This article is for information only and does not constitute legal advice issued by an attorney. If you need legal advice, please contact Veritas Law at: erica.wang@thevertiaslaw.com
On December 27, 2024, the U.S. Department of Justice (DOJ) issued a final rule, Preventing Access to Americans Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern (the Rule). It prohibits and restricts six types of Sensitive Personal Data and two types of U.S. Government-Related Data transactions with six countries, including China, except as otherwise authorized. The Rule sparked a public outcry. It was even referred to as “data decoupling” by Chinese social media, which provoked some nervousness among the public.
Medicine is an evidence-based science, and clinical trial data is the basis for drug development and registration applications. How much impact will the Rule have on the biopharma industry, and will it hinder multi-center and cross-regional clinical research? Will it affect China's global boom of out-licensed transactions?
Reading through more than 400 pages of files, including the Rule, the DOJs interpretation of the provisions, some more background information, etc., the author has come to the following three conclusions:
1. The research and approval of new drugs (and medical apparatus and instruments) in China and the United States are exemptions and permitted by the Rule;
2. Out-licensed drugs to the United States, intellectual property (IP) licensing and collaboration in R&D with big pharma, and NewCo with investment funds can be continued;
3. China and other Countries of Concern will be prohibited or restricted from obtaining or using U.S. personal data that is not closely related to drug research or registration applications, once the Rule takes effect.
The U.S. Department of Justice issued the Rule to implement President Biden's Executive Order 14117 issued in early 2024. At the beginning, the 119th session of the US Congress has commenced on January 3, 2025, and Trump will be sworn in as the new president on January 20. The U.S. Department of Justice issued and publicly posted the Rule before the end of Biden's term, which fulfills the requirement of the Executive Order.
Timeline and enforcement of the Final Rule:
· On February 28, 2024, President Biden issued Executive Order 14117, Preventing Access to Americans Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern (E.O.), and directed the Justice Department to establish and implement regulations to address these risks;
· On March 5, 2024, the U.S. Department of Justice issued an Advance Notice of Proposed Rulemaking (ANPRM) seeking public comment on various topics related to implementation of the E.O. (the “March Draft”);
· On October 21, 2024, the Department of Justice issued a Notice of Proposed Rulemaking (NPRM) to seek further public comment (the “October Draft”);
· On December 27, 2024, the U.S. Department of Justice issued the Final Rule, which will become effective 90 days after publication (i.e., March 27, 2025). Certain affirmative compliance obligations will be phased in with a later effective date of 270 days after publication. (i.e., September 23, 2025).
Certain Definitions in the Final Rule
Six Categories of “Sensitive Personal Data”
The Rule establishes six categories of Sensitive Personal Data and the following bulk volume thresholds:
Categories
Thresholds
Examples
certain covered personal identifiers
100,000over 100,000 U.S. persons
social security numbers, driver’s license, email address, etc.
precise geolocation data
1,000over 1,000 U.S. devices
GPSIPGPS coordinates, geolocation data, etc.
biometric identifiers
1,000over 1,000 U.S. persons
finger prints, facial images, etc.
human genomic data
100over 100 U.S. persons
DNADNA, epigenomic, proteomic, or transcriptomic, etc.
personal health data
10,000over 10,000 U.S. persons
medical records, health monitoring data (e.g., blood pressure, heart rate), etc.
personal financial data
10,000over 10,000 U.S. persons
information related to an individual’s bank accounts, credit cards, including transaction history, etc.
Two Categories of “Government-Related Data”
Unlike the six categories of Sensitive Personal Data, the two types of Government-Related Data do not have a quantitative threshold and are more stringent. These two types of Government-Related Data are shown in the table below:
U.S. Government-Related Data
Example
Data generated in the process of internal activities by different departments
Internal reports, budget documents, executive orders, etc.
Real-time data generated by the government in social and public services
Traffic monitoring data, public health data, emergency response data, etc.
Six “Countries of Concern”
The final rule designates six countries China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela as Countries of Concern to address national security risks by prohibiting and restricting bulk sensitive personal and U.S. government-related data transactions with these countries in response to Executive Order 14117.
“Prohibited Transactions”
The Rule prohibits or restricts U.S. persons from engaging in any covered data transactions with Countries of Concern or covered persons, such as China, except as otherwise authorized. In other words, the Countries of Concern cannot access Americans sensitive personal data that exceeds certain bulk volume thresholds, as well as any government-related data.
The term “brokerage” literally means the business or establishment of a broker. However, the final rule greatly broadens its meaning and illustrates what data brokerage covers.
Example 1. A U.S. subsidiary of a company headquartered in a country of concern develops an artificial intelligence chatbot in the United States that is trained on bulk sensitive personal data of U.S. persons. While not its primary commercial use, the chatbot is capable of reproducing or otherwise disclosing bulk U.S. sensitive personal health data that was used to train the chatbot when responding to queries. The U.S. subsidiary knowingly licenses subscription-based access to that chatbot worldwide, including to covered persons such as its parent entity.
DOJs comment: Although licensing use of the chatbot itself may not necessarily involve access to bulk U.S. sensitive personal data, the U.S. subsidiary knows or should know that the license can be used to obtain access to the U.S. persons bulk sensitive personal training data if prompted. The licensing of access to this bulk U.S. sensitive personal data is data brokerage.
The above example shows that “brokerage” is equivalent to “exchange for value” in the Rule. As long as the transmission of data involves monetary payment, it will constitute a “data brokerage transaction”.
To make it clear, the Rule does not prohibit obtaining sensitive personal data directly from a U.S individual with his or her informed consent. Nevertheless, the collection and use of personal data shall be in compliance with U.S. applicable laws and regulations, such as Health Insurance Portability and Accountability Act (HIPPA) and Privacy Act.
Exceptions
While upholding “Prohibited Data Transactions”, the final rule also carves out the following two types of exceptions, of which, one is the 11 classes of exempt transactions explicitly listed in the Rule. The other is that the Rule authorizes the U.S. Department of Justice to issue general licenses or special licenses by an American applicant on a case-by-case basis.
“Restricted Transactions”
The Rule identifies 3 categories of transactions with Countries of Concern or covered persons that would be prohibited except to the extent that they comply with predefined security requirements. The three categories of restricted transactions are:
1) vendor agreement
2) employment agreement
3) investment agreement
The security requirements set forth by the Department of Homeland Security Cybersecurity and Infrastructure Agency (CISA) include but are not limited to cybersecurity measures, such as basic organizational cybersecurity policies and practices, physical and logical access controls, data masking and minimization, encryption, and the use of privacy-enhancing techniques.
Exceptions: 11 classes of exempt transactions
The Rule exempts 11 classes of data transactions, which are:
1. Personal communications,
2. Information or informational materials,
3. Travel,
4. Official business of the United States Government,
5. Financial services,
6. Transactions within a corporate group,
7. Transactions required or authorized by federal law or international agreements, or necessary for compliance with federal law,
8. Investment agreements subject to a CFIUS action,
9. Telecommunications services,
10. Drug, biologic, and medical device authorizations,
11. Other clinical investigations and post-marketing surveillance data.
No. 10 and 11 are related to the biopharma industry, which are of concern to pharmaceutical and biotech companies, and other industry players in the ecosystem either in China or the United States. For example, the former relates how a U.S. pharmaceutical company applies for drug registration in China, while in the latter, how a Chinese biotech company may research and market a drug in the U.S. and/or applies for clinical trials and new drug approval to the FDA.
Exemption No.10: Drug, biologic, and medical device authorizations (“Drug Authorizations”)
Without Exemption No. 10, U.S. pharmaceutical companies will not be able to apply for drug registrations in the Countries of Concern, such as China, which will have a great impact on their commercial and economic interests. According to the Department of Justice, the Rule excludes data not reasonably necessary for a regulatory entity in the country of concern with authority to approve the drug in the country of concern to assess the safety and effectiveness of the drug. Nevertheless, the rule prescribes some compliance requirements for these exempted Drug Authorizations, including:
1) data submission is necessary to obtain or maintain regulatory authorization or approval,
2) U.S. businesses are required to implement the recordkeeping and reporting requirements to fulfill compliance obligations, and
3) the transfer of data requires that the data be de-identified or pseudonymized. *
*It is a long-established practice that the data be de-identified or pseudonymized as required by the FDA to protect sensitive personal data.
The Rule further defines the scope of regulatory approval data which includes clinical application, marketing application, post-marketing studies and post-marketing product surveillance activities; and data that is required for submission to certain laboratories, or ethics committees in the Countries of Concern for the purpose of drug registration applications.
The Rule addresses the issue of using a registered agent. It is allowed if the country of concern requires foreign pharmaceutical companies to submit regulatory approval data using a registered agent who primarily resides in the country of concern. However, the U.S. pharmaceutical company as the reporting entity must comply with the recordkeeping and reporting with respect to such transaction.
To further specify what data transactions it deems necessary to obtain or maintain regulatory authorization, the Rule provides the following example: if a U.S. company stores and organizes the bulk U.S. sensitive personal data for eventual submission to the country of concern regulator, but the country of concern does not require foreign pharmaceutical companies to enter into such vendor agreements, then the transaction is not exempt.
Exemption No. 11: Other clinical investigations and post-marketing surveillance data (“Other Surveillance Data”).
Exemption No.11 and No.10 are reciprocal. The Other Surveillance Data refers to data that is required to be submitted to the FDA for clinical investigations or marketing permits for drugs. It also includes the collection or processing of clinical care data indicating real-world performance or safety of products, clinical trial and care data, and post-marketing pharmacovigilance and safety monitoring data.
Exemption No. 10 and No. 11: Rights are earned by speaking out
The Rule makes special allowances for the biopharmaceutical sector, providing exemptions under No. 10 and No. 11. However, this was not the case from the beginning. Neither the Presidents E.O. of early 2024 nor the March Draft issued by the Department of Justice exempted drug application and registration.
In the process of seeking public comment on the draft, the biopharma industry expressed serious concerns about the consequences that would be caused by the restrictions and prohibitions on drug applications and registrations. The opposition prompted the DOJ to make adjustments to the October Draft version, resulting in two exemptions of biopharmaceutical related data.
Moreover, the Rule tightened its wording to only authorize transactions that comply with the methods of de-identification and pseudonymization laid out in the FDAs security requirements for personal sensitive data.
In its explanatory comments on the Rule, the Department of Justice explained the boundaries and considerations regarding these exemptions for the biopharma industry:
1. The exemptions in the final rule are limited to regulatory approval data, which is a pre-requisite;
2. The Department of Justice affirms FDA requirements for the protection of personal information data of trial because it essentially meets the needs of US national security;
3. Exemptions No. 10 and No. 11 in the Rule are a balance between humanitarian needs and economic and scientific interests.
In particular, the DOJ responded to concerns raised by the public about the introduction of investigational drugs from the Countries of Concern and cooperative development in the United States, including the need to provide data on adverse events or pharmacovigilance data to licensors located in the Countries of Concern (obviously, this mainly refers to out-licensed transactions from China to the United States).
In the view of the DOJ, this type of data transaction is already covered in Exemption 10, since it falls within the scope of that which is necessary to obtain or maintain regulatory authorization or approval to research or market a drug. The DOJ further confirms that if the transaction does not fall into one of the existing exemptions, U.S. companies may seek authorization for such transactions via a specific license.
Even though the Rule restricts data transactions as a whole, the DOJs above-mentioned interpretations still convey some positive signals:
First, the authority of the FDA is recognized (it remains for sure to be seen whether the authority of the FDA will be severely challenged under Trumps administration).
Second, the basic exchanges in the biopharma industry between China and the United States, such as drug cooperation development, are necessary and conflict-free with the interests of the United States on a fundamental level.
Third, public opinions are meaningful and are taken seriously in the context of the current U.S. legal system. Therefore, it is important for Chinese-funded enterprises in the United States in particular, private enterprises to learn how to express stances and opinions in a reasoned and well-founded way, and to make good use of these communication channels provided by the American systems.
Wrap-up
Although exemptions have been granted for certain data necessary for drug registrations as a basic business need, the Rules targeted prohibitions and restrictions on certain data transactions involving sensitive personal data to the Countries of Concern, such as China, nevertheless creates a major roadblock as a whole.
The Rule even exerts a long-arm jurisdiction over other countries in order to ensure its enforcement. For example, if a U.S. business knowingly enters into an agreement to sell US sensitive personal data to a European business, the U.S. business is required to include in that agreement a limitation on the European business right to resell or otherwise engage in a covered data transaction involving data brokerage of that data to a country of concern or covered person. Otherwise, the U.S business will be required by the US government to file a report.
Although the Rule does not hinder certain regulatory approval data necessary for drug registrations, it is already very difficult to conduct research using non-registration data. For example, the prohibition applies to any transactions that involve access to human omics data (e.g., genomics) or to human biospecimens from which bulk human genomic data can be derived.
The issue of the Rule marks the expansion of US export restrictions on products and technologies to further include data transfer restrictions with China in the era of artificial intelligence. As 2025 has commenced, although the geopolitical landscape over the next four years is likely to remain largely uncertain, there are two aspects that are relatively clear. On the one hand, the Rule basically supports the transfer of data that is necessary to obtain or maintain regulatory approval to research or market a drug, and the surge in out-licensing deals for Chinese innovative drugs will continue; on the other hand, it is even of higher importance to stay calm and resilient in a VUCA world. Where there is a will, there is a way.