On 10 July 2023, the Attorney General's designations of “qualifying states” under section 3(f) of Executive Order 14086, was implemented following the European Commission's adoption of the adequacy decision for the EU-US Data Privacy Framework. In particular, the Attorney General determined that the European Economic Area, including European Union, Iceland, Liechtenstein, and Norway data privacy legislation mandates appropriate safeguards in the conduct of signals intelligence activities and are included in the list of “qualifying states” making them eligible for the redress mechanism established in section 3 of Executive Order 14086. Under the redress mechanism, individuals can obtain a review and redress if their personal information was collected and processed in violation of US law and their data privacy rights were violated. The qualifying states will have to designate a public authority that will verify the complaint first and forward it to the Civil Liberties Protection Officer (CLPO), which will investigate, review and issue orders for remediation.
Original source