Blog

Executive Order on Sensitive Data: What does it mean?

Learn more about how President Biden’s latest executive order affects business operations related to sensitive data

Alexis Kateifides
Director, Privacy Research
March 14, 2024

National security at the forefront of data protect
The DoJ’s response to the Executive Order
What does this mean for your business?
How can OneTrust help?

President Biden has issued an Executive Order aimed at safeguarding Americans' sensitive personal data from foreign exploitation. This sweeping action empowers the Attorney General to curb the extensive transfer of personal information to countries deemed a threat, ensuring robust protection for data including genomic and biometric details, personal health and financial information, geolocation data, and certain personally identifiable information.

National security at the forefront of data protection

The Executive Order emphasizes a proactive approach to data protection, situating it within the broader context of national security. By addressing the vulnerabilities posed by foreign access to Americans' sensitive personal data, the Order recognizes the intricate link between individual privacy and the collective security of the nation. It mandates the establishment of regulations that not only shield personal data from exploitation by "countries of concern" but also safeguard this information from indirect access via commercial avenues. Directed at an array of federal departments, including Justice, Homeland Security, Health and Human Services, Defense, and Veterans Affairs, the Order is a comprehensive measure against the multifaceted threats of data exploitation. It underscores the idea that protecting the privacy of citizens' data is not just an individual responsibility but a critical component of our national defense strategy. Through this lens, the Executive Order propels forward the notion that ensuring the security of sensitive data is pivotal in maintaining the integrity of our nation's security infrastructure against emerging global threats.

What is each department tasked with?

Department of Justice (DOJ): Tasked with leading the initiative, with regulations to protect sensitive personal data of US citizens from being exploited by other countries. Sensitive personal data here is defined as data under the following categories:

Genomic data
Biometric data
Personal health data
Geolocation data
Financial data
Other personal identifiers

The DoJ is also tasked with protecting sensitive government data, not limited to geolocation information on government sites and data on members of the military.

Department of Homeland Security (DHS): The DHS is tasked with working together with the DoJ to set security standards on the sensitive data of US citizens – preventing its access by certain countries on the commercial front, e.g. (investments, employers, third-parties).

Department of Health and Human Services (HHS): Responsible for the protection of health and genomic data from countries of concern, also taking into account companies that are located in the US.

Department of Defense (DoD) & Department of Veterans Affairs: Both departments are charged with securing data related to national defense and veterans, ensuring that the sensitive data found in contracts, grants, and even certain awards cannot be used as an access point by countries of concern.

The Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector: This team is tasked with looking over submarine cable licenses, ensuring that there are no channels for access of sensitive data here.

The DoJ’s response to the Executive Order

The Department of Justice (DOJ) has announced an Advance Notice of Proposed Rulemaking (ANPRM), aligning with President Biden's recent Executive Order. This action emphasizes the administration's commitment to safeguarding sensitive personal information.

The DOJ plans to specifically identify six countries as primary concerns, including China, Russia, Iran, North Korea, Cuba, and Venezuela. This designation reflects a strategic approach to mitigate risks associated with data exploitation.

Who will be covered by these rules?

The ANPRM outlines four categories of covered persons, including:

Entities controlled by or affiliated with countries of concern
A foreign person who is an employee or contractor of
- This type of entity
- A country of concern
A foreign person who has their primary residence in a county of concern
Any person the Attorney General deems as acting on behalf of a country of concern, or subject to the jurisdiction or direction of a country of concern

What types of data transfers will be covered?

Data transfers would be bucketed into two categories – prohibited transactions and restricted transactions.

Prohibited transactions would include those between the US and a country of concern that involved:

Selling/exchanging personal data
The transfer of any genomic data that includes bulk human genome data

Restricted transactions are those which will have more security measures involved to reduce the risk involved with these transfers. These include third-party agreements that involve goods and services, employment agreements, and investment agreements.

Exemptions

The DoJ has also listed certain entities as exempt from regulation.

The following persons will not be covered under this new Executive Order:

Any US citizen, national or permanent resident
Anyone admitted to the US as a refugee or granted asylum
Any entity that falls only under US laws/jurisdictions
Anyone located in the US

As with covered persons, there are exemptions when it comes to transfers as well. These include:

Any business transactions that follow “business-as-usual” practices including
- Financial services
- Payroll
- Compliance with regulations
US Government activities
Transactions required/authorized by law (federal or international)

What does this mean for your business?

If your organization is based in the US and conducts large transfers of sensitive personal data with other countries of concern as a part of global operations that fall into any of the prohibited or restricted transaction buckets – this will be a space to keep an eye on. While no regulation has been formalized yet, the Executive Order hints that this could be an area that the DoJ will prioritize regarding compliance measures.

How can OneTrust help?

When dealing with sensitive data and international transfers, having your data mapped clearly throughout your organization is the first step towards compliance and effective data governance. OneTrust Data Mapping Automation can help your organization identify what personal data you hold, what regulations it’s subject to, and maintain records and processes to keep your operations privacy-first and hassle-free.

To keep track of any privacy regulations across the world, be sure to check out OneTrust DataGuidance. Our team of global privacy lawyers works around the clock to ensure real-time updates on privacy and security regulations from any part of the world, with law trackers to understand which phase a law is in, detailed reports to understand what compliance measures are required, and comparison charts to display different global privacy requirements.

Blog

Executive Order on Sensitive Data: What does it mean?

Table of contents

National security at the forefront of data protection

What is each department tasked with?

The DoJ’s response to the Executive Order

Who will be covered by these rules?

What types of data transfers will be covered?

Exemptions

What does this mean for your business?

How can OneTrust help?

You may also like

Privacy Management

2024 to 2025: Preparing for the next wave of privacy regulations

Prepare for 2025's privacy changes with this recap webinar on 2024's regulations and explore upcoming laws, trends, and compliance strategies.

January 23, 2025

Privacy Management

Staying equipped for compliance: A global recap of emerging privacy laws

November 20, 2024

Consent & Preferences

Mastering US opt-out requirements: A practical guide for marketers

Discover how to manage US opt-out requirements and enhance your marketing efforts with this guide. Download now to simplify compliance and build trust.

October 22, 2024

Privacy Automation

Global regulatory update: Recent privacy developments and compliance trends

Join us for a webinar on the latest updates and emerging trends in global privacy regulations.

September 12, 2024

Privacy Management

Preparing for child data protection laws in the US

Join DataGuidance and a panel of experts as we discuss US privacy laws the protection of minors' data.

August 07, 2024

Privacy Management

The road to 50 states: Rhode Island joins the US privacy landscape with a new law

Rhode Island has become the 20th US State to pass a privacy law. On June 25, 2024, the Governor of Rhode Island transmitted the Data Transparency and Privacy Protection Act (RIDTPPA) without signature allowing the Act to become law. Join the webinar to learn more.

July 16, 2024

Privacy Management

Preparing for the future of privacy in healthcare: Going beyond HIPAA compliance

Join us for a discussion on preparing your organization for healthcare privacy compliance that goes beyond HIPAA.

July 11, 2024

Privacy Management

The road to 50 states: Minnesota and Vermont join the US privacy landscape

In this webinar, OneTrust DataGuidance and expert contributors unpack the MCPA and VDPA, examining the requirements, exceptions, and practical implications of the legislations on the data controllers and processors.

June 17, 2024

Privacy Management

From legislation to operation: How to prepare for the new wave of US Privacy laws

Prepare your organization for the new wave of US privacy laws.

June 06, 2024

Third-Party Risk

TPRM privacy compliance: Questions to ask when working with third parties

Download this checklist to learn what questions to ask when designing a third-party risk management program that enables privacy compliance.

May 31, 2024

Comparing US state privacy law requirements

Download our infographic and compare the many US state privacy law requirements that have been enacted or will soon come into effect.

May 14, 2024

Privacy Management

Federal US privacy bill on the horizon? Exploring the draft APRA & new state privacy legislation

Join OneTrust DataGuidance and expert contributors for an overview of the Kentucky Consumer Privacy Act (KCPA), Maryland's Senate Bill 0541, and the draft American Privacy Rights Act and explore how a federal bill could shape the US privacy landscape.

April 23, 2024

Privacy Management

US state privacy laws timeline

View our timeline to understand the progression of current US state privacy laws and key dates.

April 23, 2024

Privacy Management

Spring into action! Navigating CPRA: Ensuring compliance and protecting privacy

Join us for an interactive webinar we dive into the CPRA, which will go into force on March 29th.

March 21, 2024

Privacy Management

The road to 50 states: New Jersey and New Hampshire join the US privacy landscape

oin OneTrust DataGuidance for a webinar highlighting the key requirements within the new US laws, New Jersey Senate Bill 332 and New Hampshire Senate Bill 255.

February 01, 2024

Privacy Automation

Embedding Privacy by Design through PIA Automation

Join us for a webinar on Embedding Privacy by Design through PIA Automation.

January 11, 2024

Privacy Management

Automating fulfillment of subject rights requests in the US

Learn how Privacy Rights Automation helps to fully automate privacy rights requests.

December 06, 2023

Privacy Management

December's deadline: Ensuring compliance with Utah's privacy regulation