The Committee on Foreign Investment in the United States (“CFIUS”) has now released for public comment its long awaited proposed regulations (“Proposed Regulations”) to implement the landmark Foreign Investment Risk Review Modernization Act of 2018 (“FIRRMA”) in two separate releases – one covering investments in real estate (135 pages in length) and the other covering all other types of investments (184 pages in length). Comments on the Proposed Regulations are due by October 17, 2019, and can be submitted electronically. CFIUS also may hold a public teleconference during the comment period.

• The Proposed Regulations Define CFIUS’ Expanded Jurisdiction Over Certain Minority Investments in US Businesses with Critical Technology, Critical Infrastructure and Sensitive Personal Data. Traditionally, CFIUS has had jurisdiction under the Defense Production Act, as amended, to review foreign acquisitions of “control” over any US businesses. As we wrote last summer when FIRRMA was enacted and reaffirm today, FIRRMA is “one of the broadest expansions of regulatory authority over business transactions in a generation.” Specifically, while retaining CFIUS’ traditional jurisdiction over “control” transactions, FIRRMA affords CFIUS additional jurisdiction over certain minority foreign investments in US businesses with specified involvement in critical technology, critical infrastructure and sensitive personal data. Such non-controlling investments are covered by FIRRMA where they afford the foreign acquirer certain access to information in the possession of, rights in, or involvement, in the decision making of such US businesses. The Proposed Regulations flesh out the scope of coverage of such critical  technology, critical infrastructure and sensitive personal data US businesses (called “TID” US businesses). In particular, please note the following:
  • Critical Technology. The definition mirrors that in FIRRMA and the Pilot Program Regulations, and makes clear that “emerging and foundational technologies” identified and made subject to export controls by the Department of Commerce  under the companion Export Control Reform Act of 2018 (“ECRA”)  would be considered “critical technologies” under the Proposed Regulations. Thus, to the extent the Department of Commerce adds certain aspects of technologies like artificial intelligence, biotechnology, data analytics to the Control List of “dual use technologies,” US companies working with such export controlled technologies would be subject to the expanded CFIUS jurisdiction.
  • Critical Infrastructure. For the first time, CFIUS has set forth a detailed list of what constitutes “critical infrastructure” for the purpose of foreign investment reviews, and also what particular “functions” related to each specific type of covered infrastructure would be subject to CFIUS’ jurisdiction (e.g., the ownership or operation of such assets, or the manufacture of specified systems or industrial resources). While the list covers certain defense related assets and infrastructure, it also covers specified infrastructure in a broad range of business sectors, including certain types of telecommunications services and information services, internet protocol networks, electrical energy generation, oil refining and crude oil storage facilities, liquefied natural gas import or export terminals, rail lines, interstate pipelines, certain carbon, alloy, and armor steel plate, water systems, certain financial market “utilities,” securities exchanges, or the like. 
    • Defense Industrial Base Elements as Critical Infrastructure. Also considered “critical infrastructure” are areas related to the defense industrial base, including “special metals” (where restrictions exist today on use of imported specialty metal products in federal procurements), certain industrial resources manufactured pursuant to Defense Department priority ratings (“DX rated orders”), and certain US businesses that are “single source,” “sole source,” or “strategic multisource” to the extent the US business has been notified of such status. The defense industrial base focus marks an apparent concern by the Trump Administration over foreign ownership in areas where the US industrial base is more limited (i.e., and, therefore, there is a need to focus on whether foreign owners would be prudent steward of these important assets).
  • Sensitive Personal Data. Recognizing that many companies collect some types of data on individuals, CFIUS has sought to carefully tailor its coverage in the Proposed Regulations in a variety of ways to only encompass information related to national security (i.e., that could be exploited by potential adversaries). Thus, for example, most data concerning a company’s employees has been excluded from the definition of sensitive personal data. Nevertheless, the Proposed Regulations, as drafted, will encompass certain minority foreign investments in a wide range of financial, insurance, and health care businesses.
    • Types of Covered US Businesses. Specifically, the Proposed Regulations apply to certain specified types of personal data, and only where the US business: a) targets or tailors its products or services to sensitive US government personnel or contractors; (b) maintains or collects such data on more than one million individuals; or c) where the US business has a “demonstrated business objective” to maintain or collect such data on over one million individuals and such data is an “integrated part of the US business’s primary products or services.”  As a practical matter, the “one million individuals” threshold will probably encompass many regional and national financial and insurance businesses with the specified types of personal data. 

• ​Types of Covered Data. Subject to specific limitations in the Proposed Regulations, the types of sensitive personal data covered include, among other things: data used to analyze or determine an individual’s financial distress or hardship, certain data in consumer reports, data in certain types of insurance applications (health, long-term care, professional liability, mortgage or life insurance), data relating to physical mental or psychological health condition of an individual, genetic data, certain geolocation data, biometric enrollment data (e.g., facial, voice, retina/iris and palm/fingerprints), and security clearance information.  

• The Proposed Regulations Define Covered Foreign Acquisitions of Real Estate Interests at US Ports and Near Military and Sensitive Installations. FIRRMA also afforded CFIUS the ability to review a foreign person’s purchase, lease or concession with respect to US real estate located at, or that will function as part of, an air or maritime port, or is in close proximity to a US military installation or other US government facilities or properties that are national security sensitive, or could reasonably afford a foreign person the ability to engage in intelligence collections or otherwise expose national security activities at such installations, facilities or properties. The Proposed Regulations flesh out the types of “covered real estate transactions” through offering a series of more specific definitions of  the types of “purchase,” “lease” and “concession” through which a foreign person is afforded certain “property rights” with respect to “covered real estate.”  It also establishes exceptions in certain situations for real estate in urbanized areas and urban clusters as well as single housing units. Of particular, note:

• Types of Covered Real Estate. The Proposed Rule for the first time provides definitions in order to limit coverage to a set of important facilities, including specific types of airports (major passenger and cargo airports by volume as well as civil-military “joint use airports”) and maritime ports (the top 25 tonnage, container, and dry bulk ports as well as strategic seaports). It also provides a limiting definition of military facilities as well as a specific list of covered military installations that meets the definition (see Appendix A to the Proposed Regulations). 
  • The Proximity Rule for Military Installations. Foreign investments are covered where the real estate being acquired is in “close proximately” (i.e., one mile or less) to a military installation or, in the case of a shorter list of installations (e.g., army combat training centers in the continental United States, major range and test facility base activities, and certain other military ranges), an area less than 99 miles from the outer boundary of such military installation (but, where applicable, no more than 12 nautical miles seaward of the coastline of the United States).
• ​​​Exemptions of Trustworthy Investors from “Excepted Countries.”  Bound to be controversial are provisions in the Proposed Regulations which exempt from CFIUS’ expanded jurisdiction certain “excepted investors” (as defined therein) from “excepted foreign states.”  The “excepted foreign states” are those that will be set forth on a list to be separately published by Treasury and are determined, by a super-majority of CFIUS voting member agencies,  to have established and be effectively utilizing “a robust process to assess foreign investments for national security risks” and to be coordinating with the United States on matters relating to investment security. The notice makes it clear that the initial list of excepted foreign states will be “limited” and may be added to over time. In effect, CFIUS has returned to a “white list” approach in the original Senate version of FIRRMA, which applies the expanded CFIUS rules to all countries other than those that are exempted, rather than only applying the new disciplines to those countries that warrant it on the basis of sustained pernicious investment practices. The selection of a limited number of countries undoubtedly will spark considerable consternation among US friends and allies left off the list.
• Other Key Elements of the Proposed Regulations. The draft provisions include numerous other features that warrant consideration. A few salient ones are as follows:
• Mandatory Filings – Foreign Governments. The acquisition of a substantial interest in a TID business (at least a 25% voting interest, direct or indirect) by a foreign person in which a foreign government has a substantial interest (at least a 49% voting interest, direct and indirect) requires the filing of a mandatory declaration. The thresholds for “substantial” interest bear scrutiny for potential investors, including in particular sovereign wealth funds considering significant investments in US entities.
• Private Equity Fund Exemption. There is a detailed exemption for investments by traditional private equity funds managed exclusively by a US general partner, managing partner or the equivalent that meet certain criteria.
• Treatment of Joint Ventures. The Proposed Regulations clarify that joint ventures involving the contribution of a US business to the venture are covered.
• Use of Declarations vs. Notices. CFIUS establishes an abbreviated filing process that may be useful for certain transactions through a declaration that will be shorter in length and subject to a shorter 30 day review period, but may result in a number of responses (including that CFIUS will not make a determination unless a notice is subsequently filed).

[View source.]