Biden orders DOJ, other federal agencies to protect Americans' personal data

President Joe Biden on Wednesday called on the Department of Justice and other federal agencies to prevent “countries of concern” from accessing Americans’ personal and government-related data. 

Biden’s executive order directs the DOJ to issue regulations protecting Americans from a “large-scale transaction” of their sensitive personal data.

Americans’ data are being collected by companies and legally sold through information brokers to countries of concern, which include China, Russia, Iran, North Korea, Cuba and Venezuela, the White House said.

“The sale of Americans’ data raises significant privacy, counterintelligence, blackmail risks and other national security risks—especially for those in the military or national security community,” the White House added. “Countries of concern can also access Americans’ sensitive personal data to collect information on activists, academics, journalists, dissidents, political figures, and members of non-governmental organizations and marginalized communities to intimidate opponents of countries of concern, curb dissent, and limit Americans’ freedom of expression and other civil liberties.” 

Specifically, the order directs the Justice Department to protect personal data such as genomic data, biometric data, personal health data, geolocation data, financial data, and specific personal identifiers. 

The Justice Department will also issue regulations to protect government-related data, such as geolocation information on sensitive government sites and information about military members. The Department of Homeland Security will work with the Justice Department to set security standards to prevent countries of concern from accessing Americans’ data through commercial means, the White House said. 

“Our adversaries are exploiting Americans’ sensitive personal data to threaten our national security,” U.S. Attorney General Merrick Garland said in a statement. “They are purchasing this data to use to blackmail and surveil individuals, target those they view as dissidents here in the United States, and engage in other malicious activities. This Executive Order gives the Justice Department the authority to block countries that pose a threat to our national security from harvesting Americans’ most sensitive personal data—including human genomic data, biometric and personal identifiers, and personal health and financial data.”

The DOJ stated that it would issue an advance notice of proposed rulemaking describing the initial categories of transactions involving bulk sensitive personal data or specific government-related data. The department will also seek public comment on items it contemplates regulating, such as prohibitions on data brokerage and transfers of genomic data and restrictions on vendor, employment and investment agreements.

Related: 5 U.S. data privacy laws going into effect in 2024

“Today, we make clear that American citizens’ sensitive and personal data is not for sale to our adversaries,” Deputy U.S. Attorney General Lisa Monaco said in a statement. “The Justice Department has long focused on preventing threat actors from stealing data through the proverbial back door. This executive order shuts the front door by denying countries of concern access to Americans’ most sensitive personal data.”

The executive order also directs the departments of Health and Human Services, Defense and Veterans Affairs to ensure that countries of concern do not use federal grants, contracts and awards to access sensitive health data.

The order also encourages the Consumer Financial Protection Bureau to consider protecting Americans from data brokers illegally assembling and selling sensitive data, including that of U.S. military personnel.

CFPB Director Rohit Chopra called the order a “reminder of the urgent need to protect the personal data of Americans.” 

“Corporate data brokers are assembling and selling extremely sensitive data on all of us, including U.S. military personnel, to foreign purchasers,” Chopra said in a statement. “The executive order calls on the CFPB to utilize its legal authorities to provide greater protections. This year, we will be proposing new rules to rein in these abuses that will safeguard families and our national security.”