Laura Black

Key Takeaways On January 8, 2025, the DOJ published a final rule prohibiting and restricting certain transactions that could allow persons from countries of concern, such as China, access to bulk sensitive personal data of U.S. citizens or to U.S. government-related data (regardless of volume). Sensitive personal data covered by the rule includes precise geolocation data, personal health data, personal financial data, combinations of specified personal identifiers (e.g., government identification numbers, financial account numbers and personal device identifiers), human ‘omic data (e.g., genomic, epigenomic, proteomic and transcriptomic data) and biometric identifiers. To be covered, the transaction would need to involve identified “bulk thresholds” for each category of sensitive personal data, ranging from 100 to 100,000 U.S. persons.