President Biden will issue an Executive Order to protect Americans’ sensitive personal data from exploitation by countries of concern. The Executive Order, which marks the most significant executive action any President has ever taken to protect Americans’ data security, authorizes the Attorney General to prevent the large-scale transfer of Americans’ personal data to countries of concern and provides safeguards around other activities that can give those countries access to Americans’ sensitive data.
The President’s Executive Order focuses on Americans’ most personal and sensitive information, including genomic data, biometric data, personal health data, geolocation data, financial data, and certain kinds of personally identifiable information. Bad actors can use this data to track Americans (including military service members), pry into their personal lives, and pass that data on to other data brokers and foreign intelligence services. This data can enable intrusive surveillance, scams, blackmail, and other violations of privacy.
Companies are collecting more of Americans’ data than ever before, and it is often legally sold and resold through data brokers. Commercial data brokers and other companies can sell this data to countries of concern, or entities controlled by those countries, and it can land in the hands of foreign intelligence services, militaries, or companies controlled by foreign governments.
The sale of Americans’ data raises significant privacy, counterintelligence, blackmail risks and other national security risks—especially for those in the military or national security community. Countries of concern can also access Americans’ sensitive personal data to collect information on activists, academics, journalists, dissidents, political figures, and members of non-governmental organizations and marginalized communities to intimidate opponents of countries of concern, curb dissent, and limit Americans’ freedom of expression and other civil liberties.
To protect Americans’ sensitive personal data, President Biden is directing:
- The Department of Justice to issue regulations that establish clear protections for Americans’ sensitive personal data from access and exploitation by countries of concern. These protections will extend to genomic data, biometric data, personal health data, geolocation data, financial data, and certain kinds of personal identifiers. They will prevent the large-scale transfer of that data to countries of concern—which have a track record of collecting and misusing data on Americans.
- The Department of Justice to issue regulations that establish greater protection of sensitive government-related data, including geolocation information on sensitive government sites and information about military members.
- The Departments of Justice and Homeland Security to work together to set high security standards to prevent access by countries of concern to Americans’ data through other commercial means, such as data available via investment, vendor, and employment relationships.
- The Departments of Health and Human Services, Defense, and Veterans Affairs to help ensure that Federal grants, contracts, and awards are not used to facilitate access to Americans’ sensitive health data by countries of concern, including via companies located in the United States.
- The Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector (often called “Team Telecom”) to consider the threats to Americans’ sensitive personal data in its reviews of submarine cable licenses.
- That these activities do not stop the flow of information necessary for financial services activities or impose measures aimed at a broader decoupling of the substantial consumer, economic, scientific, and trade relationships that the United States has with other countries.
These actions not only align with the U.S.’ longstanding support for the trusted free flow of data, but also are consistent with U.S.’ commitment to an open Internet with strong and effective protections for individuals’ privacy and measures to preserve governments’ abilities to enforce laws and advance policies in the public interest. The Administration will continue its engagements with stakeholders, including technology companies and advocates for privacy, safety, competition, labor, and human rights, to move forward in a way that appropriately balances all these objectives.
The President has encouraged the Consumer Financial Protection Bureau to consider taking steps, consistent with CFPB’s existing legal authorities, to protect Americans from data brokers that are illegally assembling and selling extremely sensitive data, including that of U.S. military personnel.
Additionally, President Biden continues to urge Congress to do its part and pass comprehensive bipartisan privacy legislation, especially to protect the safety of our children.
