Cross Border Data

State of play.

• The EU-US Data Privacy Framework is under formal reassessment pressure following Trump v. Slaughter. The Supreme Court's June 29, 2026 ruling eliminating FTC commissioner removal protections has prompted the EDPB to request a European Commission review of the 2023 adequacy decision — DPF transfers remain lawful for now, but the legal foundation is contested and contingency planning is no longer optional (→ FTC independence ruling raises fresh questions over EU-U.S. data privacy deal).
• DOJ's Bulk Sensitive Data Rule is in active enforcement, with civil penalties up to $368,136 per violation and criminal exposure for willful breaches; the first wave of class action suits has targeted Xandr, Index Exchange, and Lenovo under ECPA .
• Anthropic's covert geolocation tracking in Claude Code has produced the first confirmed case of a major AI provider shipping nationality-based surveillance, triggering an Alibaba enterprise-wide ban and creating immediate compliance exposure for enterprises using the tool (→ China Bans Claude Code After Anthropic Embeds Covert Geolocation Tracking).
• China's regulatory posture toward foreign AI and data is hardening on two tracks simultaneously — mandatory pre-launch security assessments and content filtering for generative AI services, and an emerging national data property registration framework that will affect how foreign-held data assets are valued and transferred .
• For counsel advising multinationals with US-EU or US-China data flows, the practical baseline is that three enforcement vectors — DPF adequacy uncertainty, DOJ bulk data enforcement, and China's tightening AI and data-property regimes — are simultaneously live, and the window for reactive compliance has closed.

Where things stand.

• The EU-US Data Privacy Framework remains technically operative but faces a formal adequacy reassessment. The EDPB has requested the European Commission review the 2023 adequacy decision in light of Trump v. Slaughter; no court has yet challenged DPF validity, but legal opinion is divided on whether FTC commissioner removal protection was load-bearing to the adequacy rationale (→ FTC independence ruling raises fresh questions over EU-U.S. data privacy deal).
• DOJ's Bulk Sensitive Data Rule (28 C.F.R. Part 202) is in full enforcement. The rule restricts bulk transfers of Americans' sensitive personal data to China, Russia, Iran, and Cuba; the grace period has expired; volume thresholds catch data brokers, genomic firms, consumer app developers, and financial services companies handling data on 100,000+ US persons .
• PADFAA enforcement is active at the FTC. The FTC has sent warning letters to 13 data brokers for compliance failures under the Protecting Americans' Data from Foreign Adversaries Act, with military status information identified as a specific violation category; civil penalties run to $53,088 per violation .
• China's generative AI regulatory framework is in active enforcement. The Cyberspace Administration is applying the Interim Measures for the Management of Generative AI Services, Deep Synthesis Regulations, and Algorithm Recommendation Regulations to all providers — domestic and foreign — with content filtering, algorithm registration, and pre-launch security assessments required before market access .
• China is building a national data property registration system. The NDA's draft guidelines consolidate pilots from Beijing, Shanghai, Tianjin, and Shenzhen into a unified framework targeting a blockchain-based certification system by 2029; the framework will directly affect M&A due diligence, licensing, and cross-border transfer structuring for foreign companies holding data assets in China .
• CBP border device searches operate under a broad Fourth Amendment exception with no settled warrant requirement. The border search exception permits warrantless manual and forensic review for all travelers including US citizens; Merchant v. Mayorkas is the live federal challenge but no warrant standard has been imposed .
• The US state privacy patchwork has reached 20 enacted laws with more advancing. Indiana, Kentucky, and Rhode Island regimes are launching; Iowa, Illinois, New Mexico, and New Jersey have measures in progress — each with distinct data-transfer and consent obligations affecting cross-border flows .
• Federal privacy preemption remains structurally unresolved. Rep. Lofgren's Online Privacy Act proposes a new Digital Privacy Agency, data minimization mandates, and consumer rights to access, correct, delete, and port data — but faces the same obstacles that have blocked federal privacy legislation for years .

Latest developments.

• Trump v. Slaughter eliminates FTC commissioner removal protections, prompting the EDPB to request a European Commission reassessment of the EU-US DPF adequacy decision; transfers remain lawful but contingency planning for SCCs and other transfer mechanisms is now operationally urgent (→ FTC independence ruling raises fresh questions over EU-U.S. data privacy deal).
• DOJ Bulk Sensitive Data Rule enters full enforcement with class action suits filed against Xandr, Index Exchange, and Lenovo under ECPA; civil penalties up to $368,136 per violation and criminal exposure for willful breaches .
• Anthropic's Claude Code found to contain undisclosed geolocation tracking targeting Chinese users; Alibaba imposes enterprise-wide ban citing "back-door risks" — the first confirmed case of a major AI provider shipping nationality-based covert surveillance (→ China Bans Claude Code After Anthropic Embeds Covert Geolocation Tracking).
• China's Cyberspace Administration enforces mandatory pre-launch security assessments and content filtering for all generative AI services, including American firms seeking Chinese market access .
• Trump administration imposes 25% tariffs on Brazilian imports citing Pix's government-operated, data-non-sharing model as an unreasonable trade barrier — a Section 301 action that reframes payment system data architecture as a trade law issue .
• 25 states and DC file federal suit to block Trump administration TANF data-sharing rule that would disclose welfare recipients' SSNs, addresses, immigration status, and family relationships to DHS and other entities .
• FTC sends warning letters to 13 data brokers over PADFAA compliance failures, identifying military status data sales as a specific violation category .

Active questions and open splits.

• Whether Trump v. Slaughter materially undermines the DPF adequacy rationale. The European Commission's 2023 adequacy decision explicitly cited FTC independence as a safeguard; legal opinion is divided on whether that reliance was structural or incidental — the EDPB's reassessment request puts the question formally in play, and the answer determines whether thousands of US service providers need fallback transfer mechanisms (→ FTC independence ruling raises fresh questions over EU-U.S. data privacy deal).
• Scope of the BSD Rule's "bulk" thresholds and vendor-agreement liability. The 100,000-person and 1,000-device thresholds catch a wide range of companies that have not historically treated their data flows as national security matters; whether standard vendor and data-processing agreements satisfy the rule's security, audit, and reporting requirements is unsettled .
• Nationality-based product surveillance and AI governance frameworks. The Claude Code incident is the first confirmed case of a major AI provider embedding covert user-origin tracking; no regulatory framework currently addresses whether such a mechanism is permissible as an access-control measure or constitutes an unlawful data collection — the gap will shape AI governance enforcement on both sides (→ China Bans Claude Code After Anthropic Embeds Covert Geolocation Tracking).
• Payment system data architecture as a trade law violation. The Pix tariff action asserts that a government-operated payment system's refusal to share consumer data constitutes an unreasonable trade barrier — a novel theory with implications for any jurisdiction building a sovereign payment infrastructure that excludes US financial firms .
• Federal authority to compel disclosure of state-held welfare data. The 25-state TANF litigation tests whether the Administration for Children and Families has statutory authority to expand data-sharing to DHS without explicit congressional authorization — the outcome will define the outer boundary of federal data-access claims against state-administered benefit systems .
• Warrant requirement for CBP device forensics. Merchant v. Mayorkas is the live vehicle, but no court has imposed a warrant standard for any category of border device search — attorney-client privilege and work product on business-traveler devices remain unprotected, and the line between permissible forensic analysis and a constitutional violation is unsettled .
• China data property registration: transfer and valuation obligations for foreign firms. Once the NDA framework is finalized, data assets held by foreign companies in China may be subject to registration, valuation, and circulation rules affecting M&A due diligence, licensing, and cross-border transfer structuring — the scope of those obligations is not yet determined .

What to watch.

• European Commission response to the EDPB's DPF reassessment request — any formal adequacy review or suspension triggers an immediate need for SCCs, BCRs, or other transfer mechanisms across thousands of US service providers.
• First DOJ direct enforcement action under the BSD Rule — the class action suits against Xandr, Index Exchange, and Lenovo are plaintiff-driven; a DOJ-initiated action will signal enforcement priorities and the agency's interpretation of the volume thresholds.
• Outcome of the 25-state TANF data-sharing litigation — preliminary injunction proceedings will be the first judicial test of federal authority to compel disclosure of state-held sensitive personal data to DHS.
• NDA comment period closing and finalization of China's data property registration guidelines — the final framework determines compliance obligations for foreign companies holding data assets in China.
• Whether the Claude Code incident prompts regulatory action in the EU or US on nationality-based product surveillance — GDPR enforcement authorities and the FTC are both plausible first movers.
• Outcome of Merchant v. Mayorkas — any ruling on the scope of permissible forensic analysis at the border will immediately reshape device-protocol advice for business travelers and multinational clients.