UC San Diego Institutional Approach

DOJ Bulk Data Rule

The U.S. Department of Justice (DOJ) has finalized a rule prohibiting or restricting certain transactions involving U.S. Sensitive Personal Data and U.S. Government-related Data with Countries of Concern or Covered Persons. The rule is found at 28 C.F.R. Part 202 and the DOJ has issued a Compliance Guide as well.

UC San Diego Institutional Approach

Covered Data Transactions are prohibited, unless there is prior approval granted by the Office of Ethics and Compliance (ethicsandcompliance@ucsd.edu) based on the determination that an exemption applies or a license exists.

Transfers of U.S. Sensitive Personal Data or U.S. Government-related Data to third parties must include due diligence including restricted party screening of foreign persons to ensure that they not Covered Persons. Any agreement for such a transfer must include contractual safeguards to prevent onward transfer to Covered Persons or Countries of Concern.

What You Need to Do

UC San Diego manages datasets (including genomic, health, location, biometric, and financial data) that may now fall under federal security restrictions if accessed by certain foreign collaborators or contractors. This rule mandates careful review of data access, transfer agreements, and outside engagements. The rule applies even if data is anonymized or encrypted.

Review Transactions: Assess any ongoing (in effect after April 8, 2025) or planned transactions involving data transfer (including access to databases with Covered Data) or shipment of human biospecimens. Utilize the Decision Trees and document results. Ensure a contract is in place before providing access to Covered Data.
- Implement Contractual Safeguards: Utilize approved language.

End Access with end of Employment/Affiliation: Ensure access to Covered Data sources is terminated when employment or formal affiliation ends (including for visiting scholars and postdoctoral researchers).

Pause or Cancel Risky Transfers: If you identify high-risk data transactions that clearly fall within the scope of the rule (e.g., involving genomic data to a research institution located in a Country of Concern), pause until further guidance is obtained from the Office of Ethics & Compliance about applicable exemptions or licenses.

Contact the Office of Ethics and Compliance (ethicsandcompliance@ucsd.edu): If you have determined a transaction is prohibited, you need assistance in making a Covered Person determination, or you believe an exemption or license may apply.

Additional Resources

Definitions

See 28 C.F.R. § 202.201-259 for complete definitions.

Country of Concern

Foreign governments designated by the U.S. Attorney General as posing a significant risk to national security. These currently include: China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela. Please check this list regularly as the countries listed may change.

Covered Data Transaction

A transaction involving a Vendor Agreement, Employment Agreement, Investment Agreement or Data Brokerage with a Country of Concern or Covered Person that involves the disclosure of U.S. Sensitive Personal Data or U.S. Government-related Data. This expressly includes transactions that would meet the definition of restricted transactions under 28 C.F.R. § 202.401.

Covered Person

A foreign person that is:
- An entity 50% or more owned, directly or indirectly, individually or in aggregate, by Countries of Concern or Covered Persons.
- An entity organized or chartered under the laws of, or having its principal place of business in, a Country of Concern.
- An individual who is an employee or contractor of a Country of Concern or a Covered Entity.
- An individual primarily resident in a Country of Concern.

Any person specially designated by the U.S. Attorney General on the Covered Persons List.

Data Brokerage

The sale of data, licensing of access to data, or similar commercial transactions, excluding an employment agreement, investment agreement, or a vendor agreement, involving the transfer of data from any person (the provider) to any other person (the recipient), where the recipient did not collect or process the data directly from the individuals linked or linkable to the collected or processed data.

Sharing data for non-commercial research or scientific publishing (where no money or valuable consideration is exchanged) is generally not considered data brokerage.

Employment Agreement

Any agreement or arrangement in which an individual, other than as an independent contractor, performs work or performs job functions directly for a person in exchange for payment or other consideration, including employment on a board or committee, executive-level arrangements or services, and employment services at an operational level.

Foreign Person

Any individual or entity that does not meet the definition of a U.S. Person (defined below).

Human Biospecimens

A quantity of tissue, blood, urine, or other human-derived material. See 28 C.F.R. § 202.223 Human biospecimens for full description.

Investment Agreement

An agreement or arrangement in which any person, in exchange for payment or other consideration, obtains direct or indirect ownership interests or rights in relation to: (1) Real estate located in the United States; or (2) a U.S. legal entity.

Regulatory Approval Data

U.S. Sensitive Personal Data that is de-identified or pseudonymized consistent with the standards of 21 CFR 314.80 and that is required to be submitted to a regulatory entity, or is required by a regulatory entity to be submitted to a covered person, to obtain or maintain authorization or approval to research or market a drug, biological product, device, or combination product, including in relation to post-marketing studies and post-marketing product surveillance activities, and supplemental product applications for additional uses. The term excludes U.S. Sensitive Personal Data not reasonably necessary for a regulatory entity to assess the safety and effectiveness of the drug, biological product, device, or combination product.

U.S. Goverment-related Data

Any precise geolocation data, regardless of volume, for any location within any area enumerated on the Government-related Location Data List in § 202.1401 which the Attorney General has determined poses a heightened risk of being exploited by a country of concern to reveal insights about locations controlled by the Federal Government, including insights about facilities, activities, or populations in those locations, to the detriment of national security, because of the nature of those locations or the personnel who work there. Such locations may include:
1. The worksite or duty station of Federal Government employees or contractors who occupy a national security position
2. A military installation
3. Facilities or locations that otherwise support the Federal Government’s national security, defense, intelligence, law enforcement, or foreign policy missions.
Any sensitive personal data, regardless of volume, that a transacting party markets as linked or linkable to current or recent former employees or contractors, or former senior officials, of the United States Government, including the military and Intelligence Community.

U.S. Sensitive Personal Data

Any one or combination of the following (regardless of the technical state of the data, including data that has been anonymized, pseudonymized, de-identified, or encrypted) that is linked or linkable to any identifiable U.S. Persons –

Covered Personal Identifiers: Listed identifiers (e.g., SSN, driver's license, device IDs) linked to a specific person.
Personal Financial Data: Data related to credit, bank accounts, or financial liabilities.
Personal Health Data: Health status, medical records, or treatment history.
Precise Geolocation Data: Real-time or historical location data for U.S. persons or devices.
Biometric Identifiers: Physical characteristics (facial images, prints, voice) used for identity.
Human ‘Omic Data: Proteomic, transcriptomic, or epigenomic data, or human biospecimens from which such data could be derived.
Human Genomic Data: DNA sequences, or human biospecimens (e.g., blood, tissue) from which sequences are derived.

U.S. Person

Any U.S. citizen, national, or lawful permanent resident; any individual admitted as a refugee or granted asylum; any entity organized solely under U.S. laws (including foreign branches); or any person located within the United States, regardless of citizenship (including foreign visitors physically present on campus).

Vendor Agreement

Any agreement or arrangement, other than an employment agreement, in which a person provides goods or services to another person, including cloud computing, in exchange for payment or other consideration.