ExecutiveOrdersEO
EO 14117Executive OrderBiden · D Quiet signal

Executive Order 14117

Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern

This executive order restricts countries of concern from accessing Americans' bulk sensitive personal data and U.S. government-related data through new regulations on data transactions, submarine cable licensing, and federal research funding. It directs the Attorney General and Homeland Security to issue regulations within 180 days to prohibit or restrict high-risk data transfers while avoiding broad data localization requirements or commercial decoupling. The order also mandates reports on genomic data risks and prior data transfers, with security requirements based on NIST cybersecurity frameworks.

Federal Register Open PDF 89 FR 15421

Impact dates

  1. APNSA review of recommendations on prior data transfers

  2. Recommendations to APNSA on detecting, assessing, mitigating risks from prior data transfers

  3. Report to President on effectiveness and economic impact

  4. Federal agencies to jointly submit report on progress implementing health/genomic data protections

  5. Attorney General to publish proposed rule for notice and comment

  6. Report on risks and benefits of regulating human 'omic data other than genomic data

Key directives

  • Attorney General to issue regulations prohibiting/restricting U.S. persons from data transactions with countries of concern involving bulk sensitive personal data or government-related data
  • Secretary of Homeland Security through CISA to propose security requirements for restricted transactions based on NIST frameworks
  • Committee for Assessment of Foreign Participation in U.S. Telecommunications Services Sector to prioritize submarine cable license reviews
  • Federal agencies (DOD, HHS, VA, NSF) to consider prohibiting or mitigating assistance enabling data access by countries of concern
  • CFPB Director encouraged to address data broker threats under consumer protection authority

Who is ordered

Timeline

Immediate

  • Expansion of national emergency declared in EO 13873

Near term (90d)

  • Attorney General to publish proposed rule for notice and comment (by August 26, 2024)
  • Report on human 'omic data risks due (by June 27, 2024)
  • CFPB encouraged to consider rulemaking steps on data brokers

Long term

  • Final regulations implementing prohibited/restricted transactions
  • Security requirements for restricted transactions finalized
  • Report on prior data transfer risks due 120 days after regulations effective
  • Effectiveness and economic impact report due 1 year after regulations effective
  • Federal agencies to issue guidance on protecting health/genomic data

Risks & tensions

  • Regulatory burden on data-intensive industries may affect U.S. competitiveness; report explicitly requires economic impact assessment
  • Definition of 'countries of concern' and 'covered persons' delegated to regulations, creating implementation uncertainty
  • Exemption for financial services and statutory compliance creates potential loopholes
  • Balancing national security with open scientific research and cross-border data flows for commerce explicitly acknowledged as tension
  • Submarine cable provisions may affect internet infrastructure investment and global connectivity
  • 'Omic data report delay (120 days) defers regulation of proteomic, epigenomic, metabolomic data
  • Vague 'as appropriate' and 'consider taking steps' language in several provisions reduces enforceability
Executive Order 14117: Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern · Executive Orders