Biden moves to stop the sale of sensitive personal data to China and Russia

President Biden will issue an executive order Wednesday to restrict the sale of sensitive U.S. data to China, Russia and four more countries, a first-of-its-kind effort to prevent personally identifiable information from being obtained for blackmail, fraud or other harm. .

The president will ask the Justice Department to write rules that would prohibit the sale of information about Americans’ locations, health and genetics to China, Russia, Iran, North Korea, Cuba and Venezuela, as well as to entities affiliated with those countries. to limit. The restrictions would also cover financial information, biometric data and other types of information that could identify individuals, as well as sensitive information relating to the government.

The White House said this type of sensitive data could be used for blackmail, “particularly against those in the military or national security community,” and against dissidents, journalists and academics.

The new restrictions would be the first-ever broad ban in the United States on the sale of digital data to individual countries in an era when companies known as data brokers collect vast amounts of information about people, from favorite hobbies to family income and health status. and then typically sell it to marketers who target them with ads.

A senior government official said on a call with reporters that countries like China and Russia buy that kind of data from brokers, but also obtain it through other business relationships. The officials said the countries were using their access to the data for blackmail and surveillance and that they could use artificial intelligence to improve their use of the information. The White House made the officials available on condition of anonymity.

The executive order is also the latest escalation of a digital cold war between Washington and Beijing. The United States has cut Chinese hardware makers off from crucial supplies and tried to force the sale of TikTok, owned by Chinese internet company ByteDance. In August, Mr. Biden introduced restrictions to make it harder for American investors to pour money into developing sensitive technology, such as artificial intelligence and quantum computers, in China.

China also imposes restrictions on U.S. tech companies operating within its borders and blocks access to sites like Facebook and Google. Meanwhile, Chinese companies holding sensitive data have come under scrutiny in Washington. The government forced a Chinese company to sell the dating app Grindr and has raised concerns in the past about a Chinese genetics company, BGI.

Mr. Biden’s order is part of a trend in which countries are increasingly seeking to control data for their protection and economic benefit.

Governments in Europe have required companies to store data about their citizens within their national borders as they strive for what they call “digital sovereignty.” Russia has followed China’s example and built infrastructure that allows the government to completely block the internet.

The United States has long taken a lighter approach to regulating the flow of information over the Internet, beginning with President Bill Clinton’s 1997 declaration as a “global free trade area.”

Administration officials speaking to reporters on Tuesday sought to dispel the idea that the executive order was a sign that the approach was weakening. They said the United States remains committed to the free flow of data around the world and that the rules would free up the flow of data that multinational companies need to conduct normal operations such as processing payroll.

Mr. Biden’s order will kick off a process at the Justice Department to write the rules, in which the public and companies can provide feedback on how they should be structured.

In addition to banning the sale of sensitive individual data to brokers who could send it to China or other countries, the government is considering a strict ban on the sale of genomics data. It also outweighs the fact that companies are not allowed to provide sensitive data under other circumstances, for example through an investment agreement. Companies could get around these restrictions if they took steps to protect Americans’ privacy, such as encrypting the data.

The rules have been in the works for years. Mr. Biden is issuing the executive order about a week before he is scheduled to deliver the State of the Union address to Congress on March 7.

It’s still possible that the restricted countries could access Americans’ data without purchasing it. FBI Director Christopher A. Wray said in 2020 that if you are “an American adult, it is more likely than not that China has stolen your personal information.” He linked the Chinese military to the 2017 breach of credit reporting agency Equifax, which exposed the personal information of 150 million Americans.