White House, Justice Department unveil new plan to protect personal data from China and Russia

Washington — The Biden administration is proposing regulations to help the Justice Department stop data brokers from selling Americans' personal information to "countries of concern," the White House announced Wednesday.

President Biden is issuing an executive order that will for the first time propose guardrails that shield bulk biometric and healthcare data and financial information collected by businesses inside the U.S. and that are aimed at preventing the material from being transferred to foreign adversaries, including China, Russia, Iran, Cuba, Venezuela and North Korea. The data — including genomic and geolocation information — are collected by tech companies and sold by legal means to data brokers but can eventually make their way to scammers and intelligence agencies abroad.

The regulations announced Wednesday are expected to work to prevent that. Attorney General Merrick Garland said in a statement that the executive order would give the Justice Department "the authority to block countries that pose a threat to our national security from harvesting Americans' most sensitive personal data." 

Senior administration and Justice Department officials say the goal of the new proposed rules is to prevent bad actors located in specific nations from exploiting the lawful free flow of data by scooping up large amounts of Americans' personal information for misuse. 

Personal information collected by U.S. companies is an important resource that nations like China and Russia can leverage into malicious cyber campaigns or attacks on dissidents and activists who challenge their regimes, the officials said. 

The new regulations won't go into effect right away, but will undergo a series of reviews to allow stakeholders to weigh in on them. The government is trying to minimize any  economic impacts. Once enacted, the regulations will set expectations for corporations and data brokers to prevent them from transferring data to certain actors who are identified as being of concern to U.S. national security, according to a senior Justice Department official. Enforcement measures against brokers will follow should they violate the rules. 

Data broker sales of personal information to nations like China and Russia will be prohibited outright, while security requirements will have to be met before companies can enter into vendor, employment or investment agreements in those countries. 

The executive order announced Wednesday is part of a growing effort by the Biden administration to counter the use of U.S. advances to undermine national security. U.S. officials continue to focus on ways foreign adversaries use investments to give them access to American technology and data.

"The Chinese government is not just hacking to gather our data," Deputy Attorney General Lisa Monaco said last year, as she announced the formation of the Disruptive Technology Strike Force. "If a company is operating in China and is collecting your data, it is a good bet that the Chinese government is accessing it." The year-old operation works to prevent Western technology from falling into the hands of bad actors. 

Administration officials said that while Wednesday's executive order is meant to bolster the vital relationship between national security and corporate government in protecting Americans' data. They added that it isn't a substitute for legislation that could enshrine certain privacy protections into law.