DOJ Publishes Final Rule Restricting Bulk Cross-Border Data Transfers Of Sensitive Data To Foreign Persons

On April 8, the U.S. Department of Justice's (DOJ) Final Rule, codified at 28 CFR Part 202, (Final Rule), implementing President Biden's Executive Order 14117 "Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons," came into effect. The Final Rule prohibits or restricts certain bulk transfers of sensitive personal data or U.S. government-related data to certain countries of concern and certain entities and individuals that reside in or are otherwise associated with a country of concern. The Final Rule imposes both civil and criminal penalties on offenders. The Final Rule has a far-reaching effect, influencing various activities from mergers & acquisitions to employment contracts, data licensing, and supplier management. As data exposure has shifted from being a privacy matter to an issue of national security, companies across industries need to reevaluate their cross-border data transfers