Customs brokers and client confidentiality: what 19 CFR 111.24 allows

What does 19 CFR 111.24 say in plain English?#

19 CFR 111.24 says that a licensed customs broker's records relating to the business of its clients are confidential. The broker may share their contents, or information connected with them, only with a short list of recipients the rule names. Broadly, that list covers the client itself, the client's surety on a particular entry, named CBP officials and other duly accredited officers or agents of the United States, and a subpoena from a court of competent jurisdiction can compel disclosure.

The rule sits in Part 111 of Title 19, which governs customs broker licensing, permits and broker duties. Part 111 has been amended over time, so read the current text on the official electronic Code of Federal Regulations rather than a summary saved years ago, and have customs counsel confirm how it applies to your facts.

Two words do most of the work: records and connected. The duty does not stop at the entry packet. It reaches information drawn from those records, which can include summaries, spreadsheets and data extracts built from client files.

Which broker records does the rule reach?#

The records 19 CFR 111.24 reaches are, in practice, most of what a brokerage holds, because nearly every workflow starts with a client shipment. The table sorts common record types by how closely they tie to client business. Treat it as a starting map for counsel, not a conclusion.

The practical lesson is that very few broker records are free of client information. Even internal training material tends to use real entries as examples, so treat any record as client-related until someone has checked it.

Why client authorization is the gating step#

Client authorization is the gating step because an AI developer, a data intermediary or any other commercial recipient is not one of the parties the rule names. The cleanest way to bring client-related records into a license is for the client to authorize that disclosure in writing, with a defined scope.

Some brokers ask whether stripping client names or aggregating data takes the information outside the rule. That is an open legal question to put to counsel, not an assumption to build a deal on. Entry data can point to an importer through product descriptions, supplier names, ports and timing, even with the name removed.

A useful authorization is specific. Broad consent buried in general terms and conditions of service invites dispute later, and it may not satisfy counsel's reading of the rule. A stand-alone authorization should cover the points below.

• 1Which records are covered, by system and date range.
• 2The purpose: training or evaluating AI models, not marketing or resale.
• 3Who may receive the prepared records, including any intermediary.
• 4What preparation applies, such as removing personal and confidential details.
• 5How long the permission lasts and how the client can withdraw it.
• 6Who signs for the client, in what capacity, and on what date.

What a broker can review before asking any client#

A broker can review its own systems and volumes before asking any client, because describing an archive is different from disclosing its contents. Knowing which ABI software holds entries, which document management system holds images and how many years remain accessible lets leadership decide whether client conversations are worth starting.

Keep this review descriptive. Record counts, date ranges, system names and field lists are the right level of detail. Do not paste sample entries into emails, slide decks or questionnaires, even for outside advisors, until counsel has said whether that is itself a disclosure.

The review also shows which clients matter most. A broker whose classification work concentrates in a few long-standing accounts has a short list of authorizations to request, while one with a long tail of small importers may find that only a subset is practical to approach.

Rules and contracts that sit on top of 111.24#

19 CFR 111.24 is one layer among several, and a broker reviewing a data request checks them together. Clearing the confidentiality rule with client authorization does not settle what the client contract, privacy law or a separate nondisclosure agreement says.

Which laws apply is assessed deal by deal with counsel. A broker with individual importers among its accounts, or clients spread across many states, will usually need a closer privacy review than one serving only business importers.

Illustrative: a regional broker answers an AI data inquiry#

Illustrative: a fictional regional customs brokerage hears that classification histories may interest AI developers. Its entries live in ABI software, scanned invoices and rulings research sit in a document management system, and client conversations run through shared email boxes.

Counsel reads 19 CFR 111.24 with the leadership team and concludes that client-related records need written client authorization. The brokerage drafts a short authorization covering classification worksheets and related email for named date ranges, and offers it to its longest-standing business clients. It excludes individual importers and any shipment flagged for export control review.

Some clients sign and some decline. The resulting package is narrower than the full archive, but every record in it traces to a signed authorization, and the declined accounts are simply left out.

How SourceX approaches broker confidentiality#

SourceX treats 19 CFR 111.24 as a Rights question within the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. Nothing leaves the brokerage during the first assessment, which works from system names, date ranges and volumes alone, so the broker and its counsel can decide whether to proceed before any client file is touched.

Where a package goes ahead, the SourceX Evidence Packet covers provenance, licensing rights, permitted use, the privacy record and release authorization. For a broker, the licensing rights entry lists each client authorization, so the scope of every release can be checked against a signed document.