Signals Intel Safeguards (E.O. 14086)

Summary

Creates new privacy protections for people's personal information collected by U.S. intelligence and a new way for people in certain countries to complain.

What problem does this solve?

Foreign countries were concerned about how the U.S. collected their citizens' data, which made sharing information for business difficult. This order creates new rules and a special court to ensure data is handled properly, helping to rebuild trust for data sharing.

What does this order do?

Creates a new complaint system

Establishes a two-part system for people in certain allied countries to complain if they believe their data was collected improperly by U.S. intelligence.

Establishes a Data Protection Review Court

Creates a new court made of non-government judges to review decisions about complaints and order fixes if violations are found.

Limits data collection to what is necessary and proportional

Requires that intelligence gathering must be necessary to advance a valid security goal and be balanced against the impact on people's privacy.

Prioritizes targeted data collection

Mandates that intelligence agencies must prioritize collecting specific information and can only use bulk collection if targeted methods will not work.

Lists valid reasons for intelligence collection

Defines 12 specific objectives for which signals intelligence can be collected, such as countering terrorism, cybersecurity threats, and espionage.

Bans certain types of intelligence collection

Prohibits collecting intelligence to silence critics, disadvantage people based on race or religion, or give U.S. companies a commercial advantage.

Requires agencies to update and publish privacy policies

Directs all intelligence agencies to update their policies and procedures within one year to match the new safeguards and to make them public.

Who does this affect?

Individuals in allied nations (e.g., European Union)
U.S. Intelligence Agencies
U.S. companies transferring international data

What is the real world impact?

•

Restores international data transfers

Rebuilds trust with foreign partners, especially the European Union, to allow personal data to flow freely again for business. This was needed after previous data sharing agreements were struck down by European courts.

•

Balances national security and individual privacy

Attempts to find a middle ground between the need for U.S. intelligence agencies to gather information for national security and the right of all people, regardless of nationality, to have their personal information protected.

When does this start?

This order takes effect immediately on October 7, 2022, and sets several deadlines for government agencies to create new processes and update policies.

Establish complaint submission process

Within 60 days of October 7, 2022, the Director of National Intelligence must create a process for receiving complaints from qualifying states.

Establish Data Protection Review Court

Within 60 days of October 7, 2022, the Attorney General must establish the new Data Protection Review Court through regulations.

Update agency policies

Within one year of October 7, 2022, each intelligence agency must update its policies to implement the new safeguards.

Address oversight recommendations

Within 180 days of a review, intelligence agencies must address all recommendations from the Privacy and Civil Liberties Oversight Board.