US to curb data flows to China and Russia
US President Joe Biden’s administration on Wednesday unveiled an executive order aimed at protecting US personal data by restricting its transfer to China, Russia and other countries, senior US officials said, citing national security concerns.
The order will curb bulk transfers of Americans’ geolocation, biometric, health and financial information by data brokers and others to specific “countries of concern”, the officials said.
It will also bar the transfer of any volume of data on US government personnel, they said, to such countries, which also include Iran, North Korea, Cuba and Venezuela.
“China and Russia are buying American sensitive personal data from data brokers” and leveraging it “to engage in a variety of nefarious activities including malicious cyberenabled activities, espionage and blackmail”, the officials said.
“Buying data through data brokers is currently legal in the US. That reflects a gap in our national security toolkit,” they said, adding that Wednesday’s order aimed to fill that gap.
The order is the latest bid by Washington to stem the flow of US data to China, which is locked in a years-long trade and technology war with the US.
The US Congress is considering legislation to ban federal agencies from contracting with China’s BGI Group and Wuxi APPTEC, part of an effort to keep China from accessing US genetic data and personal health information.
In 2018, a US panel that reviews foreign investments for potential national security threats rejected a plan by China’s Ant Financial to acquire US money transfer company MoneyGram International because the companies could not assuage concerns over the safety of data that can be used to identify US citizens.
The officials said on Wednesday that transactions with data brokers who know that the information will end up in “countries of concern” will be banned, as will all genomic data transfers.
Transfers of other classes of data — from biometric to financial — would only be banned if they met certain volume thresholds and were being sent to those countries, one official said.
To allay concerns that the new rules would unnecessarily hamper economic activity, certain types of data, including corporate payroll and compliance are exempted, they said. Certain transactions, such as cloud service, employment and investment agreements, would also be permitted, subject to some security requirements such as encryption and anonymisation.
The order also directs the justice department to give industry ample opportunity to comment on proposals before they go into effect.
The White House says companies are collecting more of Americans’ data than ever before. That data is often legally sold and resold through data brokers who can then transfer it to foreign intelligence services, militaries, or companies controlled by foreign governments.