The United States Restricts Data Flows to "Concerning" Countries

The limitation of personal data transfers to China, North Korea, Cuba, Iran, Russia, and Venezuela will take effect in three months.

On December 27, 2024, the United States Department of Justice (DoJ) published its “final rule” on restricting the flow of sensitive personal data to “concerning” countries. This rule implements Executive Order 14117, issued in February 2024 by President Joe Biden. It targets China (including Hong Kong), North Korea, Cuba, Iran, Russia, and Venezuela and will become operational within three months.

The DoJ aims to ensure that “the personal data of Americans is no longer permitted to be sold to hostile foreign powers, whether through direct purchase or other means of commercial access.” The final rule sets strict thresholds for critical personal information flows, specifically:

Human “genomic” data (related to DNA, RNA, etc.);
Biometric identifiers;
Precise geolocation data;
Personal health information;
Personal financial data;
“Certain personal identifiers.”

The rule also includes extensive administrative provisions regarding licenses, protocols, and mandatory declarations governing these flows. However, the final rule does not impose any restrictions on the geographic location of sensitive data, including data related to the U.S. government.