USA Trends and Developments Contributed by: Paul Lanois, Fieldfisher
There was much activity in the data privacy and cyber - security law space in 2025, as lawmakers, regulators and courts responded to rising cyber threats, rapid technological adoption and growing public concern about data misuse. The result is a regulatory environment that has become increasingly fragmented, largely because the United States does not have a comprehensive federal pri - vacy law, prompting states to fill this perceived gap with their own state privacy laws, creating a patch - work of overlapping (and sometimes conflicting) obli - gations for organisations operating nationwide. This state‑driven expansion not only broadened the scope of consumer rights and business responsibilities but also introduced compliance challenges for compa - nies navigating divergent requirements across juris - dictions. At the same time, enforcement activity intensified across federal and state agencies, which shifted from guidance‑driven approaches to more aggressive investigations, penalties and enforcement actions. 2025 was also marked by the growing influence of artificial intelligence, which reshaped both the risks regulators were trying to address and the legal frame - works being developed to govern automated deci - sion‑making, biometric data and AI‑enabled cyberat - tacks. Together, these trends and developments made 2025 a year defined by heightened scrutiny, expanding obli - gations and a more complex compliance landscape than ever before. The below is not intended to be an exhaustive list of all major developments in the US, but rather a list of selected highlights of some devel - opments of significance. DOJ Finalises Rule on Sensitive Cross-Border Data Transfers On 8 January 2025, the US Department of Justice issued its final rule implementing Executive Order 14117, Preventing Access to Americans’ Bulk Sen - sitive Personal Data and United States Govern - ment‑Related Data by Countries of Concern (the “DOJ Rule”). The DOJ Rule took effect on 8 April 2025, and establishes sweeping restrictions on cross‑border transfers of bulk US sensitive personal data and US
government‑related data to a designated “country of concern”, including China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba and Ven - ezuela, as well as to “covered persons” (which are entities or individuals with certain ties to a country of concern). The DOJ Rule also imposes obligations on certain transactions with any foreign person, not only those linked to a country of concern. The DOJ Rule prohibits US persons from engaging in any “data brokerage” transaction involving speci - fied categories of sensitive US personal data with a country of concern or a covered person. In effect, US data brokers may not license, sell or otherwise trans - fer a broad range of sensitive US personal data to these entities. The DOJ Rule also bars US persons from engaging in data brokerage transactions involv - ing sensitive US personal data with any foreign per - son unless the US person imposes contractual safe - guards designed to prevent downstream transfers to countries of concern or covered persons. Separately, the DOJ Rule prohibits US persons from knowing - ly engaging in any “covered data transaction” with a country of concern or covered person that would provide access to bulk human genomic, epigenomic, proteomic, transcriptomic data or to human biospeci - mens from which such data could be derived. The DOJ Rule creates a category of “restricted trans - actions”, which include certain vendor, employment and investment agreements that provide countries of concern or covered persons with access to bulk US sensitive personal data or US government‑related data. US persons may engage in these transactions, but only if they comply with cybersecurity standards issued by the Cybersecurity and Infrastructure Secu - rity Agency (CISA) and meet additional obligations, such as implementing a data compliance programme, undergoing audits and maintaining detailed records. The DOJ Rule defines sensitive personal data broadly and sets relatively low volume thresholds, meaning that routine online or commercial data collection activ - ities may fall within scope. Many organisations will need to build or significantly expand compliance pro - grammes to meet diligence, auditing, recordkeeping and reporting requirements. Companies should also
561 CHAMBERS.COM
Powered by FlippingBook