Industrial Policy & Trade Monitor· 2662 actions· ✨ 89 recent

On 2025-07-08 President Trump issued a Section 721 (Defense Production Act) order retroactively prohibiting Hong Kong-based Suirui International Co., Ltd.'s 2020 acquisition of Jupiter Systems, LLC, a US video-wall and audio-visual technology maker, from Foxconn. CFIUS found the transaction posed a national security risk because a Chinese military company holds an indirect interest in Suirui Group and can appoint one of its directors, creating a risk that Jupiter's products — used in military and critical- infrastructure environments — could be compromised. The order requires Suirui to fully divest all interests and rights in Jupiter within 120 days of the order (extendable at CFIUS's discretion) and bars Jupiter from holding interests in Suirui-linked Asian subsidiaries formed after the 2020 deal.

The Protecting Americans from Foreign Adversary Controlled Applications Act (PAFACA), enacted as Division H of P.L. 118-50 (21st Century Peace through Strength Act), prohibits app stores and internet hosting services from distributing, maintaining, or updating "foreign adversary controlled applications" — defined explicitly to include ByteDance Ltd and its subsidiaries (TikTok). ByteDance was given 270 days from enactment (until January 19, 2025) to execute a "qualified divestiture" — selling TikTok to an owner with no operational relationship with a foreign adversary — or face a nationwide distribution ban. The Supreme Court unanimously upheld the law's constitutionality in TikTok, Inc. v. Garland (January 17, 2025), rejecting First Amendment challenges and affirming the national-security rationale grounded in data-collection concerns.

Signed by President Javier Milei and the entire cabinet on 20 December 2023 and published in the Boletín Oficial extraordinario on 21 December 2023, Decreto de Necesidad y Urgencia 70/2023 declares a public emergency across economic, financial, fiscal, administrative, pension, tariff, sanitary, and social matters until 31 December 2025 (Article 1) and enacts 366 articles across 16 titles that fundamentally restructure Argentina's regulatory framework. The DNU repeals or amends dozens of statutes to deregulate foreign trade (repealing the Compre Nacional buy-preference law Ley 18.875 and the price-control framework Ley 27.345), opens privatisation of state enterprises (Aerolíneas Argentinas, ENARSA, Banco Nación, Correo Argentino, Trenes Argentinos), dismantles the Ley de Abastecimiento price-control regime, liberalises civil aviation cabotage to foreign carriers, deregulates hydrocarbons export and mining permitting, and replaces the severance-pay regime with a capitalisation-fund system. It is the foundational enabling framework for all subsequent Milei-administration deregulatory instruments filed on the IPTM register, including RIGI (Law 27.742), Decreto 38/2025, Decreto 449/2025, and Decreto 563/2025.

On 24 February 2022, hours after Russia's invasion of Ukraine began, the UK Foreign Secretary announced a full asset freeze on VTB, Russia's second-largest bank (£154bn in assets, 95,000 employees), alongside a freeze on all Russian bank assets in the UK and a ban on Russian companies raising finance on UK markets. The package designated more than 100 companies and individuals -- including five major defence firms (Rostec, Uralvagonzavod, Tactical Missile Corporation, United Aircraft Corporation, United Shipbuilding Corporation) and Putin-inner-circle figures such as Kirill Shamalov -- for asset freezes and travel bans. Aeroflot was banned from UK airspace and new export controls were imposed on electronics, telecommunications and aerospace goods to Russia.

Effective 24 February 2022 — the date of Russia's full-scale invasion of Ukraine — the US Bureau of Industry and Security (BIS) published an interim final rule (87 FR 12226, FR Doc 2022-04300) adding sweeping new export license requirements under a new § 746.8 of the Export Administration Regulations (EAR). The rule requires a licence for any item in CCL Categories 3–9 (electronics, computers, telecommunications, sensors, lasers, navigation/avionics, marine, aerospace, propulsion) exported, reexported, or transferred to Russia, with a review policy of denial. Two new Russia-specific Foreign Direct Product (FDP) rules extend US jurisdiction to foreign-manufactured goods: the Russia FDP Rule (§ 734.9(f)) covers all foreign-made items using US technology/equipment destined for Russia, and the Russia-MEU FDP Rule (§ 734.9(g)) covers items destined to 47 designated military-end-user (MEU) entities with no licence exceptions available. All three restrictions carry a presumption of denial, making this the most sweeping peacetime expansion of the EAR since its modern codification.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

MOFCOM Order No. 4 of 2020, issued and effective 19 September 2020, establishes the Unreliable Entity List (UEL / 不可靠实体清单) regime — China's primary countermeasure framework for designating foreign companies, organisations, and individuals that are deemed to endanger Chinese national sovereignty, security, or development interests, or that apply discriminatory measures against Chinese entities in violation of normal market principles. The UEL inter-ministerial Working Mechanism, administered through MOFCOM, may impose restrictions or prohibitions on the designated entity's China-related import/export activities, investment in China, and entry or stay of senior personnel in China, as well as fines. Promulgated under the Foreign Trade Law of the PRC and the National Security Law of the PRC, the Provisions serve as the statutory parent for every UEL designation announcement since 2023, and operate as the structural peer of the US BIS Entity List / OFAC SDN architecture and the simultaneously promulgated Anti-Foreign Sanctions Law framework.

Effective 17 August 2020 (published in the Federal Register 20 August 2020, Vol. 85 No. 162, FR Doc 2020-18213), BIS implemented three simultaneous measures targeting Huawei's global supply chain. First, 38 non-U.S. affiliates of Huawei Technologies Co., Ltd. were added to the Entity List with the most restrictive license review policy (presumption of denial) and designated under footnote 1, extending the Huawei-specific Foreign-Produced Direct Product Rule (FDPR) to their operations. Second, the Temporary General License (TGL), which since May 2019 had authorized limited ongoing transactions with Huawei (network maintenance, software updates, standards participation), was allowed to expire on 13 August 2020 and replaced with a narrower authorization. Third, BIS expanded the scope of the Huawei FDPR (General Prohibition Three) to cover foreign-produced items when a footnote 1 entity is a party to any transaction or when the item will be used in the production or development of products for any footnote 1 entity, closing the design-house loophole that had allowed TSMC to supply HiSilicon/Kirin chips as long as Huawei was not the direct importer.

The Cybersecurity Law of the People's Republic of China (中华人民共和国网络安全法) was adopted at the 24th meeting of the 12th NPC Standing Committee on 7 November 2016 and entered into force on 1 June 2017, establishing the foundational legal framework for network security governance across all sectors. The law creates the Critical Information Infrastructure Operator (CIIO) designation and protection regime administered by the Cyberspace Administration of China (CAC), mandates data localisation for personal information and important data collected or generated by CIIOs in China, and establishes cross-border data-transfer security assessment requirements under Article 37 — the provision later operationalised by DSL 2021, PIPL 2021, and the 2024 CAC Cross-Border Data Flow Provisions. The CSL introduced multi-level protection scheme (等级保护制度 / MLPS) obligations for all network operators and network-product/service security-review procedures, under which CAC triggered the cybersecurity review of Didi Global in 2021 and the exclusion of Micron's products from Chinese critical-infrastructure projects in 2023.