US issues executive order to keep Americans’ sensitive personal data safe from ‘countries of concern’

Unprecedented directive focuses on tackling the legal means by which foreign adversaries gain access, such as obtaining information via data brokers
Countries like China and Russia ‘are leveraging their access to Americans’ bulk sensitive personal data and government-related data’, official says

US-China relations

Bochen Hanin Washington

Published: 6:00pm, 28 Feb 2024

Why you can trust SCMP

In what could be a fresh salvo in the US-China tech war, the White House issued an executive order on Wednesday meant to prevent “countries of concern” such as China and Russia from accessing high volumes of sensitive personal data about Americans and people connected to the US government.

According to senior administration officials, the order sets forth new restrictions on transactions of genomic data, biometric data, personal health data, geolocation data, financial data, government-related data and certain personal identifiers – information that, if obtained by certain countries, could threaten American national security.

“Our adversaries increasingly view data as a strategic resource,” said a senior administration official.

Countries such as China and Russia “are leveraging their access to Americans’ bulk sensitive personal data and government-related data to engage in a variety of nefarious activities, including malicious cyber-enabled activities, espionage and blackmail”, he continued.

A senior Justice Department official identified China, Russia, North Korea, Iran, Cuba and Venezuela as countries that are likely to be targeted by rules resulting from Wednesday’s executive action.

The order will mark the first time the US has restricted the transfer of data to specific locations.

It focuses on tackling the legal means by which foreign adversaries gain access to Americans’ “most personal and sensitive information”.

These methods include “countries of concern” requiring organisations operating in their jurisdictions to hand over data.

They also include obtaining information through commercial channels, such as data brokers, third-party vendor agreements, employment agreements or investment agreements.

Renewal of US-China science pact likely to be delayed again

The planned restrictions are likely to alter US engagement with Chinese companies, from TikTok, a video-sharing app owned by Chinese tech giant ByteDance, to biotech firms that collect DNA.

Critics of American restrictions on TikTok, for instance, have argued Beijing would not have to rely on asking Chinese companies or subsidiaries to hand over data as they can simply buy data from brokers.

But the new executive order would make it more difficult for brokers to be enlisted.

Aside from government targets, the White House is particularly concerned about data from journalists, academics, activists and members of marginalised communities, as well as patient data obtained through healthcare providers and researchers.

Many Chinese companies are licensed to perform genetic testing or whole genome sequencing on patients in the American healthcare system, according to a 2021 report by the Office of the Director of National Intelligence.

US moves against cybersecurity ‘risk’ posed by China-made port infrastructure

Last month a bipartisan group of legislators introduced a bill to block one of China’s biggest genomics firms from operating in the US.

Rules resulting from the executive order are likely to focus the most stringent restrictions on transactions related to data brokerage and genomic data, according to the Justice Department official.

Some observers worry the order could impede commercial activity and scientific research.

According to the Justice Department official, the rule-making process will consider exemptions to limit unintended adverse impacts.

This will include carve-outs for activities that are routine to processing financial transactions and to ordinary business operations within multinational companies, such as payroll, he said.

Chinese hackers are targeting key US infrastructure, FBI chief warns

Officials speaking on background stressed that the executive order would only be implemented after multiple rounds of public consultation.

In a statement, Senator Mark Warner, a Virginia Democrat and chairman of the Senate select committee on intelligence, applauded Biden’s order but said it was no substitute for comprehensive data privacy legislation.

“I urge my colleagues to come together on legislation that finally protects Americans’ privacy online,” said Warner.

Responding to Wednesday’s announcement, Liu Pengyu, a spokesman for the Chinese embassy in Washington, said: “All countries have the right to take measures to protect the personal data and privacy of their citizens”.

“But the relevant measures should be reasonable and well-grounded. They should not be reduced to tools to suppress certain countries and companies by overstretching national security concepts and abusing state power.”

In recent years, Beijing has increasingly favoured restrictions on cross-border data transfers, though late last year, China’s cyberspace regulator began easing restrictions that made it difficult for foreign businesses to operate.