There is a new Biden executive order on American sensitive personal data that protects American citizens from exploitation by countries of concern. It relates to sensitive personal data or information. It authorises the Attorney General to prevent the large-scale transfer of American sensitive personal data to countries of concern and provides safeguards around other activities that can give those countries access to Americans’ sensitive data. This data can enable intrusive surveillance, scams, blackmail, and other privacy violations.

Biden has ordered the restriction of the prosessing of American sensitive personal data

Which countries are of concern?

The Biden executive order does not specify which countries are “countries of concern”. These will be specific later but we suppose countries like Russia, China and others will fall into this category.

What is American sensitive personal data?

American sensitive personal data includes:

  1. genomic data,
  2. biometric data,
  3. personal health data,
  4. geolocation data,
  5. financial data, and
  6. certain kinds of personally identifiable information.

We will have to wait to see exactly what the list includes. It reminds me of the definition of special personal information or special categories of personal data in data protection laws. This will become a new classification of data that every organisation will have to track or discover.

How does the executive order impact you?

For now, the Biden executive order on American sensitive personal data is binding on government agencies in the United States – they need to take action. It does not impact the private sector. However, it might have an indirect impact on your organisation. If you process American sensitive personal data, you might be indirectly impacted. If you are a cloud provider you might have to take technical measures in future to ensure that American sensitive personal data does not get transferred to countries of concern.

In a way, this Biden executive order is a data localisation law requiring certain personal data of Americans to be kept in the United States.

Actions you can take

  • Dive into the details of the Biden executive order by downloading it.
  • Determine how this impacts your organisation by joining our data protection programme and working through the transferring data across borders module.
  • Classify your data and check if you process any American sensitive personal data in any country of concern. If you do, work out what you’ll do in the future.