Biden acts to better protect Americans’ data
WASHINGTON — President Joe Biden on Wednesday signed an executive order aimed at better protecting Americans’ personal data on everything from biometrics and health records to finances and geolocation from foreign adversaries like China and Russia.
The attorney general and other federal agencies are to prevent the large-scale transfer of Americans’ personal data to what the White House calls “countries of concern,” while erecting safeguards around other activities that can give those countries access to people’s sensitive data.
The goal is to do so without limiting legitimate commerce around data, senior Biden administration officials said on a call with reporters.
Biden’s move targets commercial data brokers, the sometimes shadowy companies that traffic in personal data and that officials say may sell information to foreign adversaries or U.S. entities controlled by those countries.
Most eventual enforcement mechanisms still have to clear complicated and often monthslong rulemaking processes. Still, the administration hopes eventually to limit foreign entities, as well as foreign-controlled companies operating in the U.S., that might otherwise improperly collect sensitive data, the senior officials said.
Data brokers are legal in the U.S. and collect and categorize personal information, usually to build profiles on millions of Americans that the brokers then rent or sell.
The officials said activities like computer hacking are already prohibited in the
U.S., but that buying potentially sensitive data through brokers is legal. That can represent a key gap in the nation’s national security protections when data is sold to a broker knowing it could end up in the hands of an adversary — one the administration now aims to close with the president’s executive action.
“Bad actors can use this data to track Americans, including military service members, pry into their personal lives, and pass that data on to other data brokers and foreign intelligence services,” the White House wrote in a fact sheet announcing the move. “This data can enable intrusive surveillance, scams, blackmail, and other violations of privacy.”
The order directs the Department of Justice to issue regulations that establish protections for Americans’ sensitive personal data, as well as sensitive government-related data — including geolocation information on sensitive government sites and members of the military.
The Justice Department also plans to work with Homeland Security officials to build safety standards to prevent foreign adversaries from collecting data. It will further attempt better checks to ensure that federal grants going to various other agencies, including the departments of Defense and Veterans Affairs, aren’t used to facilitate Americans’ sensitive data flowing to foreign adversaries or U.S. companies aligned with them.
The senior administration officials listed potential countries of concern as China, Russia, North Korea, Iran, Cuba and Venezuela. But it is China — and Tiktok, which has over 150 million American users and is a wholly owned subsidiary of Chinese technology firm Bytedance Ltd. — that U.S. leaders have been most vocal about.
Rep. Mike Gallagher, a Wisconsin Republican who chairs the House Select Committee on the Chinese Communist Party, recently noted, “There’s no such thing as a private business in China.”
The senior administration officials stressed that the executive action was designed to work in conjunction with legislative action. So far, however, numerous bills seeking to establish federal privacy protections have failed to advance in Congress.
Albert Fox Cahn, a Harvard fellow and executive director of the nonprofit Surveillance Technology Oversight Project, said Wednesday’s order doesn’t address the core issue of Americans’ exposure to rampant data collection by industry and government -- and the absence of a federal privacy law.
“For most Americans, the country of greatest concern on surveillance is the U.S.
Americans are tracked every day by an increasingly invasive array of private data brokers and government agencies, transforming nearly every aspect of our digital lives into a marketing and policing tools,” he said.
“This executive order will do almost nothing to address the real privacy needs that most Americans have, and continues to conflate surveillance capitalism with foreign surveillance. Only in Washington does privacy once again get misunderstood as a foreign threat, rather than a domestic industry,” he added. “None of this is a substitute for the civil rights and privacy protections the public so desperately needs.”
But privacy researcher Wolfie Christl called the executive order “a good first step” that may force a number of data-collection and trafficking companies “to rethink their data practices at a more fundamental level.”