A Defensible Decision at the Boundary

The DOJ Data Security Program answers the question in this series with a conditional proposition: sensitive data becomes an export-control problem when a qualifying transaction creates access to that data for a country of concern or covered person, and the arrangement falls within the rule’s prohibited or restricted categories. Sensitivity alone is not enough. Foreign involvement alone is not enough. A security policy alone is not enough. This final chapter connects those facts to the boundaries that can change the result—exemptions, licenses, and advisory opinions—and turns them into a decision model that remains honest about uncertainty.

Exemptions are boundaries, not loopholes

Part 202 contains exemptions because not every transfer of information serves the same purpose or creates the same national-security concern. The exemptions cover specified activity such as personal communications, informational materials, travel, official U.S. Government business, financial services, corporate-group administration, transactions required or authorized by federal law or international agreements, certain CFIUS actions, telecommunications services, and specified medical, biological, and clinical activity. They are not a general exception for any company that can describe its purpose as useful, ordinary, or commercial.

The operative phrase is usually “to the extent” the listed criteria are met. That makes an exemption a boundary around a particular activity, not a label that follows every related data transfer. The organization must identify the purpose, participants, data, access, and transaction that the exemption actually covers. A transfer outside that purpose remains subject to the ordinary analysis, even when it uses the same database, vendor, or corporate group.

Financial services provide a clear paired example. The eCFR treats data transfers ordinarily incident to payment processing, funds transfers, banking, capital-markets activity, financial insurance, and related services as exempt when the stated conditions are met. It also gives examples involving an online marketplace transferring payment and delivery information to a merchant in a country of concern, and a financial institution using a service provider in a country of concern to facilitate international payments. The data access is not ignored; it is connected to the financial service that gives the transfer its exempt purpose.

Now change only the purpose. A payment-processing company that sells bulk U.S. sensitive personal data to a covered person is not protected by the financial-services exemption merely because it also processes payments. The sale is not ordinarily incident to the payment service in the example, so it remains prohibited data brokerage. The paired cases reveal the governing principle: the same category of data can be treated differently when the transaction’s function changes, but the organization must show the connection rather than rely on a general business description.

Federal research creates a similar boundary. A hospital conducting federally funded human-genomic research may contract with a covered foreign laboratory and employ a covered researcher when those arrangements fall within the official government activity or grant. The same institution may not assume that every publication or database built around the research is automatically covered by the grant. The eCFR distinguishes research and data publication that the grant directs or authorizes from a separately funded or separately arranged database outside the grant’s scope. An exemption can protect the authorized activity while leaving an adjacent transaction subject to the rule.

Corporate-group transactions show why internal administration must be separated from access demanded for a foreign intelligence purpose. Part 202 can exempt data transactions between a U.S. person and a subsidiary or affiliate in a country of concern when they are ordinarily incident to administrative or ancillary operations such as human resources, payroll, risk management, customer support, or internal communications. But the exemption does not automatically cover a license that gives the subsidiary access to a parent’s database in order to satisfy a request under the country’s national-security laws. The purpose and necessity of the access matter.

The same functional reasoning applies to the other boundaries. Personal communications and informational materials are different from a commercial license to a database. Telecommunications services are different from a separate data-brokerage sale. Clinical investigations, post-marketing surveillance, and certain drug, biological-product, or medical-device authorizations may receive specific treatment, but the relevant transaction must meet the conditions for that treatment. A CFIUS action may also have a defined relationship to the access risk. The existence of a familiar sector or public-interest purpose does not eliminate the need to read the applicable exemption.

Exempt does not mean invisible. The regulation preserves some requirements even for listed exempt transactions.