Department of Justice: Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons

B-337007

January 27, 2025

The Honorable Chuck Grassley
Chairman
The Honorable Richard J. Durbin
Ranking Member
Committee on the Judiciary
United States Senate

The Honorable Jim Jordan
Chairman
The Honorable Jamie Raskin
Ranking Member
Committee on the Judiciary
House of Representatives

Subject: Department of Justice: Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons

Pursuant to section 801(a)(2)(A) of title 5, United States Code, this is our report on a major rule promulgated by the Department of Justice (DOJ) entitled “Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons” (RIN: 1124-AA01). We received the rule on January 10, 2025. It was published in the Federal Register on January 8, 2025. 90 Fed. Reg. 1636. The effective date of the rule is April 8, 2025.

According to DOJ, this rule implements Executive Order 14117 of February 28, 2024, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.” DOJ stated that this rule implements the Order through categorical rules that regulate certain data transactions involving government-related data or bulk U.S. sensitive personal data that could give countries of concern or covered persons access to such data and present an unacceptable risk to U.S. national security.

Enclosed is our assessment of DOJ’s compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule. If you have any questions about this report or wish to contact GAO officials responsible for the evaluation work relating to the subject matter of the rule, please contact Charlie McKiver, Assistant General Counsel, at (202) 512-5992.

Shirley A. Jones
Managing Associate General Counsel

Enclosure

cc: Devin A. DeBacker
Chief, Foreign Investment Review Section
Department of Justice

ENCLOSURE

REPORT UNDER 5 U.S.C. § 801(a)(2)(A) ON A MAJOR RULE
ISSUED BY THE
DEPARTMENT OF JUSTICE
ENTITLED
“PREVENTING ACCESS TO U.S. SENSITIVE PERSONAL DATA AND
GOVERNMENT-RELATED DATA BY COUNTRIES OF CONCERN OR COVERED PERSONS”
(RIN: 1124-AA01)

(i) Cost-benefit analysis

The Department of Justice (DOJ) conducted a Final Regulatory Impact Analysis for this rule. See 90 Fed. Reg. 1702 (Jan. 8, 2025). DOJ estimates the discounted annualized cost of the rule to be approximately $459 million annually. DOJ noted that while the benefits to national security are difficult to quantify, DOJ expects them to be substantial, including preventing the use of data by countries of concern and covered persons to micro-target U.S. persons, to aggregate insights from large datasets to target U.S. Government and private-sector activities, and to enhance military capabilities that include facilitating the development of bioweapons.

(ii) Agency actions relevant to the Regulatory Flexibility Act (RFA), 5 U.S.C. §§ 603–605, 607, and 609

DOJ prepared a Final Regulatory Flexibility Analysis. The analysis included (1) a succinct statement of the objectives of, and legal basis for, the rule; (2) a description of and, where feasible, an estimate of the number of small entities to which the rule will apply; (3) a description of the projected reporting, recordkeeping, and other compliance requirements of the rule, and (4) an identification of all relevant federal rules that may duplicate, overlap or conflict with this rule. See 90 Fed. Reg. 1703–1705.

(iii) Agency actions relevant to sections 202–205 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. §§ 1532–1535

DOJ stated that because the entirety of this rule and every provision in it addresses the national emergency described by the President in Executive Order 14117, DOJ concluded that the Unfunded Mandates Reform Act does not apply to this rule. 90 Fed. Reg. 1706.

(iv) Other relevant information or requirements under acts and executive orders

Administrative Procedure Act, 5 U.S.C. §§ 551 et seq.

On October 29, 2024, DOJ published a proposed rule. See 89 Fed. Reg. 86118. DOJ received 75 timely comments from trade associations, public interest advocacy groups, think tanks, private individuals, and companies, as well as comments from several foreign governments. DOJ summarized and responded to comments in the final rule. See 90 Fed. Reg. 1642–1702.

Paperwork Reduction Act (PRA), 44 U.S.C. §§ 3501–3520

DOJ determined that this rule contains information collection requirements under the Act. 90 Fed. Reg. 1705.

Statutory authorization for the rule

DOJ promulgated this rule pursuant to 50 U.S.C. §§ 1701 et.seq.; 50 U.S.C. §§ 1601 et.seq.; and 3 U.S.C. § 301.

Executive Order No. 12866 (Regulatory Planning and Review)

DOJ stated that this rule is significant under the Order. See 90 Fed. Reg. 1702.

Executive Order No. 13132 (Federalism)

DOJ determined that this rule does not have federalism implications. See 90 Fed. Reg. 1705.