skip to main content

October 23, 2020

Stroock Client Alert

By: Chris Griner, Michele L. Jacobson, Robert Lewin, Shannon Reaves, Gregory Jaeger, Christopher R. Brewster, Jonathan A. Labib, Erin Bruce Iacobucci

The multi-agency Committee on Foreign Investment in the United States (“CFIUS”) is authorized to investigate the national security implications of acquisitions that would result in foreign control of a U.S. business.

In addition, CFIUS may also investigate non-controlling investments that would provide a foreign investor (1) access to material non-public information; (2) board membership or observer rights; or (3) “any involvement, other than through voting of shares, in substantive decision-making of the U.S. business in [among other things] the use, development, acquisition, safekeeping, or release of sensitive personal data of U.S. citizens maintained or collected by the U.S. business.” (Emphasis added.)

If CFIUS finds that a transaction could threaten national security, it may recommend that the President block the transaction. Transactions that are not reviewed are open to challenge in perpetuity. Divestments can and have been ordered, and transactions may require restructuring to clear CFIUS review.

It is clear that the regulations reach controlling and certain non-controlling foreign investments in the U.S. insurance industry.

The regulations and precedent make clear that the broadscale collection and maintenance of sensitive personal data of U.S. citizens is deemed to present an inherent risk to national security.

Under the law, sensitive personal data means “identifiable data” (data that can distinguish or trace an individual’s identity) that is –

maintained or collected by a U.S. business that targets or tailors products

or services to any U.S. executive branch agency or military department as well as personnel and contractors with intelligence, national security, or homeland security responsibilities; or

maintained or collected by a U.S business on greater than one million individuals at any point over the (12) twelve preceding months.

Indeed, even if the U.S. business does not currently, or did not historically maintain data on one million individuals, it is sufficient if the business has “a demonstrated business objective” to maintain or collect sensitive personal data on more than one million individuals and the data is an “integrated part” of the U.S. company’s “primary products or services.”

CFIUS jurisdiction thus reaches investments outside what is generally thought of as the national security sector, and is certain to reach covered investments in most U.S. insurance companies.

In fact, with limited exceptions, among the types of data that the regulations expressly identify as sensitive personal data are non-public data within any of the following categories:

  • Financial data that could be used to analyze or determine an individual's financial distress or hardship;
  • With limited exceptions, data in a consumer report;
  • Data in an application for health insurance, long-term care insurance, professional liability insurance, mortgage insurance, or life insurance;
  • Data relating to the physical, mental, or psychological health condition of an individual;
  • Biometric enrollment data including facial, voice, retina/iris, and palm/fingerprint templates; and
  • With certain exceptions, the results of an individual's genetic tests.

The emphasis on sensitive personal data reflects the consensus view that national security can be implicated if a foreign person has access to personally identifiable medical or financial data involving a substantial number of U.S. persons, regardless of any other factors.

For these reasons, due diligence involving any foreign investment in the U.S. insurance industry should assess whether the transaction is subject to CFIUS review and, if so, whether the transaction is likely to be challenged as structured. Also, in some cases involving foreign government or government-controlled investors, CFIUS filings can be mandatory. For these reasons, CFIUS jurisdiction is an important consideration not only for foreign investors and U.S. businesses, but also for lenders (foreign and domestic) as they evaluate the regulatory implications of potential foreign investments.


For More Information:

Chris Griner

Michele L. Jacobson

Robert Lewin

Shannon Reaves

Gregory Jaeger

Christopher R. Brewster

Jonathan A. Labib

Erin Bruce Iacobucci

This Stroock publication offers general information and should not be taken or used as legal advice for specific situations, which depend on the evaluation of precise factual circumstances. Please note that Stroock does not undertake to update its publications after their publication date to reflect subsequent developments. This Stroock publication may contain attorney advertising. Prior results do not guarantee a similar outcome.