The House of Representatives passed the Protecting Americans’ Data from Foreign Adversaries Act (PADFA), and it’s gaining traction.This act cracks down on how data brokers can share sensitive data about US citizens with certain foreign countries.

Who should care about the Protecting Americans’ Data from Foreign Adversaries Act

The Protecting Americans’ Data from Foreign Adversaries Act has wide-ranging implications. Below’s a breakdown of who needs to pay attention and why.

  • Data brokers (biggest impact). These companies are ground zero for PADFA. They’ll face strict limitations on selling or sharing sensitive data about US citizens with foreign adversary countries (think China, Russia, North Korea, and Iran) or entities they control.
  • Businesses dealing with US personal information. Even if you’re not a traditional data broker, PADFA applies if you buy, sell, or use personal information of US citizens. You need to understand what constitutes “sensitive data” under PADFA and ensure your practices comply by the June 23rd deadline. This could include many online businesses that collect customer data.
  • Many online businesses. The net is wide. Many online businesses collect and use customer data. If they handle “sensitive data” and have foreign connections, PADFA compliance becomes important.

Overview of the Protecting Americans’ Data from Foreign Adversaries Act

The Protecting Americans’ Data from Foreign Adversaries Act is a recently passed bill in the US House of Representatives that safeguards sensitive personal information of US citizens. Below’s a quick rundown of the Act.

Prohibited transfers

Data brokers cannot sell, share, or otherwise provide access to “personally identifiable sensitive data” of US citizens to:

  • countries designated as “foreign adversary countries” (currently undefined but likely includes China, Russia, etc.)
  • any entity controlled by such countries.

The Act defines a “data broker” as an entity that sells or provides access to personal data they acquire from sources other than the individuals themselves.

Exceptions

While the Act excludes certain activities from the restrictions, such as:

  • Publishing news or information of public interest.
  • Acting as a service provider (e.g., email provider storing your data).

Types of sensitive data covered in the Act

The Act provides a detailed list of what constitutes “personally identifiable sensitive data,” including:

  • Government IDs (Social Security numbers, passports)
  • Health information
  • Financial information (account numbers, income)
  • Biometric and genetic data
  • Precise geolocation information
  • Private communications (emails, texts, phone records)
  • Login credentials
  • Information revealing sexual behaviour, race, religion, etc.
  • Online activity history
  • Information about minors

Enforcement of the Protecting Americans’ Data from Foreign Adversaries Ac

The Federal Trade Commission (FTC) is responsible for enforcing the Protecting Americans’ Data from Foreign Adversaries Act.

Effective date

The Protecting Americans’ Data from Foreign Adversaries Ac takes effect 60 days after it is signed into law. (President Biden signed it into law on April 24, 2024, so it likely takes effect around June 23rd).

Actions

  • Identify all data you collect and analyse how you share this data with third parties. This includes data brokers, cloud service providers, or any other entity involved in data processing or storage. You can ask us to help map your activities for you.
  • Carefully examine existing contracts with data brokers and other third-party vendors. Ensure they have strong data security practices and contractual obligations that prohibit them from sharing data with foreign adversaries as defined by PADFA. You can ask Michalsons to review your contracts.
  • Protect yourself by establish clear internal policies and procedures for handling sensitive data. This includes data access controls, data minimisation practices, and data retention policies. Michalsons can assist with drafting your internal policies.