Elizabeth J. McEvoy, Member of the Firm in the Health Care & Life Sciences practice, in the firm’s Boston office, was quoted in Bloomberg Law, in “China-Focused Bulk Data Rule Sparks New Risk for Pixel Tracking,” by Ufonobong Umanah.
Following is an excerpt:
A recently implemented national security regulation restricting the transfer of sensitive US personal data to hostile foreign regimes—particularly China—presents new legal challenges for companies engaged in online advertising.
The Bulk Sensitive Data Rule, finalized in April of last year, prohibits or restricts the transmission of bulk data to China and five other countries in a variety of contexts. It stems from a Biden-era executive order directing the Justice Department to issue regulations to restrict access to US data where it would pose an unacceptable national security risk. ...
The regulation’s complexity may have meant plaintiffs’ firms needed time to understand how to leverage the rule for use in private suits, which would explain the sudden recent wave, said Elizabeth J. McEvoy of Epstein Becker & Green PC.
“If you’re engaged in sharing data cross- border that’s personal to US citizens and you’re sharing it directly with one of those six countries of concern, or someone residing in those countries, you should stop and do an analysis of whether you’re running afoul of the sensitive data rule,” said McEvoy, who represents large academic medical centers and private companies. ...
The lawsuits are only one pressure point, as nine of them came ahead of a March 1 deadline for some companies to file annual reports describing some of their data transactions.
“We will see an increase in 2026 in government enforcement” as the US evaluates those reports, McEvoy said. …
Plaintiffs have used substantive privacy laws to target data transfers that allegedly violate the Health Insurance Portability and Accountability Act, which also lacks a private right of action, in the same way, McEvoy said. Suits that do so often allege that trackers installed on health-care websites collect personal health information, which HIPAA generally prohibits disclosing to others.
