Bulk Data Rule FAQs

All U.S. persons, which includes: 

• Any U.S. citizen, national or lawful permanent resident; 

• Any individual admitted to the United States as a refugee or granted asylum; or 

• Any person in the United States (i.e., any individual – regardless of citizenship or status – physically located in the United States).

No. Research collaborations are a major use case, but all Covered Data Transactions are prohibited and data transactions meeting the definitions of Vendor Agreements, Employment Agreements, Investment Agreements, or Data Brokerage will need to be assessed. 

Yes, for foreign entities. A foreign entity is automatically a Covered Person if Countries of Concern or Covered Persons own 50% or more of it. 

Any entity organized solely under the laws of the United States is a U.S. Person and ownership doesn’t matter.

The law requires cumulative tracking of disclosure of U.S. Sensitive Personal Data to Cover Persons or Countries of Concern over a rolling 12-month basis. Due to the administrative difficulty in tracking these, and the associated risk, UC San Diego has made the decision to prohibit these transactions regardless of data thresholds. 

The rule still applies. De-identification does not remove the need for prior approval. 

De-identified or pseudonymized U.S. Sensitive Personal Data required for submission to a regulatory entity, or required by a regulatory entity to be submitted to a Covered Person, to obtain or maintain authorization or approval for a drug, biological product, device, or combination product, may be exempted. Contact the Office of Ethics and Compliance (ethicsandcompliance@ucsd.edu) for more information. 

A transaction involving a Vendor Agreement, Employment Agreement, Investment Agreement, or Data Brokerage with a Country of Concern or Covered Person that involves disclosure of U.S. Sensitive Personal Data or U.S. Government-related Data. 

Access to Covered Persons or Countries of Concern is enough.  

Yes, 28 CFR 202.501-511 includes exemptions, and federally funded research activities may be exempt when conducted pursuant to a federal grant, contract, or other federal agreement. But exemptions are technical and fact-specific; non-federally funded research and educational access may not be exempt. See the Decision Tree. UC San Diego users should not self-apply exemptions without institutional review, please contact the Office of Ethics and Compliance (ethicsandcompliance@ucsd.edu) if you believe an exemption may apply. 

Yes. The policy applies to human clinical and research biospecimens from U.S. Persons regardless of identifiability, when collected, obtained, stored, used, or distributed using ongoing or new NIH funds. 

Yes, but any collaboration involving the sharing of U.S. Sensitive Personal Data or U.S. Government-related Data may be prohibited as a Covered Data Transaction if the transfer involves a commercial transaction.

There are two instructive examples in 28 CFR § 202.214 "Data brokerage."

Example 9. A U.S. researcher shares bulk human `omic data on U.S. persons with a researcher in a country of concern (a covered person) with whom the U.S. researcher is drafting a paper for submission to an academic journal. The two researchers exchange country of concern and bulk U.S. human `omic data over a period of several months to analyze and describe the findings of their research for the journal article. The U.S. person does not provide to or receive from the covered person or the covered person's employer any money or other valuable consideration as part of the authors' study. The U.S. person has not engaged in a covered data transaction involving data brokerage, because the transaction does not involve the sale of data, licensing of access to data, or similar commercial transaction involving the transfer of data to the covered person. 

Example 10. A U.S. researcher receives a grant from a university in a country of concern to study bulk personal health data and bulk human `omic data on U.S. persons. The grant directs the researcher to share the underlying bulk U.S. sensitive personal data with the country of concern university (a covered person). The transaction is a covered data transaction because it involves access by a covered person to bulk U.S. sensitive personal data and is data brokerage because it involves the transfer of bulk U.S. sensitive personal data to a covered person in return for a financial benefit.

Limited exemptions may apply, see 28 CFR 202.501-511. Contact the Office of Ethics and Compliance (ethicsandcompliance@ucsd.edu) if you believe an exemption may apply.

If you have Human Biospecimens that were collected, obtained, stored, used or distributed using ongoing or new NIH funds, these may not be sent to persons within Countries of Concern.  Export control regulations and other laws may also apply. 

A Covered Person is: 

• An entity 50% or more owned, directly or indirectly, by a Country of Concern.
• An entity organized or chartered under the laws of, or having its principal place of business in, a Country of Concern.
• An entity 50% or more owned by another Covered Person.
• A foreign individual who is an employee or contractor of a Country of Concern or a Covered Entity.
• A foreign individual primarily resident in a Country of Concern.
• Any person specially designated by the U.S. Attorney General on the Covered Persons List as acting on behalf of or being controlled by a Country of Concern. 

Generally a person is physically located in the U.S. they are a U.S. Person, if an entity is solely organized under the laws of the U.S. it is a U.S. Person. The exception is if a person or entity is specially designated as a Covered Person they will be treated as such regardless of the general rules. Screen partners through Visual Compliance https://blink.ucsd.edu/sponsor/exportcontrol/rps.html and escalate any potential hits to the Export Control Office.