DOJ Seeks Comment on Rulemaking to Protect Personal Data

The National Security Division and the Department of Justice requested comment on potential rulemakings related to the implementation of U.S. President Joseph R. Biden's Executive Order ("E.O.") authorizing the Attorney General to take actions to prevent the transfer of Americans’ personal data to countries of concern.

As previously covered, the E.O. requires the Department of Justice to issue regulations that establish protections for Americans’ sensitive personal data and sensitive government-related data from access and exploitation by countries of concern. The President's E.O. was issued pursuant to his authority under the Constitution and laws of the United States, including the International Emergency Economic Powers Act (IEEPA), the National Emergencies Act (NEA), and section 301 of title 3, United States Code.

According to the advanced notice of proposed rulemaking, the National Security Division and the Department of Justice are considering, among other things, (i) how to define "sensitive personal data," "bulk," "government-related data" and "covered data transaction," (ii) implementing security requirements for restricted transactions, (iii) implementing an approach in which the program would independently regulate, (iv) creating a compliance and enforcement program, (v) implementing a licensing regime and (vi) exempting certain data transactions.

Comments must be submitted by April 19, 2024.