Biden signs executive order to stop Russia and China from buying Americans’ personal data

President Joe Biden signed an executive order that aims to limit the bulk sale of Americans’ personal data to “countries of concern,” including Russia and China. The order specifically targets the mass sale of geolocation, genomic, financial, biometric, health and other personal information.

During a briefing with reporters, a senior administration official said selling such data to those countries poses a national security risk. “Our current policies and laws leave open access to vast amounts of America’s sensitive personal data,” the official said. “Purchasing data through data brokers is currently legal in the United States, and this reflects a gap in our national security toolkit that we are working to fill with this program.”

Researchers and privacy advocates have long warned of the national security risks posed by the largely unregulated, multibillion-dollar data broker industry. Last fall, researchers reported that they were able to easily buy a trove of personal and health data on US military personnel while posing as foreign agents.

Biden’s executive order attempts to address such scenarios. It prohibits data brokers and other companies from selling large amounts of Americans’ personal information to countries or organizations in Russia, China, Iran, North Korea, Cuba and Venezuela, directly or indirectly. There will likely be further restrictions on companies’ ability to sell data as part of cloud service contracts, investment agreements and employment contracts.

Although the White House described the move as “the most significant executive action a president has ever taken to protect the security of Americans’ data,” it’s unclear exactly how the Justice Department’s implementation of the new policies will be managed. A Justice Department official said the executive order would require data brokers to conduct due diligence to verify who they are dealing with, similar to how companies are expected to comply with U.S. sanctions.

As the White House notes, there is currently little regulation of the billion-dollar data broker industry. The order will not delay the bulk sale of Americans’ data to countries or companies not considered a security risk. “President Biden continues to urge Congress to do its part and pass comprehensive bipartisan privacy legislation, especially to protect the safety of our children,” the White House said in a statement.