US government says companies no longer allowed to send big data to these countries

US DoJ Issues Final Rule on Executive Order 14117
Large data transactions of US citizens to hostile countries will be banned
The ban will protect U.S. national security by preventing U.S. citizens from being targeted en masse by cyberespionage and foreign influence.

The US Department of Justice has published a final rule on Executive Order 14117, which President Joe Biden signed in February 2024, preventing the transfer of U.S. citizens’ data to a number of “countries of concern.”

The list of countries includes China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela, all of which, according to the Justice Department, “have engaged in a pattern in the long term or in serious cases of significantly unfavorable behavior towards States. the national security of the United States or the safety and security of American citizens.

He added that these countries could “access and exploit Americans’ sensitive personal data and certain data linked to the US government.”

No US data for hostile countries

The final rule will take effect in 90 days, with Assistant Attorney General Matthew G. Olsen of the Department of Justice’s National Security Division saying, “This powerful new national security program is designed to ensure that personal data Americans are no longer permitted to be disclosed. be sold to hostile foreign powers, whether through outright purchase or other means of commercial access.

The executive order aims to prevent countries generally hostile to the United States from using the data of American citizens in cyberespionage and influence campaigns, as well as to create profiles of American citizens intended to be used for the purposes of social engineering, phishing, blackmail and fraud. identity theft campaigns.

The final rule sets the threshold for data transactions that carry an unacceptable level of risk, as well as the various classes of transactions that are prohibited, restricted, or exempt. Businesses that violate this order will be subject to civil and criminal penalties. The types of prohibited data are:

Certain covered personal identifiers (e.g., names linked to device identifiers, social security numbers, driver’s licenses, or other government identification numbers)
Precise geolocation data (e.g. GPS coordinates)
Biometric identifiers (e.g. facial images, fingerprints and voice patterns and retina scans)
Human genomic data and three other types of human omics data (epigenomics, proteomics or transcriptomics)
Personal health data (e.g., height, weight, vital signs, symptoms, test results, diagnosis, digital dental records, and psychological diagnoses)
Personal financial data (for example, information relating to an individual’s credit, debit cards, bank accounts and financial debts, including payment history)

The DoJ also emphasized that the final rule does not apply to “medical, health, or scientific research, or the development and marketing of new drugs” nor does it “generally prohibit U.S. citizens from engage in commercial transactions, including the exchange of financial and other data. part of the sale of commercial goods and services with countries of concern or covered persons, or impose measures aimed at broader decoupling of the substantive consumer, economic, scientific, and commercial relationships that the United States maintains with others country.

Via Hacker news