Overview

Under the DOJ Data Security Program, certain covered data-brokerage transactions with a country of concern or covered person are prohibited, as are covered transactions involving bulk human ‘omic data or related biospecimens unless an exemption or authorization applies. The prohibition can reach access through advertising technology, AI products, or other interfaces, not only raw files. Part 202 also bars evasion, attempts, conspiracies, and knowingly directing prohibited or noncompliant restricted conduct. Contracts and security controls address defined risks but do not legalize a prohibited path; the factual purpose, capability, counterparty, and route determine the analysis.

Learning outcomes

A covered data-brokerage transaction with a country of concern or covered person is prohibited unless a valid exemption or authorization applies.
Bulk human ‘omic data and related biospecimens receive a prohibition analysis, not an automatic restricted path; scientific or medical purpose alone is not enough.
Contracts and security controls cannot turn prohibited conduct into authorized conduct; they matter where the rule creates a conditional path or defined onward-transfer duty.

Keywords

Data Security ProgramProhibited transactionsAnti-evasionData brokerageHuman ‘omic dataBiospecimens

The Red Line: Prohibited Transactions and Anti-Evasion

The DOJ Data Security Program does not treat every covered transaction as a problem that can be solved by adding encryption, a contract, or a compliance officer. This chapter focuses on the transactions the rule places on its prohibited side, and on the indirect routes that can create the same result. The practical judgment is categorical: once the facts establish a prohibited path, the organization must stop treating controls or paperwork as permission and must instead prevent, reject, and appropriately address the activity.

When commercial access becomes prohibited

The clearest prohibition concerns data brokerage. Unless an exemption or authorization applies, a U.S. person may not knowingly engage in a covered data transaction involving data brokerage with a country of concern or covered person. Data brokerage is defined broadly enough to include the sale of data, licensing access to data, or a similar commercial transaction in which a provider transfers data to a recipient that did not collect or process it directly from the individuals linked or linkable to the data. The rule is concerned with the commercial transfer and the recipient’s access, not only with a company that calls itself a data broker.

This definition reaches familiar products. An organization may maintain a database and sell memberships that license access to it. A mobile application may provide identifiers or location information to an advertising exchange as part of selling advertising space. An application may contain tracking pixels or software development kits that transfer information to another service. A company may license an artificial-intelligence product that can reproduce sensitive training data when queried. Each case requires its own factual analysis, but the shared mechanism is clear: a commercial interface can become a route through which a recipient obtains data that the recipient did not collect directly from the people represented in it.

The eCFR makes that mechanism concrete. It describes an advertising arrangement in which a U.S. company provides IP addresses and advertising identifiers for more than 100,000 U.S. users’ devices to an advertising exchange based in a country of concern. The provision is treated as data brokerage and a prohibited transaction because the identifiers satisfy the applicable bulk category in that transaction. The important lesson is not that all advertising is prohibited. It is that “we were selling ad space” does not answer whether the commercial arrangement transferred protected data to a prohibited recipient.

A second prohibition addresses bulk human ‘omic data and human biospecimens from which bulk human ‘omic data could be derived. Human ‘omic data includes data about biological systems, while the related biospecimen provision addresses material such as tissue, blood, urine, or other human-derived material from which the regulated data could be obtained. The rule prohibits a U.S. person from knowingly engaging in a covered data transaction with a country of concern or covered person that gives access to this protected biological material, unless the activity is otherwise authorized or exempt.

This separate treatment matters because it prevents a company from assuming that every vendor, employment, or investment relationship can be placed on the restricted path. For many kinds of protected data, those transaction forms are generally restricted and can proceed if the required security and other conditions are met.

Published by DeepMox

FAQ

What data-brokerage transactions are prohibited under the DOJ Data Security Program?

Unless an exemption or authorization applies, a U.S. person may not knowingly engage in a covered data-brokerage transaction involving a country of concern or covered person.

How does the DSP address an intermediary or shell used to route prohibited data access?

It prohibits transactions structured to evade or avoid its prohibitions and can treat knowingly directing a prohibited or noncompliant restricted transaction as prohibited conduct. A nominally neutral intermediary does not settle the analysis when the route is known.

Are bulk human ‘omic data transactions always prohibited under Part 202?

No. A covered transaction giving a country of concern or covered person access to bulk human ‘omic data or related biospecimens falls under a prohibition unless an exemption or authorization applies, but not every scientific or medical exchange meets the coverage predicates.

Previous12 minDOJ Data Security Program: Covered Data Transaction Test

Next11 minDOJ Data Security Program: Restricted Transactions and Controls

DOJ Data Security Program: Prohibited Transactions and Anti-Evasion

The Red Line: Prohibited Transactions and Anti-Evasion

When commercial access becomes prohibited

FAQ