Pursuant to the authority vested in me as President by the Constitution and the laws of the United States of America, it is hereby provided:
Section 1. the purpose The United States collects signals intelligence so that its national security decision makers have access to the timely, accurate, and clear information necessary to advance US national security interests and protect its citizens and the citizens of its allies and partners from harm. Signals intelligence capabilities are the primary reason we have been able to adapt to a dynamic and challenging security environment, and the United States must maintain and continue to develop robust and technologically advanced signals intelligence capabilities to protect our security and that of our allies and partners. At the same time, the United States recognizes that signal intelligence activities must take into account that all persons must be treated with dignity and respect, regardless of their nationality or where they live, and that all persons have legitimate privacy interests to manage. their personal information. Therefore, this order establishes safeguards for signal intelligence activities.
Sec. 2. Signal Intelligence activities.
(a) Principles. Signal intelligence activities will be permitted and conducted in accordance with the following principles:
(i) Signal intelligence activities shall be authorized by statute or by Executive Order, proclamation, or other Presidential directive and shall be conducted in accordance with the Constitution and applicable statutes and Executive Orders, proclamations, and other Presidential directives.
(ii) Signal intelligence activities shall be subject to appropriate safeguards, which shall ensure that privacy and civil liberties are fully considered in the planning and execution of such activities, such that:
(A) signals intelligence activities shall be conducted only after a determination based on a reasonable assessment of all relevant factors that the activities are necessary to further a validated intelligence priority, although signals intelligence shall not be the only means available or employed. for advancing aspects of the validated intelligence priority; and
(B) signals intelligence activities shall be conducted only to the extent and in a manner proportionate to the authorized validated intelligence priority, with the objective of striking an appropriate balance between the importance of advancing the validated intelligence priority. and their impact on the privacy and civil liberties of all people, regardless of their nationality or place of residence.
(iii) Signal intelligence activities will be subject to strict oversight to ensure compliance with the principles outlined above.
(b) Purposes. Signals intelligence gathering activities will be conducted for legitimate purposes.
(A) Signals intelligence gathering activities shall be conducted solely to achieve one or more of the following purposes:
(1) understanding or assessing the capabilities, intentions, or activities of a foreign government, foreign military, faction of a foreign nation, a foreign-based political organization, or an entity acting on behalf of or under the control of such foreign government. , military, faction, or political organization to protect the national security of the United States and its allies and partners;
(2) To understand or assess the capabilities, intentions, or activities of foreign organizations that pose a current or potential threat to the national security of the United States or its allies or partners, including international terrorist organizations;
(3) understand or assess transnational threats affecting global security, including climate and other ecological changes, public health risks, humanitarian threats, political instability, and geographic competition;
(4) protection from foreign military capabilities and activities;
(5) protecting against terrorism, hostage-taking, and holding individuals captive (including the identification, location, and rescue of hostages and captives) by or on behalf of a foreign government, foreign organization, or foreign person;
(6) protect against espionage, sabotage, assassination, or other intelligence activities by, on behalf of, or with the assistance of, a foreign government, foreign organization, or foreign person;
(7) protect against threats of the development, possession, or proliferation of weapons of mass destruction or related technologies and threats made on behalf of or with the assistance of a foreign government, foreign organization, or foreign person;
(8) protect against cybersecurity threats created or exploited by a foreign government, foreign organization, or foreign person or cyber security threats created by or on behalf of a foreign government, foreign organization, or foreign person;
(9) Protect against threats against personnel of the United States or its allies or partners;
(10) protection from transnational criminal threats, including illicit financing and evasion of sanctions related to one or more of the other purposes identified in subsection (b)(i) of this section;
(11) to protect the integrity (physical and electronic) of elections and political processes, government property, and United States infrastructure from activities by, on behalf of, or with the assistance of a foreign government, foreign organization, or foreign person; and
(12) advancing collection or operational capabilities or activities in furtherance of a legitimate purpose identified in subsection (b)(i) of this section.
(B) The President may authorize an update of the target list in light of new national security obligations, such as new or increased threats to the national security of the United States, for which the President determines that signals collection activities may be used. The Director of National Intelligence (Director) shall publicly release updates to the President’s authorized target list, unless the President determines that doing so would pose a risk to the national security of the United States.
(ii) Prohibited Purposes.
(A) Signal intelligence gathering activities shall not be conducted for the following purposes:
(1) freely express or burden criticism, dissent or political ideas or opinions of the public or the press;
(2) eliminate or limit legitimate privacy interests;
(3) eliminate or limit the right to legal counsel; or
(4) disadvantaging people based on their ethnicity, race, gender, gender identity, sexual orientation, or religion.
(B) It is not a legitimate purpose to collect foreign private commercial information or trade secrets to provide a commercially competitive advantage to United States companies and United States business sectors. Collection of such information is authorized only to protect the national security of the United States or its allies or partners.
(iii) Validating signals intelligence collection priorities.
(A) Pursuant to section 102A of the National Security Act of 1947, as amended (50 U.S.C. 3024), the Director shall establish priorities for the Intelligence Community to ensure the timely and effective collection of national information, including national signals intelligence. The Director does so through the National Intelligence Priorities Framework (NIPF), which the Director maintains and presents to the President through the Assistant to the President for National Security Affairs on a regular basis. To ensure that signals intelligence gathering activities are conducted in furtherance of legitimate objectives, prior to presenting the President with the NIPF or a successor framework that identifies intelligence priorities, the Director shall request the National Directorate’s Civil Liberties Protection Officer. Intelligence (CLPO) assessment of planned signals intelligence gathering activities for each intelligence priority identified in the NIPF or the following framework:
(1) furthers one or more of the legitimate purposes set forth in subsection (b)(i) of this section;
(2) is not designed and is not intended to conduct signals intelligence collection contrary to the prohibited purposes set forth in subsection (b)(ii) of this section; and
(3) it was established after due consideration of the privacy and civil liberties of all persons, regardless of their nationality or residence.
(B) If the Director disagrees with any aspect of the CLPO’s assessment with respect to any of the intelligence priorities identified in the NIPF or subsequent framework, the Director shall include the CLPO’s assessment and the Director’s views in the submission to the NIPF Chair.
(c) Privacy and civil liberties protections. The following warranties shall comply with the principles contained in subsections (a)(ii) and (a)(iii) of this section.
(i) Gathering signals intelligence.
(A) The United States shall conduct signals intelligence collection activities only after determining that a specific signals intelligence collection activity, based on a reasonable assessment of all relevant factors, is necessary to advance a validated intelligence priority, even if signals intelligence is not required. being the only means available or used to advance priority aspects of validated intelligence; it could be used, for example, to ensure alternative means of validation or to maintain reliable access to the same information. To determine whether to collect signals intelligence consistent with this principle, the United States, through an element of the Intelligence Community or through an interagency committee composed in whole or in part of the heads of Intelligence Community elements and the heads of their departments. elements, or their designees, shall consider the availability, feasibility, and suitability of other less intrusive sources and methods for gathering information necessary to advance a validated intelligence priority, including diplomatic and public sources, and shall give priority to those available, feasible, and usable . suitable alternatives to signal intelligence.
(B) Signals intelligence gathering activities shall be tailored to the extent practicable to further the validated intelligence priority and, with due consideration of relevant factors, not to disproportionately affect privacy and civil liberties. These factors can be, depending on the circumstances, the nature of the goal achieved; feasible measures taken to limit the scope of the collection to the authorized purpose; the intrusiveness of the collection activity, including its duration; the probable contribution of the collection to the goal achieved; reasonably foreseeable consequences for individuals, including unintended third parties; the nature and sensitivity of the data to be collected; and the guarantees given to the information collected.
(C) For purposes of subsection (c)(i) of this section, the scope of a specific signals intelligence gathering activity may include, for example, a specific effort or objective, as applicable.
(ii) Mass collection of signals intelligence.
(A) Preference shall be given to indirect collection. Mass collection of signals intelligence shall be authorized only upon a decision by: an element of the Intelligence Community or by an interagency committee composed in whole or in part of the heads of Intelligence Community elements, the heads of the departments containing those elements. , or their designees – that the information necessary to advance the validated intelligence priority cannot reasonably be obtained through targeted collection. When it is determined that mass collection is necessary to advance a validated intelligence priority, elements of the Intelligence Community will apply reasonable methods and technical measures to limit the data collected to what is necessary to advance a validation. prioritizing intelligence, minimizing the collection of irrelevant information.
(B) Each element of the Intelligence Community that collects signals intelligence through bulk collection shall use such information only to achieve one or more of the following purposes:
(1) anti-terrorism protection, hostage-taking, and captivity of individuals (including the identification, location, and rescue of hostages and captives) by or on behalf of a foreign government, foreign organization, or foreign person;
(2) protect against espionage, sabotage, assassination, or other intelligence activities by, on behalf of, or with the assistance of a foreign government, foreign organization, or foreign person;
(3) protect against the threat of the development, possession, or proliferation of weapons of mass destruction or related technologies and threats made on behalf of or with the assistance of a foreign government, foreign organization, or foreign person;
(4) protect against cybersecurity threats created or exploited by a foreign government, foreign entities, or a foreign person, or against malicious cyber activities by or on behalf of a foreign government;
(5) protect against threats against personnel of the United States or its allies or partners; and
(6) to protect against transnational criminal threats, including illicit financing and evasion of sanctions related to one or more of the other purposes identified in subsection (c)(ii) of this section.
(C) The President may authorize an update of the target list based on new national security imperatives, such as new or increased threats to the national security of the United States, for which the President determines that mass collection may be used. The Director shall publicly release any updates to the President’s authorized target list unless the President determines that doing so would pose a risk to the national security of the United States.
(D) To minimize any impact on privacy and civil liberties, targeted signal intelligence collection activities that use data acquired indiscriminately (eg, without specific identifiers or selection criteria) shall be subject to the safeguards described in this subsection. unless these data are:
(1) targeted signal intelligence collection is used only to support the initial technical phase of the activity;
(2) retained only for the short period of time necessary to complete this phase; and
(iii) Managing Personal Information collected through Signal Intelligence.
(A) Minimization. Each element of the Intelligence Community that manages Personal Information collected through Signal Intelligence shall establish and enforce policies and procedures designed to minimize the dissemination and retention of Personal Information collected through Signal Intelligence.
(1) Expansion. Each element of the Intelligence Community that manages personal information collected through Signal Intelligence:
(a) The United States shall disclose personal information of non-United States persons collected through signals intelligence only if it includes one or more of the comparable types of information described in Section 2.3 (United States Intelligence Activities) of Executive Order 12333 of December 4, 1981. as amended, states may be extended to information about persons in the United States;
(b) will not disclose personal information collected through signal intelligence solely because of an individual’s nationality or place of residence;
(c) disclose personal information collected through signals intelligence within the United States Government if an authorized and properly trained person believes that the personal information will be adequately protected and the recipient has a need to know the information;
(d) shall give due consideration to the purpose of the disclosure, the nature and extent of the personal information being disclosed, and the potential adverse effect on the person or persons before disclosing the personal information received through signal intelligence to recipients outside the United States. Government of States, including a foreign government or international organization; and
(e) shall not disclose personal information collected through signal intelligence for the purpose of circumventing the provisions of this order.
(2) Withholding. Each element of the Intelligence Community that manages personal information collected through Signal Intelligence:
(a) Personal Information collected through Signal Intelligence will retain Personal Information of non-United States persons only if retention of comparable information about United States persons is permitted under applicable law, and such information shall be subject to the same retention periods as would apply to comparable information; . concerning persons of the United States;
(b) personal information of non-U.S. persons for which a final retention decision has not been made will be subject to the same temporary retention periods as would apply to comparable information about United States persons; and
(c) will delete personal information about non-United States persons collected through intelligence signals that will be deleted, and may not be retained, in the same way that comparable information about United States persons would be deleted.
(B) Data Security and Access. Each element of the Intelligence Community that manages personal information collected through Signal Intelligence:
(1) will process and store personal information collected through signals intelligence under conditions that provide adequate protection to unauthorized persons and prevent access, consistent with applicable sensitive information safeguards contained in relevant Executive Orders, proclamations, other Presidential directives, Intelligence Community directives. and related policies;
(2) shall limit access to such personal information to authorized personnel who have a need to know the information to perform their duties and who have received adequate training regarding the requirements of applicable United States law, as described in the policies and procedures provided for in subsection (c). (iv) of this section; and
(3) must ensure that personal information collected through signals intelligence for which no final retention determination has been made is accessed to make or support such determination or to perform authorized administrative, testing, development, security, or oversight functions.
(C) Data quality. Each element of the Intelligence Community that manages personal information collected through signals intelligence shall include such personal information in intelligence products only in accordance with applicable Intelligence Community standards for accuracy and objectivity, focusing on the application of standards regarding information quality and reliability. , consideration of alternative sources of information and interpretations of data, and objectivity in conducting analyses.
(D) Bulk Collection Inquiries. Each element of the Intelligence Community that interrogates minimum signals intelligence obtained through cluster collection shall comply with and comply with the permitted uses of signals intelligence obtained through collection identified in subsection (c)(ii)(B) of this section. policies and procedures issued pursuant to subsection (c)(iv) of this section, which shall take due account of their impact on the privacy and civil liberties of all persons, regardless of their nationality or residence.
(E) Documentation. To facilitate the oversight process set forth in subsection (d) of this section and the redress mechanism set forth in section 3 of this order, each element of the Intelligence Community that conducts signals intelligence gathering activities shall maintain reasonable documentation. depending on the nature and type of collection in question and the context in which it is collected. The content of such documentation may vary depending on the circumstances, but to the extent reasonable, the Intelligence Community element, based on a reasonable assessment of all relevant factors, will provide a factual basis for evaluating signals intelligence collection. activity is necessary to advance the validated intelligence priority.
(iv) Update and publish policies and procedures. The head of each element of the Intelligence Community:
(A) The policies and procedures issued pursuant to Presidential Policy Directive 28 (Signals Intelligence Activities) dated January 17, 2014 (PPD-28) (PPD-28) shall continue to be used until updated pursuant to subparagraph (c)(iv)(B). of this section;
(B) shall, within one year of the date of this order, in consultation with the Attorney General, the CLPO, and the Privacy and Civil Liberties Oversight Board (PCLOB), update such policies and procedures to the extent necessary to implement privacy and civil. guarantees of liberties in this order; and
(C) within one year after the date of this order, publish these policies and procedures to the public to the extent possible, consistent with the protection of intelligence sources and methods, to improve public understanding and to promote public awareness. trust, under guarantees that the United States conducts signal intelligence activities.
(A) Nature of Review. Consistent with applicable law, the PCLOB is encouraged to conduct a review of the policies and procedures described in subsection (c)(iv)(B) of this section to ensure that they are consistent with the enhanced protections contained therein. in this order
(B) Consideration of Review. Within 180 days of the completion of any review by the PCLOB described in subsection (c)(v)(A) of this section, the head of each component of the Intelligence Community shall carefully review and implement or address any recommendations contained in such review. review, in accordance with current law.
(d) Subjecting signals intelligence activities to strict supervision. The actions addressed in this subsection are designed to build on oversight mechanisms already in place by elements of the Intelligence Community to ensure that signals intelligence activities are subject to rigorous oversight.
(i) Legal, Oversight, and Compliance Officials. Each element of the Intelligence Community that includes Signal Intelligence:
(A) shall include senior legal, oversight, and enforcement officials who conduct periodic oversight of signals intelligence activities, including the Inspector General, the Privacy and Civil Liberties Officer, and a designated enforcement officer or officers. Power to oversee and ensure compliance with applicable United States law;
(B) will provide law enforcement, oversight, and enforcement officials with access to all information appropriate to carry out their oversight responsibilities under this subsection, consistent with the protection of intelligence sources or methods, including their oversight responsibilities, to ensure that appropriate actions are taken . to resolve an incident of non-compliance with applicable US law; and
(C) shall not take any action designed to interfere with or improperly influence such legislative, oversight, or enforcement officials in carrying out their oversight responsibilities under this subsection.
(ii) Training. Each element of the Intelligence Community will maintain appropriate training requirements to ensure that all personnel with access to signals intelligence know and understand the requirements of this order and the policies and procedures for reporting and resolving incidents resulting from noncompliance with applicable United States law.
(iii) Significant events of non-compliance.
(A) Each element of the Intelligence Community shall ensure that, if a law enforcement, supervisory, or compliance official or any other employee identifies a significant event of noncompliance as described in subsection (d)(i) of this section. Under applicable US law, the incident will be reported immediately to the head of the Intelligence Community element, the head (as applicable) and the director of the executive department or agency(ies) containing the Intelligence Community element. .
(B) Upon receipt of such report, the head of the Intelligence Community element, the head of the agency containing the Intelligence Community element (as applicable), and the director shall ensure that necessary action is taken. resolving significant incidents of non-compliance and preventing recurrence.
(e) Savings Clause. If signals intelligence collection is conducted in the manner and consistently as prescribed by this section of this order, this order does not limit any signals intelligence collection techniques authorized under the National Security Act of 1947 (50 U.S.C. 3001 et seq.). , the Foreign Intelligence Surveillance Act of 1978, as amended (50 U.S.C. 1801 et seq.) (FISA), Executive Order 12333, or other applicable law or Presidential directive.
Sec. 3. Signal Intelligence Repair Mechanism.
(a) Purpose. This section establishes a redress mechanism for the review of qualifying complaints filed by the appropriate public authority in a qualifying State regarding United States signals intelligence activities for any covered violations of United States law and, as appropriate, applicable law.
(b) Process for Filing Appropriate Claims. Within 60 days from the date of publication of this order, the Director, in consultation with the heads of the elements of the Intelligence Community that collect or manage personal information collected through Signals Intelligence and the Attorney General, will establish a process for submitting qualifying complaints sent. appropriate public authorities of a qualifying state.
(c) Initial investigation of qualifying complaints by CLPO.
(i) Establishment. The Director, in consultation with the Attorney General, shall establish a process that authorizes the CLPO to investigate, review, and, if necessary, order correction of appropriate complaints. This process will govern how the CLPO will review qualifying claims that protect classified or otherwise privileged or protected information and will ensure that, at a minimum, for each qualifying claim the CLPO:
(A) review information necessary to investigate the necessary complaint;
(B) using its statutory and delegated powers to determine whether a covered violation has occurred;
(i) taking into account national security interests and applicable privacy protections;
(ii) giving due deference to important decisions made by national security officials; and
(iii) apply the law impartially;
(C) determining the appropriate remedy for any covered violation;
(D) Provide a classified report of information indicating a violation by any authority subject to the oversight of the Foreign Intelligence Surveillance Court (FISC) to the Assistant Attorney General for National Security, who shall report violations to the FISC in accordance with its rules. procedure;
(E) After the review is completed, notify the complainant, through the appropriate public authority of a competent state and without confirming or denying that the complainant was subject to United States signals intelligence activities, that:
(1) “the review has not identified a covered violation or the Office of the Director of National Intelligence’s Civil Liberties Protection Officer has issued a determination requiring appropriate remediation”;
(2) the complainant or an element of the Intelligence Community may, in accordance with regulations issued by the Attorney General under section 3(d)(i) of this Order, apply for a review of the CLPO’s decisions through a Data Protection Review. the court described in subsection (d) of this section; and
(3) if the complainant or an element of the Intelligence Community applies for review by the Data Protection Review Tribunal, the Data Protection Review Tribunal shall select special counsel to defend the complainant’s interest in the matter;
(F) maintain appropriate documentation of the review of the qualifying claim and submit a classified decision that explains the basis of its factual findings, determines whether a covered violation has occurred, and specifies the appropriate remedy if such a violation occurs. , in accordance with its statute and delegated authority;
(G) prepare a qualified review docket, which consists of appropriate documentation of the qualifying complaint review described in subsection (c)(i)(F) of this section; and
(H) Provide necessary assistance to the Data Protection Review Tribunal.
(ii) Lot effect. Each element of the Intelligence Community, and each agency that has an element of the Intelligence Community, shall comply with any decision made by the CLPO to make appropriate corrections pursuant to subsection (c)(i)(C) of this section, in any case to the contrary. Decided by the Data Protection Review Court.
(iii) Support. Each element of the Intelligence Community shall provide the CLPO with access to information necessary to conduct the reviews described in subparagraph (c)(i) of this section, consistent with the protection of intelligence sources and methods, and shall not take action. Obstructing or interfering with CLPO reviews. Privacy and civil liberties officials from elements of the Intelligence Community will also assist the CLPO as it conducts the reviews described in subparagraph (c)(i) of this section.
(iv) Independence. The Director shall not interfere with the CLPO’s review of a qualifying complaint under subsection (c)(i) of this section; The Director shall not remove a CLPO for actions taken pursuant to this order, except in cases of misconduct, misconduct, security breaches, dereliction of duty, or incapacity.
(d) Data Protection Review Tribunal.
(i) Establishment. The Attorney General is authorized and shall establish a process for review of decisions made by the CLPO under subsection (c)(i) of this section. In exercising this authority, the Attorney General shall, within 60 days of the date of this order, promulgate regulations establishing a Data Protection Review Tribunal to exercise the Attorney General’s authority to review such decisions. This regulation will provide, at least, the following:
(A) The Attorney General, in consultation with the Secretary of Commerce, the Director, and the PCLOB, shall appoint persons to serve as judges of the Data Protection Review Tribunal who shall be law enforcement officers with appropriate experience in the field of data privacy. and national security legislation, with an emphasis on individuals with prior judicial experience who, upon initial appointment, will not be employees of the United States Government. While appointed to the Data Protection Review Tribunal, such judges shall have no official duties or employment with the United States Government other than their official duties and positions as judges of the Data Protection Review Tribunal.
(B) When the complainant or an element of the Intelligence Community receives a request for review of a decision made by the CLPO under subsection (c) of this section, the Data Protection Review Tribunal shall consist of three judges. has called for the examination of the request. The Data Protection Review Tribunal panel service will require the judge to have the necessary security clearances to access classified national security information.
(C) When convened, the Data Protection Review Tribunal shall select a special counsel through procedures set forth in the Attorney General’s regulations. The special counsel will assist the panel in its review of the review application, including by advocating the complainant’s interest in the matter and ensuring that the Data Protection Review Tribunal is informed of the relevant issues and law. Serving as special counsel will require the special counsel to have the necessary security clearances to access classified national security information and to comply with restrictions set forth in Attorney General regulations regarding communications with the complainant to ensure the protection of classified or otherwise privileged or protected information. .
(D) The Data Protection Review Tribunal will impartially review decisions made by the CLPO as to whether a covered breach has occurred and the appropriate remedy if such a breach has occurred. The review shall be based at a minimum on the classified review record described in subsection (c)(i)(F) of this section and on information or submissions provided by the complainant, the special counsel, or an Intelligence component. the community In reviewing decisions made by CLPO, the Data Protection Review Tribunal will be guided by important decisions of the United States Supreme Court, Article III of the United States Constitution. Important decisions of National Security officials.
(E) If the Data Protection Review Tribunal disagrees with the decisions of the Data Protection Review Tribunal as to whether a breach covered by the CLPO has occurred or the appropriate remedy, the commission shall issue its own determinations.
(F) The Data Protection Review Tribunal shall provide a classified report of information indicating a violation of any authority subject to FISC oversight to the Assistant Attorney General for Homeland Security, who shall report violations to the FISC in accordance with its rules. of the procedure
(G) After the review is completed, the CLPO will be notified of the decisions of the Data Protection Review Tribunal through the procedures established by the Attorney General’s regulations.
(H) After the completion of the review, in response to the complainant’s request for review, the Data Protection Review Tribunal, through the procedures established by the regulations of the Attorney General, will notify the complainant through the appropriate public authority in a qualifying situation and with or without confirmation. denying that the complainant was subject to United States signals intelligence activities, “that the review did not identify a covered violation or that the Data Protection Review Tribunal issued a decision requiring appropriate remediation.”
(ii) Lot effect. Each element of the Intelligence Community and each agency that has an element of the Intelligence Community must comply with any remedy decided by the Data Protection Review Tribunal.
(iii) Support. Each element of the Intelligence Community shall provide the CLPO with access to the information necessary to conduct the review described in subsection (d)(i) of this section, consistent with the protection of intelligence sources and methods required by the Data Protection Review Tribunal. from the CLPO and shall not take any action intended to obstruct or prejudice the review of a panel.
(iv) Independence. The Attorney General shall not interfere with the Data Protection Review Tribunal’s review of a decision made by the CLPO on a qualifying complaint under subsection (i) of this section; The Attorney General shall not remove from service judges appointed pursuant to subsection (d)(i)(A) of this section, nor shall judges of the Data Protection Review Tribunal be removed from service, except in cases of misconduct, misconduct or infractions. safety, neglect of duty, or incapacity, after due consideration of the rules established by the Judicial Conference of the United States under the Judicial Conduct and Disability Act (28 U.S.C. 351 and 351). next).
(v) Record of decisions. For each qualifying complaint issued by the appropriate public authority of a conditional state, the Secretary of Commerce shall:
(A) maintain a record of the complainant who filed such complaint;
(B) not later than 5 years after the date of this order and no less than every five years thereafter, contact the relevant element or elements of the Intelligence Community to determine whether information relevant to the CLPO’s review of that complaint has been declassified and information related to the review of the review application filed with the Data Protection Review Tribunal. whether, inter alia, an element of the Intelligence Community has filed an application for review with the Data Protection Review Tribunal; and
(C) If notified that such information has been declassified, notify the complainant, through the appropriate public authority in a qualifying state, of information regarding the CLPO’s review of its complaint or review of any review request submitted. A Data Protection Review Tribunal may be used in accordance with applicable law.
(e) Annual review of the remedial process by the PCLOB.
(i) Nature of review. Consistent with applicable law, the PCLOB is directed to review annually the processing of qualifying complaints through the resolution mechanism set forth in section 3 of this order, including whether the CLPO and the Data Protection Review Tribunal have processed appropriate complaints in a timely manner; whether the CLPO and the Data Protection Review Tribunal are getting full access to the necessary information; whether the CLPO and the Data Protection Review Tribunal agree with this order; whether the safeguards established in section 2 of this order are properly taken into account in the processes of the CLPO and the Data Protection Review Tribunal; and whether elements of the Intelligence Community have fully complied with the decisions made by the CLPO and the Data Protection Review Tribunal.
(ii) Support. The Attorney General, the CLPO, and elements of the Intelligence Community shall provide the PCLOB with access to information necessary to conduct the review described in subsection (e)(i) of this section, consistent with the protection of intelligence sources and methods.
(iii) Report and certification. Within 30 days of the completion of any review described in subsection (e)(i) of this section, the PCLOB is recommended to:
(A) provide a classified report detailing the results of the review to the President, the Attorney General, the Director, the heads of elements of the Intelligence Community, the CLPO, and the congressional intelligence committees;
(B) making public an unclassified version of the report; and
(C) make an annual public certification as to whether the redressal mechanism set forth in section 3 of this order is processing complaints consistent with this order.
(iv) Consideration of revision. Within 180 days of receipt of any report by the PCLOB described in subsection (e)(iii)(A) of this section, the Attorney General, the Director, the heads of Intelligence Community elements, and the CLPO shall carefully review and implement or otherwise address any recommendations contained in such report. , in accordance with the law in force.
(f) Designation of qualifying state.
(i) In order to implement the remedial mechanism established in section 3 of this order, the Attorney General is authorized to designate a country or regional economic integration organization as a qualifying state for purposes of the remedial mechanism established in accordance with section 3 of this order, effective. immediately or on a date specified by the Attorney General, if the Attorney General decides, in consultation with the Secretary of State, the Secretary of Commerce and the Director:
(A) The laws of the country, the regional economic integration organization, or the member countries of the regional economic integration organization require adequate safeguards in the conduct of signals intelligence activities in which personal information of United States persons is transferred from the territory of the United States. from the country of the regional economic integration organization or from the member country;
(B) the country, the regional economic integration organization or the countries that are members of the regional economic integration organization authorize, or are expected to authorize, the transfer of personal information for commercial purposes within or between the territory of that country. member countries and the territory of the United States; and
(C) such designation would further the national interests of the United States.
(ii) The Attorney General may revoke or modify such designation, immediately or on a date specified by the Attorney General, if the Attorney General determines, in consultation with the Secretary of State, the Secretary of Commerce, and the Director:
(A) countries, regional economic integration organizations, or countries that are members of regional economic integration organizations do not provide adequate safeguards for signals intelligence activities that transfer personal information of United States persons from the United States to the territory of the United States. to the country or to a country that is a member of the regional economic integration organization;
(B) the country, the regional economic integration organization, or the member countries of the regional economic integration organization do not permit the transfer of personal information for commercial purposes between that country or such member countries and the territory of the United States; or
(C) such designation is not in the national interests of the United States.
Sec. 4. Definitions. For the purposes of this order:
(a) “Adequate remedy” means legal measures designed to fully remedy a covered violation of a particular complainant and is limited to measures designed to correct that particular complainant’s complaint, taking into account the manner in which violations of the type identified have typically been corrected. . These measures may include, depending on the specific offense in question, resolving through administrative measures, procedural technical errors or technical errors related to legal access to data or data processing, termination of data acquisition, when collection is not legally authorized, deletion. data obtained without legal authorization, deleting the results of queries made inappropriately, deleting inquiries about data collected legally, limiting access to data collected legally to those who have been properly trained, or recalling information reports that contain data obtained without legal authorization or otherwise disclosed. A manner inconsistent with United States law. Adequate remedies will be tailored to a large extent to resolve the covered breach and minimize adverse effects on the operations of the Intelligence Community and the national security of the United States.
(b) “Bulk collection” means the authorized collection of large amounts of signals intelligence data, for technical or operational reasons, that is acquired without the use of discrimination (eg, without the use of specific identifiers or selection terms).
(c) “Counterintelligence” shall have the same meaning as in Executive Order 12333.
(d) “Covered Violation” means a breach of:
(i) arises from signals intelligence activities conducted after the date of this order with respect to data transferred from a qualifying state to the United States after the effective date of the designation by the Attorney General for that state as provided in section 3(f)(i). of this order;
(ii) harms the individual privacy and civil liberties interests of the complainant; and
(iii) violates one or more of the following:
(A) the Constitution of the United States;
(B) applicable sections of FISA or applicable procedures adopted by the FISC;
(C) applicable agency procedures under Executive Order 12333 or Executive Order 12333;
(D) This order or applicable agency policies and procedures issued or updated pursuant to this order (or the policies and procedures identified in section 2(c)(iv)(A) of this order, prior to updating pursuant to section 2. c)( of this order). (iv)(B));
(E) any statute, order, policy, or procedure superseding those identified in section 4(d)(iii)(B)-(D) of this order; or
(F) Any other statute, order, policy, or procedure adopted after the date of this order, with respect to United States signals intelligence activities, that provides privacy and civil liberties protections within the scope of this order, as identified in a published and updated list. By the Attorney General, in consultation with the Director of National Intelligence.
(e) “Foreign intelligence” shall have the same meaning as in Executive Order 12333.
(f) “Intelligence” shall have the same meaning as in Executive Order 12333.
(g) “Intelligence Community” and “Elements of the Intelligence Community” shall have the same meaning as in Executive Order 12333.
(h) “National Security” shall have the same meaning as in Executive Order 13526 of December 29, 2009 (Classified National Security Information).
(i) “Non-United States Person” means a person who is not a United States Person.
(j) “Personnel of the United States or its allies or partners” means a current or former member of the Armed Forces of the United States, any current or former official of the United States Government, and any other person currently or formerly employed by the United States. Any person working for or on behalf of the United States Government, current or former members of the military, current or former officials, or an ally or partner.
(k) “Qualifying Complaint” means a complaint submitted in writing;
(i) complains that a covered violation has occurred with respect to personal information about the complainant or an individual that is reasonably believed to have been transferred to the United States from a qualifying state after the Attorney General’s designation to that state becomes effective. , according to the provisions of section 3.f) i) of this order;
(ii) includes the following basic information to permit review: information that is the basis for the allegation that a covered violation has occurred, which does not require evidence that the complainant’s data has been subject to United States signals intelligence activities; the nature of the relief sought; the specific means by which personal information of or about the complainant was believed to have been transmitted to the United States; the identities (if known) of the United States Government entities involved in the alleged violation; and any other measures taken by the complainant to obtain the relief sought and the response received through such other measures;
(iii) is not frivolous, obnoxious or made in bad faith;
(iv) is filed on behalf of the complainant, acting on that person’s behalf and not as a representative of a governmental, non-governmental or intergovernmental organization; and
(v) issued by the appropriate public authority in a qualifying situation, after verifying the identity of the complainant and that the complaint meets the requirements of section 5(k)(i)-(iv) of this order.
(l) “Significant event of noncompliance” means a systematic or intentional failure to comply with a principle, policy, or procedure of applicable United States law that could impugn the reputation or integrity of an element of the Intelligence Community. Questions the propriety of an Intelligence Community activity, including considering the significant impact on the privacy and civil liberties interests of the data subject or individuals.
(m) “United States person” shall have the same meaning as in Executive Order 12333.
(n) “Validated intelligence priority” means, for most United States signals intelligence gathering activities, a priority validated through the process described in section 2(b)(iii) of this order; or, in exigent circumstances (eg, when such a process cannot be carried out because of the need to address a new or evolving intelligence requirement), it means a priority established by the President or the head of an element of the Intelligence Community. with the criteria described in section 2.b)(iii)(A)(1)-(3) of this order, to the extent possible.
(o) “Weapons of mass destruction” shall have the same meaning as in Executive Order 13526.
Sec. 5. General Provisions. (a) Nothing in this Order shall be deemed to prejudice or otherwise affect:
(i) the authority conferred by law on an executive department, agency or its head; or
(ii) Duties of the Director of the Office of Management and Budget relating to budgetary, administrative, or legislative proposals.
(b) This Order shall be implemented in accordance with applicable law, including orders and procedures adopted by the FISC, and subject to credit availability.
(c) Nothing in this order prevents the application of additional privacy protections to United States signals intelligence activities that would apply in the absence of this order. In the event of a conflict between this Order and other applicable laws, the privacy safeguards will govern Signal Intelligence activities to the extent permitted by law.
(d) Nothing in this order prohibits elements of the Intelligence Community from disclosing information about a crime to law enforcement; disseminate warnings of threats of death, serious bodily injury or kidnapping; disseminating cyber threat, incident or intrusion response information; reporting to victims or warning potential victims of crime; or complying with expansion obligations required by statute, treaty or court order, including orders and proceedings adopted by the FISC or other courts.
(e) The collection, retention, and disclosure of information about United States persons is governed by various statutory and policy requirements, such as those required by FISA and Executive Order 12333. This order is not intended to change the rules applicable to persons in the United States. FISA, issued pursuant to Executive Order 12333 or other applicable law.
(f) This order shall apply to signals intelligence activities consistent with the scope of application of PPD-28 to those activities prior to the partial repeal by PPD-28 of the national security memoranda issued in conjunction with this order. To implement this subsection, the head of each agency that has an element of the Intelligence Community, in consultation with the Attorney General and the Director, is delegated the authority to issue guidance, and as appropriate, within the scope of the classifiable scope. Application of this order to any element or elements of the Intelligence Community within their agency. The CLPO and the Data Protection Review Tribunal, in carrying out the duties assigned to them under this order, will consider this guidance as authoritative and binding.
(g) Nothing in this order authorizes the declassification or disclosure of classified national security information except as authorized under Executive Order 13526 or any successor order. Consistent with the requirements of Executive Order 13526, CLPO, the Data Protection Review Tribunal, and special counsel shall not have the authority to declassify classified national security information, and shall not disclose classified or otherwise privileged or protected information except as authorized and appropriate. Clean people who need to know information.
(h) This order creates a right to submit appropriate complaints to the CLPO and to have the CLPO’s decisions reviewed by the Data Protection Review Tribunal in accordance with the redress mechanism set out in section 3 of this order. This order is not intended to create and does not create any right, title, or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers. employees, or agents, or any other person. This order does not and does not alter the availability or scope of any judicial review of decisions made through the settlement mechanism governed by applicable law.
JOSEPH R. BIDEN JR.
