Privacy Shield Compliance Tip #1: Navigating Your Annual Re-Certification

May 20, 2020, 09:00 AM by BBB National Programs

In our Privacy Shield Compliance Tips series, the BBB EU Privacy Shield team shares insights into the ins and outs of complying with the Privacy Shield Frameworks—adequate mechanisms for transferring personal data from the European Union or Switzerland to the United States. Each tip is focused on an issue that we often encounter in our work with hundreds of companies that have self-certified under Privacy Shield.

One perennially complex issue for businesses that participate in Privacy Shield is the annual re-certification process. There are two separate steps that participating Privacy Shield businesses must take every year to maintain an active certification in the Privacy Shield Frameworks:

  1. Re-certify your Privacy Shield self-certification with the U.S. Department of Commerce (DOC).
  2. Renew your participation agreement with your Independent Recourse Mechanism (BBB EU Privacy Shield), ensuring that you continue to receive dispute resolution services—a core requirement of Privacy Shield. 

It is important to note that re-certification and IRM renewal are two separate and distinct steps. Depending on your history in Privacy Shield, the due date of your re-certification with DOC may differ from the due date of your renewal with BBB EUPS.

  • What is re-certification? Re-certification is the process by which you annually re-affirm to DOC your Privacy Shield self-certification. Your annual Privacy Shield re-certification is essentially a process of re-approval, much the same as the initial process of becoming approved under Privacy Shield. The required steps are almost identical to those you went through to secure initial approval of your Privacy Shield self-certification, including verifying that DOC has copies of your most up-to-date disclosures and policies. After submission, your account receives a thorough review by a Privacy Shield team member. Securing approval for your annual re-certification may take time, so we recommend that you file within 5 days of your due date.

    If you allow your account to lapse, this could trigger a series of processes that make regaining compliance extremely difficult! The Privacy Shield site has full instructions for completing your re-certification.
  • What is IRM renewal? Renewal is the process of re-registering with BBB EU Privacy Shield, renewing your contract so that we may continue to serve as your IRM. When you renew with BBB EUPS, you pay your annual dues and our staff reviews your Privacy Shield disclosures to ensure ongoing compliance with our program.

In addition to our compliance tracking services provided throughout the year, BBB EUPS notifies each of our participating businesses when its DOC re-certification date is coming up, as well as when it is time to renew enrollment in our program. If you are a BBB EU Privacy Shield participant, please look out for these messages and follow the instructions in themIf you are interested in our services, click here to learn more about signing up for Privacy Shield

Suggested Articles


Unpacking Misleading Advertising Claims in the Children’s Space

Advertisements may seem simple on the surface, but certain aspects of the ad business, including advertising law, are complex. The role of monitoring ads directed to children is especially complex. It seems straightforward: advertisers are not allowed to lie in their advertisements, but an advertiser is also responsible for all reasonable interpretations of the claims it makes and not just the messages it intended to convey. This blog outlines how to make sure your advertising passes the truthfulness test.
Read more

A Beginner's Guide to Reading Privacy Policies

Privacy policies are complicated and can be frustrating to read, especially when you are trying to learn about your child's data privacy online. The Children’s Advertising Review Unit (CARU) reviews child-directed online environments to ensure that children’s data is collected and handled responsibly. As a parent, follow these steps to take a proactive role in your child’s data privacy, using privacy policies as your guide to better understand an online service’s data collection practices.
Read more

Q&A: What is an SRO? A Beginner’s Guide to International Advertising Self-Regulation

Advertising is a cutting-edge industry, so it is no surprise that the ad business has been at the forefront of a global trend building for almost 60 years – independent industry self-regulation. In the U.S., the National Advertising Division is the industry’s widely recognized “truth-in-advertising” body, an independent third party that enables competitors to resolve disputes outside the courtroom. It is the self-regulatory organization (SRO) of the U.S. In this Q&A with Mary Engle, Executive Vice President, Policy, here at BBB National Programs, we dig into what industry self-regulation looks like in other parts of the world.
Read more

Substantiating Advertising Claims in Three Steps: A How-To Checklist for Advertisers

Substantiating advertising claims is important, both to comply with the law and to avoid regulatory scrutiny or a potential challenge from a competitor in court or in a proceeding before the National Advertising Division (NAD). NAD examines the fit between challenged claims and the substantiation provided. What follows is not legal advice but a basic one-two-three checklist for advertisers concerned about substantiating their advertising claims.
Read more