The Department of Justice (DOJ) released a final rule restricting certain transfers of Americans’ sensitive personal data, including human genomic data, to identified countries of concern or covered individuals. The rulemaking process at the DOJ was initiated in response to national security concerns outlined in White House Executive Order 14117, issued Feb. 28, 2024. The rule will go into effect April 8.
The AAMC previously submitted comments (PDF) to the DOJ on the proposed rule, as well as on an advance notice for this rule (PDF), recognizing the need to address national security concerns but identifying potential deleterious effects of this rule on scientific research and international collaboration [refer to Washington Highlights, April 26, 2024 and Dec. 6, 2024]. The preamble to the final rule acknowledges many of the concerns raised by the AAMC but the DOJ declined to make many of the changes proposed by the association and others in the research community.
The rule generally prohibits or restricts transactions involving specific types of data to six countries of concern and sets thresholds for what constitutes “bulk” data for each type based on the number of U.S. persons whose data are included in the transaction. Because the definition of covered persons includes anyone outside of the U.S. with certain ties to those countries of concern, ensuring compliance with the rule will require institutions to evaluate all international research collaborations involving genomic, health-related, and other data covered by the rule. The rule does exempt transactions made as part of federally funded research and excludes from the rule biospecimens such as blood when used to diagnose, treat, or prevent disease.