EPIC Urges DOJ to Clarify and Strengthen Proposed Rule on Preventing Access to U.S. Personal Data

On November 27, EPIC submitted comments in response to the Department of Justice’s (DOJ) notice of proposed rule making (NPRM) on Provisions Regarding Access to Americans’ Bulk Sensitive Personal Data and Government Related Data to Countries of Concern. DOJ requested comments on how the Attorney General could implement a new program regulating certain types of data transactions that involve bulk U.S. sensitive personal data and government-related data that present an “unacceptable risk to U.S. national security.” EPIC also submitted comments on the advanced notice proposed rulemaking stage of this rule.  

While EPIC applauds the DOJ for not letting industry talking points erode the privacy protections already baked into the rule, this rule still fails to comprehensively protect national security interests due to the narrow, piecemeal approach to data broker transactions. While EPIC is disappointed the DOJ did not harmonize its rule with existing federal privacy protections, EPIC proposes narrow changes to clarify and strengthen the rule.  

First, EPIC requests that DOJ clarify that only countries of concern and covered persons are prohibited from receiving government-related data and/or bulk U.S. sensitive personal data. Blocking U.S. persons from acquiring data abroad, including in countries of concern, could unduly burden expressive speech such as news reporting on suspicious government activity. EPIC also urges the DOJ to include Social Security Numbers in its definition of Covered Personal Identifiers due to the sensitive nature and frequent use as a primary (and sometimes only) identity authentication tool by government agencies. Finally, EPIC urges DOJ to give Internet Service Providers (“ISPs”) an explicit exemption mirroring the telecommunication service providers definition due to the contested nature of ISPs inclusion as a telecommunications service provider.  

EPIC has long advocated for robust safeguards to protect consumers from exploitative data collection, use, distribution, and retention practices. EPIC regularly files amicus briefs, regulatory comments, and supports legislation to protect consumers from commercial surveillance regimes.