Project 2025 Tracker / What’s done, what’s next

21. Department of Commerce · Major

Issue an IEEPA executive order controlling exports of Americans' data

Not started

674 21. Department of Commerce

“In particular, they should draft and implement an executive order (EO) based on the International Emergency Economic Powers Act, which expands export control authority beyond ECRA’s scope (goods, software, technology) to regulate and restrict exports of U.S. persons’ data to countries of concern. The EO should establish a framework for the types of personal data subject to export controls and licensing policy by country, and the BIS should implement the EO through regulations.”

What has happened

  1. Not started

    Half of this ask predates the evidence window and the other half is outstanding, which is why the item is not flagged Already true. An IEEPA framework restricting transfers of Americans' bulk sensitive personal data to countries of concern has been in force since Executive Order 14117 of 2024-02-28, implemented by the Justice Department at 28 CFR part 202 — though by DOJ rather than by the Bureau of Industry and Security through the Export Administration Regulations, which is what the Mandate asks for. Inside the window nothing happened: no executive order on the export of U.S. persons' data was issued and BIS wrote no data-export regulations. The Status stays not-started because a Status measures what this administration did (ADR 0003), and it did nothing. This item is deliberately **not** flagged Already true: the Quote asks for two things, an IEEPA framework and BIS regulations implementing it through the EAR, and only the first exists. The second is genuinely outstanding, so the item belongs in Still to come.

    No action found yet. This entry is the starting point, not a finding.

  2. Not started

    This moved nearby, not onto the ask. The Justice Department put into operation the pre-window IEEPA data regime. The Data Security Program under Executive Order 14117 took effect on 2025-04-08. On this date the National Security Division issued its Compliance Guide, more than 100 FAQs and a 90-day Implementation and Enforcement Policy, and said the program "establishes what are effectively export controls" on Americans' bulk sensitive personal data. The order is Biden's and the regulator is the Justice Department. The Quote asks for a new IEEPA order implemented by BIS through export-control regulations, and neither exists. Only the press release was read for this event.

Research log

What was searched, and what didn’t count as evidence

Research notes

  • Negative searches (exact strings in docs/research/ch-21.md): Federal Register full-text since 2025-01-20 for “bulk sensitive personal data” returns six documents, none of them a presidential document and none from BIS (a DOJ regulatory agenda, a State delegation of authority, two NIH policies, a FinCEN proposed rule and an FCC submarine-cable proposed rule); a search for “International Emergency Economic Powers Act” together with “personal data” returns one unrelated FinCEN proposed rule; a search of presidential documents for “data security” returns 56 documents, none of which creates a data-export control framework. The Corpus’s fr-presdocu and presidential-actions files contain no such order.
  • Lead, not Evidence: the only Federal Register document in the window touching the existing regime is a DOJ correction to its 2025-01-08 Data Security Program final rule — https://www.federalregister.gov/documents/2025/04/18/2025-06477/pertaining-to-preventing-access-to-us-sensitive-personal-data-and-government-related-data-by — which corrects a cross-reference. Both the rule and its parent order (EO 14117) are dated before 2025-01-20 and so cannot be Evidence on this site.
  • Boundary call for the human reviewer: if the site’s reading is “the object exists, whoever built it and whenever”, this is arguably partial — an IEEPA framework restricting transfers of Americans’ data to countries of concern is in force. The reading taken here is the Mandate’s own: a new order, implemented by BIS through the export-control regulations, which does not exist.

Scan triage, 2026-10-01 (tenth run). The 2026-08-27 note says “inside the window nothing happened”. That is true of this ask’s object, a new order with BIS regulations. It is not true of the regime next to it. The Justice Department’s 2025-04-11 release on the Data Security Program came in with the department’s press releases this round, and it is now a not started event under §3b’s moved-nearby device. The dated note is left as written. The boundary call above is unchanged: the program is DOJ’s, under a 2024 order.

Reginfo agenda sweep, 2026-09-01 (§3b). The seventeen active RINs of the DOC/BIS slice of the 2026 Unified Agenda (agencyCd=0600, pubId=202510, published in the Federal Register 2026-08-14) were re-read against the rule settled 2026-09-01 — a dated agenda entry naming the ask’s object is attempted. No entry names data, IEEPA, or an executive order; the ask is for a presidential instrument and BIS’s implementing regulations would follow it, so an absence here is expected and is recorded only so the next pass does not re-search the agenda. Status unchanged.

Action
issue
Object
executive order on export of U.S. persons’ data under IEEPA
ID
1865