Biden acts to better protect Americans’ personal data such as health records and finances

WASHINGTON (AP) — President Joe Biden is signing an executive order aimed at better protecting Americans’ personal data on everything from biometrics and health records to finances and geolocation from foreign adversaries like China and Russia.

The move allows the Department of Justice and other federal agencies to take steps to prevent the large-scale transfer of Americans’ personal data to what the White House calls “countries of concern.” The goal is to do so without limiting legitimate commerce around data, senior Biden administration officials said on a call with reporters.

Biden’s move targets commercial data brokers, the sometimes shadowy companies that traffic in personal data and that officials say may sell information to foreign adversaries or U.S. entities controlled by those countries.

Most eventual enforcement mechanisms still have to clear complicated and often monthslong rulemaking processes. Still, the administration hopes eventually to limit foreign entities, as well as foreign-controlled companies operating in the U.S., that might otherwise improperly collect sensitive data, the senior officials said.

Data brokers are legal in the U.S. and collect and categorize personal information, usually to build profiles on millions of Americans that the brokers then rent or sell.

The officials said activities like computer hacking are already prohibited in the U.S., but that buying potentially sensitive data through brokers is legal. That can represent a key gap in the nation’s national security protections when data is sold to a broker knowing it could end up in the hands of an adversary — one the administration now aims to close with the president’s executive action.

“Bad actors can use this data to track Americans, including military service members, pry into their personal lives, and pass that data on to other data brokers and foreign intelligence services,” the White House wrote in a fact sheet announcing the move. “This data can enable intrusive surveillance, scams, blackmail, and other violations of privacy.”

The order directs the Department of Justice to issue regulations that establish protections for Americans’ sensitive personal data, as well as sensitive government-related data — including geolocation information on sensitive government sites and members of the military.

Justice officials also plan to work with Homeland Security officials to build safety standards to prevent foreign adversaries from collecting data. It will further attempt better checks to ensure that federal grants going to various other agencies, including the departments of Defense and Veterans Affairs, aren’t used to facilitate Americans’ sensitive data flowing to foreign adversaries or to U.S. companies aligned with them.

The senior administration officials said they were concerned about China, Russia, North Korea, Iran, Cuba and Venezuela. But it is China — and TikTok, which has over 150 million American users and is a wholly owned subsidiary of Chinese technology firm ByteDance Ltd. — that U.S. leaders have been most vocal about.

Asked on Wednesday if the Biden administration is worried about TikTok when it comes to trafficking sensitive data, White House press secretary Karine Jean-Pierre responded, “We do have concerns — that’s why we put out” the executive order. But she also added that it “does not cover any one company.”

Rep. Mike Gallagher, a Wisconsin Republican who chairs the House Select Committee on the Chinese Communist Party, recently noted, “There’s no such thing as a private business in China.”

The senior administration officials stressed that the executive action was designed to work in conjunction with legislative action. So far, however, numerous bills seeking to establish federal privacy protections have failed to advance in Congress. Jean-Pierre said the White House would like to see Congress also impose new protections, but declined to discuss what that might look like or when it could be approved.

Albert Fox Cahn, a Harvard fellow and executive director of the nonprofit Surveillance Technology Oversight Project, said the order doesn’t address the core issue of Americans’ exposure to rampant data collection by industry and government -- and the absence of a federal privacy law.

“For most Americans, the country of greatest concern on surveillance is the U.S. Americans are tracked every day by an increasingly invasive array of private data brokers and government agencies, transforming nearly every aspect of our digital lives into a marketing and policing tools,” he said.

“This executive order will do almost nothing to address the real privacy needs that most Americans have, and continues to conflate surveillance capitalism with foreign surveillance. Only in Washington, does privacy once again get misunderstood as a foreign threat, rather than a domestic industry,” he added. “None of this is a substitute for the civil rights and privacy protections the public so desperately needs.”

But Vienna-based privacy researcher Wolfie Christl called the executive order “a good first step” that may force a number of data-collection and trafficking companies “to rethink their data practices at a more fundamental level. Otherwise, they may not be able to comply.”

“The executive order may help to fix some of the most pressing issues regarding national security in the US, but leaves many other problems unaddressed,” he said.