CFIUS Legislative Update – a Wave of New Initiatives
Possible expansion of mandatory reviews of transactions involving personal data
Senators Marco Rubio (R-Florida) and Raphael Warnock (D-Georgia) introduced the “Protecting Sensitive Personal Data Act” in November 2021. The bill would expand the scope of transactions requiring a mandatory filing with CFIUS to include qualifying investments in “sensitive personal data” companies - and is essentially a broader version of the Genomics Expenditures and National Security Enhancement (GENE) Act, introduced in May 2021 and covered in our previous update. While mandatory filings in certain U.S. “TID” businesses that collect or maintain sensitive personal data are already obligatory under FIRRMA, the bill requires CFIUS to engage in rulemaking to further expand what would be covered under CFIUS’s mandatory filing requirements based on sensitive personal data. The scope of new transactions covered could theoretically become quite broad, depending on how CFIUS interprets the legislation and implements any new rules. It should be noted, however, that the proposal may encounter pushback from the Senate Committee on Banking, Housing and Urban Affairs which, as the committee with formal oversight authority over CFIUS, generally wants to take the lead on CFIUS reform legislation. We also note that in the absence of a Biden administration appointment to fill the position of Assistant Secretary for Investment Security, policy-related regulations such as those proposed by the Protecting Sensitive Personal Data Act may be more difficult to develop and implement. Finally, as we discussed in a recent post, CFIUS seems to have found an acceptable mitigation formula for Chinese investments in U.S. businesses that collect personal data, so more CFIUS reviews wouldn’t necessarily mean fewer successful transactions.
Recent developments regarding CFIUS’s designations of “excepted foreign states”
In the absence of politically appointed senior leadership, CFIUS’s sole rulemaking efforts have been largely, if not entirely, ministerial. A recent CFIUS rulemaking has led to updates to the designated “excepted foreign states”: CFIUS has recently confirmed that Australia and Canada meet both criteria for excepted foreign states, formally establishing that these countries “are and will remain” excepted foreign states under applicable regulations absent further CFIUS action. Under CFIUS regulations, investors from excepted foreign states are not subject to mandatory pre-closing filings and CFIUS’s jurisdiction over those investors is more limited. CFIUS has also added New Zealand as a provisional excepted foreign state (though New Zealand has been the source of exactly one CFIUS case between 2015 and 2020), and has also extended until February 2023 the deadline for determining whether the United Kingdom and New Zealand meet the requisite criteria for formal designation as well.
Additional legislation to add new permanent CFIUS member agencies introduced – but is this justified?
In our last legislative update in June 2021, we covered the Agricultural Security Risk Review Act (ASRRA), introduced in the House and Senate that seeks to add the U.S. Department of Agriculture (USDA) as a permanent member of CFIUS. Since then, two additional pieces of legislation have been introduced in the Senate that aim to add the USDA as a permanent member; the Foreign Adversary Risk Management Act (FARM Act) and the Food Security is National Security Act, both introduced in October 2021. Notably, the latter would add as a permanent member agency to CFIUS not only the USDA but also the U.S. Department of Health and Human Services (DHHS).
On top of seeking new permanent membership, the pieces of legislation would expand the scope of transactions requiring mandatory CFIUS filings – the FARM Act would modify the definition of “critical infrastructure” and “critical technology” to include agricultural systems and supply chains, while the Food Security is National Security Act would add food security as an enumerated national security factor.
With all the talk of adding agencies such as the USDA and DHHS to CFIUS, an important question remains: how many transactions per year actually fall under the purview of these potential new member agencies? As we’ve previously noted, CFIUS has long held - and routinely used - the authority to bring in other U.S. government agencies (such as the USDA and DHHS) with particular expertise or substantive equities relating to specific transactions and have had those agencies participate on an ad hoc basis in the CFIUS decision process. Permanent membership, however, would require these new agencies to devote limited resources to participate in reviews of transactions that, for the most part, would have nothing to do with these agencies’ responsibilities.
We encourage CFIUS to publish, in its annual report to Congress, statistics on the number of times per year these non-member agencies are brought in to participate in CFIUS reviews. That way, we would be in a better position to properly assess whether permanent CFIUS membership for these types of agencies is really needed. We anticipate that there are, in all likelihood, not enough deals to justify these agencies’ permanent presence.
Update on mandatory reviews of foreign grants to universities
In our previous legislative update, we also covered the introduction of the United States Innovation and Competition Act of 2021 (USICA) to the Senate, which incorporates conflicting provisions regarding CFIUS’s power to review certain foreign gifts to, or contracts with, U.S. universities. The USICA as currently drafted includes both a provision to allow CFIUS to review certain foreign grants to universities (complements of prior legislation by the Senate Foreign Relations Committee) and a provision prohibiting the same (complements of prior legislation by the Senate Committee on Banking, Housing and Urban Affairs). Despite the competing provisions, the bill passed the Senate in June 2021, so it will be up to the House to decide which provision (if any) will prevail.
