Outside the Beltway

Protecting Privacy in a World Without Privacy

A well-intentioned but likely doomed effort.

James Joyner · Wednesday, February 28, 2024 · 4 comments

CBS News (“White House, Justice Department unveil new plan to protect personal data from China and Russia“):

The Biden administration is proposing regulations to help the Justice Department stop data brokers from selling Americans’ personal information to “countries of concern,” the White House announced Wednesday.

President Biden is issuing an executive order that will for the first time propose guardrails that shield bulk biometric and healthcare data and financial information collected by businesses inside the U.S. and that are aimed at preventing the material from being transferred to foreign adversaries, including China, Russia, Iran, Cuba, Venezuela and North Korea. The data — including genomic and geolocation information — are collected by tech companies and sold by legal means to data brokers but can eventually make their way to scammers and intelligence agencies abroad.

The regulations announced Wednesday are expected to work to prevent that. Attorney General Merrick Garland said in a statement that the executive order would give the Justice Department “the authority to block countries that pose a threat to our national security from harvesting Americans’ most sensitive personal data.”

Senior administration and Justice Department officials say the goal of the new proposed rules is to prevent bad actors located in specific nations from exploiting the lawful free flow of data by scooping up large amounts of Americans’ personal information for misuse.

Personal information collected by U.S. companies is an important resource that nations like China and Russia can leverage into malicious cyber campaigns or attacks on dissidents and activists who challenge their regimes, the officials said.

The new regulations won’t go into effect right away, but will undergo a series of reviews to allow stakeholders to weigh in on them. The government is trying to minimize any economic impacts. Once enacted, the regulations will set expectations for corporations and data brokers to prevent them from transferring data to certain actors who are identified as being of concern to U.S. national security, according to a senior Justice Department official. Enforcement measures against brokers will follow should they violate the rules.

Data broker sales of personal information to nations like China and Russia will be prohibited outright, while security requirements will have to be met before companies can enter into vendor, employment or investment agreements in those countries.

There’s very little to go on here, but I honestly don’t see how this can possibly work—especially with regard to China. Like it or not, our two economies are ridiculously intertwined and, more importantly, most “American” companies have vast Chinese operations. Given that there’s little distinction between the PRC, the Chinese Communist Party, and any large Chinese corporation, this effectively means the Chinese government already has any information that many of these companies have.