President Joe Biden has signed an executive order that aims to limit the mass-sale of Americans’ personal data to “countries of concern,” including Russia and China. The order specifically targets the bulk sale of geolocation, genomic, financial, biometric, health and other personally identifying information.
During a briefing with reporters, a senior administration official said that the sale of such data to these countries poses a national security risk. “Our current policies and laws leave open access to vast amounts of American sensitive personal data,” the official said. “Buying data through data brokers is currently legal in the United States, and that reflects a gap in our national security toolkit that we are working to fill with this program.”
Researchers and privacy advocates have long warned about the national security risks posed by the largely unregulated multibillion-dollar data broker industry. Last fall, researchers reported that they were able to easily buy troves of personal and health data about US military personnel while posing as foreign agents.
Biden’s executive order attempts to address such scenarios. It bars data brokers and other companies from selling large troves of Americans’ personal information to countries or entities in Russia, China, Iran, North Korea, Cuba and Venezuela either directly or indirectly. There are likely to be additional restrictions on companies’ ability to sell data as part of cloud service contracts, investment agreements and employment agreements.
Though the White House described the step as “the most significant executive action any President has ever taken to protect Americans’ data security,” it’s unclear how exactly enforcement of the new policies will be handled within the Justice Department. A DoJ official said the executive order would require due diligence from data brokers to vet who they are dealing with, similar to the way companies are expected to adhere to US sanctions.
As the White House points out, there are currently few regulations for the multibillion-dollar data broker industry. The order will do nothing to slow the bulk sale of Americans’ data to countries or companies not deemed to be a security risk. “President Biden continues to urge Congress to do its part and pass comprehensive bipartisan privacy legislation, especially to protect the safety of our children,” a White House statement says.