BBB EU Privacy Shield

BBB EU Privacy Shield Procedure Rules

 

Part 1:   Procedure Overview and Definitions

1.1 Overview

The BBB EU Privacy Shield Dispute Resolution Procedure (“Procedure”) is administered by BBB National Programs, Inc. (“BBB NP”). The Procedure provides for the resolution of complaints alleging that a U.S. business participating in the BBB EU Privacy Shield Program (a “Participating Business”) has failed to comply with the Privacy Shield Principles with respect to the processing of Personal Data collected in the European Union, Switzerland, or other countries participating in the Privacy Shield Frameworks and received in the United States pursuant to Privacy Shield. By participating in the Procedure, all parties agree to abide by the Rules set forth below.

The Procedure has two components:

  1. “Conciliation,” a voluntary process whereby the Parties explore Settlement options with the assistance of BBB NP staff.
  2. The Data Privacy Review Procedure (“Review”), an expedited arbitration process in which an impartial decision maker (the “Panelist”) drawn from a panel of privacy experts (“BBB NP Data Privacy Board”) reviews the Case and renders a Decision after considering the evidence presented.


1.2 Definitions

BBB NP refers to the BBB National Programs, Inc., which is the provider located in the United States that administers the Procedure.

Complaint means an allegation that a Respondent has failed to comply with the Privacy Shield Principles.

Complainant means an individual who has filed a Complaint with the Procedure.

Case means a Complaint that BBB NP has determined to be eligible in accordance with Part 2.

Decision means the judgment reached by the Panelist based on the merits of the Case after considering all the evidence presented to him or her.

Participating Business has the meaning set forth in Section 1.1.

Panelist has the meaning set forth in Section 4.2.

Parties are the Complainant and Respondent.

Personal Data is information relating to an individual that identifies that individual, or could reasonably be used to identify the individual, regardless of the medium involved (e.g., paper, electronic, video, or audio) transferred from the European Union, Switzerland, or other participating countries, as applicable, to the United States, pursuant to the Privacy Shield Frameworks. 

Position means all written testimony and supporting documentation submitted by the Complainant for consideration by the Panelist.

Privacy Shield Principles are the seven Privacy Shield Principles and the Supplemental Principles agreed to by the European Commission and the U.S. Department of Commerce on July 12, 2016, and set forth in the Privacy Shield Frameworks, and as they may subsequently be amended. 

Procedure has the meaning set forth in Section 1.1.

Proprietary Information is information designated by a Party as proprietary in accordance with Section 8.5. It may include Personal Data relating to Complainant or Respondent’s customers; information concerning Respondent’s business records and plans; trade secrets; technological information; computer programs and listings; source code and/or object code; and financial information.

Response means all written testimony and supporting documentation submitted by the Respondent for consideration by the Panelist.

Respondent is a Participating Business alleged by Complainant to have failed to comply with the Privacy Shield Principles.

Settlement is an agreement reached by the Parties as resolution of a Complaint at any point during the Procedure. The terms of the Settlement must be recorded in writing to be effective. 

 

Part 2:  Eligibility

2.1 Initial review of Complaints

Upon contact by a potential Complainant, BBB NP will record basic information about the potential Complaint and will seek additional information needed to determine eligibility. BBB NP will open a Case when it determines, in its sole judgment, that the Complaint is eligible for resolution under the Procedure. 


2.2 Eligible Complainant

In order to be eligible, a Complainant must be either:

  1. The subject of Personal Data collected in the European Union, Switzerland, or other countries participating in the Privacy Shield Frameworks and received in the United States pursuant to Privacy Shield; or 
  2. The parent or legal guardian of such a data subject where the subject is a child under 13.


2.2.1 Verifying Identity of Complainant

BBB NP shall take reasonable steps to verify the identity of the Complainant. If, in the sole discretion of BBB NP, the identity of the Complainant cannot be verified, BBB NP shall decline to open a Case.


2.3 Eligible Complaint

In order to be eligible, a Complaint must:

  1. Be filed by an eligible Complainant;
  2. Be made against a Participating Business;
  3. Allege that the Respondent failed to comply with the Privacy Shield Principles in relation to covered Personal Data; include information to support Complainant’s allegations as required by Section 2.3.1; follow a good faith effort to resolve the Complaint as required by Section 2.3.2; and not have been previously resolved by the Procedure, or by court action, arbitration, or other form of dispute settlement; and
  4. Unless both Parties agree otherwise, not be currently the subject of litigation or any other adjudicatory process (including claims submitted for resolution through binding arbitration). 


2.3.1 Information Required to Support a Complaint

Information submitted by a Complainant must be sufficient to permit both BBB NP and the Respondent to evaluate the Complaint adequately, and to enable the Respondent to respond to the Complaint. BBB NP shall be the sole judge of whether the information submitted is sufficient.


2.3.2 Prior Good Faith Attempt to Resolve Complaint

Prior to filing a Complaint with the Procedure, the Complainant must have made a good faith attempt to resolve the Complaint directly with the Respondent.


2.4 Eligibility Determination

BBB NP shall determine whether the Complaint is eligible and shall take one of the following actions:

  1. If BBB NP, in its sole judgment, concludes that a Complaint is eligible and contains all necessary information, it shall docket the Complaint as a Case.
  2. If BBB NP, in its sole judgment, concludes that additional information is needed to sustain a Complaint, it shall promptly request the information from the Complainant. If the Complainant fails to provide the requested information within five (5) days, BBB NP may advise the Complainant that it cannot process the complaint.
  3. If BBB NP, in its sole judgment, concludes that a Complaint is not eligible for reasons other than a lack of information, it shall advise the Complainant that BBB NP cannot process the Complaint and that it will be closed. Where appropriate, BBB NP may provide the Complainant with the name and address of any other agency or group that may have jurisdiction over the Complaint.


2.5 Representatives

After a Case has been opened, either Party may designate another individual or entity as the Party’s representative in the Procedure.

 

Part 3:  Conciliation and Settlement


3.1 Role of BBB NP

BBB NP shall act as an impartial facilitator to assist the Parties in the Conciliation process. BBB NP staff shall promote communication between the Parties to encourage the discussion of Settlement options.


3.2 Settlement Discussions

BBB NP staff shall work with the Parties to help them take an objective look at the issues in dispute. This may include obtaining the facts as viewed by the Complainant, providing relevant information obtained from the Complainant to the Respondent, seeking the Respondent’s response to the Complainant, and presenting the response and any Settlement offers to the Complainant.


3.3 Written Confirmation of a Settlement

If a Settlement is reached, BBB NP shall be informed of the terms of the Settlement and shall draft and circulate to the Parties a letter detailing the terms of the Settlement.


3.4 Timely Resolution

BBB NP Staff and the Parties shall make best efforts to conclude a Settlement within fifteen (15) days after BBB NP opens a Case.

 

Part 4:  Data Privacy Review

4.1 Overview and Available Remedies

If Conciliation efforts fail to reach a Settlement, either party may request a Data Privacy Review, in which a Complainant may seek the following remedies from the Respondent:

  1. Access to, correction or suppression of Complainant’s Personal Data; or
  2. Processing of Complainant’s Personal Data in a manner consistent with the Privacy Shield Principles. 

Following a Review, the Decision shall order corrective action to change the Respondent’s privacy policies or practices if, based on the evidence presented, such action is found necessary to reverse or correct the effects of noncompliance with the Privacy Shield Principles.

A Complainant may not use the Data Privacy Review to seek, and the Decision may not order, any corrective action that:

  1. Requires payment of monetary damages; or
  2. Requires the Respondent to violate its legal obligations.


4.2 Data Privacy Board

The Data Privacy Board (the “Board”) shall consist of a panel of individuals, unaffiliated with BBB NP, and recognized as experts in the field of data privacy (the “Panelists”). All Panelists shall be required to sign confidentiality agreements with respect to any confidential information or Proprietary Information either provided to them by BBB NP or that they may receive otherwise in the course of their service as a Panelist. 


4.2.1 Eligibility of Panelists 

BBB NP shall find an individual ineligible to serve as a Panelist in a specific Case if (a) his or her employing company or corporate affiliate is the Respondent, or sells a product or service that competes directly with a product or service of the Respondent or (b) he or she has a relationship with a Party, does business with a Party, is employed by a Party, or represents a Party in any capacity.

A potential Panelist shall disqualify himself or herself from service on a Case if for any reason arising out of past or present employment, affiliation or conflict of interest, the Panelist believes that he or she is unable to impartially examine a Case. In addition, either Party shall have the right to object to the selection of any Panelist for any of the conflicts of interest stated in this Section, and to request that a replacement be appointed to serve on the Case. Such request will be subject to approval by BBB NP, which shall act reasonably in determining whether good cause exists to disqualify a potential Panelist. 


4.2.2 Panelist Responsibilities

The Panelist shall be responsible for evaluating, investigating, analyzing, and reaching a Decision on the merits of a Case.


4.3 Administration

BBB NP staff shall administer the Review process. Administration shall include communicating with the Panelist; collecting and forwarding necessary documentation to the Panelist; and distributing requests for information and/or the Decision on behalf of the Panelist.


4.3.1 Communicating with the Panelist

The Parties agree not to communicate directly with the Panelist, except at a hearing where the other party is present or has received notice. All written communication with the Panelist must be through BBB NP. If either Party violates this agreement, BBB NP may refuse to proceed with the Case. If the Party violating the agreement is a Respondent, BBB NP may immediately refer the matter to the appropriate government agency. 


4.3.2 Preparation and Forwarding of Case Record

BBB NP shall prepare the Case Record and forward it to the Panelist. The Case Record shall consist of documents comprising the Position and Response submitted pursuant to Section 4.4. No other submissions shall be considered by the Panelist except as expressly provided for in Section 4.5.

Copies of the Case Record shall be sent to the Parties.


4.4 Submission and Exchange of Written Position and Response 

If the Complainant requests a Review, BBB NP shall ask the Complainant to submit a written Position within ten (10) days of the request. If the Complainant so requests, BBB NP may accept the Complaint information submitted under Section 2.3.1 in whole or in part as the Complainant’s Position. If the Complainant fails to submit a Position within the time limit provided, the Case shall be closed.

BBB NP shall forward the Position to the Respondent. The Respondent shall, within ten (10) days after receipt of the Complainant’s Position, file a written Response. If the Respondent files a timely Response, BBB NP shall forward it to the Complainant as provided for in Section 4.4.2 and the Case will move forward.


4.4.1 Respondent’s Failure to File a Response

If a Respondent fails to file a Response in compliance with Section 4.4, the default will be noted in the next Procedure report and BBB NP shall initiate a referral to the appropriate government agencies pursuant to Section 8.8. 


4.4.2 Late Filings

If either Party submits requested information outside the time limits specified in section 4.4., BBB NP may, in its sole discretion, grant the Party an extension of the applicable time limit and include the information in the Case Record.


4.5 Review Procedure

BBB NP will assign a single Panelist to conduct the Review. The Panelist will decide any substantive questions presented in the Case Record, within the scope of the Procedure Rules. The Panelist will submit a written Decision determining these issues, including reasons for the determination.


4.5.1 Examination by the Panelist

The Panelist may, in his or her discretion, request additional information or comments from either or both Parties. The Party receiving the request shall, within five (5) days after receipt of the request, submit a written response thereto. On receipt of any such response, BBB NP shall immediately forward it to the other Party, who may also submit a response within five (5) days after receipt. 


4.5.2 Telephone Hearing

The Panelist may, in his or her discretion, render a Decision entirely on the Case Record. If the Panelist determines at any point in the Review process that there should be an oral hearing, it shall be conducted by telephone conference call, and the hearing date and time will be set with due regard for the schedule of the Parties and the Panelist. BBB NP will send all Parties a written notice five (5) days before the hearing date, setting out the date and time of the hearing, and the procedure to be followed. If either Party has submitted Proprietary Information, the Panelist will exclude the other Party from the hearing during any discussion of the Proprietary Information.


4.5.3 Failure to Participate in Telephone Hearing

If a Party fails to participate in a telephone hearing after receiving proper notice, the Panelist will inquire of BBB NP as to any known reason for the Party’s absence and will decide, in his or her discretion, whether to reschedule the hearing or to proceed with the hearing and receive evidence and testimony from the other Party.

BBB NP may observe the telephone hearing in order to represent the public interest in the integrity of the program, subject to the confidentiality provisions set forth in Section 8.2.


4.5.4 Late Filings

If a Party submits requested information after the time limits specified in section 4.5, the untimely document shall not be submitted to the Panelist unless, pursuant to Section 4.2.2, BBB NP grants an extension for good cause. In that case, the Panelist shall proceed with consideration of the Case and may give appropriate weight to the lack of response.


4.6 Decision

4.6.1 Issuance of a Decision

The Panelist shall make best efforts to provide a written Decision to BBB NP within ten (10) days after completion of the Review Procedure. The Decision shall include the Panelist’s reasons for decision, and should (a) state whether or not corrective action is necessary; and if so, (b) provide a time frame for such action.


4.6.2 Decision Outcomes

If the Panelist’s Decision requires no further action by the Respondent, the Panelist should recommend to BBB NP that the Case be closed with no further action. If the Panelist issues a decision in favor of the Complainant, the Decision shall describe any remedial actions to be taken by the Respondent.


4.6.3 Respondent’s Statement Regarding Corrective Action

If a Decision requires corrective action by the Respondent, the Respondent must, within five (5) days of its receipt of the Decision, submit to BBB NP a statement indicating whether and how it will comply with the Decision, and will describe how it will implement the recommended corrective action within the time frame provided. 


4.6.4 Decision Impossible to Implement

If either Party believes that a Decision requiring corrective action cannot be implemented at all, or cannot be implemented within the specified time frame, that Party should immediately inform BBB NP in writing. BBB NP shall return the Case to the Panelist, who may request additional evidence, request a hearing with all parties via telephone conference call, or do anything the Panelist deems appropriate to confirm or deny the claim of impossibility of implementation. If the Panelist confirms such impossibility, the Panelist may amend the original Decision to alter the specified time frame or to order an alternative remedy within the scope of the Procedure Rules.


4.6.5 Failure to Respond to a Decision

If the Decision recommends corrective action and the Respondent fails to indicate within the time period specified in Section 4.6.3, either that it intends to implement the recommended corrective action, or that the corrective action is impossible to implement pursuant to section 4.6.3, BBB NP shall consider the Respondent noncompliant with the Decision. In such a case, BBB NP shall initiate a referral of the Case to the appropriate government agencies (usually the Federal Trade Commission and the Department of Commerce) pursuant to Section 8.8.

In the event of a referral for noncompliance, BBB NP shall publish a Case Report summarizing the facts of the case, including the Respondent’s name, the fact of the Respondent’s noncompliance with the Decision, and the government referral. Information regarding the referral may also be released to the press and the public.

The case details shall also be noted in the next Procedure Report. 

 

Part 5:  Verification of Performance of a Settlement or Decision

If a Settlement requiring corrective action is reached or a Respondent agrees to take corrective action recommended by a Decision, Respondent shall, after the specified time for performance, certify to BBB NP within ten (10) days that the corrective action required by the Settlement or Decision has been implemented. If BBB NP is in doubt as to whether the corrective action has been implemented as required, it may return the case to the Panelist for verification. The Panelist may request additional evidence, request a telephone hearing with all parties via telephone conference call, or do anything else the Panelist deems appropriate to verify performance of the corrective action as required by the Decision.

If BBB NP and the Panelist determine that the corrective action has not been implemented as required, BBB NP shall initiate a referral to the appropriate government agencies pursuant to Section 8.8.

In the event of a referral for nonperformance, BBB NP shall publish a Case Report pursuant to section 4.6.4, summarizing the facts of the case, including the Respondent’s name, the fact of the Respondent’s noncompliance with the Decision, and the government referral. Information regarding the referral may also be released to the press and the public.

The case details shall also be reported in the next Procedure Report. 

 

Part 6:  Closing a Case

The Procedure shall close a Case when:

  1. BBB NP determines that a Complaint is not eligible;
  2. BBB NP determines additional information is needed to sustain the Complaint and that information is not timely received by BBB NP pursuant to Section 2.4(b);
  3. The Complainant withdraws his or her Complaint;
  4. The Parties have reached a Settlement that requires corrective action and BBB NP has determined that the corrective action has been taken;
  5. The Parties have reached a Settlement that does not require corrective action;
  6. The Panelist has issued a Decision that does not recommend corrective action;
  7. The Panelist has issued a Decision that recommends corrective action, the Respondent has agreed to implement the corrective action, and BBB NP has determined that the corrective action has been implemented;
  8. BBB NP has referred the matter to a government agency pursuant to Section 8.8;
  9. BBB NP refuses to proceed with the Case because of a Party’s failure to abide by its agreement under Section 8.4 to hold information in confidence;
  10. BBB NP refuses to proceed with the Case because of a Party’s failure to abide by its agreement under Section 4.3.1 regarding communication with the Panelist; or
  11. BBB NP refuses to proceed with the Case because of the conduct of a Party.

 

Part 7:  Reporting of Procedure Activity and Publication of Case Reports

BBB NP shall publish a Procedure Report annually. This Report, to be published on the BBB EU Privacy Shield web pages, shall: 

  1. Provide a statistical summary of the number and nature of contacts from the public and the actions taken by BBB NP and Panelist with respect to those contacts. The statistical summary shall be comprised of aggregated data and shall not contain any Party-specific data. 
  2. Provide a statistical summary of the number and nature of Complaints deemed ineligible for processing during the period, including the specific reason for a determination of ineligibility. The statistical summary shall be comprised of aggregated data and shall not contain any Party-specific data. 
  3. For each Case BBB NP refers to the appropriate government agencies pursuant to Section 8.8, provide a summary Case Report (including the Respondent’s name) describing the nature of the Case and the Procedure action in the matter.

Case Reports required to be published pursuant to Section 4.6.5 shall also be published on the BBB EU Privacy Shield web pages.

 

Part 8:  General Provisions

8.1 Parties’ Waiver of Subpoena Rights and Liability Claims

By participating in the Procedure, the Parties agree that they will not subpoena any of the following in any legal proceeding arising out of the matters at issue in the Procedure: BBB NP or BBB NP staff; Board members; committee members; volunteers; independent contractors; Panelists; or any records of the Procedure. 

The Parties also agree that the following shall not be liable for any act or omission in connection with the Procedure: BBB NP or BBB NP staff; Board members; committee members; volunteers; independent contractors utilized by BBB NP; or Panelists.


8.2 Confidentiality of Procedure Files

All deliberations, meetings, proceedings and writings of the Procedure shall be sealed from public access and shall be treated as confidential by BBB NP. This provision shall include Settlement Agreements or Decisions, except when publication is required following a referral to appropriate government agencies pursuant to Section 8.8. After the Procedure has been concluded and the Case has been closed, the Settlement Agreement or Decision, and where applicable, any published Case Report, shall be the only permanent record required to be kept by BBB NP as to the basis of a Complaint, the issues defined, the facts and information presented, and the agreement reached by the parties or the conclusions reached by the Panelist. 


8.3 Retention of Procedure Files

BBB NP shall destroy all materials in a Procedure file, except the Settlement Agreement or the Decision, after the Procedure has been concluded and the Case has been closed. Proprietary Information shall be returned to the submitting Party when the Case is closed.


8.4 Parties’ Treatment of Information Received During the Procedure

The Parties agree that during the course of the Procedure they will treat any information provided to them by BBB NP as information provided exclusively for the purpose of furthering the Procedure, and that they will not disseminate such information to anyone other than those persons directly involved in the handling of the Case. If a Party violates this agreement, BBB NP may refuse to continue processing the Complaint. The purpose of this protection is to maintain a professional, unbiased atmosphere to facilitate a timely and lasting resolution to a Case. If the Party violating the agreement is a Respondent, BBB NP may refer the matter to the appropriate government agency. 


8.5 When Information May Be Treated as Proprietary

A Complainant or Respondent may submit information to BBB NP with the request that such information be treated as Proprietary Information and not made available to the other Party. A Party seeking such treatment must: (a) identify in its submission which materials include Proprietary Information; and (b) affirm that the information for which proprietary status is claimed is not publicly available. 

If BBB NP does not agree that the information so identified should be treated as Proprietary Information, it shall immediately return the information to the submitting Party and inform the Party that the information will not be considered. 

BBB NP shall promptly return any Proprietary Information to the submitting Party upon closing the case, and neither BBB NP nor the Panelist shall make the information public in any report issued by the Procedure or otherwise. 


8.6 Providing a Non-Confidential Summary of Proprietary Information

When a Party submits material with a request that it be treated as Proprietary Information, that Party must also submit a summary of such material that does not reveal any Proprietary Information but provides sufficient information about the material to allow the other Party to respond to it. Failure to provide an acceptable summary for this purpose will result in the information not being considered. BBB NP shall be the sole judge of the acceptability of a summary offered by a Party.


8.7 Transmittal of Documents

Any document that must be provided to a Party, BBB NP, or the Panelist shall be transmitted electronically (via facsimile or encrypted electronic mail). Documents provided to any Party shall be addressed to the contact designated by that Party for purposes of the Procedure. 


8.8 Referrals to Government Agencies

BBB NP, in its discretion, may refer matters to the appropriate government agencies (usually the Federal Trade Commission and the Department of Commerce) if: 

  1. The Respondent states that it is not willing to participate in the Procedure in response to a Case;
  2. BBB NP determines that the Respondent has not taken corrective action required by a Settlement;
  3. The Respondent fails to file a Response pursuant to Section 4.4.1;
  4. The Respondent does not agree to take corrective action required by a Decision; or
  5. BBB NP or the Panelist determines that the Respondent has not taken corrective action required by a Decision or agreed to in a Settlement. 

Before referring any matter to any government agency, BBB NP must send Respondent a Notice of Intent stating the reason for the intended referral and give Respondent three (3) days to cure any failure leading to the referral. Reports of referrals to government agencies shall be included in the Procedure Report and may be included in other publications. 


8.9 Language

All proceedings will be conducted primarily in English. BBB NP shall furnish translation and interpretation services to the Parties as needed. Decisions, Settlement Agreements, Procedure Reports and Case Reports will be published in English.