Amidst the thicket of federal regulators that populate Washington is the obscure Committee on Foreign Investment in the United States (CFIUS). Founded on the eve of World War II, CFIUS is an inter-agency task force. Its mandate is to evaluate mergers between American and foreign firms that may have national security implications.
The typical CFIUS intervention involves defense contractors or vendors. For example, it barred a Chinese investor from acquiring American chipmaker Lattice Semiconductor. In the same vein, it blocked a merger between Singapore’s Broadcom and American Qualcomm.
CFIUS does not, however, typically concern itself with citizens’ dating lives. But in April 2019, it made an exception. Media reported that the Chinese owners of gay dating app Grindr were seeking buyers under CFIUS pressure. CFIUS was apparently concerned by the sensitive personal data Grindr has on millions of American citizens.
Grindr holds considerable sensitive personal information on its users. That information includes their identities, locations, and some health information such as HIV status. The implicit concern was that Grindr’s owners could use the data to blackmail American citizens. Americans with security clearances would be particularly vulnerable.
The incident marks the first time CFIUS has reversed an acquisition premised solely on the data held by the acquired entity. Indeed, CFIUS rarely reverses a consummated transaction.
The episode is thus noteworthy for three reasons. First, it is the first time that personal data protection has been found to be a national security issue. Washington has sent a strong signal that it is expanding the traditionally narrow view of national security concerns to personal data.
Second, this expansion suggests that foreign companies operating businesses with access to sensitive personal data can expect scrutiny. For example, CFIUS ultimately approved a deal between Genworth and China Oceanwide Holdings—but only after the companies appended significant mitigation measures to alleviate privacy concerns.
Finally, the episode demonstrates yet another consideration that companies must factor into data collection practices. Even companies in traditionally benign areas, such as dating services, must be cautious with data collection. Excessive access to sensitive data can engender unforeseen consequences, such as a fire sale divestment prompted by a visit from the Men In Black.
Saad Gul and Mike Slipsky, editors of NC Privacy Law Blog, are partners with Poyner Spruill LLP. They advise clients on a wide range of privacy, data security, and cyber liability issues, including risk management plans, regulatory compliance, cloud computing implications, and breach obligations. Saad (@NC_Cyberlaw) may be reached at 919.783.1170 or sgul@poynerspruill.com. Mike may be reached at 919.783.2851 or mslipsky@poynerspruill.com.