BBB EU Privacy Shield Procedure Rules

 

Part 1:   Procedure Overview and Definitions

1.1 Overview

The BBB EU Privacy Shield Dispute Resolution Procedure (“Procedure”) is administered by the Council of Better Business Bureaus, Inc. (“CBBB”). The Procedure provides for the resolution of complaints alleging that a U.S. business participating in the BBB EU Privacy Shield Program (a “Participating Business”) has failed to comply with the Privacy Shield Principles with respect to the processing of Personal Data collected in the European Union, Iceland, Liechtenstein, Norway or where applicable, Switzerland

By participating in the Procedure, all parties agree to abide by the Rules set forth below.

The Procedure has two components:

  1. “Conciliation”, a voluntary process whereby the Parties explore Settlement options with the assistance of CBBB staff.
  2. The Data Privacy Review Procedure (“Review”), an expedited  arbitration process in which an impartial decision maker (the “Panelist”) drawn from a panel of privacy experts (“CBBB Data Privacy Board”) reviews  the Case and renders a Decision after considering the evidence presented.

1.2 Definitions

CBBB refers to the Council of Better Business Bureaus, which is the provider located in the United States that administers the Procedure.

Complaint means an allegation that a Respondent has failed to comply with the Privacy Shield Principles.

Complainant means an individual who has filed a Complaint with the Procedure.

Case means a Complaint that CBBB has determined to be eligible in accordance with Part 2.

Decision means the judgment reached by the Panelist based on the merits of the Case after considering all the evidence presented to him or her.

Participating Business has the meaning set forth in Section 1.1.

Panelist has the meaning set forth in Section 4.2.

Parties are the Complainant and Respondent.

Personal Data is information relating to an individual that identifies that individual, or could reasonably be used to identify the individual, regardless of the medium involved (e.g., paper, electronic, video, or audio) transferred from the European Union, or where applicable, Switzerland, to the United States, pursuant to the EU-US Privacy Shield. 

Position means all written testimony and supporting documentation submitted by the Complainant for consideration by the Panelist.

Privacy Shield Principles are the seven Privacy Shield Principles agreed to by the European Commission and the U.S. Department of Commerce on July 12, 2016, and as they may subsequently be amended. 

Procedure has the meaning set forth in Section 1.1.

Proprietary Information is information designated by a Party as proprietary in accordance with Section 8.5. It may include Personal Data relating to Complainant or Respondent’s customers; information concerning Respondent’s business records and plans; trade secrets; technological information; computer programs and listings; source code and/or object code; and financial information.

Response means all written testimony and supporting documentation submitted by the Respondent for consideration by the Panelist.

Respondent is a Participating Business alleged by Complainant to have failed to comply with the Privacy Shield Principles.

Settlement is an agreement reached by the Parties as resolution of a Complaint at any point during the Procedure. The terms of the Settlement must be recorded in writing to be effective. 

 

Part 2: Eligibility

2.1 Initial review of Complaints

Upon contact by a potential Complainant, CBBB will record basic information about the potential Complaint and will seek additional information needed to determine eligibility. CBBB will open a Case when it determines, in its sole judgment, that the Complaint is eligible for resolution by the Procedure. 

2.2 Eligible Complainant

In order to be eligible, a Complainant must be either:

  1. The subject of Personal Data collected in the European Union, Iceland,  Liechtenstein, Norway or where applicable, Switzerland; or 
  2. The parent or legal guardian of that data subject in the case of Personal Data collected in the European Union, Iceland,  Liechtenstein, Norway or where applicable, Switzerland, from a child under 13.

2.2.1 Verifying Identity of Complainant

CBBB shall take reasonable steps to verify the identity of the Complainant. If, in the sole discretion of CBBB, the identity of the Complainant is not verified, CBBB shall decline to open a Case.

2.3 Eligible Complaint

In order to be eligible, a Complaint must:

  1. Be filed by an eligible Complainant;
  2. Be made against a Participating Business;
  3. Allege that the Respondent failed to comply with the  Privacy Shield Principles in relation to covered Personal Data; Include information to support Complainant’s allegations as required by Section 2.3.1; Follow a good faith effort to resolve the Complaint as required by Section 2.3.2; Not have  been previously resolved by the Procedure, court action, arbitration, or other form of dispute settlement; and
  4. Unless both Parties agree otherwise, not be currently the subject of litigation or any other adjudicatory process (including claims submitted for resolution through binding arbitration). 

2.3.1 Information Required to Support a Complaint

Information submitted by a Complainant must be sufficient to permit both CBBB and the Respondent to evaluate the Complaint adequately, and to enable the Respondent to respond to the Complaint. CBBB shall be the sole judge of whether the information submitted is sufficient.

2.3.2 Prior Good Faith Attempt to Resolve Complaint

Prior to filing a Complaint with the Procedure, the Complainant must have made a good faith attempt to resolve the Complaint directly with the Respondent.

 2.4 Eligibility Determination

CBBB shall determine whether the Complaint is eligible and shall take one of the following actions:

  1. If CBBB, in its sole judgment, concludes that a Complaint is eligible and contains all necessary information, it shall docket the Complaint as a Case.
  2. If CBBB, in its sole judgment, concludes that additional information is needed to sustain a Complaint it shall promptly request the information from the Complainant. If the Complainant fails to provide the requested information within five (5) days, CBBB may advise the Complainant that it cannot process the complaint.
  3. If CBBB, in its sole judgment, concludes that a Complaint is not eligible for reasons other than a lack of information, it shall advise the Complainant that CBBB cannot process the Complaint and that it will be closed.  Where appropriate, CBBB may provide the Complainant with the name and address of any other agency or group that may have jurisdiction over the Complaint.

2.5 Representatives

After a Case has been opened, either Party may designate another individual or entity as the Party’s representative in the Procedure.

 

Part 3: Conciliation and Settlement

3.1 Role of CBBB

CBBB shall act as an impartial facilitator to assist the Parties in the Conciliation process. CBBB staff shall promote communication between the Parties to encourage the discussion of Settlement options.

3.2 Settlement Discussions

CBBB staff shall work with the Parties to help them take an objective look at the issues in dispute. This may include obtaining the facts as viewed by the Complainant, providing relevant information obtained from the Complainant to the Respondent, seeking the Respondent’s response to the Complainant, and presenting the response and any Settlement offers to the Complainant.

3.3 Written Confirmation of a Settlement

If a Settlement is reached, CBBB shall be informed of the terms of the Settlement and shall draft and circulate to the Parties a letter detailing the terms of the Settlement.

 3.4 Timely Resolution

CBBB Staff and the Parties shall make best efforts to conclude a settlement within fifteen (15) days after CBBB opens a Case.

 

Part 4:  Data Privacy Review

4.1 Overview and Available Remedies

If Conciliation efforts fail to reach a Settlement, either party may request a Data Privacy Review, in which a Complainant may seek the following remedies from the Respondent:

  1. Access to, correction or suppression of  Complainant’s Personal Data; or
  2. Processing of Complainant’s Personal Data in a manner consistent with the Privacy Shield Principles. 

Following a Review, the  Decision shall order corrective action to change the Respondent’s privacy policies or practices if, based on the evidence presented, such action is found necessary to reverse or correct the effects of noncompliance with the Privacy Shield Principles.

A Complainant may not use the Data Privacy Review to seek, and the Decision may not order, any corrective action that:

  1. Requires payment of monetary damages; or
  2. Requires the Respondent to violate its legal obligations.

4.2 Data Privacy Board

The Data Privacy Board (the “Board”) shall consist of a panel of individuals, unaffiliated with CBBB, and recognized as experts in the field of data privacy (the “Panelists”). All Panelists shall be required to sign confidentiality agreements with respect to any confidential information or Proprietary Information either provided to them by CBBB or that they may receive otherwise in the course of their service as a Panelist. 

4.2.1 Eligibility of Panelists 

CBBB shall find an individual ineligible to serve as a Panelist in a specific Case if (a) his or her employing company or corporate affiliate is the Respondent, or sells a product or service that competes directly with a product or service of the Respondent; (b) if he or she has a relationship with a Party, does business with a Party, is employed by a Party, or represents a Party in any capacity.

A potential Panelist shall disqualify himself or herself from service on a Case if for any reason arising out of past or present employment, affiliation or conflict of interest, the Panelist believes that he or she is unable to impartially examine a Case. In addition, either Party shall have the right to object to the selection of any Panelist for any of the conflicts of interest stated in this Section, and to request that a replacement be appointed to serve on the Case. Such request will be subject to approval by CBBB, which shall act reasonably in determining whether good cause exists to disqualify a potential Panelist. 

4.2.2 Panelist Responsibilities

The Panelist shall be responsible for evaluating, investigating, analyzing, and reaching a Decision on the merits of a Case.

4.3 Administration

CBBB staff shall administer the Review process. Administration shall include communicating with the Panelist; collecting and forwarding necessary documentation to the Panelist; and distributing requests for information and/or the Decision on behalf of the Panelist.

4.3.1 Communicating with the Panelist

The Parties agree not to communicate directly with the Panelist, except at a hearing where the other party is present or has received notice. All written communication with the Panelist must be through CBBB. If either Party violates this agreement, CBBB may refuse to proceed with the Case. If the Party violating the agreement is a Respondent, CBBB may immediately refer the matter to the appropriate government agency. 

4.3.2 Preparation and Forwarding of Case Record

CBBB shall prepare the Case Record and forward it to the Panelist. The Case Record shall consist of documents comprising the Position and Response submitted pursuant to Section 4.4. No other submissions shall be considered by the Panelist except as expressly provided for in Section 4.5.

Copies of the Case Record shall be sent to the Parties.

4.4 Submission and Exchange of Written Position and Response 

If the Complainant requests a Review, CBBB shall ask the Complainant to submit a written Position within ten (10) days of the request. If the Complainant so requests, CBBB may accept the Complaint information submitted under Section 2.3.1 in whole or in part as the Complainant’s Position. If the Complainant fails to submit a Position within the time limit provided, the Case shall be closed.

CBBB shall forward the Position to the Respondent. The Respondent shall, within ten (10) days after receipt of the Complainant’s Position, file a written Response. If the Respondent files a timely Response, CBBB shall forward it to the Complainant as provided for in Section 4.4.2 and the Case will move forward.

4.4.1 Respondent’s Failure to File a Response

If a Respondent fails to file a Response in compliance with Section 4.4, the default will be noted in the next Procedure report and CBBB shall initiate a referral to the appropriate government agencies pursuant to Section 8.8. 

4.4.2 Late Filings

If either Party submits requested information outside the time limits specified in section 4.4., CBBB may, in its sole discretion, grant the Party an extension of the applicable time limit and include the information in the Case Record.

4.5 Review Procedure

CBBB will assign a single Panelist to conduct the Review. The Panelist will decide any substantive questions presented in the Case Record, within the scope of the Procedure Rules. The Panelist will submit a written Decision determining these issues, and including reasons for the determination.

4.5.1 Examination by the Panelist

The Panelist may, in his or her discretion, request additional information or comments from either or both Parties. The Party receiving the request shall, within five (5) days after receipt of the request, submit a written response thereto. On receipt of any such response, CBBB shall immediately forward it to the other Party, who may also submit a response within five (5) days after receipt. 

4.5.2 Telephone Hearing

The Panelist may, in his or her discretion, render a Decision entirely on the case record.  If the Panelist determines at any point in the Review process that there should be an oral hearing, it shall be conducted by telephone conference call, and the hearing date and time will be set with due regard for the schedule of the Parties and the Panelist. CBBB will send all Parties a written notice five (5) days before the hearing date, setting out the date and time of the hearing, and the procedure to be followed. If either Party has submitted Proprietary Information, the Panelist will exclude the other Party from the hearing during any discussion of the Proprietary Information.

4.5.3 Failure to Participate in Telephone Hearing

If a Party fails to participate in a telephone hearing after receiving proper notice, the Panelist will inquire of CBBB as to any known reason for the Party’s absence and will decide, in his or her discretion, whether to reschedule the  hearing or to proceed with the hearing and receive evidence and testimony from the other Party

CBBB may observe the telephone hearing in order to represent the public interest in the integrity of the program, subject to the confidentiality provisions set forth in Section 8.2.

4.5.4 Late Filings

If a Party submits requested information after the time limits specified in section 4.5, the untimely document shall not be submitted to the Panelist unless, pursuant to Section 4.2.2, CBBB grants an extension for good cause. In that case, the Panelist shall proceed with consideration of the Case and may give appropriate weight to the lack of response.

4.6 Decision

4.6.1 Issuance of a Decision

The Panelist shall make best efforts to forward a written Decision to CBBB within ten (10) days after completion of the Review Procedure. The Decision shall include the Panelist’s reasons for decision, and should (a) state whether or not corrective action is necessary; and if so, (b) provide a time frame for such action.

4.6.2 Respondent’s Statement Regarding Corrective Action

When a Decision requires corrective action the Respondent must, within five (5) days of its receipt of the Decision, submit a statement indicating whether and how it will comply with the Decision and implement the recommended corrective action within the time frame provided. 

4.6.3 Decision Impossible to Implement

If either Party believes that a Decision requiring corrective action cannot be implemented within the specified time frame or at all, that Party should immediately inform CBBB in writing. CBBB shall return the Case to the Panelist, who may request additional evidence, request a hearing with all parties via telephone conference call, or do anything the Panelist deems appropriate to confirm or deny the claim of impossibility of implementation. If the Panelist confirms such impossibility, the Panelist may amend the original Decision to alter the specified time frame or to order any other remedy within the scope of the Procedure Rules.  

4.6.4 Noncompliance with a Decision

If the Decision recommends corrective action and the Respondent fails to indicate within the time period specified in Section 4.6.2, either that it intends to implement the recommended corrective action, or that the corrective action is impossible to implement pursuant to section 4.6.3, CBBB shall initiate a referral of the Case to the appropriate government agencies (usually the Federal Trade Commission and the Department of Commerce) pursuant to Section 8.8.

In the event of a referral for noncompliance, CBBB shall publish a Case Report summarizing the facts of the case, including the Respondent’s name, the fact of the Respondent’s noncompliance with the Decision, and the government referral. Information regarding the referral may also be released to the press and the public.

The case details shall also be noted in the next Procedure Report. 

Part 5:  Verification of Performance of a Settlement or Decision

If a Settlement requiring corrective action is reached or a Respondent agrees to take corrective action recommended by a Decision, Respondent shall, after the specified time for performance, certify to CBBB within ten (10) days that the corrective action required by the Settlement or Decision has been implemented. If CBBB is in doubt as to whether the corrective action has been implemented as required, it may return the case to the Panelist for verification. The Panelist may request additional evidence, request a telephone hearing with all parties via telephone conference call, or do anything else the Panelist deems appropriate to verify performance of the corrective action as required by the Decision.

If CBBB and the Panelist determine that the corrective action has not been implemented as required, CBBB shall initiate a referral to the appropriate government agencies pursuant to Section 8.8.

In the event of a referral for nonperformance, CBBB shall publish a Case Report pursuant to section 4.6.4., summarizing the facts of the case, including the Respondent’s name, the fact of the Respondent’s noncompliance with the Decision, and the government referral. Information regarding the referral may also be released to the press and the public.

The case details shall also be noted in the next Procedure Report. 

 

Part 6:  Closing a Case

The Procedure shall close a Case when:

  1. CBBB determines that a Complaint is not eligible;
  2. CBBB determines additional information is needed to sustain the Complaint and that information is not timely received by CBBB pursuant to Section 2.4(b);
  3. The Complainant withdraws his or her Complaint;
  4. The Parties have reached a Settlement that requires corrective action and CBBB has determined that the corrective action has been taken;
  5. The Parties have reached a Settlement that does not require corrective action;
  6. The Panelist has issued a Decision that does not recommend corrective action;
  7. The Panelist has issued a Decision that recommends corrective action, the Respondent has agreed to implement the corrective action, and CBBB has determined that the corrective action has been implemented;
  8. CBBB has referred the matter to a government agency pursuant to Section 8.8;
  9. CBBB refuses to proceed with the Case because of a Party’s failure to abide by its agreement under Section 8.4 to hold information in confidence;
  10. CBBB refuses to proceed with the Case because of a Party’s failure to abide by its agreement under Section 4.3.1 regarding communication with the Panelist; or
  11. CBBB refuses to proceed with the Case because of the conduct of a Party.

 

Part 7: Reporting of Procedure Activity and Publication of Case Reports

CBBB shall publish a Procedure Report annually. This Report, to be published online at www.bbb.org, shall: 

  1. Provide a statistical summary of the number and nature of contacts from the public and the actions taken by CBBB and Panelist with respect to those contacts. The statistical summary shall be comprised of aggregated data and shall not contain any Party-specific data. 
  2. Provide a statistical summary of the number and nature of Complaints deemed ineligible for processing during the period, including the specific reason for a determination of ineligibility. The statistical summary shall be comprised of aggregated data and shall not contain any Party-specific data. 
  3. For each Case CBBB refers to the appropriate government agencies pursuant to Section 8.8, provide a summary Case Report (including the Respondent’s name) describing  the nature of the Case and the Procedure action in the matter.

Case Reports required to be published pursuant to Section 4.6.4 shall also be published online at www.bbb.org.

 

Part 8:  General Provisions

8.1 Parties’ Waiver of Subpoena Rights and Liability Claims

By participating in the Procedure, the Parties agree that they will not subpoena any of the following in any legal proceeding arising out of the matters at issue in the Procedure: CBBB or CBBB staff; Board members; committee members; volunteers; independent contractors; Panelists; or any records of the Procedure. 

The Parties also agree that the following shall not be liable for any act or omission in connection with the Procedure: CBBB or CBBB staff; Board members; committee members; volunteers; independent contractors utilized by CBBB; or Panelists.

8.2 Confidentiality of Procedure Files

All deliberations, meetings, proceedings and writings of the Procedure other than the Settlement Agreement or the Decision shall be sealed from public access and shall be treated as confidential by CBBB. The Settlement Agreement or Decision, and where applicable, any published Case Report, shall be the only permanent record required to be kept as to the basis of a Complaint, the issues defined, the facts and information presented, and the agreement reached by the parties or the conclusions reached by the Panelist. 

8.3 Retention of Procedure Files

CBBB shall destroy all materials in a Procedure file, except the Settlement Agreement or the Decision after the Procedure has been concluded and the Case has been closed. Proprietary Information shall be returned to the submitting Party when the Case is closed.

8.4 Parties’ Treatment of Information Received During the Procedure

The Parties agree that during the course of the Procedure they will treat any information provided to them by CBBB as information provided exclusively for the purpose of furthering the Procedure, and that they will not disseminate such information to anyone other than those persons directly involved in the handling of the Case. If a Party violates this agreement, CBBB may refuse to continue processing the Complaint. The purpose of this protection is to maintain a professional, unbiased atmosphere to facilitate a timely and lasting resolution to a Case. If the Party violating the agreement is a Respondent, CBBB may refer the matter to the appropriate government agency. 

8.5 When Information May Be Treated as Proprietary

A Complainant or Respondent may submit information to CBBB with the request that such information be treated as Proprietary Information and not made available to the other Party. A Party seeking such treatment must: (a) identify in its submission which materials include Proprietary Information; and (b) affirm that the information for which proprietary status is claimed is not publicly available. 

If CBBB does not agree that the information so identified should be treated as Proprietary Information, it shall immediately return the information to the submitting Party and inform the Party that the information will not be considered. 

CBBB shall promptly return any Proprietary Information to the submitting Party upon closing the case, and neither CBBB nor the Panelist shall make the information public in any report issued by the Procedure or otherwise. 

8.6 Providing a Non-Confidential Summary of Proprietary Information

 When a Party submits material with a request that it be treated as Proprietary Information, that Party must also submit a summary of such material that does not reveal any Proprietary Information but provides sufficient information about the material to allow the other Party to respond to it. Failure to provide an acceptable summary for this purpose will result in the information not being considered. CBBB shall be the sole judge of the acceptability of a summary offered by a Party.

8.7 Transmittal of Documents

Any document that must be provided to a Party, CBBB or the Panelist, shall be transmitted electronically (via facsimile or encrypted electronic mail). Documents provided to any Party shall be addressed to the contact designated by that Party for purposes of the Procedure. 

8.8 Referrals to Government Agencies

CBBB, in its discretion, may refer matters to the appropriate government agencies (usually the Federal Trade Commission and the Department of Commerce) if: 

  1. The Respondent states that it is not willing to participate in the Procedure in response to a Case;
  2. CBBB determines that the Respondent has not taken corrective action required by a Settlement;
  3. The Respondent fails to file a Response  pursuant to Section 4.4.1;
  4. The Respondent does not agree to take corrective action required by a Decision; or
  5. CBBB or the Panelist determines that the Respondent has not taken corrective action required by a Decision. 

Before referring any matter to any government agency, CBBB must send Respondent a Notice of Intent stating the reason for the intended referral and give Respondent three (3) days to cure any failure leading to the referral.  Reports of referrals to government agencies shall be included in the Procedure Report and may be included in other publications. 

8.9 Language

All proceedings will be conducted primarily in English. CBBB shall furnish translation and interpretation services as needed. Decisions and Statistical Reports will be published in English.