Access Now welcomes U.S. President Joe Biden’s Executive Order (EO) restricting data sales to foreign countries but calls for Congressional action. The EO issued on February 28 aims to safeguard bulk sensitive personal data of U.S. persons, refugees, and others, and U.S. government-related data from foreign governments.
Empowering the U.S. Departments of Justice (DOJ) and Homeland Security (DHS), the EO grants authority to restrict data brokers and other companies from selling a wide range of sensitive personal data, including genomic, biometric, and military information to “countries of concern” like China, Russia, Iran, North Korea, Cuba, and Venezuela.
Notably, the White House statement urges Congress again to enact comprehensive bipartisan privacy legislation, a pursuit that has yielded minimal results. For years, Congress has been negligent in protecting people’s most sensitive data, skirting a long-overdue responsibility in the digital age.
While appreciating the attention given to safeguarding people’s data against national security threats, much more must be done at home. We need to tackle international and domestic data broker sales. The Executive Order does not and cannot fully mitigate the broader risks inherent in the data broker industry. We need legislative action from Congress.Willmary Escoto, U.S. Policy Counsel at Access Now
The DOJ and DHS will also collaborate to set high-security standards to prevent access to people’s data through investment, vendor, and employment relationships. The U.S. Departments of Health and Human Services, Defense, and Veterans Affairs will work together to ensure that federal grants, contracts, and awards do not inadvertently facilitate access to sensitive health data.
Despite these positive steps, the EO is imperfect and contains certain ambiguities. The EO’s focus on data broker sales outside the U.S. leaves unaddressed red flags civil society has raised, including law enforcement bypassing the 4th amendment to acquire sensitive data from brokers. Access Now has long advocated for closing the data-broker loophole in the U.S. by passing legislation like the Fourth Amendment is Not for Sale Act, which would ban all government agencies from buying personal information from data brokers without a court order.
The EO also needs to address uncertainties surrounding geolocation data broker practices in a post-Roe world and has been criticized for failing to account for selling data to third parties outside the U.S. that could turn around and sell that data to foreign adversaries.
In tandem with the EO, the U.S. Department of Justice issued an Advance Notice of Proposed Rulemaking (ANPRM) to provide detailed insights into the proposed rules, including the specific data transactions that will be prohibited.
Access Now looks forward to submitting comments to the ANPRM and collaborating with civil society partners for transparent policies, accountability, and inclusive data protection.