There are, generally, no geographic transfer restrictions that apply in the US, except regarding the storing of some governmental records and information. However, the HIPAA Privacy Rule requires that covered entities not disclose protected health information outside the US without appropriate safeguards.

Executive Order 14117 

Additionally, on February 28, 2024, Executive Order 14117 'Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern' (EO), set forth that '[i]t is the policy of the United States to restrict access by countries of concern to Americans’ bulk sensitive personal data and United States Government-related data when such access would pose an unacceptable risk to the national security of the United States.' Under the EO, the Attorney General is authorized to determine and identify classes of transactions that 'pose an unacceptable risk to the national security of the United States because the transactions may enable countries of concern or covered persons to access bulk sensitive personal data or United States Government-related data.' In this context 'sensitive personal data' includes covered personal identifiers (such as SSN, passport and government IDs), personal financial data, personal health data, precise geolocation data, biometric identifiers, and human 'omic data or a combination thereof. However, it is important to note that the EO does not broadly set forth general bulk transfer restrictions, but is focused on regulating specific transfers that could be of concern to national security. 

Pursuant to the EO, following its Advance Notice of Proposed Rulemaking (ANPRM) publication in the Federal Register on March 5, 2024, and subsequent Notice of Proposed Rulemaking (NPRM) from October 21, 2024, the Department of Justice (DOJ) issued its Final Rule to implement EO 14117 (Rule) to the EO. The Rule sets forth definitions, countries of concern, in-scope covered persons and defines prohibited, restricted, and transactions exempt under the Rule. In addition the Rule addresses the relevant processes to obtain licenses to authorize otherwise prohibited or restricted transactions, provides protocols for the designation of covered persons, and sets forth requirements related to advisory opinions, and recordkeeping, reporting, and other audit and due diligence obligations applicable to covered transactions. The Rule will come into effect 90 days from the date of the Rule’s publication, with certain requirements (eg, due diligence, reporting, and auditing requirements) coming into effect 270 days after publication.  The DOJ announced that it intends to publish additional compliance, enforcement, and other practical guidance and clarifications. Such supplemental guidance will be located at www.justice.gov/nsd/data-security.

Final Rule to implement Executive Order 14117

Under the Rule certain highly sensitive transactions are prohibited in their entirety ('prohibited transactions'), while other classes of transactions are restricted but permitted to the extent they comply with predefined security requirements to mitigate the risk of access to certain high-risk 'bulk data' by 'countries of concern' ('restricted transactions'). The Rule prohibits or limits U.S. persons from knowingly engaging in prohibited and restricted transfers that pose an unacceptable risk of providing 'countries of concern' or 'covered persons' access to US government-related data or bulk sensitive personal data as such terms are defined under the EO and Rule. Accordingly the Rule:

• classifies:
  • prohibited, restricted, and exempt transactions
  • countries of concern to which the prohibitions and restrictions apply
  • covered persons to which the prohibitions and restrictions apply, and
• identifies and establishes:
  • the processes for licensing and advisory opinions
  • threshold for applicability of the prohibitions and restrictions on covered data 
    transactions involving bulk sensitive personal data
  • recordkeeping, auditing reporting, and other compliance requirements, and
  • enforcement mechanisms including civil penalties 

Key Definitions and Classifications under the Rule

Countries of Concern

The Rule identifies six countries as countries of concern:

• China (including Hong Kong and Macau)
• Cuba
• Iran
• North Korea
• Russia, and
• Venezuela 

Sensitive Personal Data

Under the Rule the definition of sensitive personal data includes covered personal identifiers (e.g., names linked to device identifiers, Social Security numbers, driver’s license, or other government identification numbers), precise geolocation data, biometric identifiers, human 'omic data, personal health data, personal financial data, or any combination thereof.

Notably, the definition categorically excludes public or nonpublic data that does not relate to an individual, including trade secrets or proprietary information (that meet the relevant definition), data that is, at the time of the transaction, lawfully available to the public from a Federal, State, or local government record (eg, court records) or via widely distributed media (ie, sources generally available to the public via unrestricted access), personal communications, and information or informational materials, including ordinarily associated metadata or metadata reasonably necessary to enable the transmission or dissemination of such information or informational materials.

Bulk Data

The term 'bulk' refers to any amount of sensitive personal data that meets or exceeds the following thresholds at any point in the prior 12 months, regardless whether through a single covered data transaction or aggregated across covered data transactions involving the same U.S. person and the same foreign or covered person:

• human genomic data collected or maintained on more than 100 U.S. persons
• human 'omic data collected or maintained on more than 1,000 U.S. persons
• biometric identifiers collected or maintained on more than 1,000 U.S. persons
• precise geolocation data collected or maintained on more than 1,000 U.S. devices
• personal health data collected or maintained on more than 10,000 U.S. persons
• personal financial data collected or maintained on more than 10,000 U.S. persons
• certain covered personal identifiers collected or maintained on more than 100,000 U.S. persons
• any combination of the above data types that meets the lowest threshold for any category in the dataset

Bulk U.S. Sensitive Personal Data

The term 'bulk U.S. sensitive personal data' means a collection or set of sensitive personal data relating to U.S. persons, in any format, regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted, where such data meets or exceeds the applicable threshold set forth above.

Covered Data Transaction

A 'covered data transaction' is any transaction that involves any access by a country of concern or covered person to any government-related data or bulk U.S. sensitive personal data and that involves:

• data brokerage
• a vendor agreement
• an employment agreement, or
• an investment agreement

U.S. persons engaged in data brokerage with foreign persons who are not covered persons must comply with minimum conditions, including putting in place contract terms that prohibit the foreign person from subsequently reselling or providing access to the transferred data to countries of concern or covered persons.

Prohibited Transactions

The Rule provides for four categories of ‘prohibited transactions,' including:

• covered data transactions involving data brokerage with a country of concern or covered person,
• transactions involving any access by a foreign person to government-related data or bulk U.S. sensitive personal data and that involves data brokerage with any foreign person that is not a covered person unless the U.S. person agrees to certain contractual and reporting obligations.

The Rule further specifically prohibits:

• transactions involving access by a country of concern or covered person to bulk U.S. sensitive personal data that involves bulk human `omic data, or to human biospecimens from which bulk human `omic data could be derived, and
• any transaction that has the purpose of evading or avoiding, causes a violation of, or attempts to violate any of the Rule’s provisions.

The Rule also prohibits conspiring to violate the Rule.

Restricted Transactions

The Rule provides for three categories of 'restricted transactions':

• vendor agreements
• employment agreements, and
• non-passive investment agreements

In contrast to 'prohibited restrictions,' the rule permits 'restricted transactions,' provided that certain security requirements developed by the Department of Homeland Security’s Cybersecurity and Infrastructure Agency (CISA), are met to mitigate the risk of access by any 'countries of concern' or 'covered persons.' Restricted transactions involving access by countries of concern or covered persons to 'bulk U.S. sensitive personal data' or 'U.S. Government-related data' must comply with separate security requirements developed by CISA in coordination with the DOJ. Accordingly, CISA has also published its own security requirements. CISA's security requirements include data-level and organizational- and-covered system-level requirements.

Reporting Requirements

Under the Rule, certain U.S. persons must comply with reporting requirements to demonstrate compliance and safeguard national security. These include:

• annual reports filed by U.S. persons engaged in restricted transactions involving cloud-computing services, if they are 25% or more owned, directly or indirectly, by a country of concern or covered person
• reports by any U.S. person that has received and affirmatively rejected an offer from another person to engage in a prohibited transaction involving data brokerage
• reports by U.S. persons engaged in a covered data transaction involving data brokerage with a foreign non-covered person if the U.S. person knows or suspects that the foreign counterparty is violating the restrictions on resale and onward transfer to countries of concern or covered persons, and
• reports by U.S. persons invoking the exemption for certain data transactions that are necessary to obtain or maintain regulatory approval to market a drug, biological product, device, or a combination product in a country of concern.