Protecting Americans' Data (E.O. 14117)

Summary

Stops certain foreign countries from getting large amounts of Americans' private data to protect national security.

What problem does this solve?

Certain foreign countries are trying to get large amounts of private data on Americans, which they can use with AI for spying and other harmful activities. This order creates rules to block or limit the transfer of this data to those countries, protecting U.S. national security.

What does this order do?

Authorizes new rules to block sensitive data transfers

Directs the Attorney General to create regulations that prohibit or restrict transactions involving Americans' bulk sensitive personal data with countries of concern.

Defines sensitive personal data to be protected

Identifies protected data types, including personal identifiers, geolocation, biometrics, health data, financial data, and human genomic data.

Increases scrutiny of submarine data cables

Requires a government committee to prioritize reviewing licenses for submarine cables connected to countries of concern to prevent them from accessing data.

Protects health and genomic data from foreign access

Directs federal agencies like the DoD and HHS to prevent federal funding from enabling countries of concern to access Americans' health and genomic data.

Targets data brokers selling personal information

Encourages the Consumer Financial Protection Bureau (CFPB) to use its authority to address data brokers that collect and sell Americans' sensitive data.

Who does this affect?

U.S. citizens
Data-related businesses (tech, healthcare, data brokers)
Foreign entities from countries of concern

What is the real world impact?

•

Protects national security from foreign threats

Prevents countries of concern from using Americans' personal data for spying, blackmail, or building advanced AI that could be used against the United States.

•

Could impact international business and data flows

Restricting data transfers could create challenges for U.S. companies that operate globally, potentially disrupting trade, scientific research, and economic relationships with other countries.

•

Targets geopolitical rivals like China and Russia

Uses the term 'countries of concern' to create broad authority to target specific foreign adversaries without explicitly naming them, in an effort to counter their technological and intelligence gathering capabilities.

When does this start?

This order takes effect on February 28, 2024, and sets several deadlines for federal agencies to propose and finalize new rules.

Proposed rule on data transactions

Within 180 days of the order (by August 26, 2024), the Attorney General must publish a proposed rule to prohibit or restrict data transactions.

Report on other human biological data

Within 120 days of the order (by June 27, 2024), a report must be submitted to the President assessing the risks of regulating other types of human 'omic data.

Recommendations on past data transfers

Within 120 days of the new regulations' effective date, agencies must recommend actions to address risks from past data transfers to countries of concern.

Progress report on protecting health data

Within 1 year of the order (by February 28, 2025), relevant agencies must report their progress on protecting sensitive health data from foreign access.