The U.S. Department of Justice's Final Rule on the Data Security Program: A Comprehensive Guide

The U.S. Department of Justice's final rule on the Data Security Program aims to protect sensitive personal data and government-related data from countries of concern, including China, Cuba, Iran, North Korea, Russia, and Venezuela.

The program restricts, prohibits, or exempts certain data transactions involving covered data that could give countries of concern or covered persons access to such data.

Covered persons include entities owned or chartered by countries of concern, foreign persons with ties to countries of concern, and individuals designated by the Attorney General as covered persons.

Covered data includes U.S. sensitive personal data and U.S. government-related data, subject to restrictions, prohibitions, and exemptions.

The Data Security Program sets forth prohibitions and restrictions on certain data transactions that pose national security risks, rather than privacy regulations.

The DSP applies to U.S. persons and entities engaging in transactions that provide access to covered data to countries of concern or covered persons in specified ways.

The DSP includes a "telecommunications services" exemption, which applies to data transactions that are ordinarily incident to and part of the provision of telecommunications services.

The exemption specifically applies to activities directly related to the technical and operational aspects of delivering telecommunications services, excluding ancillary services like marketing or data analytics.

The "telecommunications services" exemption may pose challenges for providers with integrated offerings, and providers should carefully review their services and data sharing arrangements to ensure compliance.

The DOJ's final rule on the Data Security Program represents a significant shift in protecting sensitive data and related information, and providers should carefully review their services and ensure compliance to avoid significant civil and criminal penalties.