meters.\33\ The Department selected 1,000 meters as the option
that most carefully balanced the risk that countries of concern or
covered persons could exploit U.S. persons' precise geolocation data
and current technology practices and standards. The Department also
considered State privacy laws, with which companies are already
familiar and which provide examples of the level of precision at which
a device's location warrants protection.\34\
---------------------------------------------------------------------------
\33\ CLLocationAccuracy, Apple Developer, https://developer.apple.com/documentation/corelocation/cllocationaccuracy
[https://perma.cc/AZ48-VSCP]; Change Location Settings, Android
Developer, https://developer.android.com/develop/sensors-and-location/location/change-location-settings [https://perma.cc/5BY3-P7L3].
\34\ See, e.g., Cal. Civ. Code sec. 1798.140(w) (which uses a
radius of 1,850 feet); Utah Consumer Privacy Act, Utah Code Ann.
sec. 13-61-101(33)(a) (West 2024) (which uses a radius of 1,750
feet).
---------------------------------------------------------------------------
A few commenters suggested that the Department define ``precise
geolocation data'' as that term is defined in the California Privacy
Rights Act, which includes a geographic radius of 1,850 feet
(approximately 563 meters). The Department did not accept this
suggestion because our assessment of the relevant national security
interests required a broader geographic area, in part due to the types
of United States Government personnel and locations (such as military
bases with large surrounding footprints) that are relevant to national
security. By contrast, the California standard does not take these
national security interests relating to Government personnel into
account. One commenter suggested that the Department omit the phrase
``based on electronic signals or inertial sensing units,'' which was
included in the ANPRM definition of ``precise geolocation data,'' to
make the term more technology-neutral as to the method of
collection.\35\ The Department has adopted this suggestion and deleted
that phrase from the proposed definition.
---------------------------------------------------------------------------
\35\ 89 FR 15785.
---------------------------------------------------------------------------
8. Section 202.204--Biometric Identifiers
Adopting the approach contemplated in the ANPRM without change, the
proposed rule defines ``biometric identifiers'' as measurable physical
characteristics or behaviors used to recognize or verify the identity
of an individual, including facial images, voice prints and patterns,
retina and iris scans, palm prints and fingerprints, gait, and keyboard
usage patterns that are enrolled in a biometric system and the
templates created by the system.
9. Section 202.224--Human Genomic Data
Adopting the approach contemplated in the ANPRM without change, the
proposed rule defines ``human genomic data'' as data representing the
nucleic acid sequences that constitute the entire set or a subset of
the genetic instructions found in a human cell, including the result or
results of an individual's ``genetic test'' (as defined in 42 U.S.C.
300gg-91(d)(17)) and any related human genetic sequencing data. The
term ``human genomic data'' does not include non-human data, such as
pathogen genetic sequence data, that is derived from or integrated into
human genomic data.
10. Other Human 'Omic Data
The Department of Justice is considering regulating, as prohibited
or restricted transactions in the final rule, certain transactions in
which a U.S. person provides a country of concern (or covered person)
with access to bulk human 'omic data, other than human genomic data, as
defined in Sec. 202.224. At a high level, the 'omics sciences examine
biological processes that contribute to the form and function of cells
and tissues.\36\ The categories of 'omic data that the Department is
considering regulating could include
[[Page 86125]]
human epigenomic data, glycomic data, lipidomic data, metabolomic data,
meta-multiomic data, microbiomic data, phenomic data, proteomic data,
and transcriptomic data. The Department does not intend the definition
of meta-multiomic data to include nonhuman data separated from human
data or for the definition of microbiomics data to include data related
to individual pathogens, even when derived from human sources. The
Department is considering whether to include the following definitions
of these terms in the final rule:
---------------------------------------------------------------------------
\36\ See, e.g., Evolution of Translational Omics: Lessons
Learned and the Path Forward 23, 33 (Christine M. Micheel et al.,
eds., 2012), https://www.ncbi.nlm.nih.gov/books/NBK202168/pdf/Bookshelf_NBK202168.pdf [https://perma.cc/Q5YE-7XLM].
---------------------------------------------------------------------------
1. Epigenomic data: data derived from the analysis of human
epigenetic modifications, which are changes in gene expression or
cellular phenotype that do not involve alterations to the DNA sequence
itself. These epigenetic modifications include modifications such as
DNA methylation, histone modifications, and non-coding RNA regulation.
2. Glycomic data: data derived from the analysis of the structure,
function, and interactions of glycans (complex carbohydrates) within
human biological systems. The field of glycomics generally aims to
understand the roles of glycans in cell-cell communication, immune
responses, and various diseases.
3. Lipidomic data: data derived from a systems-level
characterization of lipids from a human or human cell, including their
identification, quantification, and characterization in biological
systems. Routine clinical measurements of lipids for individualized
patient care purposes would not be considered lipidomic data because
such measurements would not entail a systems-level analysis of the
complete set of lipids found in such a sample.
4. Metabolomic data: data derived from the analysis of metabolites,
the small molecules produced during metabolism, that aim to understand
disease mechanisms, identify biomarkers for diagnosis, and develop
targeted treatments by revealing the dynamic biochemical activities in
a living system. This data provides a general snapshot of an organism,
tissue, or cell, offering insights into physiological and pathological
processes.
5. Meta-multiomic data: The Department is considering the following
options for defining meta-multiomic data:
(i) Datasets that include two or more categories of human 'omic
data identified in this regulation, which can include data derived from
the human genome, proteome, transcriptome, epigenome, or metabolome; or
(ii) Datasets that include two or more categories of human 'omic
data identified in this regulation and that include 'omic data from
another species.
6. Microbiomic data: data derived from analysis of all the
microorganisms of a given community within the human body (including a
particular site on the human body). Microbiomic data is implicated in
the field of metagenomics, which generally aims to investigate and
understand genetic material of entire communities of organisms,
including the composition of a microbial community.
7. Phenomic data: data derived from analysis of human phenotypes,
including physical traits, physiological parameters, and behavioral
characteristics.
8. Proteomic data: data derived from analysis of human proteomes,
which refers to the entire set of proteins expressed by a human genome,
cell, tissue, or organism. The field of proteomics generally aims to
identify and characterize proteins and study their structures,
functions, interactions, and post-translational modifications.
9. Transcriptomic data: data derived from analysis of a human
transcriptome, which is the complete set of RNA transcripts produced by
the human genome under specific conditions or in a specific cell type.
The field of transcriptomics generally aims to understand gene
expression patterns, alternative splicing, and regulation of RNA
molecules.
The Department is considering excluding from the definition of
other human 'omic data pathogen-specific data embedded in 'omic data
sets.
The Department welcomes input from commenters regarding the
potential risks and benefits that may arise from restricting or
prohibiting covered data transactions with a country of concern or
covered person involving some or all of these categories of other human
'omic data. The Department is particularly interested in comments
addressing the health, economic, or scientific impacts of regulating
such data transactions, as well as any national security implications.
Specifically:
In what ways, if any, should the Department of Justice
elaborate or amend the definitions of these classes of other human
'omic data? If the definitions should be elaborated or amended, why?
Should bulk data transactions involving these types of
other human 'omic data be regulated? If so, which types of human 'omic
data--including any not listed--should be regulated, why should they be
regulated, and how should they be regulated? Additionally, what bulk
thresholds should apply and why?
To what extent would the regulation of bulk data
transactions involving these types of other human 'omic data affect
individuals' rights to share their own biological samples (e.g., blood,
urine, tissue, etc.) or health, 'omic, and other data?
What would be the effects of prohibiting or restricting
transactions involving these data classes in the final rule,
particularly with respect to:
[cir] health outcomes
[cir] health supply chain impacts
[cir] research and administrative costs
[cir] economic costs due to (1) imposing these regulations, or (2)
allowing unregulated bulk access to human 'omic data
[cir] innovation costs
What additional risks should be considered if these bulk
data transactions are not regulated, specifically as they relate to:
[cir] risks stemming from exploitable health information
[cir] manipulation of bulk data for strategic advantage over the
United States
[cir] use of bulk datasets for the creation and refinement of AI or
other similar advanced technologies
11. Section 202.240--Personal Financial Data
Adopting the approach contemplated in the ANPRM without change, the
proposed rule defines ``personal financial data'' as data about an
individual's credit, charge, or debit card, or bank account, including
purchases and payment history; data, including assets liabilities,
debts, and transactions in a bank, credit, or other financial
statement; or data in a credit report or in a ``consumer report'' (as
defined in 15 U.S.C. 1681a(d)).
One commenter sought clarification that personal financial data
does not include inferences based on that data, suggesting, for
example, that hotel record transactions may be personal financial data
but an ultimate inference that the person is interested in business
travel should not be considered personal financial data. As set forth
in the Order and previewed in the ANPRM, the proposed rule would
prohibit or restrict only certain categories of transactions in
government-related data or bulk U.S. sensitive personal data, neither
of which include inferences on their own.\37\
---------------------------------------------------------------------------
\37\ 89 FR 15783; 89 FR 15428-29.
---------------------------------------------------------------------------
[[Page 86126]]
12. Section 202.241--Personal Health Data
The ANPRM contemplated defining ``personal health data'' as
``individually identifiable health information,'' as defined under the
Health Insurance Portability and Accountability Act of 1996
(``HIPAA''), ``regardless of whether such information is collected by a
`covered entity' or `business associate.' '' \38\
---------------------------------------------------------------------------
\38\ Id.; see 42 U.S.C. 1320d(6); 45 CFR 160, 103.
---------------------------------------------------------------------------
Several commenters supported defining personal health data as
``individually identifiable health information.'' That definition is
similar to how those terms are defined in HIPAA and its implementing
regulations. However, one commenter expressed confusion as to how
cross-referencing that definition in this program would relate to
``covered entities'' or ``business associates'' under HIPAA. The
proposed rule adopts much of the substance of the approach in the ANPRM
while providing greater clarity to address this confusion. Instead of
defining ``personal health information'' by cross referencing and
incorporating HIPAA, the proposed rule reproduces the relevant
substance of the HIPAA definition to provide greater clarity that the
definition does not turn on the HIPAA-specific inquiry of whether data
is handled by covered entities or business associates. Further, unlike
the HIPAA definition, the proposed rule would not define health
information in terms of whether the information identifies individuals,
because the proposed rule applies regardless of whether data is de-
identified.
As a result, the proposed rule defines ``personal health data'' as
health information that relates to the past, present, or future
physical or mental health or condition of an individual; the provision
of healthcare to an individual; or the past, present, or future payment
for the provision of healthcare to an individual. The term includes
basic physical measurements and health attributes (such as bodily
functions, height and weight, vital signs, symptoms, and allergies);
social, psychological, behavioral, and medical diagnostic,
intervention, and treatment history; test results; logs of exercise
habits; immunization data; data on reproductive and sexual health; and
data on the use or purchase of prescribed medications. The proposed
rule would operate on a categorical basis and would determine that the
category of personal health data generally meets the requirements of
being ``exploitable by a country of concern to harm United States
national security'' and ``is linked or linkable to any identifiable
United States individual or to a discrete and identifiable group of
United States individuals'' under section 7(l) of the Order. To be
sure, it is possible to hypothesize a limited data set of discrete
information related to an individual's physical or mental health
condition that is not inherently linked or linkable to U.S. individuals
(such as a data set of only heights or weights with no identifying
information). But based on the information currently available, it does
not appear that such limited datasets accurately reflect how personal
health data is stored, transmitted, and used in the real world, and
thus it does not appear appropriate to adjust the proposed rule to
account for this hypothetical at this time. The Department welcomes
comments on the extent to which such datasets exist and are the subject
of covered data transactions between U.S. persons and countries of
concern or covered persons.
13. Section 202.206--Bulk U.S. Sensitive Personal Data
Adopting the approach contemplated in the ANPRM without change, the
prohibitions and restrictions apply to ``bulk U.S. sensitive personal
data,'' which the proposed rule defines as a collection or set of
sensitive personal data relating to U.S. persons, in any format,
regardless of whether the data is anonymized, pseudonymized, de-
identified, or encrypted. The bulk thresholds of data set by the
proposed rule are addressed in detail in part V of this preamble.
Several commenters requested that the Department align the
categories of sensitive personal data with State data privacy laws,
particularly to exclude encrypted, pseudonymized, de-identified, or
aggregated data from the proposed rule's coverage. In contrast, other
commenters supported the Department's treatment of pseudonymized, de-
identified, or encrypted data, including to prevent the data from being
re-identified in the future and to recognize that not all techniques
for pseudonymization, de-identification, encryption, or aggregation are
equally effective. The Department declines to adjust the proposed rule
to exclude anonymized, encrypted, pseudonymized, or de-identified data,
and the proposed rule adopts the approach described in the ANPRM
without change. As the Order emphasizes, even where types of sensitive
personal data are ``anonymized, pseudonymized, or de-identified,
advances in technology, combined with access by countries of concern to
large datasets, increasingly enable countries of concern that access
this data to re-identify or de-anonymize data,'' which could reveal
exploitable sensitive personal information on U.S. persons.\39\ As the
Department has recently explained, ``[o]pen-source reporting has
repeatedly raised concern[s] that supposedly anonymized data is rarely,
if ever, truly anonymous.'' \40\ As a recent study has explained, for
example, ``[a]ggregated insights from location data'' could be used to
damage national security.\41\ Examples abound. Researchers in 2024 used
a little more than a year's worth of ``raw, `ping'-level data, a year's
worth of location data from de-identified smartphones in 26 major
metropolitan areas encompassing nearly every SEC office and most public
firm headquarters to identify non-public investigations and enforcement
actions, and glean insights about how those visits affected financial
markets.\42\ In 2018, the publication of a global heatmap of anonymized
users' location data collected by a popular fitness app enabled
researchers to quickly identify and map the locations of military and
government facilities and activities.\43\ Similarly, in 2019, New York
Times writers were able to combine a single set of bulk location data
collected from cell phones and bought and sold by location-data
companies--which was anonymized and represented ``just one slice of
data, sourced from one company, focused on one city, covering less than
one year''--with publicly available information to identify, track, and
follow ``military officials with security clearances as they drove home
at night,'' ``law enforcement officers as they took their kids to
school,'' and ``lawyers (and their guests) as they
[[Page 86127]]
traveled from private jets to vacation properties.'' \44\ A 2019
research study concluded that ``99.98% of Americans would be correctly
re-identified in any dataset using 15 demographic attributes,'' thus
``suggest[ing] that even heavily sampled anonymized datasets are
unlikely to satisfy the modern standards for anonymization set forth by
[the EU's General Data Protection Regime] and seriously challenge the
technical and legal adequacy of the de-identification release-and-
forget model.'' \45\ Other studies and reports have reported similar
results.\46\ As a result, as the Department recently explained,
``[a]dversaries can use these datasets to reverse-engineer anonymized
data and identify people, subjects, or devices that were supposedly
anonymized.'' \47\
---------------------------------------------------------------------------
\39\ 89 FR 15426; see also E.O. 14083, 87 FR 57369, 57372-73
(Sept. 15, 2022).
\40\ In Camera, Ex Parte Classified Decl. of David Newman,
Principal Deputy Assistant Att'y Gen., Nat'l Sec. Div., U.S. Dep't
of Just., Doc. No. 2066897 at Gov't App. 74-75 ]] 100-01, TikTok
Inc. v. Garland, Case Nos. 24-1113, 24-1130, 24-1183 (D.C. Cir. July
26, 2024) (publicly filed redacted version) (hereinafter ``Newman
Decl.'').
\41\ Sherman et al., supra note 6, at 15.
\42\ William C. Gerken et al., Watching the Watchdogs: Tracking
SEC Inquiries using Geolocation Data 2-4 (Aug. 30, 2024)
(unpublished manuscript), https://ssrn.com/abstract=4941708 [https://perma.cc/L7L9-WU3T].
\43\ E.g., Richard Perez-Pena & Matthew Rosenberg, Strava
Fitness App Can Reveal Military Sites, Analysts Say, N.Y. Times
(Jan. 29, 2018), https://www.nytimes.com/2018/01/29/world/middleeast/strava-heat-map.html [https://perma.cc/FT3A-W547]; Jeremy
Hsu, The Strava Heat Map and the End of Secrets, Wired (Jan. 29,
2018), https://www.wired.com/story/strava-heat-map-military-bases-fitness-trackers-privacy/ [https://perma.cc/6TWD-P76B].
\44\ Stuart A. Thompson & Charlie Warzel, Twelve Million Phones,
One Dataset, Zero Privacy, N.Y. Times (Dec. 19, 2019), https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html [https://perma.cc/X3VB-429P].
\45\ Luc Rocher et al., Estimating the Success of Re-
Identifications in Incomplete Datasets Using Generative Models, 10
Nature Commc'ns, at 1 (2019), https://www.nature.com/articles/s41467-019-10933-3.pdf [https://perma.cc/SYJ7-KA95]; see also Alex
Hern, `Anonymised' Data Can Never Be Totally Anonymous, Says Study,
The Guardian (Jul. 23, 2019), https://www.theguardian.com/technology/2019/jul/23/anonymised-data-never-be-anonymous-enough-study-finds [https://perma.cc/5BF8-745A].
\46\ See, e.g., Alex Hern, New York Taxi Details Can Be
Extracted From Anonymised Data, Researchers Say, The Guardian (June
27, 2014), https://www.theguardian.com/technology/2014/jun/27/new-york-taxi-details-anonymised-data-researchers-warn [https://perma.cc/6SYK-6ZEG] (reporting that a researcher ``discovered that
the anonymous data'' of taxi records ``was easy to restore to its
original, personally identifiable format,'' taking a ``matter of
only minutes to determine which [license] numbers were associated
with which pieces of anonymised data'' and only an hour to ``de-
anonymise the entire dataset,'' making it possible to ``figure out
which person drove each trip'' and to determine taxi drivers'
supposedly anonymous home addresses); Ryan Singel, Netflix Spilled
Your Brokeback Mountain Secret, Lawsuit Claims, Wired (Dec. 17,
2009), https://www.wired.com/2009/12/netflix-privacy-lawsuit/
[https://perma.cc/B96P-AY97] (reporting on researchers who de-
anonymized a Netflix dataset of movie ratings by using publicly
available information, which revealed ``political leanings and
sexual orientation'' in some cases, and reporters who ``quickly''
de-anonymized supposedly anonymous AOL search-engine logs ``to track
down real people'').
\47\ Newman Decl., supra note 40, at Gov't App. 33 ] 105.
---------------------------------------------------------------------------
Similar concerns exist with respect to encrypted data. Countries of
concern amass large quantities of encrypted data including by
harvesting encrypted data now in order to decrypt it in the future
should advances in quantum technologies render current standard public-
key cryptographic algorithms ineffective.\48\ Encryption keys can also
be stolen, handed over under compulsion, and otherwise obtained for use
in decrypting datasets.\49\
---------------------------------------------------------------------------
\48\ David Lague, U.S. and China Race to Shield Secrets from
Quantum Computers, Reuters (Dec. 14, 2023), https://www.reuters.com/investigates/special-report/us-china-tech-quantum/ [https://perma.cc/9HAA-46XA]; Nat'l Counterintel. & Sec. Ctr., Protecting
Critical and Emerging U.S. Technologies From Foreign Threats 5 (Oct.
2021), https://www.dni.gov/files/NCSC/documents/SafeguardingOurFuture/FINAL_NCSC_Emerging%20Technologies_Factsheet_10_22_2021.pdf [https://perma.cc/L6ZU-8HU7]; Nat'l Cybersec. Ctr. of Excellence, NIST SP
1800-38B, Migration to Post-Quantum Cryptography, at 1 (drft. Dec.
2023), https://www.nccoe.nist.gov/sites/default/files/2023-12/pqc-migration-nist-sp-1800-38b-preliminary-draft.pdf [https://perma.cc/FXF2-BJ62].
\49\ Can Encrypted Data be Hacked?, IT Foundations (Apr. 19,
2021), https://itfoundations.com/can-encrypted-data-be-hacked/
[https://perma.cc/E3TN-YAVV].
---------------------------------------------------------------------------
A few commenters suggested that the approach contemplated in the
ANPRM would weaken national security by failing to differentiate
between data that is encrypted or otherwise protected and data that is
not. In their view, encryption is an important tool to secure data from
unauthorized access, and treating encrypted and non-encrypted data
alike could discourage the use of encryption, weakening the overall
security of data. Other commenters, however, supported treating
pseudonymized, encrypted, de-identified, and aggregated data as
sensitive personal data because of the ability to re-identify such data
and the rapid advancements in re-identification techniques. The
Department declines to modify the proposed rule in response to these
comments. As contemplated in the ANPRM, the proposed rule explicitly
recognizes and relies upon the privacy and national security-preserving
value of high quality, effective methods of encryption, de-
identification, pseudonymization, and aggregation by specifically
authorizing certain otherwise prohibited transactions so long as they
meet the security requirements described in part IV.B.1 of this
preamble, including by using data-level control(s) such as these
techniques in combination with other security requirements. At the same
time, as contemplated in the ANPRM, the proposed rule also recognizes
that ineffective methods of encryption, de-identification,
pseudonymization, and aggregation present the same unacceptable
national security risk of access by countries of concern and covered
persons as the risks posed by such access to identifiable data that is
not secured through any of these techniques. The proposed rule thus
allows otherwise prohibited employment agreements, vendor agreements,
and investment agreements only if they use any combination of the data-
level requirements necessary to prevent access to covered data by
covered persons or countries of concern, as requirements laid out in
the security requirements to be published by the Department of Homeland
Security (``DHS''), in addition to organizational- and system-level
requirements.
Commenters also requested that the Department use existing State
privacy law definitions to define the categories of sensitive personal
data, such as personal financial data. Commenters stated that many
companies already know how to comply with State privacy laws. The
Department has considered these comments. However, as discussed in part
IV.A.6 of this preamble, the cited definitions do not necessarily align
with the specific national security goals of these regulations.
Therefore, the proposed rule adopts the approach described in the ANPRM
without change and does not adopt the State privacy law definitions of
the terms in the proposed rule.
14. Section 202.205--Bulk
As previewed in the ANPRM, the proposed rule's prohibitions apply
to bulk amounts of U.S. sensitive personal data (in addition to the
separate category of government-related data). The proposed rule
defines ``bulk'' as any amount of such data that meets or exceeds
thresholds during a given 12-month period, whether through one covered
data transaction or multiple covered data transactions involving the
same U.S. person and the same foreign person or covered person. The
proposed rule sets specific thresholds for each category of sensitive
personal data. See Sec. 202.205. Certain specified data transactions
that exceed those thresholds are ``covered data transactions'' and thus
subject to the proposed rule's prohibitions unless they are otherwise
authorized by the proposed rule. See Sec. 202.210. The Department has
determined the proposed bulk thresholds based on the analysis previewed
in the ANPRM and described in more detail in part V of this preamble.
A few commenters expressed concerns that it would be necessary to
decrypt data to determine whether it meets a relevant bulk threshold
and suggested discarding the bulk thresholds as a result. They noted
that decrypting data is generally less secure and could lead to
unauthorized access. The proposed rule makes no change in response to
these comments, for several reasons. First, many businesses engaging in
the categories of prohibited and restricted transactions generally use
[[Page 86128]]
the data in the course of operating their business, rather than merely
serving as a pass-through for encrypted data as the comments suggest.
While encrypting data in transit and data at rest is and should be a
standard security technique, and encrypting data in use is increasingly
common, data is routinely decrypted while it is being actively
accessed, processed, filtered, sorted, searched, analyzed, displayed,
and otherwise used by a business (for example, when an authorized
employee or user opens and searches an encrypted file or database).
However, nothing in the proposed rule imposes a legal requirement to
decrypt data to comply. Instead, the proposed rule requires only that
U.S. persons implement a risk-based compliance program tailored to
their individual risk profiles. And data may also be encrypted using
cryptographic methods that permit some computation and analysis to be
performed on cyphertext that ascertains the kinds and volume of data
without decrypting the data.\50\ Businesses can map the kinds and
volumes of their data to evaluate it against the bulk thresholds in the
data life cycle in which it is either decrypted for access or encrypted
in use.
---------------------------------------------------------------------------
\50\ Abbas Acar et al., A Survey on Homomorphic Encryption
Schemes: Theory and Implementation, 51 [No. 4] ACM Computing Survs.
79:1, 79:2 (2018), https://dl.acm.org/doi/pdf/10.1145/3214303
[https://perma.cc/AM69-7ZWV]. In addition, to the extent that
businesses use emerging techniques (such as homomorphic encryption)
that permit computations to be performed on encrypted data without
first decrypting it, these techniques may enable businesses to map
their data even if it remains encrypted.
---------------------------------------------------------------------------
Second, even beyond mapping data in use, companies choosing to
engage in these categories of data transactions can and should have
some awareness of the volume of data they possess and in which they are
transacting. For example, typically data-using entities maintain
metrics, such as user statistics, that can help estimate the number of
impacted individuals for the purposes of identifying whether a
particular transaction meets the bulk threshold.\51\ Given that the
bulk thresholds are built around order-of-magnitude evaluations of the
quantity of user data, it is reasonable for entities to conduct similar
order-of-magnitude-based assessments of their data stores and
transactions for the purposes of regulatory compliance. Companies
already must understand, categorize, and map the volumes of data they
have for other regulatory requirements, such as State laws requiring
notification of data breaches of specific kinds of data above certain
thresholds.\52\
---------------------------------------------------------------------------
\51\ Justin Ellingwood, User Data Collection: Balancing Business
Needs and User Privacy, DigitalOcean (Sept. 26, 2017), https://www.digitalocean.com/community/tutorials/user-data-collection-balancing-business-needs-and-user-privacy [https://perma.cc/GCX5-RGSK]; Jodie Siganto, Data Tagging: Best Practices, Security &
Implementation Tips, Privacy108 (Nov. 14, 2023), https://privacy108.com.au/insights/data-tagging-for-security/ [https://perma.cc/8PQA-89DA]; National Institutes of Health, Metrics for Data
Repositories and Knowledgebases: Working Group Report 7, (Sept. 15,
2021), https://datascience.nih.gov/sites/default/files/Metrics-Report-2021-Sep15-508.pdf [https://perma.cc/8KBQ-HWRK].
\52\ See, e.g., Del. Code. Ann. tit. 6, sec. 12B--100 to--104
(West 2024); N.M. Stat. Ann. sec. 57-12C-10 (LexisNexis 2024).
---------------------------------------------------------------------------
Third, this concern appears premised on a scenario in which a U.S.
business handles only encrypted data on which no computational
functions can be performed to determine the kinds and volume of data,
never accesses the decrypted data in its business, does not have other
proxies or metrics to determine the kinds and volumes of data in which
it is transacting, and must comply with the prohibitions and
restrictions in the proposed rule. This scenario appears to be an edge
case at best, and the comments do not provide a real-world example of
this scenario or its frequency. Indeed, as discussed in some of the
examples contained in the proposed rule, if a U.S. entity merely
provides a platform for, or transports data between, a U.S. customer
and a covered person or country of concern, and thus does not know or
reasonably should not know of the kind or volume of data involved, then
it generally would not ``knowingly'' engage in a prohibited transaction
if the U.S. customer uses that platform or infrastructure to engage in
a prohibited transaction with a covered person. Instead, the U.S.
customer would generally be responsible for having ``knowingly''
engaged in the prohibited transaction, as illustrated in the
clarification of the ``knowingly'' standard and the new examples
incorporated into the proposed rule. See Sec. 202.230. Similarly, if a
U.S. entity merely stores encrypted data on behalf of a U.S. customer
and does not possess the encryption key, and if the U.S. entity does
not know or reasonably should not know the kind or volume of data
involved, the U.S. entity generally would not meet the ``knowingly''
standard of the proposed rule.
Fourth, to the extent that there is a U.S. business that handles
only encrypted data on which no computational functions can be
performed to determine the kinds and volume of data, never accesses the
decrypted data in its business, does not have other proxies or metrics
to determine the kinds and volumes of data it is transacting, and is
subject to the prohibitions and restrictions in the proposed rule, that
U.S. business would have choices under the proposed rule. It would be
able to engage with the Department and seek an advisory opinion or a
specific license tailored to its business. Similarly, it would have
choices about how best to comply as part of its individualized, risk-
based compliance program. For example, it can choose not to engage in
prohibited or restricted transactions with countries of concern or
covered persons as part of its individualized risk-based compliance
program. If the U.S. business chooses to engage in categories of
transactions potentially subject to the proposed rule, it can conduct
reasonable due diligence on the source of its encrypted data (such as
engaging with and obtaining contractual commitments from its customers)
to determine the volume and kinds of data in which it is transacting.
Or, if it chooses to engage in restricted transactions with countries
of concern or covered persons, it can assume that its transactions
involve bulk volumes of sensitive personal data and comply with the
security requirements and other applicable conditions out of an
abundance of caution.
Even if this hypothetical U.S. business were to choose to engage in
categories of transactions potentially subject to the proposed rule,
and it voluntarily decided to briefly decrypt the data to determine the
kinds and volume of its data as part of its risk-based compliance
program, commentors have not provided evidence that such a brief
decryption would meaningfully increase the risks of unauthorized access
relative to the risks involved in routine decryption for business use.
Encryption is one security tool designed to mitigate the risk of
unauthorized access to data.\53\ Entities should use encryption as a
tool whenever possible, including when data is at rest, in transit, and
in use. However, using encryption does not eliminate risk or the
requirement to perform appropriate due diligence. If an entity is using
data at any point or has access to both encrypted data and the
encryption key, that entity has full se into and control over the data
on its systems for the
[[Page 86129]]
purposes of this regulation.\54\ Entities are responsible for balancing
risks within their systems, with encryption serving as one available
tool for achieving risk management goals alongside other tools like
data governance and data minimization plans, role-based and least-
privilege access controls, and identity management through multifactor
authentication.\55\
---------------------------------------------------------------------------
\53\ What Is Encryption?, Cloudflare, https://www.cloudflare.com/learning/ssl/what-is-encryption/ [https://perma.cc/T3KT-BURX]; Cybersec. & Infrastructure Sec. Agency, Zero
Trust Maturity Model 5, 27 (v. 2.0 Apr. 2023), https://www.cisa.gov/sites/default/files/2023-04/zero_trust_maturity_model_v2_508.pdf
[https://perma.cc/F9LB-JVL9].
\54\ Clare Stouffer, What Is Encryption? How It Works + Types of
Encryption, Norton: Blog (July 18, 2023), https://us.norton.com/blog/privacy/what-is-encryption [https://perma.cc/RC3D-NS95].
\55\ Nat'l Sec. Agency & Cybersec. & Infrastructure Sec. Agency,
Recommended Best Practices for Administrators: Identity and Access
Management (n.d.), https://media.defense.gov/2023/Mar/21/2003183448/-1/-1/0/ESF%20identity%20and%20access%20management%20recommended%20best%20practices%20for%20administrators%20pp-23-0248_508c.pdf [https://perma.cc/B7VP-4RWF]; Mohammed Khan, Data Minimization--A Practical
Approach, ISACA (Mar. 29, 2021), https://www.isaca.org/resources/news-and-trends/industry-news/2021/data-minimization-a-practical-approach [https://perma.cc/8APH-5E5A]; Cybersec. & Infrastructure
Sec. Agency, Protecting Sensitive and Personal Information From
Ransomware-Caused Data Breaches (n.d.), https://www.cisa.gov/sites/default/files/publications/CISA_Fact_Sheet-Protecting_Sensitive_and_Personal_Information_from_Ransomware-Caused_Data_Breaches-508C.pdf [https://perma.cc/Q7TN-NLR4].
---------------------------------------------------------------------------
It is the responsibility of the regulated entity to manage risk
that already exists, which includes making choices about the best way
to manage its own particular risk and tradeoffs between various data
risk management strategies, including technical measures like
encryption, organizational policies, and access management. Other
options include altering commercial activities to minimize the size and
scope of covered data transactions and utilizing a strong data
governance regime to minimize the type and quantity of data collected.
If data cannot remain encrypted while in use, the risk of temporarily
decrypting data to comply with regulations can be offset by measures
such as well-designed data collection, data management, and data
security programs. Given these factors, any risk associated with a
hypothetical U.S. business' decision to temporarily decrypt data that
would otherwise remain encrypted at all times in the business' life
cycle would appear to be much more remote and attenuated than the risk
that accrues by allowing the U.S. business to engage in a transaction
that grants a country of concern or covered person access to encrypted
government-related data or bulk U.S. sensitive personal data.
15. Section 202.222--Government-Related Data
As set forth in Sec. 202.222, the proposed rule would not impose
any bulk threshold requirements on transactions involving government-
related data. The proposed rule defines subcategories of government-
related data for locations and personnel, as contemplated in the ANPRM.
For the location subcategory, the proposed rule defines ``government-
related data'' as any precise geolocation data, regardless of volume,
for any location within any area enumerated on the Government-Related
Location Data List in Sec. 202.1401 that the Attorney General has
determined poses a heightened risk of being exploited by a country of
concern to reveal insights to the detriment of national security about
locations controlled by the Federal Government, including insights
about facilities, activities, or populations in those locations,
because of the nature of those locations or the personnel who work
there. The purpose of this list is to prevent countries of concern from
exploiting the geolocation data in these locations, such as by using
aggregated geolocation data to draw inferences about facilities,
activities, or populations located there that could undermine U.S.
national security or foreign policy or to conduct intelligence or
counterintelligence operations against government employees or
contractors, or against government facilities, as discussed in parts
II, IV(D) and V(A) of this preamble. As set forth in the proposed rule,
the locations that the Department might add to this list may include
the worksites or duty stations of Federal Government employees or
contractors who occupy national security positions, as that term is
defined in 5 CFR 1400.102(a), wherever they are located. The locations
may also include military installations, embassies or consulates, or
other facilities worldwide that support the Federal Government in
achieving its national security, defense, intelligence, law
enforcement, or foreign policy missions. The proposed rule thus
modifies the definition contemplated in the ANPRM by setting forth more
details about the types of locations that will be listed on the
Government-Related Location Data List.\56\
---------------------------------------------------------------------------
\56\ 89 FR 15787.
---------------------------------------------------------------------------
The proposed rule also proposes a format for the Government-Related
Location Data List and proposes some areas for inclusion on that List.
See Sec. 202.1401. This is not yet a comprehensive list of locations.
The Department anticipates that the final rule will include additional
locations associated with military, other Government, or other
sensitive facilities or locations that meet the criteria in the
definition. These locations may include, for example, military bases,
embassies, or law enforcement facilities.
For the personnel subcategory, the proposed rule adopts the ANPRM's
contemplated definition without change by defining ``government-related
data'' as any sensitive personal data, regardless of volume, that a
transacting party markets as linked or linkable to current or recent
former employees or contractors, or former senior officials, of the
United States Government, including the military and intelligence
community.\57\
---------------------------------------------------------------------------
\57\ Id.
---------------------------------------------------------------------------
Commenters were generally supportive of the proposed rule's
protections for government-related data. A few commenters requested
that the proposed rule provide clarity as to what constitutes a
``former senior official'' and a ``recent former employee.'' The
proposed rule defines ``recent former employees or contractors'' as
employees or contractors who have worked for or provided services to
the United States Government, in a paid or unpaid status, within the 2
years preceding a proposed covered data transaction. See Sec. 202.245.
The proposed rule defines a ``former senior official'' as either a
``former senior employee'' or ``former very senior employee,'' as those
terms are defined in the ethics regulations pertaining to post-
employment conflicts of interest for former Executive Branch or
independent agency employees. 5 CFR 2641.104. See Sec. 202.220.
One commenter expressed concern that, with respect to the personnel
subcategory, companies will have to ask individuals whether they are
former government employees when collecting their data and retain that
information to ensure they can comply with the regulations. The
commenter argued that this could have the unintended consequence of
inadvertently creating a database of sensitive information that bad
actors could target. While the Department appreciates that concern and
agrees that this unintended consequence should be avoided, the
Department has designed the proposed rule to specifically avoid this
problem by defining the personnel subcategory based on how the U.S.
person markets the data, not on whether a particular dataset contains
data on former government employees or contractors. In other words, the
personnel subcategory applies only to transactions in which the U.S.
person has already identified and described sensitive personal data as
being about certain government personnel. This subcategory does not
apply on the basis of the presence or absence of data linked to
[[Page 86130]]
certain government personnel in the underlying sensitive personal data.
One commenter suggested removing the qualifier that data had to be
``marketed'' as data about members of the military or intelligence
community because certain data can still be ``linked or linkable'' to
members of the military through geolocation without being explicitly
marketed as such. As the Order's second category of government-related
data confirms, sensitive personal data that is linked to categories of
data that could be used to identify current or certain former
government personnel can present a national security risk, even if a
transacting party does not market it as linked or linkable to those
personnel.\58\ The Department is still considering how to address this
issue, specifically whether to include, and how to define, this
category of information in the proposed rule while minimizing the
unintended consequence described above in this section. The Department
appreciates any views from the public.
---------------------------------------------------------------------------
\58\ 89 FR 15429.
---------------------------------------------------------------------------
16. Section 202.302--Other Prohibited Data-Brokerage Transactions
Involving Potential Onward Transfer to Countries of Concern or Covered
Persons
As previewed in the ANPRM, the proposed rule also includes a
prohibition specific to data brokerage to address transactions
involving the onward transfer or resale of government-related data or
bulk U.S. sensitive personal data to countries of concern and covered
persons.\59\ See Sec. 202.302. The proposed rule defines ``data
brokerage'' as the sale of data, licensing of access to data, or
similar commercial transactions involving the transfer of data from any
person (``the provider'') to any other person (``the recipient''),
where the recipient did not collect or process the data directly from
the individuals linked or linkable to the collected or processed data.
See Sec. 202.214. The proposed rule prohibits any U.S. person from
knowingly engaging in a covered data transaction involving data
brokerage with any foreign person that is not a covered person unless
the U.S. person contractually requires that the foreign person refrain
from engaging in a subsequent covered data transaction involving that
data with a country of concern or covered person. This narrow
circumstance is the only instance in which the proposed rule's
regulation of covered data transactions could impact transactions
involving third countries (i.e., U.S. persons' covered data
transactions in which a country of concern or covered person is not a
party).
---------------------------------------------------------------------------
\59\ 89 FR 15792.
---------------------------------------------------------------------------
Commenters generally supported the feasibility of using contractual
requirements to address the resale of data as contemplated in the
ANPRM. They noted, however, that it may be difficult for U.S. persons
to enforce those requirements or to ensure that the data is not
subsequently resold in violation of those provisions. Several aspects
of the proposed rule are designed to address these concerns. First, in
addition to requiring a contractual commitment from the foreign person
not to engage in a subsequent covered data transaction with a country
of concern or covered person, as contemplated in the ANPRM, the
proposed rule adds a requirement for U.S. persons engaged in such
transactions to report any known or suspected violations of the
required contractual provision. This requirement creates a mechanism to
provide the necessary information for the Department to investigate and
take appropriate action to address any violations of the proposed rule.
Second, relying on both its own investigations and its investigations
of any known or suspected violations reported by private parties, the
Department intends to exercise the designation authority under the
proposed rule to designate as covered persons, as appropriate, foreign
third parties that violate the contractual provisions required by this
prohibition. See Sec. 202.701. Third, consistent with the overall
approach to compliance and enforcement under the proposed rule, the
Department expects U.S. persons engaged in these kinds of data
brokerage transactions to take reasonable steps to evaluate whether
their foreign counterparties are complying with the contractual
provision as part of implementing risk-based compliance programs under
the proposed rule. Absent indications of evasion, conspiracy, or
knowingly directing prohibited transactions, U.S. persons that conduct
adequate due diligence as part of a risk-based compliance program would
not have engaged in a prohibited transaction if the foreign
counterparty later violates the required contractual provision or if
the U.S. person fails to detect such violations. Depending on the
circumstances, a U.S. person's failure to conduct adequate due
diligence may subject the U.S. person to enforcement actions if that
failure would constitute an evasion of the regulations, such as
repeatedly knowing of violations by a foreign person and continuing to
engage in data-brokerage transactions with that foreign person. The
Department welcomes public input on any additional measures that should
be considered as part of the final rule. In addition, after the final
rule goes into effect, the Department intends to monitor the
effectiveness of the measures to address the risk of onward sale and
make any appropriate adjustments.
Although not specifically raised by commenters, the Department is
considering the specific language used to describe the contractual
requirement. As previewed in the ANPRM,\60\ the proposed rule frames
the contractual requirement as an obligation to provide that the
foreign party ``refrain from engaging in a subsequent covered data
transaction involving the same data with a country of concern or
covered person.'' See Sec. 202.302(a)(1). The Department invites
public comment on this language, including whether any alternative
language (such as inserting ``knowingly'' before ``refrain'' or
``contractually requires that the foreign person use best efforts not
to engage'') would be more appropriate.
---------------------------------------------------------------------------
\60\ Id.
---------------------------------------------------------------------------
Commenters expressed varying views about the contemplated
definition of ``data brokerage.'' Several commenters expressed concerns
about the breadth of the definition of ``data brokerage'' in the
ANPRM.\61\ Some commenters suggested that the proposed term, and in
particular the phrase ``or similar commercial transactions,'' creates
uncertainty as to its scope and fails to distinguish between selling
data for monetary purposes and transferring data pursuant to normal
business operations. Some commenters urged the Department to limit the
scope of the proposed rule to ``data brokers'' by adopting the
definition used in existing State privacy laws, such as
California's.\62\ Others proposed ways that the Department should
narrow the definition, including by requiring that the data be sold in
exchange for monetary or other valuable consideration; that the data
must be the object of the transaction and not shared incident to the
development, testing, or sale of a product or service; or that the data
must be knowingly transferred or sold. Other commenters suggested that
the Department amend the definition of ``sale'' to exclude the
disclosure of sensitive personal data to service providers processing
data on behalf of a U.S. company, to third parties for providing
products or services requested by a U.S. company, or for
[[Page 86131]]
disclosures or transfers to subsidiaries or affiliates of U.S.
companies. Still other commenters supported the approach contemplated
by the ANPRM for defining data brokerage by reference to transactions,
not the identities of the parties, noting that the ANPRM's approach is
stronger than existing State privacy laws, and encouraged the adoption
of a broad definition.
---------------------------------------------------------------------------
\61\ See 89 FR 15788.
\62\ See Cal. Civ. Code 1798.99.80 (West 2024).
---------------------------------------------------------------------------
The Department declines to revise the definition of ``data
brokerage'' in response to these comments. The definition of ``data
brokerage'' in the proposed rule is intentionally designed to address
the activity of data brokerage that gives rise to the national security
risk, regardless of the kind of entity that engages in it. Both first-
party data brokerage (i.e., by the person that directly collected the
U.S. person's data) and third-party data brokerage (i.e., by a person
that did not directly collect the U.S. person's data, such as a
subsequent reseller) present similar national security risks: the
outright sale and transfer of sensitive personal data to a country of
concern or covered person. For this reason, the proposed definition
intentionally regulates data transactions, including transactions that
transfer data to entities in countries of concern for product
development, an issue raised by numerous commenters, because those
transactions give rise to the risks discussed in the Order. In
addition, commenters did not provide any specific evidence that the
proposed definition of data brokerage would have any measurable
economic impact related to product development or testing.\63\
Consequently, the proposed rule maintains the approach described in the
ANPRM without change.
---------------------------------------------------------------------------
\63\ See infra note 418 and accompanying text.
---------------------------------------------------------------------------
A few commenters expressed concern about how this provision might
affect the ability of biomedical and pharmaceutical manufacturers to
share clinical trial data with drug and device regulators in countries
of concern. Relatedly, a few commenters expressed concerns that the
proposed rule's inclusion of aggregated and anonymized data would
prohibit companies from using clinical trial data to launch clinical
trials in countries of concern or sharing safety and efficacy data
obtained from clinical trials in the United States with countries of
concern. The proposed rule includes two exemptions responsive to these
comments, in sections 202.510 and 202.511. These exemptions allow
certain transactions relevant to medical research, marketing, and
safety, as explained in more detail below.
17. Section 202.303--Prohibited Human Genomic Data and Human
Biospecimen Transactions
As previewed in the ANPRM, the proposed rule includes a prohibition
to specifically address the risks posed by covered data transactions
involving access by countries of concern to U.S. persons' bulk human
genomic data and human biospecimens from which that bulk data can be
derived, such as covered data transactions that give access to bulk
human genomic data to laboratories owned or operated by covered persons
or provide them with human biospecimens from which such data can be
derived. The proposed rule prohibits any U.S. person from knowingly
engaging in any covered data transaction involving human genomic data
that provides a country of concern or covered person with access to
bulk U.S. sensitive personal data that consists of human genomic data
or human biospecimens from which such data could be derived, where the
number of U.S. persons in the dataset is greater than the applicable
bulk threshold at any point in the preceding 12 months, whether in a
single covered data transaction or aggregated across covered data
transactions. This prohibition applies to any of the categories of
covered data transactions that involve access to bulk human genomic
data or human biospecimens from which bulk human genomic data can be
derived, even when the transactions involve an employment, investment,
or vendor agreement. In other words, transactions falling within the
scope of proposed Sec. 202.303 are never treated as restricted
transactions under the proposed rule. Relatedly, and as discussed in
more detail with respect to the categories of exempt transactions, the
proposed rule exempts (1) transactions for the conduct of the official
business of the United States Government by employees, grantees, or
contractors thereof, or transactions conducted pursuant to a grant,
contract, or other agreement entered into with the United States
Government, including those for outbreak and pandemic prevention,
preparedness, and response; and (2) data transactions, including the
sharing of human biospecimens from which human genomic data may be
derived, that are required or authorized by certain specified
international arrangements addressing global and pandemic preparedness.
One commenter sought clarification that vendor, employment, and
investment agreements involving access to bulk human genomic data, or
human biospecimens from which such data could be derived, are
prohibited transactions under subpart C of the proposed rule rather
than restricted transactions under subpart D of the proposed rule. The
commenter suggested that the proposed rule should clarify that such
vendor, employment, and investment agreements are prohibited because
they present the same policy concerns as other categories of
transactions involving access to this kind of data. The Department
agrees. As shown by Example 49 in the ANPRM, vendor, employment, and
investment agreements involving access to this kind of sensitive
personal data are prohibited rather than restricted.\64\ For the
avoidance of doubt, Sec. 202.303 of the proposed rule clarifies that
the authorization for restricted transactions, see Sec. Sec. 202.401-
202.402, does not apply to any transactions involving access to bulk
human genomic data or bulk human biospecimens.
---------------------------------------------------------------------------
\64\ 89 FR 15794.
---------------------------------------------------------------------------
18. Section 202.304--Prohibited Evasions, Attempts, Causing Violations,
and Conspiracies
Adopting the approach contemplated in the ANPRM without change, the
proposed rule prohibits any transactions that have the purpose of
evading or avoiding the proposed rule's prohibitions, or that cause a
violation of or attempt to violate the proposed rule's prohibitions.
The proposed rule also prohibits conspiracies formed to violate the
proposed rule's prohibitions.
One commenter suggested expanding the scope of the regulations to
prohibit transactions involving algorithms or artificial intelligence
models that are trained and developed using bulk U.S. sensitive
personal data in certain circumstances. The commenter described a
scenario in which the transfer of such an algorithm or model provides a
means to evade the prohibitions--for example, where a transaction gives
a country of concern or covered person access to the model, and the
model makes the underlying bulk U.S. sensitive personal data on which
it was trained available to that country of concern or covered person.
According to the commenter, this access could occur by querying the
model in such a way that results in it sharing all of or a highly
relevant component of the underlying data on which it was trained, such
as a query that resulted in identification of people with a particular
medical condition.\65\ Apart
[[Page 86132]]
from concerns over access to the underlying data, a model could also
provide insights into counter-intelligence targeting that would not
otherwise be observable from the underlying sensitive personal data.
The Department shares these concerns. In response to the comment, the
proposed rule includes Examples 5 and 6 in Sec. 202.304(b)
highlighting how these regulations would apply in certain scenarios
where bulk U.S. sensitive personal data would be licensed or sold to
support algorithmic development, including cases of evasion, or where
sensitive personal data could be extracted from artificial intelligence
models. The Department will continue to evaluate the national-security
risks in this emerging area as it considers the effectiveness of this
regulation. To the extent that there are broader concerns about
national-security risks from the export of artificial intelligence
models or algorithms regardless of the access they provide to sensitive
personal data (such as their ability to provide insights that would not
otherwise be observable from the data on which they are trained), the
Department believes that other authorities, such as export controls and
Executive Order 13859 of February 11, 2019 (Maintaining American
Leadership in Artificial Intelligence),\66\ are more appropriate in the
first instance to address those concerns.
---------------------------------------------------------------------------
\65\ Tim Johansson & Balder Janryd, Preventing Health Data from
Leaking in a Machine Learning System 4-6 (2024) (First Cycle 15
credits, KTH Royal Institute of Technology), https://kth.diva-portal.org/smash/get/diva2:1865596/FULLTEXT01.pdf [https://perma.cc/S5S8-M3DJ]; see, e.g., Anuj Mudaliar, ChatGPT Leaks Sensitive User
Data, OpenAI Suspects Hack, Spiceworks (Feb. 1, 2024), https://www.spiceworks.com/tech/artificial-intelligence/news/chatgpt-leaks-sensitive-user-data-openai-suspects-hack/ [https://perma.cc/AS5E-FATZ].
\66\ E.O. 13859, 84 FR 3967 (Feb. 11, 2019).
---------------------------------------------------------------------------
19. Section 202.305--Knowingly Directing Prohibited Transactions
Adopting the approach contemplated in the ANPRM without change, the
proposed rule prohibits U.S. persons from knowingly directing any
covered data transaction that would be a prohibited transaction
(including restricted transactions that do not comply with the security
requirements) if engaged in by a U.S. person.
20. Section 202.215--Directing
Adopting the approach contemplated in the ANPRM without change, the
proposed rule defines ``directing'' to mean that the U.S. person has
any authority (individually or as part of a group) to make decisions on
behalf of a foreign entity and exercises that authority. For example, a
U.S. person would direct a transaction by exercising their authority to
order, decide to engage, or approve a transaction that would be
prohibited under these regulations if engaged in by a U.S. person.
21. Section 202.230--Knowingly
Adopting the approach contemplated in the ANPRM without change, the
proposed rule defines ``knowingly'' to mean, with respect to conduct, a
circumstance, or a result, that the U.S. person had actual knowledge
of, or reasonably should have known about, the conduct, circumstance,
or result. To determine what an individual or entity reasonably should
have known in the context of prohibited transactions, the Department
will take into account the relevant facts and circumstances, including
the relative sophistication of the individual or entity at issue, the
scale and sensitivity of the data involved, and the extent to which the
parties to the transaction at issue appear to have been aware of and
sought to evade the application of these proposed rules. As a result of
the knowledge standard, the regulations incorporating the word
``knowingly'' do not adopt a strict liability standard.
The ``knowingly'' language is also not intended to require U.S.
persons, in engaging in vendor agreements and other classes of data
transactions with foreign persons, to conduct due diligence on the
employment practices of those foreign persons to determine whether the
foreign persons' employees qualify as covered persons. For instance, as
illustrated by Examples 37 and 38 in the ANPRM, which are incorporated
into the proposed rule, it would not be a prohibited transaction for a
U.S. person to enter into a vendor agreement to have bulk U.S.
sensitive personal data processed or stored by a foreign person that is
not a covered person, even if that foreign person then employs covered
persons and grants them access to the data (absent any indication of
evasion or knowing direction).\67\ In those circumstances, the U.S.
person would not be expected to conduct due diligence on the foreign
person's employment practices as part of its risk-based compliance
program.
---------------------------------------------------------------------------
\67\ 89 FR 15792.
---------------------------------------------------------------------------
Several commenters sought clarity about liability where service
providers have little or no knowledge of the data that customers keep
or transact on their infrastructure. They also requested that the
Department distinguish between data controllers and data processers. In
response to these comments, the proposed rule has provided additional
examples to clarify the function of the ``knowingly'' standard. See
Sec. 202.230(b)(2)-(6). As the examples demonstrate, if a U.S. entity
merely provides a software platform or owns or operates infrastructure
for a U.S. customer, and thus does not know or reasonably should not
know of the kind or volume of data involved, then the U.S. entity
generally would not ``knowingly'' engage in a prohibited transaction if
the U.S. customer uses their platform or infrastructure to engage in a
prohibited transaction. Instead, the U.S. customer would generally be
responsible for having ``knowingly'' engaged in the prohibited
transaction. Likewise, if a U.S. entity merely stores encrypted data on
behalf of a U.S. customer and does not have access to the encryption
key (or has access only to an emergency backup encryption key usable
only at the customer's explicit request), and if the U.S. entity is
reasonably unaware of the kind or volume of data involved, the U.S.
entity generally would not meet the ``knowingly'' standard of the
proposed rule.
The Department declines, however, to draw a categorical distinction
between processors and controllers in the proposed rule. Inserting a
categorical distinction based on the kind of entity would be
inconsistent with the structure and overall approach of the proposed
rule, which addresses activities that present an unacceptable national
security risk. In addition, as the new examples illustrate, the same
kinds of entities can engage in different kinds of activities, some of
which (such as merely providing a software platform) raise different
risks than others (such as providing a software platform and services
to handle and process the data). The ``knowingly'' standard provides
the requisite flexibility to address the national security risks while
providing a basis to distinguish responsibility based on the activities
and roles that particular entities may have. The proposed rule thus
adopts the approach described in the ANPRM with the additional examples
described above in this section to illustrate the ``knowingly''
standard.
Similarly, one comment sought clarification that the proposed rule
would apply only to U.S. persons that have or maintain control over the
bulk U.S. sensitive personal data involved in a prohibited or
restricted transaction. As the commenter explained, an automobile
manufacturer should not have compliance obligations with respect to
bulk U.S. sensitive personal data that is transferred via an
aftermarket device that was installed in a vehicle fleet by the owner.
As
[[Page 86133]]
previewed in the ANPRM, the proposed rule imposes prohibitions and
restrictions only on U.S. persons that are engaged in covered data
transactions that meet certain criteria. In the commenter's example,
the U.S. automobile manufacturer has not engaged in a covered data
transaction with respect to the aftermarket device. As a result, no
change was made to the proposed rule in response to this comment.
B. Subpart D--Restricted Transactions
1. Section 202.401--Authorization To Conduct Restricted Transactions;
Section 202.402--Incorporation by Reference
The proposed rule sets forth three classes of transactions (vendor
agreements, employment agreements, and investment agreements) that are
prohibited unless the U.S. person entering into the transactions
complies with the ``security requirements'' referenced in section
202.248. The goal of the proposed security requirements is to address
national security and foreign-policy threats that arise when countries
of concern and covered persons access government-related data or bulk
U.S. sensitive personal data that may be implicated by the categories
of restricted transactions. The security requirements have been
developed and proposed by the Cybersecurity and Infrastructure Security
Agency (``CISA'') in coordination with the Department. CISA has
published the proposed requirements--the CISA Proposed Security
Requirements for Restricted Transactions--on its website, as announced
via a Federal Register notice requesting comment on those proposed
security requirements issued concurrently with this proposed rule. The
proposed security requirements require U.S. persons engaging in
restricted transactions to comply with organizational and system-level
requirements, such as ensuring that basic organizational cybersecurity
policies, practices, and requirements are in place, as well as data-
level requirements, such as data minimization and masking, encryption,
or privacy-enhancing techniques. After CISA receives and considers
public input, it will revise as appropriate and publish the final
security requirements. The Department of Justice will then incorporate
by reference the published final security requirements in the final
rule that the Department issues. Interested parties can view CISA's
proposed security requirements on CISA's website at https://www.cisa.gov/ and can review CISA's notice requesting comments on the
proposed security requirements in the notice docketed as CISA-2024-0029
(October 29, 2024).
The proposed rule also clarifies that restricted transactions are
not prohibited only if they comply with the security requirements and
other applicable requirements for conducting restricted transactions.
The proposed rule includes a new example that makes it clear that U.S.
persons engaging in restricted transactions may not, absent a license,
use measures other than the security requirements and other applicable
conditions to mitigate the risk posed by country-of-concern or covered-
person access.
Some commenters provided feedback on the security requirements that
would govern restricted transactions. As explained in the ANPRM, CISA
will be soliciting comments on the proposed security requirements as
part of a separate notice-and-comment process in parallel with this
NPRM, and the Department urges commenters to provide any comments on
the security requirements through that process.
2. Section 202.258--Vendor Agreement
The proposed rule defines a ``vendor agreement'' as any agreement
or arrangement, other than an employment agreement, in which any person
provides goods or services to another person, including cloud-computing
services, in exchange for payment or other consideration. The ANPRM
contemplated defining the term ``cloud-computing services'' as that
term is defined in NIST Special Publication (``SP'') 800-145.\68\ NIST
SP 800-145 describes cloud computing in a way that includes different
essential characteristics, deployment models, and service models, such
as ``Infrastructure as a Service (IaaS),'' ``Platform as a Service
(PaaS),'' and ``Software as a Service (SaaS).'' \69\ Because cloud
computing is just one example of several types of services that may be
involved in a vendor agreement, it does not appear useful to separately
or specially define that term in the proposed rule at this time. The
Department may consider issuing guidance in the future that describes
cloud computing in reference to the NIST definition.
---------------------------------------------------------------------------
\68\ 89 FR 15788.
\69\ See Peter Mell & Timothy Grance, The NIST Definition of
Cloud Computing (NIST, SP 800-145, Sept. 2011), https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf [https://perma.cc/HUJ5-B2JS].
---------------------------------------------------------------------------
3. Section 202.217--Employment Agreement
The proposed rule defines an ``employment agreement'' as any
agreement or arrangement in which an individual, other than as an
independent contractor, performs work or performs job functions
directly for a person in exchange for payment or other consideration,
including employment on a board or committee, executive-level
arrangements or services, and employment services at an operational
level.
4. Section 202.228--Investment Agreement
The proposed rule defines an ``investment agreement'' as any
agreement or arrangement in which any person, in exchange for payment
or other consideration, obtains direct or indirect ownership interests
in or rights in relation to (1) real estate located in the United
States or (2) a U.S. legal entity. The proposed rule categorically
excludes certain passive investments that do not pose an unacceptable
risk to national security because they do not give countries of concern
or covered persons a controlling ownership interest, rights in
substantive decision-making, or influence through a non-controlling
interest that could be exploited to access government-related data or
bulk U.S. sensitive personal data. Specifically, the proposed rule
excludes from ``investment agreement'' investments (1) in any publicly
traded security, in any security offered by any investment company that
is registered with the United States Securities and Exchange
Commission, such as index funds, mutual funds, exchange-traded funds,
or made as limited partners (or equivalent) into a venture capital
fund, private equity fund, fund of funds, or other pooled investment
fund, if the limited partner's contributions and influence are
circumscribed as set forth in the proposed rule; (2) that give the
covered person less than 10 percent of total voting and equity interest
in a U.S. person; and (3) that do not give a covered person rights
beyond those reasonably considered to be standard minority shareholder
protections.
With respect to the requirement of a de minimis percentage of total
voting and equity interest, the Department is considering a range of
different proposals. The proposed rule's definition of ``investment
agreement'' would apply to investments that give a covered person a
certain percentage or more of total voting and equity interest in a
U.S. person, even where that investment is not accompanied by other
[[Page 86134]]
formal rights beyond standard minority shareholder protections. The
proposed rule would include this de minimis threshold to account for
the unacceptable national security risk posed by otherwise passive
investments that may provide investors with meaningful economic
leverage or informal influence over access to a company's assets (like
sensitive personal data) even when the investors do not obtain formal
rights, control, or access beyond standard minority shareholder
protections. The proposed rule would tentatively set this threshold
number at 10 percent to exclude truly passive investments while also
capturing investments that informally may provide covered persons with
influence that presents unacceptable national security risks. The
Department is also considering de minimis thresholds that are
significantly lower and higher than this percentage, such as the 5
percent threshold above which investors must publicly report their
direct or indirect beneficial ownership of certain covered securities
under the Securities Exchange Act of 1934, 15 U.S.C. 78m(d). As a
result, the final figure in the proposed rule could potentially cover
passive investments that provide less (or more) than 10-percent voting
and equity interests in a U.S. person. The Department invites public
comment on the specific de minimis threshold that should be used in
this exception for passive investments.
C. Subpart E--Exempt Transactions
As previewed in the ANPRM, the proposed rule exempts several
classes of data transactions from the scope of the proposed rule's
prohibitions.
1. Section 202.501--Personal Communications; Section 202.502--
Information or Informational Materials; and Section 402.503--Travel
The proposed rule exempts three classes of data transactions to the
extent that they involve data that is statutorily exempt from
regulation under IEEPA: personal communications, information or
informational materials, and data that is ordinarily incident to travel
to or from another country.
One comment suggested clarifying that the exemption for personal
communications that do ``not involve a transfer of anything of value''
under 50 U.S.C. 1702(b)(1) is ``inclusive of business and commercial
transactions.'' The proposed rule makes no change in response to this
comment, as the clarification does not seem necessary at this time,
given the scope of the statutory exemption and the proposed rule.
Section 1702(b)(1) applies to any ``personal communication,'' so it
would be inappropriate to rely on that statutory language to exempt, as
this comment suggests, ``business and commercial transactions.''
Further, the categories of sensitive personal data encompassed by the
proposed rule do not include any personal communications. For example,
fingerprints and other biometric identifiers, human genetic testing
results, and data about financial assets and liabilities are not
``communications'' from one person to another. Any clarification of the
phrase ``a transfer of anything of value,'' therefore, does not appear
necessary. To the extent the commenters, a group of trade associations
representing telecommunications providers, are concerned that personal
communications between individuals that do not involve a transfer of
anything of value are business transactions from their perspective, as
purveyors of telecommunications services, the Department refers the
commenters to the qualified exemption for telecommunications services
in proposed Sec. 202.509.
The Department discusses the exemption for information or
informational materials in part VI of this preamble.
Although not raised by commenters, the proposed rule also adds a
separate exemption for data transactions that are ordinarily incident
to travel to or from another country, such as arranging travel or
importing baggage for personal use. This exemption implements and
tracks the statutory exemption in 50 U.S.C. 1702(b)(4).
2. Section 202.504--Official Business of the United States Government
Adopting the approach contemplated in the ANPRM without change, the
proposed rule exempts data transactions to the extent that they are for
(1) the conduct of the official business of the United States
Government by its employees, grantees, or contractors; (2) any
authorized activity of any United States Government department or
agency (including an activity that is performed by a Federal depository
institution or credit union supervisory agency in the capacity of
receiver or conservator); or (3) transactions conducted pursuant to a
grant, contract, or other agreement entered into with the United States
Government. Most notably, this exemption would exempt grantees and
contractors of Federal departments and agencies, including the
Department of Health and Human Services, the Department of Veterans
Affairs, the National Science Foundation, and the Department of
Defense, so that those agencies can pursue grant-based and contract-
based conditions to address risks that countries of concern can access
sensitive personal data in transactions related to their agencies' own
grants and contracts, as laid out in section 3(b) of the Order--without
subjecting those grantees and contractors to dual regulation.
3. Section 202.505--Financial Services
Section 2(a)(v) of the Order exempts any transaction that is
``ordinarily incident to and part of the provision of financial
services, including banking, capital markets, and financial insurance
services, or required for compliance with any Federal statutory or
regulatory requirements, including any regulations, guidance, or orders
implementing those requirements.'' \70\ The proposed rule defines these
exempt transactions in further detail. Notably, the proposed rule
exempts the transfer of personal financial data or covered personal
identifiers incidental to the purchase and sale of goods and services
(such as the purchase, sale, or transfer of consumer products and
services through online shopping or e-commerce marketplaces, while
still prohibiting these marketplaces from conducting data transactions
that involve data brokerage), as well as exempting the transfer of
personal financial data or covered personal identifiers for the
provision or processing of payments or funds transfers.
---------------------------------------------------------------------------
\70\ 89 FR 15423.
---------------------------------------------------------------------------
Numerous commenters expressed support for the financial-services
exemption. Commenters expressed appreciation for the exemption's
careful scoping to enable business and commercial transactions.
Commenters sought specific edits to the payment-processing part of the
exemption to ensure that it covers operations involving payment dispute
resolution, payor authentication, tokenization, payment gateway,
payment fraud detection, payment resiliency, mitigation and prevention,
and payment-related loyalty point program administration. The
Department appreciates these suggested clarifications, and the proposed
rule incorporates these proposed edits by explicitly adding the
provision of services ancillary to processing payments and funds
transfers, with the suggested examples, to the list of exempt financial
services transactions.\71\ The financial-services exemption aims to
identify the low-risk business and
[[Page 86135]]
commercial transactions that should continue unimpeded while also
ensuring that the Order and its implementing regulations do not serve
as a broader economic decoupling from countries of concern. These edits
are consistent with that purpose.
---------------------------------------------------------------------------
\71\ 89 FR 15794.
---------------------------------------------------------------------------
Another commenter also suggested that investment-management
services be included in the financial-services exemption. The
Department does not intend to impede activities that are ordinarily
incident to and part of the provision of investment-management services
that manage or provide advice on investment portfolios or individual
assets for compensation (such as devising strategies and handling
financial assets and other investments for clients) or provide services
ancillary to investment-management services (such as broker-dealers
executing trades within a securities portfolio based upon instructions
from an investment advisor). For further clarity, the proposed rule
explicitly adds investment-management services to the financial-
services exemption set out in Sec. Sec. 202.505(a)(1) and
202.505(a)(6).
One commenter requested an exemption for cargo-related information
containing listed identifiers. The Department believes this comment is
focused on scenarios in which bulk personal identifiers are transferred
as part of shipping purchased goods internationally. The Department
declines to adopt a separate exemption, or an expansion of the scope of
the exemption for transfers of data required by or authorized by
Federal law or international agreement, for cargo-related information
because the proposed rule already exempts the transfer of personal
financial data or covered personal identifiers incidental to the
purchase and sale of goods and services. This existing exemption
appears to adequately address the scenario raised by the commenter.
Thus, the proposed rule adopts the approach described in the ANPRM.
Although not raised by any commenters, the Department is also
considering whether and how the financial-services exemption should
apply to employment and vendor agreements between U.S. financial-
services firms and covered persons where the underlying financial
services provided do not involve a country of concern. Under this
exemption, U.S. persons would be required to evaluate whether a
particular data transaction (such as a transaction involving data
brokerage or a vendor, employment, or investment agreement) is
``ordinarily incident to and part of'' the provision of financial
services such that it is treated as an exempt transaction.\72\ At one
end of the spectrum, and as previewed by Example 53 in the ANPRM, if a
U.S. financial institution or financial-services company uses a data
center operated by a covered person in a country of concern to
facilitate payments to U.S. persons in that country of concern, the
proposed rule would treat that vendor agreement as ``ordinarily
incident to and part of'' the facilitation of those payments--and thus
exempt.\73\ See Sec. 202.505(b)(3). On the other end of the spectrum,
and as previewed by Example 27 in the ANPRM, if a U.S. financial
institution or financial-services company hires a covered person as a
data scientist with access to its U.S. customers' bulk personal
financial data to develop a new app that could be sold as a standalone
product to the company's customers, the proposed rule would treat this
employment agreement as not ``ordinarily incident to and part of'' the
financial services provided by the U.S. company--and thus not
exempt.\74\ See Sec. 202.217(b)(4).
---------------------------------------------------------------------------
\72\ Cf., e.g., 31 CFR 560.405(c) (discussing OFAC exemption for
transactions ``ordinarily incident to a licensed transaction'' as
applied to scenarios involving the provision of transportation
services to or from Iran), 515.533 n.1 (discussing OFAC exemption
for transactions ``ordinarily incident to'' a licensed transaction
as applied to scenarios involving the licensed export of items to
any person in Cuba); Letter from R. Richard Newcomb, Director, U.S.
Dep't of Treas., Off. of Foreign Assets Control, Re: Iran: Travel
Exemption (Nov. 25, 2003), https://ofac.treasury.gov/media/7926/download?inline [https://perma.cc/3VRL-X886] (discussing the OFAC
exemption for transactions ``ordinarily incident to'' travel as
applied to scenarios involving the use of airline-service providers
from a sanctioned jurisdiction).
\73\ 89 FR 15794.
\74\ 89 FR 15789.
---------------------------------------------------------------------------
Between those two ends of the spectrum, the Department is
considering whether the transactions in the following new examples
should be treated as exempt transactions or as restricted transactions:
New example in Sec. 202.505(b)(4). Same as Example 3 (see
Sec. 202.505(b)(3)), but the underlying payments are between U.S.
persons in the United States and do not involve a country of concern: A
U.S. bank or other financial institution, to facilitate payments that
do not involve a covered person or country of concern (e.g., between
U.S. persons in the United States), stores and processes the customers'
bulk financial data using a data center operated by a third-party
service provider in a country of concern, which is a covered person.
Should the vendor agreement with the covered person, which is otherwise
a restricted transaction, be treated as ``ordinarily incident to and
part of'' the U.S. financial institution's facilitation of payments
that do not involve a covered person or country of concern?
New example in Sec. 202.505(b)(12). A U.S. company
provides wealth-management services and collects bulk personal
financial data on its U.S. clients. The U.S. company appoints a citizen
of a country of concern, who is located in a country of concern, to its
board of directors. In connection with the board's data security and
cybersecurity responsibilities, the director could access the bulk
personal financial data. Should the employment agreeme