Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern

Executive Order Number: 14117
President: Joseph R. Biden Jr.
Signed: February 28, 2024
Published: March 1, 2024
Source: Federal Register
Original Document: https://www.govinfo.gov/content/pkg/FR-2024-03-01/pdf/2024-04573.pdf

AI-Generated Summary

Executive Order 14117: Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern

Purpose:

The executive order aims to protect Americans' bulk sensitive personal data and United States Government-related data from access by countries of concern, which is deemed to pose an "unusual and extraordinary threat" to U.S. national security and foreign policy. It expands the scope of a previously declared national emergency to address the risks associated with such data access.

Key Actions or Directives:

Regulation Development: The Attorney General, in coordination with the Secretary of Homeland Security and relevant agencies, is tasked with issuing regulations to prohibit or restrict transactions involving bulk sensitive personal data or U.S. Government-related data that pose an unacceptable risk to national security.
Security Requirements: The Secretary of Homeland Security, through the Director of the Cybersecurity and Infrastructure Security Agency, is to establish security requirements for restricted transactions, based on NIST's Cybersecurity and Privacy Frameworks.
Submarine Cables: The Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector is directed to prioritize reviews of existing licenses for submarine cable systems that may enable data access by countries of concern.
Healthcare and Data Brokerage: The order encourages actions to protect sensitive health and genomic data in the healthcare sector and calls for enhanced compliance in the data brokerage industry to prevent data access by countries of concern.
Assessment and Reporting: Various reports are mandated to assess the effectiveness of the measures, economic impacts, and risks associated with other types of human 'omic data.

Significant Changes to Policy or Law:

Expansion of National Emergency: The order expands the national emergency previously declared, focusing on data security and privacy.
New Regulatory Framework: It introduces a new framework for regulating transactions involving sensitive data, potentially affecting how businesses handle such data.
No Data Localization Requirements: The order explicitly states that it does not impose generalized data localization requirements, maintaining support for open data flows.

Potential Impacts:

Government Agencies: Agencies like the Department of Justice and Homeland Security will need to develop and enforce new regulations, potentially requiring additional resources.
Citizens: Increased protection of personal data, particularly health and genomic data, may enhance privacy but could affect international data sharing in research.
International Relations: The order may strain relations with countries identified as "countries of concern," potentially affecting economic and scientific collaborations.
Businesses: Companies, especially in data-intensive sectors like healthcare and data brokerage, may face new compliance requirements, potentially increasing operational costs.

Main Stakeholders Affected:

U.S. Government Agencies: Particularly the Department of Justice, Homeland Security, and agencies involved in healthcare and scientific research.
U.S. Citizens: Whose sensitive personal data is the focus of the order.
Businesses: Especially those in data brokerage, healthcare, and telecommunications sectors.
Countries of Concern: As defined by the Attorney General, these countries will face restrictions on accessing U.S. data.

Notable Legal, Constitutional, or Political Implications:

Legal Basis: The order is grounded in the International Emergency Economic Powers Act (IEEPA) and the National Emergencies Act (NEA), providing a legal framework for the President's actions.
Constitutional Concerns: There may be debates over the extent of executive power in declaring and expanding national emergencies, particularly in the realm of data privacy and security.
Political Implications: The order could be politically contentious, with debates over privacy rights versus national security, and the impact on international relations with designated countries of concern.

This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.