The Biden administration has identified “countries of concern” exploiting Americans’ sensitive personal data as a national emergency. To address the crisis, the White House issued an executive order on Feb. 28, 2024, aimed at preventing these countries from accessing Americans’ bulk sensitive personal data.
The order doesn’t specify the countries, but news reports cited unnamed senior administration officials identifying them as China, Russia, North Korea, Iran, Cuba and Venezuela.
The executive order adopts a simple, broad definition of sensitive data that should be protected, but the order is limited in the protections it affords.
The order’s larger significance lies in its stated rationale for why the U.S. needs such an order to protect people’s sensitive data in the first place. The national emergency is the direct result of the staggering quantities of sensitive personal data up for sale – to anyone – in the vast international commercial data market, which is comprised of companies that collect, analyze and sell personal data.
Data brokers are using ever-advancing predictive and generative artificial intelligence systems to gain insight into people’s lives and exploit that power. This is increasingly posing risks to individuals and to domestic and national security.
I am an attorney and law professor, and I work, write and teach about data, information privacy and AI. I appreciate the spotlight the order puts on the dangers of the data market by acknowledging that companies collect more data about Americans than ever before – and that the data is legally sold and resold through data brokers. These dangers underscore Congress’ failure to protect people’s most sensitive data.
Sensitive personal data can be fodder for blackmail, raises national security concerns, and can be used as evidence for prosecutions. This is especially true in this era of misinformation and deepfakes – AI-generated video or audio impersonations – and with recent U.S. federal and state court rulings that permit states to restrict and criminalize private personal choices, including those related to reproductive rights. The executive order seeks to protect Americans from these risks – at least from those countries of concern.
In addition to the executive order attempting to prevent adversary countries from accessing Americans’ bulk sensitive data, the Biden administration is also investigating the privacy risk posed by Chinese cars sold in the U.S.
What the executive order does
The order issues directives to federal agencies to counter certain countries’ continuing efforts to access Americans’ bulk sensitive personal data as well as U.S. government-related data. Among other concerns, the order emphasizes that personal data could be used to blackmail people, including military and government personnel.
Under the order, the Department of Justice…