Executive Order 14086: Enhancing Safeguards for United States Signals Intelligence Activities
President: Joseph R. Biden Jr.
Required necessity, proportionality, privacy and civil-liberties safeguards for signals intelligence and created a two-level redress mechanism including the Data Protection Review Court.
Status: In effect. Is Executive Order 14086 still in effect? Yes. Executive Order 14086 remains in effect. Its signals-intelligence safeguards and redress framework remain published in the current Justice Department materials; no express revocation is recorded in the reviewed Federal Register disposition table.
What does Executive Order 14086 do?
Biden directed US signals-intelligence activities to observe necessity, proportionality, oversight and privacy protections for all people, regardless of nationality or residence. Collection had to advance a validated intelligence priority and remain appropriately tailored. The order listed legitimate security objectives and prohibited collection for purposes such as suppressing political criticism, burdening legal counsel or obtaining commercial secrets merely to advantage US companies. Signed text.
It also created a two-stage redress mechanism for qualifying complaints from people in designated countries or regional organizations. The ODNI Civil Liberties Protection Officer investigates first; a newly established Data Protection Review Court can review that determination with assistance from a special advocate. Relevant intelligence agencies must comply with binding remediation determinations. The DPRC is an executive-branch review body within Justice, not an Article III federal court with the same public proceedings and jurisdiction as ordinary courts. Signed text.
These safeguards addressed the surveillance and redress concerns surrounding transatlantic personal-data transfers. They did not repeal FISA, authorize otherwise unlawful collection or promise a complainant disclosure of classified operational records. The framework requires a qualifying-state designation and qualifying complaint, while substantive signals-intelligence safeguards extend beyond just EU citizens. Commerce keeps complaint records and coordinates later inquiries about whether review information has been declassified. Signed text.
Before and after
Before the order
Before the order, US intelligence activities operated under statutes and earlier executive safeguards, including Presidential Policy Directive 28. European courts had rejected the prior Privacy Shield arrangement. EO 14086 added a more detailed necessity/proportionality framework and independent executive redress review, while requiring agencies to revise their procedures. It did not directly compel Europe to accept US data transfers. Signed text.
After the order
Justice promulgated the DPRC regulation in October 2022. ODNI published agency implementing procedures on July 3, 2023. The Attorney General’s June 30 designation of the EU and EEA states became effective when the European Commission adopted its adequacy decision on July 10. The legal history of EU adequacy and US surveillance statutes is distinct from whether this executive order has been revoked; current Justice materials continue to describe the review mechanism. Official follow-up record 1. Official follow-up record 2. Official follow-up record 3.
Who had to do what
| Agency / office | Action | Timing / position |
|---|---|---|
| Heads of Intelligence Community elements | Update and publish signals-intelligence safeguards, train personnel, investigate/report significant noncompliance, provide redress reviewers information and comply with remediation. | Procedures within one year; ongoing compliance and assistance. |
| Director of National Intelligence | Validate intelligence priorities with CLPO input, publish authorized objective updates where permitted and establish the first-stage complaint process. | During intelligence-priority development and redress implementation; no single fixed redress deadline. |
| ODNI Civil Liberties Protection Officer | Assess intelligence priorities, investigate qualifying complaints and determine violations and appropriate remediation independently. | When priorities or qualifying complaints arise. |
| Attorney General / Justice Department | Promulgate DPRC regulations, appoint eligible independent judges and designate or revoke qualifying-state status in consultation with State, Commerce and DNI. | DPRC regulations within 60 days; designations as statutory and order conditions are met. |
| Data Protection Review Court / special advocates | Independently review first-stage determinations and provide binding remedial decisions, with special advocates protecting complainants’ interests. | On qualifying applications under Justice’s regulations. |
| Commerce Secretary | Maintain complainant records, inquire about declassification and notify through the relevant qualifying-state authority when information becomes available. | Initial declassification inquiry no later than five years after signing; at least every five years thereafter. |
| State Secretary | Consult on qualifying-state designations and revocation decisions. | When qualifying-state decisions arise. |
| Privacy and Civil Liberties Oversight Board | Encouraged to review agency policies and the redress process; consult on implementing safeguards and appointments. | Agency procedure consultation within the one-year implementation period; redress-process review annually as encouraged. |
What happened next
Biden signed EO 14086. Official source
Justice published the DPRC regulation at 28 CFR part 201. Official source
The Attorney General designated the EU and EEA states, with effectiveness conditional on the EU adequacy decision. Official source
ODNI released agency implementing procedures. Official source
The adequacy decision made the EU/EEA qualifying-state designation effective. Official source
Court status
See the court documents in Sources by type.
Legal and source detail
How it works legally
The framework operates under the Constitution, FISA, the National Security Act, Justice’s statutory powers and executive intelligence authority. It cannot legalize conduct prohibited by statute. DPRC determinations bind relevant executive agencies under the order, but the order disclaims a new private right of action in ordinary courts. Classified information remains protected, and complainants receive a prescribed notification rather than confirmation of surveillance or an unrestricted intelligence-file release. EU adequacy review addresses a separate legal system. Signed text.
Sources by type
If a source is unavailable, first check the cited publisher or another official repository. The cited publisher remains the authority.
Primary and official sources
Orders, laws, court records and official implementation material.
How we checked this
Last checked against the sources above on September 9, 2026. How we research →
Intelligence agencies updated procedures, DOJ established the review court, and the European Commission adopted an adequacy decision. Legal challenges in Europe continue to test that framework; no US court has invalidated EO 14086.