Overview
This series explains when the DOJ Data Security Program treats commercial data access as a national-security transaction rather than only a privacy or cybersecurity issue. It connects data categories, bulk thresholds, government-related status, linkage, access capability, counterparty status, and qualifying transaction forms under 28 CFR Part 202. It then separates exemptions and authorizations from prohibited, restricted, and anti-evasion paths; shows the mandated security requirements and Data Compliance Program for qualifying restricted transactions; and follows audits, records, reporting, and change management. The result is a fact-specific decision record, not a blanket rule for foreign access or a substitute for other law.
Learning outcomes
- Coverage requires government-related or bulk U.S. sensitive personal data, relevant access, a country of concern or covered person, and a qualifying transaction form.
- Bulk is category-specific and measured over the preceding 12 months; aggregation and linkage can change the result, while government-related data can qualify regardless of volume.
- Prohibited data brokerage and bulk human ‘omic access cannot be made permissible by stronger controls or contracts, absent a valid exemption or authorization.
- Qualifying restricted vendor, employment, and investment transactions require mandated security requirements and a written, individualized, risk-based Data Compliance Program.
- Exemptions, licenses, and advisory opinions are bounded by purpose, facts, and terms; audits, records, and reports preserve an accountable decision trail.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
When does the DOJ Data Security Program treat data access as a covered transaction?
The DSP treats access as a covered data transaction when government-related or bulk U.S. sensitive personal data, access by a country of concern or covered person, and a data-brokerage, vendor, employment, or investment agreement align.
What makes a DOJ Data Security Program transaction prohibited rather than restricted?
A transaction is prohibited when Part 202 places it in a barred category, such as covered data brokerage, bulk human ‘omic data or related biospecimens, or evasion; it is restricted when a qualifying vendor, employment, or investment transaction may proceed only under mandated conditions.
How do exemptions, licenses, and advisory opinions change a DSP analysis?
An exemption applies only to the specified purpose and conditions; a license authorizes conduct within its terms, while an advisory opinion states NSD’s present enforcement intentions and is not a license or universal safe harbor.
What evidence does the DOJ Data Security Program require for ongoing compliance?
A company must preserve records showing the data, parties, access, purpose, transfer method, classification, controls, and decision. Part 202 generally requires records for at least ten years; restricted transactions also require annual audits, and specified events can trigger reports.