Department of Justice Executive Order 14117: Preventing Access to Americans' Bulk Sensitive Personal Data
*Disclaimer: Content under development and subject to federal updates
Overview
The U.S. Department of Justice (DOJ) has finalized a rule under Executive Order 14117 that prohibits and restricts certain transactions involving Americans’ bulk sensitive personal data and government-related data with countries of concern or covered persons. This final rule, codified at 28 C.F.R. Part 202, aims to prevent national security risks arising from the exploitation of data by foreign adversaries. Full compliance is expected by July 8, 2025, with regulatory enforcement actions beginning October 6, 2026.
Definitions
- The People’s Republic of China (including Hong Kong and Macau)
- The Republic of Cuba
- The Islamic Republic of Iran
- The Democratic People’s Republic of North Korea
- The Russian Federation
- The Bolivarian Republic of Venezuela
- Entities 50% or more owned or controlled (directly or indirectly) by a country of concern
- Entities organized under the laws or primarily located in a country of concern
- Entities owned by or affiliated with another covered person
- Foreign individuals primarily resident in countries of concern
- Employees, contractors, or agents of countries of concern or covered entities
Important UC Merced Institutional Requirement
UC Merced requires prior institutional review and approval before engaging in any proposed transaction, collaboration, data access arrangement, transfer, or other activity involving a country of concern or covered person, regardless of whether the applicable DOJ bulk data thresholds under 28 C.F.R. Part 202 are met.
This institutional requirement is separate from and broader than the DOJ regulatory thresholds and reflects UC Merced’s research security, export control, privacy, contractual, and data governance obligations. Investigators and departments are required to contact the Export Control & Research Secuirty Office before initiating such activities.
Bulk Data Thresholds
This rule applies when cumulative data volumes across a 12-month rolling period meet or exceed the following thresholds (regardless of anonymization, pseudonymization, or encryption):
- Covered Personal Identifiers: ≥ 100,000 U.S. persons
- Precise Geolocation Data: ≥ 1,000 devices
- Biometric Identifiers: ≥ 1,000 U.S. persons
- Human Genomic Data/Biospecimens: ≥ 100 U.S. persons
- Other Human ‘Omic Data: ≥ 1,000 U.S. persons
- Personal Health Data: ≥ 10,000 U.S. persons
- Personal Financial Data: ≥ 10,000 U.S. persons
- Combined Data: Lowest applicable threshold triggers review
Key Provisions Under the DOJ Bulk Data Rule
Review Data Transactions: Assess any current or planned cross-border data sharing or access—especially where sensitive personal data may exceed bulk thresholds.
Check Collaborators and Vendors: Determine whether collaborators, contractors, vendors, or funders may be “covered persons” or based in “countries of concern.”
Pause Risky Transfers: Pause high-risk data transfers until institutional review is completed.
Implement Contractual Safeguards: Include clauses preventing onward transfer of covered data to restricted entities.
Consult Export Control & Research Security: Required before initiating any covered data transaction.
Prohibited Transactions
- Data brokerage involving bulk sensitive data to countries of concern
- Unrestricted transfers without safeguards
- Access to genomic or biospecimen data by covered persons
Restricted Transactions
- Clinical and research collaborations involving sensitive data transfers
- Vendor agreements involving data hosting or processing
- Investment or funding involving covered persons
Potential Exemptions
- FDA-regulated clinical investigations
- Regulatory approval data submissions
- Federally funded research explicitly authorized by U.S. government agreements
Note: Exemption scope remains subject to federal interpretation.
What This Means for UC Merced Researchers
UC Merced researchers frequently work with sensitive datasets, including genomic, health, geolocation, biometric, and financial data. These datasets may fall under DOJ bulk data restrictions depending on scale and foreign access conditions.
Researchers must proactively evaluate data flows, international collaborations, and vendor relationships prior to initiating research activities.
Additional Resources
DOJ Foreign Investment Review Section
Contact
Office of Research Compliance & Integrity (RCI)
Email: rci@ucmerced.edu
Export Control & Research Security Office: exportcontrols@ucmerced.edu
