Transitioning to the Data Privacy Framework Program

If you have already self-certified your compliance with the U.S. Department of Commerce under Privacy Shield, you do not need to recertify under the Data Privacy Framework Program until your renewal date.

 

If your business is not yet a participant, or has left the program and is looking to return, please contact us. To get on the mailing list for updates as information is available, subscribe to the Privacy Initiatives newsletter.

 

 

 

 

 

 

Part 1:  Procedure Overview and Definitions 

 

1.1 Overview 

The BBB National Programs Data Privacy Framework Services Dispute Resolution Procedure (“Procedure”) provides for the resolution of complaints alleging that a U.S. business receiving our Data Privacy Framework Services (a “Participating Business”) has failed to comply with the Data Privacy Framework Principles with respect to the processing of Personal Data collected in the European Union, the United Kingdom (and Gibraltar), and Switzerland, or other participating countries and received in the United States pursuant to the Data Privacy Framework Program. By participating in the Procedure, all parties agree to abide by the Rules set forth below. 

 

The Procedure has two components: 

 

  1. “Conciliation,” a voluntary process whereby the Parties explore Settlement options with the assistance of BBB National Programs staff. 

  2. The Data Privacy Review Procedure (“Review”), an expedited arbitration process in which an impartial decision maker (the “Panelist”) drawn from a panel of privacy experts (“BBB National Programs Data Privacy Board”) reviews the Case and renders a Decision after considering the evidence presented. 

 

 

1.2 Definitions 

 

BBB National Programs is the provider located in the United States that administers the Procedure. 

 

Complaint means an allegation that a Respondent has failed to comply with the Principles. 

 

Complainant means an individual who has filed a Complaint with the Procedure. 

 

Case means a Complaint that BBB National Programs has determined to be eligible in accordance with Part 2. 

 

Decision means the judgment reached by the Panelist based on the merits of the Case after considering all the evidence presented to him or her. 

 

Participating Business has the meaning set forth in Section 1.1. 

 

Panelist has the meaning set forth in Section 4.2. 

 

Parties are the Complainant and Respondent. 

 

Personal Data is information relating to an individual that identifies that individual, or could reasonably be used to identify the individual, regardless of the medium involved (e.g., paper, electronic, video, or audio) transferred from the European Union, Switzerland, or other participating countries, as applicable, to the United States, pursuant to the Data Privacy Framework Program.  

 

Position means all written testimony and supporting documentation submitted by the Complainant for consideration by the Panelist. 

 

Data Privacy Framework Principles are the seven Principles and Supplemental Principles agreed to by the European Commission and the U.S. Department of Commerce, and set forth in the Data Privacy Framework Program, and as they may subsequently be amended.  

 

Procedure has the meaning set forth in Section 1.1. 

 

Proprietary Information is information designated by a Party as proprietary in accordance with Section 8.5. It may include Personal Data relating to Complainant or Respondent’s customers; information concerning Respondent’s business records and plans; trade secrets; technological information; computer programs and listings; source code and/or object code; and financial information. 

 

Response means all written testimony and supporting documentation submitted by the Respondent for consideration by the Panelist. 

 

Respondent is a Participating Business alleged by Complainant to have failed to comply with the Data Privacy Framework Principles. 

 

Settlement is an agreement reached by the Parties as resolution of a Complaint at any point during the Procedure. The terms of the Settlement must be recorded in writing to be effective. 

 

Back to top

 

Part 2:  Eligibility 

 

2.1 Initial Review of Complaints 

Upon contact by a potential Complainant, BBB National Programs will record basic information about the potential Complaint and will seek additional information needed to determine eligibility. BBB National Programs will open a Case when it determines, in its sole judgment, that the Complaint is eligible for resolution under the Procedure.  

 
2.2 Eligible Complainant 

In order to be eligible, a Complainant must be either: 

 

  1. The subject of Personal Data collected in the European Union, the United Kingdom, and Switzerland, or other participating countries, and received in the United States; or  

  2. The parent or legal guardian of such a data subject where the subject is a child under 13. 

 
2.2.1 Verifying Identity of Complainant 

BBB National Programs shall take reasonable steps to verify the identity of the Complainant. If, in the sole discretion of BBB National Programs, the identity of the Complainant cannot be verified, BBB National Programs shall decline to open a Case. 

 
2.3 Eligible Complaint 

In order to be eligible, a Complaint must: 

 

  1. Be filed by an eligible Complainant; 

  2. Be made against a Participating Business; 

  3. Allege that the Respondent failed to comply with the Data Privacy Framework Principles in relation to covered Personal Data; include information to support Complainant’s allegations as required by Section 2.3.1; follow a good faith effort to resolve the Complaint as required by Section 2.3.2; and not have been previously resolved by the Procedure, or by court action, arbitration, or other form of dispute settlement; and 

  4. Unless both Parties agree otherwise, not be currently the subject of litigation or any other adjudicatory process (including claims submitted for resolution through binding arbitration).  

 
2.3.1 Information Required to Support a Complaint 

Information submitted by a Complainant must be sufficient to permit both BBB National Programs and the Respondent to evaluate the Complaint adequately and to enable the Respondent to respond to the Complaint. BBB National Programs shall be the sole judge of whether the information submitted is sufficient. 

 
2.3.2 Prior Good Faith Attempt to Resolve Complaint 

Prior to filing a Complaint with the Procedure, the Complainant must have made a good-faith attempt to resolve the Complaint directly with the Respondent. 

 
2.4 Eligibility Determination 

BBB National Programs shall determine whether the Complaint is eligible and shall take one of the following actions: 

 

  1. If BBB National Programs, in its sole judgment, concludes that a Complaint is eligible and contains all necessary information, it shall docket the Complaint as a Case. 

  2. If BBB National Programs, in its sole judgment, concludes that additional information is needed to sustain a Complaint, it shall promptly request the information from the Complainant. If the Complainant fails to provide the requested information within five (5) days, BBB National Programs may advise the Complainant that it cannot process the complaint. 

  3. If BBB National Programs, in its sole judgment, concludes that a Complaint is not eligible for reasons other than a lack of information, it shall advise the Complainant that BBB National Programs cannot process the Complaint and that it will be closed. Where appropriate, BBB National Programs may provide the Complainant with the name and address of any other agency or group that may have jurisdiction over the Complaint. 

 
2.5 Representatives 

After a Case has been opened, either Party may designate another individual or entity as the Party’s representative in the Procedure. 

 

Back to top

 

Part 3:  Conciliation and Settlement 

 
3.1 Role of BBB National Programs 

BBB National Programs shall act as an impartial facilitator to assist the Parties in the Conciliation process. BBB National Programs staff shall promote communication between the Parties to encourage the discussion of Settlement options.  

 
3.2 Settlement Discussions 

BBB National Programs staff shall work with the Parties to help them take an objective look at the issues in dispute. This may include obtaining the facts as viewed by the Complainant, providing relevant information obtained from the Complainant to the Respondent, seeking the Respondent’s response to the Complainant, and presenting the response and any Settlement offers to the Complainant. 

 
3.3 Written Confirmation of a Settlement 

If a Settlement is reached, BBB National Programs shall be informed of the terms of the Settlement and shall draft and circulate to the Parties a letter detailing the terms of the Settlement. 

 
3.4 Timely Resolution 

BBB National Programs Staff and the Parties shall make best efforts to conclude a Settlement within fifteen (15) days after BBB National Programs opens a Case. 

 

Back to top

 

Part 4:  Data Privacy Review 

 

4.1 Overview and Available Remedies 

If Conciliation efforts fail to reach a Settlement, either party may request a Data Privacy Review, in which a Complainant may seek the following remedies from the Respondent: 

 

  1. Access to, correction, or suppression of Complainant’s Personal Data; or 

  2. Processing of Complainant’s Personal Data in a manner consistent with the Data Privacy Framework Principles.  

 

Following a Review, the Decision shall order corrective action to change the Respondent’s privacy policies or practices if, based on the evidence presented, such action is found necessary to reverse or correct the effects of noncompliance with the Principles. 

 

A Complainant may not use the Data Privacy Review to seek, and the Decision may not order, any corrective action that: 

 

  1. Requires payment of monetary damages; or 

  2. Requires the Respondent to violate its legal obligations. 

 

4.2 Data Privacy Board 

The Data Privacy Board (the “Board”) shall consist of a panel of individuals, unaffiliated with BBB National Programs, and recognized as experts in the field of data privacy (the “Panelists”). All Panelists shall be required to sign confidentiality agreements with respect to any confidential information or Proprietary Information either provided to them by BBB National Programs or that they may receive otherwise in the course of their service as a Panelist.  

 
4.2.1 Eligibility of Panelists  

BBB National Programs shall find an individual ineligible to serve as a Panelist in a specific Case if (a) his or her employing company or corporate affiliate is the Respondent, or sells a product or service that competes directly with a product or service of the Respondent or (b) he or she has a relationship with a Party, does business with a Party, is employed by a Party, or represents a Party in any capacity. 

 

A potential Panelist shall disqualify himself or herself from service on a Case if for any reason arising out of past or present employment, affiliation or conflict of interest, the Panelist believes that he or she is unable to impartially examine a Case. In addition, either Party shall have the right to object to the selection of any Panelist for any of the conflicts of interest stated in this Section, and to request that a replacement be appointed to serve on the Case. Such request will be subject to approval by BBB National Programs, which shall act reasonably in determining whether good cause exists to disqualify a potential Panelist.  

 
4.2.2 Panelist Responsibilities 

The Panelist shall be responsible for evaluating, investigating, analyzing, and reaching a Decision on the merits of a Case. 

 
4.3 Administration 

BBB National Programs staff shall administer the Review process. Administration shall include communicating with the Panelist; collecting and forwarding necessary documentation to the Panelist; and distributing requests for information and/or the Decision on behalf of the Panelist. 

 
4.3.1 Communicating with the Panelist 

The Parties agree not to communicate directly with the Panelist, except at a hearing where the other party is present or has received notice. All written communication with the Panelist must be through BBB National Programs. If either Party violates this agreement, BBB National Programs may refuse to proceed with the Case. If the Party violating the agreement is a Respondent, BBB National Programs may immediately refer the matter to the appropriate government agency.  

 
4.3.2 Preparation and Forwarding of Case Record 

BBB National Programs shall prepare the Case Record and forward it to the Panelist. The Case Record shall consist of documents comprising the Position and Response submitted pursuant to Section 4.4. No other submissions shall be considered by the Panelist except as expressly provided for in Section 4.5. 

 

Copies of the Case Record shall be sent to the Parties. 

 
4.4 Submission and Exchange of Written Position and Response  

If the Complainant requests a Review, BBB National Programs shall ask the Complainant to submit a written Position within ten (10) days of the request. If the Complainant so requests, BBB National Programs may accept the Complaint information submitted under Section 2.3.1 in whole or in part as the Complainant’s Position. If the Complainant fails to submit a Position within the time limit provided, the Case shall be closed. 

 

BBB National Programs shall forward the Position to the Respondent. The Respondent shall, within ten (10) days after receipt of the Complainant’s Position, file a written Response. If the Respondent files a timely Response, BBB National Programs shall forward it to the Complainant as provided for in Section 4.4.2 and the Case will move forward. 

 
4.4.1 Respondent’s Failure to File a Response 

If a Respondent fails to file a Response in compliance with Section 4.4, the default will be noted in the next Procedure report and BBB National Programs shall initiate a referral to the appropriate government agencies pursuant to Section 8.8.  

 
4.4.2 Late Filings 

If either Party submits requested information outside the time limits specified in section 4.4., BBB National Programs may, in its sole discretion, grant the Party an extension of the applicable time limit and include the information in the Case Record. 

 
4.5 Review Procedure 

BBB National Programs will assign a single Panelist to conduct the Review. The Panelist will decide any substantive questions presented in the Case Record, within the scope of the Procedure Rules. The Panelist will submit a written Decision determining these issues, including reasons for the determination. 

 
4.5.1 Examination by the Panelist 

The Panelist may, in his or her discretion, request additional information or comments from either or both Parties. The Party receiving the request shall, within five (5) days after receipt of the request, submit a written response thereto. On receipt of any such response, BBB National Programs shall immediately forward it to the other Party, who may also submit a response within five (5) days after receipt.  

 
4.5.2 Telephone Hearing 

The Panelist may, in his or her discretion, render a Decision entirely on the Case Record. If the Panelist determines at any point in the Review process that there should be an oral hearing, it shall be conducted by telephone conference call, and the hearing date and time will be set with due regard for the schedule of the Parties and the Panelist. BBB National Programs will send all Parties a written notice five (5) days before the hearing date, setting out the date and time of the hearing, and the procedure to be followed. If either Party has submitted Proprietary Information, the Panelist will exclude the other Party from the hearing during any discussion of the Proprietary Information. 

 
4.5.3 Failure to Participate in Telephone Hearing 

If a Party fails to participate in a telephone hearing after receiving proper notice, the Panelist will inquire of BBB National Programs as to any known reason for the Party’s absence and will decide, in his or her discretion, whether to reschedule the hearing or to proceed with the hearing and receive evidence and testimony from the other Party. 

 

BBB National Programs may observe the telephone hearing in order to represent the public interest in the integrity of the program, subject to the confidentiality provisions set forth in Section 8.2. 

 
4.5.4 Late Filings 

If a Party submits requested information after the time limits specified in section 4.5, the untimely document shall not be submitted to the Panelist unless, pursuant to Section 4.2.2, BBB National Programs grants an extension for good cause. In that case, the Panelist shall proceed with consideration of the Case and may give appropriate weight to the lack of response. 

 
4.6 Decision 

 

4.6.1 Issuance of a Decision 

The Panelist shall make best efforts to provide a written Decision to BBB National Programs within ten (10) days after completion of the Review Procedure. The Decision shall include the Panelist’s reasons for the decision and should (a) state whether corrective action is necessary; and if so, (b) provide a time frame for such action. 

 
4.6.2 Decision Outcomes 

If the Panelist’s Decision requires no further action by the Respondent, the Panelist should recommend to BBB National Programs that the Case be closed with no further action. If the Panelist issues a decision in favor of the Complainant, the Decision shall describe any remedial actions to be taken by the Respondent. 

 
4.6.3 Respondent’s Statement Regarding Corrective Action 

If a Decision requires corrective action by the Respondent, the Respondent must, within five (5) days of its receipt of the Decision, submit to BBB National Programs a statement indicating whether and how it will comply with the Decision, and will describe how it will implement the recommended corrective action within the time frame provided.  

 
4.6.4 Decision Impossible to Implement 

If either Party believes that a Decision requiring corrective action cannot be implemented at all, or cannot be implemented within the specified time frame, that Party should immediately inform BBB National Programs in writing. BBB National Programs shall return the Case to the Panelist, who may request additional evidence, request a hearing with all parties via telephone conference call, or do anything the Panelist deems appropriate to confirm or deny the claim of impossibility of implementation. If the Panelist confirms such impossibility, the Panelist may amend the original Decision to alter the specified time frame or to order an alternative remedy within the scope of the Procedure Rules. 

 
4.6.5 Failure to Respond to a Decision 

If the Decision recommends corrective action and the Respondent fails to indicate within the time period specified in Section 4.6.3, either that it intends to implement the recommended corrective action, or that the corrective action is impossible to implement pursuant to section 4.6.3, BBB National Programs shall consider the Respondent noncompliant with the Decision. In such a case, BBB National Programs shall initiate a referral of the Case to the appropriate government agencies (usually the Federal Trade Commission and the Department of Commerce) pursuant to Section 8.8. 

 

In the event of a referral for noncompliance, BBB National Programs shall publish a Case Report summarizing the facts of the case, including the Respondent’s name, the fact of the Respondent’s noncompliance with the Decision, and the government referral. Information regarding the referral may also be released to the press and the public. 

 

The case details shall also be noted in the next Procedure Report.  

 

 

Back to top

 

Part 5:  Verification of Performance of a Settlement or Decision 

 

If a Settlement requiring corrective action is reached or a Respondent agrees to take corrective action recommended by a Decision, Respondent shall, after the specified time for performance, certify to BBB National Programs within ten (10) days that the corrective action required by the Settlement or Decision has been implemented. If BBB National Programs is in doubt as to whether the corrective action has been implemented as required, it may return the case to the Panelist for verification. The Panelist may request additional evidence, request a telephone hearing with all parties via telephone conference call, or do anything else the Panelist deems appropriate to verify performance of the corrective action as required by the Decision. 

 

If BBB National Programs and the Panelist determine that the corrective action has not been implemented as required, BBB National Programs shall initiate a referral to the appropriate government agencies pursuant to Section 8.8. 

 

In the event of a referral for nonperformance, BBB National Programs shall publish a Case Report pursuant to section 4.6.4, summarizing the facts of the case, including the Respondent’s name, the fact of the Respondent’s noncompliance with the Decision, and the government referral. Information regarding the referral may also be released to the press and the public. 

 

The case details shall also be reported in the next Procedure Report.  

 

Back to top

 

Part 6: Closing a Case 

 

The Procedure shall close a Case when: 

 

  1. BBB National Programs determines that a Complaint is not eligible; 

  2. BBB National Programs determines additional information is needed to sustain the Complaint and that information is not timely received by BBB National Programs pursuant to Section 2.4(b); 

  3. The Complainant withdraws his or her Complaint; 

  4. The Parties have reached a Settlement that requires corrective action and BBB National Programs has determined that the corrective action has been taken; 

  5. The Parties have reached a Settlement that does not require corrective action; 

  6. The Panelist has issued a Decision that does not recommend corrective action; 

  7. The Panelist has issued a Decision that recommends corrective action, the Respondent has agreed to implement the corrective action, and BBB National Programs has determined that the corrective action has been implemented; 

  8. BBB National Programs has referred the matter to a government agency pursuant to Section 8.8; 

  9. BBB National Programs refuses to proceed with the Case because of a Party’s failure to abide by its agreement under Section 8.4 to hold information in confidence; 

  10. BBB National Programs refuses to proceed with the Case because of a Party’s failure to abide by its agreement under Section 4.3.1 regarding communication with the Panelist; or 

  11. BBB National Programs refuses to proceed with the Case because of the conduct of a Party. 


 

Back to top

 

Part 7:  Reporting of Procedure Activity and Publication of Case Reports 

 

BBB National Programs shall annually publish a Procedure Report to the BBB National Programs website that will:  

 

  1. Provide a statistical summary of the number and nature of contacts from the public and the actions taken by BBB National Programs and Panelist with respect to those contacts. The statistical summary shall be comprised of aggregated data and shall not contain any Party-specific data. 
  2. Provide a statistical summary of the number and nature of Complaints deemed ineligible for processing during the period, including the specific reason for a determination of ineligibility. The statistical summary shall be comprised of aggregated data and shall not contain any Party-specific data. 

  3. For each Case BBB National Programs refers to the appropriate government agencies pursuant to Section 8.8, provide a summary Case Report (including the Respondent’s name) describing the nature of the Case and the Procedure action in the matter. 

 

Case Reports required to be published pursuant to Section 4.6.5 shall also be published on the BBB National Programs website. 

 

Back to top

 

Part 8:  General Provisions 

 

8.1 Parties’ Waiver of Subpoena Rights and Liability Claims 

 

By participating in the Procedure, the Parties agree that they will not subpoena any of the following in any legal proceeding arising out of the matters at issue in the Procedure: BBB National Programs or BBB National Programs staff; Board members; committee members; volunteers; independent contractors; Panelists; or any records of the Procedure.  

 

The Parties also agree that the following shall not be liable for any act or omission in connection with the Procedure: BBB National Programs or BBB National Programs staff; Board members; committee members; volunteers; independent contractors utilized by BBB National Programs; or Panelists. 

 

 
8.2 Confidentiality of Procedure Files 

 

All deliberations, meetings, proceedings and writings of the Procedure shall be sealed from public access and shall be treated as confidential by BBB National Programs. This provision shall include Settlement Agreements or Decisions, except when publication is required following a referral to appropriate government agencies pursuant to Section 8.8. After the Procedure has been concluded and the Case has been closed, the Settlement Agreement or Decision, and where applicable, any published Case Report, shall be the only permanent record required to be kept by BBB National Programs as to the basis of a Complaint, the issues defined, the facts and information presented, and the agreement reached by the parties or the conclusions reached by the Panelist.  

 

 
8.3 Retention of Procedure Files 

 

BBB National Programs shall destroy all materials in a Procedure file, except the Settlement Agreement or the Decision, after the Procedure has been concluded and the Case has been closed. Proprietary Information shall be returned to the submitting Party when the Case is closed. 

 

 
8.4 Parties’ Treatment of Information Received During the Procedure 

 

The Parties agree that during the course of the Procedure they will treat any information provided to them by BBB National Programs as information provided exclusively for the purpose of furthering the Procedure, and that they will not disseminate such information to anyone other than those persons directly involved in the handling of the Case. If a Party violates this agreement, BBB National Programs may refuse to continue processing the Complaint. The purpose of this protection is to maintain a professional, unbiased atmosphere to facilitate a timely and lasting resolution to a Case. If the Party violating the agreement is a Respondent, BBB National Programs may refer the matter to the appropriate government agency.  

 

 
8.5 When Information May Be Treated as Proprietary 

 

A Complainant or Respondent may submit information to BBB National Programs with the request that such information be treated as Proprietary Information and not made available to the other Party. A Party seeking such treatment must: (a) identify in its submission which materials include Proprietary Information; and (b) affirm that the information for which proprietary status is claimed is not publicly available.  

 

If BBB National Programs does not agree that the information so identified should be treated as Proprietary Information, it shall immediately return the information to the submitting Party and inform the Party that the information will not be considered.  

 

BBB National Programs shall promptly return any Proprietary Information to the submitting Party upon closing the case, and neither BBB National Programs nor the Panelist shall make the information public in any report issued by the Procedure or otherwise.  

 

 
8.6 Providing a Non-Confidential Summary of Proprietary Information 

 

When a Party submits material with a request that it be treated as Proprietary Information, that Party must also submit a summary of such material that does not reveal any Proprietary Information but provides sufficient information about the material to allow the other Party to respond to it. Failure to provide an acceptable summary for this purpose will result in the information not being considered. BBB National Programs shall be the sole judge of the acceptability of a summary offered by a Party. 

 

 
8.7 Transmittal of Documents 

 

Any document that must be provided to a Party, BBB National Programs, or the Panelist shall be transmitted electronically (via facsimile or encrypted electronic mail). Documents provided to any Party shall be addressed to the contact designated by that Party for purposes of the Procedure.  

 

 
8.8 Referrals to Government Agencies 

 

BBB National Programs, in its discretion, may refer matters to the appropriate government agencies (usually the Federal Trade Commission and the Department of Commerce) if:  

 

  1. The Respondent states that it is not willing to participate in the Procedure in response to a Case;
  2. BBB National Programs determines that the Respondent has not taken corrective action required by a Settlement; 
  3. The Respondent fails to file a Response pursuant to Section 4.4.1; 
  4. The Respondent does not agree to take corrective action required by a Decision; or 
  5. BBB National Programs or the Panelist determines that the Respondent has not taken corrective action required by a Decision or agreed to in a Settlement.  

 

Before referring any matter to any government agency, BBB National Programs must send Respondent a Notice of Intent stating the reason for the intended referral and give Respondent three (3) days to cure any failure leading to the referral. Reports of referrals to government agencies shall be included in the Procedure Report and may be included in other publications.  

 

 
8.9 Language 

 

All proceedings will be conducted primarily in English. BBB National Programs shall furnish translation and interpretation services to the Parties as needed. Decisions, Settlement Agreements, Procedure Reports and Case Reports will be published in English. 

 

Back to top