The USA PATRIOT Act obligates organizations operating within the United States to decrypt user data upon request by law enforcement agencies without a court order.
The USA PATRIOT Act does indeed grant law enforcement agencies the power to request user data, but it requires a court order for such disclosures to comply with due process. It is imperative for Security+ candidates to understand the legal obligations imposed on organizations by national regulation and legislation, but also to be aware of the legal processes that protect individual privacy rights.