Dear Deputy Chief Licata:
The Bank Policy Institute[1] and its technology division BITS[2] appreciate the opportunity to comment on the Department of Justice, National Security Division’s Notice of Proposed Rulemaking concerning the Provisions Pertaining to Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons[3]
As we noted in our comment on the Advance Notice of Proposed Rulemaking[4] we support the national security objectives of Executive Order 14117 and the legitimate national security interests to protect the bulk sensitive personal data of U.S. persons. With increased frequency, certain countries of concern seek to leverage Americans’ sensitive personal data to engage in espionage, refine hostile cyber operations, and identify strategic advantages detrimental to U.S. national security. We continue to recognize private industry’s critical responsibility to secure such data. Banking organizations focus extensively on monitoring and improving their security measures given these dynamic threat environments and geopolitical tensions.
In addition to their own security programs and internal oversight mechanisms, banking organizations are subject to continuous on-site supervision and regular examination by government regulators to ensure compliance with numerous requirements governing those organizations’ collection, processing, and storage of U.S. person data in connection with the provision of banking and financial services. On an ongoing basis and across novel contexts, supervisors and examiners review compliance with the significant security, privacy, operational resilience, and third-party risk management requirements applicable to banks operating in the United States.
Accordingly, we appreciate that the NPRM recognizes the unique oversight already applied to financial institutions by retaining the ANPRM’s exemption for the industry. We also appreciate that NSD incorporates industry feedback to expand this exemption to payment-processing and investment management services. Like other companies, banking organizations must transfer relevant data across their affiliates and subsidiaries to operate their businesses responsibly, so we also strongly support the retention in any final rule of the exemption for corporate group transactions. These exemptions will help ensure that this rulemaking does not impede the provision of financial services critical to domestic and international markets. As noted in our prior comment, we encourage NSD to reconsider the threshold for personal financial data and covered personal identifiers to qualify as bulk data and revise the treatment of de-identified sensitive personal data. Finally, we encourage NSD to provide at minimum one year for banking organizations to achieve full compliance with any final rule.
To read the full comment letter, please click here, or click on the download button below.
[1] The Bank Policy Institute is a nonpartisan public policy, research and advocacy group that represents universal banks, regional banks, and the major foreign banks doing business in the United States. The Institute produces academic research and analysis on regulatory and monetary policy topics, analyzes and comments on proposed regulations, and represents the financial services industry with respect to cybersecurity, fraud, and other information security issues.
[2] BITS – Business, Innovation, Technology, and Security – is BPI’s technology policy division that provides an executive-level forum to discuss and promote current and emerging technology, foster innovation, reduce fraud, and improve cybersecurity and risk management practices for the nation’s financial sector.
[3] See DOJ, National Security Division, Provisions Pertaining to Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, 89 Fed. Reg. 86,116 (Oct. 29, 2024).
[4] See DOJ, Provisions Regarding Access to Americans’ Bulk Sensitive Personal Data and Government-Related Data by Countries of Concern, 89 Fed. Reg. 15,780 (March 5, 2024); BPI and BITS, Comment on Provisions Regarding Access to Americans’ Bulk Sensitive Personal Data and Government-Related Data by Countries of Concern (Apr. 19, 2024), https://www.regulations.gov/comment/DOJ-NSD-2024-0002-0033.
