Use export controls to prevent theft of personally identifiable information

Research notes

Cluster negative search BIS-1 (chapter log): a jq pass over all 154 in-window Federal Register records whose agency is the Industry and Security Bureau, plus Federal Register full-text phrase searches since 2025-01-20 and the Bureau’s whole active Unified Agenda on reginfo.gov (agencyCd 0600). Also Federal Register full text since 2025-01-20 for "personally identifiable information" restricted to the Industry and Security Bureau slug (0), and for "bulk sensitive personal data" across all agencies.

Leads, not Evidence. The Justice Department’s Data Security Program (28 CFR part 202, implementing EO 14117) restricts transfers of Americans’ bulk sensitive personal data to countries of concern and took effect inside the window. It is the closest thing in the record to what the Quote wants — but it is a DOJ regime under IEEPA, not a Commerce export control under the EAR, and the Quote’s instrument is “U.S. export control regulations”. The second half of the Quote — using export controls to push production out of China — is likewise not evidenced; the tariff instruments used instead (Section 232, Section 301) are leveled in Chapter 26.

Reginfo agenda sweep, 2026-09-01 (§3b). The seventeen active RINs of the DOC/BIS slice of the 2026 Unified Agenda (agencyCd=0600, pubId=202510, published in the Federal Register 2026-08-14) were re-read against the rule settled 2026-09-01 — a dated agenda entry naming the ask’s object is attempted. No entry names personally identifiable information, personal data, or shifting production out of China. The nearest is RIN 0694-AK17 Critical Technologies Controls (Proposed Rule Stage, NPRM 07/2026), which implements controls on items under ECRA rather than on data. Subject area only — Status unchanged.