Does the DOJ bulk data rule apply to company data?
The short answer
It can, when the buyer is foreign. The DOJ rule, 28 CFR Part 202, prohibits transfers to covered persons and requires contract terms against onward transfer for other foreign recipients. Its thresholds count de-identified data. Ask counsel whether your buyer and volumes fall inside it.
The Justice Department's Data Security Program is a national security rule, and a company-archive license can fall inside it.
Does the DOJ bulk data rule count a license to an AI lab as data brokerage?
Section 202.214 of the DOJ bulk data rule defines data brokerage as the sale of data, licensing of access to data, or similar commercial deals. Employment, investment and vendor agreements are excluded.
The rule covers transfers where the buyer did not collect the data directly from the people. A license of an archive to a lab fits that wording on its face.
Who is a covered person?
Section 202.211 covers two kinds of foreign entity:
- One that is 50% or more owned by a country of concern or by covered persons.
- One that is organized or based in a country of concern.
It also covers two kinds of individual:
- Employees or contractors of such entities.
- People who live mainly in a country of concern.
Section 202.601 lists the countries: China, Cuba, Iran, North Korea, Russia and Venezuela.
Under the rule's own example, Chinese or Russian citizens in the United States count as US persons.
What counts as bulk?
Section 202.205 sets thresholds over any 12 months:
- Personal health data on more than 10,000 US persons.
- Personal financial data on more than 10,000 US persons.
- Covered personal identifiers on more than 100,000 US persons.
- Biometric identifiers or precise geolocation on 1,000 persons or devices.
Section 202.212 excludes demographic or contact data that links only to other demographic or contact data. Names and email addresses alone fall there. Payroll, health or financial data inside HR mail may count toward a threshold. That second point is my reading.
What if the buyer is a different kind of foreign person?
Section 202.302 requires a US person to use a contract. The contract must bar the foreign buyer from onward data brokerage with a country of concern or covered person. The US person must also report any known or suspected violation within 14 days.
What is the penalty?
Section 202.1301 applies IEEPA. It sets a civil penalty of up to the greater of $368,136 or twice the transaction amount. Criminal penalties apply to willful violations.
Look up a buyer's ownership in public sources and take the legal analysis to your lawyer. Our rights check covers your own side: contracts, personal data and who can sign. The state data broker laws are a separate set of rules.
Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
