BBB EU Privacy Shield Procedure Rules
Part 1: Procedure Overview and Definitions
The BBB EU Privacy Shield Dispute Resolution Procedure (“Procedure”) is administered by the Council of Better Business Bureaus, Inc. (“CBBB”). The Procedure provides for the resolution of complaints alleging that a U.S. business participating in the BBB EU Privacy Shield Program (a “Participating Business”) has failed to comply with the Privacy Shield Principles with respect to the processing of Personal Data collected in the European Union, Iceland, Liechtenstein, Norway or where applicable, Switzerland
By participating in the Procedure, all parties agree to abide by the Rules set forth below.
The Procedure has two components:
CBBB refers to the Council of Better Business Bureaus, which is the provider located in the United States that administers the Procedure.
Complaint means an allegation that a Respondent has failed to comply with the Privacy Shield Principles.
Complainant means an individual who has filed a Complaint with the Procedure.
Case means a Complaint that CBBB has determined to be eligible in accordance with Part 2.
Decision means the judgment reached by the Panelist based on the merits of the Case after considering all the evidence presented to him or her.
Participating Business has the meaning set forth in Section 1.1.
Panelist has the meaning set forth in Section 4.2.
Parties are the Complainant and Respondent.
Personal Data is information relating to an individual that identifies that individual, or could reasonably be used to identify the individual, regardless of the medium involved (e.g., paper, electronic, video, or audio) transferred from the European Union, or where applicable, Switzerland, to the United States, pursuant to the EU-US Privacy Shield.
Position means all written testimony and supporting documentation submitted by the Complainant for consideration by the Panelist.
Privacy Shield Principles are the seven Privacy Shield Principles agreed to by the European Commission and the U.S. Department of Commerce on July 12, 2016, and as they may subsequently be amended.
Procedure has the meaning set forth in Section 1.1.
Proprietary Information is information designated by a Party as proprietary in accordance with Section 8.5. It may include Personal Data relating to Complainant or Respondent’s customers; information concerning Respondent’s business records and plans; trade secrets; technological information; computer programs and listings; source code and/or object code; and financial information.
Response means all written testimony and supporting documentation submitted by the Respondent for consideration by the Panelist.
Respondent is a Participating Business alleged by Complainant to have failed to comply with the Privacy Shield Principles.
Settlement is an agreement reached by the Parties as resolution of a Complaint at any point during the Procedure. The terms of the Settlement must be recorded in writing to be effective.
Part 2: Eligibility
2.1 Initial review of Complaints
Upon contact by a potential Complainant, CBBB will record basic information about the potential Complaint and will seek additional information needed to determine eligibility. CBBB will open a Case when it determines, in its sole judgment, that the Complaint is eligible for resolution by the Procedure.
2.2 Eligible Complainant
In order to be eligible, a Complainant must be either:
2.2.1 Verifying Identity of Complainant
CBBB shall take reasonable steps to verify the identity of the Complainant. If, in the sole discretion of CBBB, the identity of the Complainant is not verified, CBBB shall decline to open a Case.
2.3 Eligible Complaint
In order to be eligible, a Complaint must:
2.3.1 Information Required to Support a Complaint
Information submitted by a Complainant must be sufficient to permit both CBBB and the Respondent to evaluate the Complaint adequately, and to enable the Respondent to respond to the Complaint. CBBB shall be the sole judge of whether the information submitted is sufficient.
2.3.2 Prior Good Faith Attempt to Resolve Complaint
Prior to filing a Complaint with the Procedure, the Complainant must have made a good faith attempt to resolve the Complaint directly with the Respondent.
2.4 Eligibility Determination
CBBB shall determine whether the Complaint is eligible and shall take one of the following actions:
After a Case has been opened, either Party may designate another individual or entity as the Party’s representative in the Procedure.
Part 3: Conciliation and Settlement
3.1 Role of CBBB
CBBB shall act as an impartial facilitator to assist the Parties in the Conciliation process. CBBB staff shall promote communication between the Parties to encourage the discussion of Settlement options.
3.2 Settlement Discussions
CBBB staff shall work with the Parties to help them take an objective look at the issues in dispute. This may include obtaining the facts as viewed by the Complainant, providing relevant information obtained from the Complainant to the Respondent, seeking the Respondent’s response to the Complainant, and presenting the response and any Settlement offers to the Complainant.
3.3 Written Confirmation of a Settlement
If a Settlement is reached, CBBB shall be informed of the terms of the Settlement and shall draft and circulate to the Parties a letter detailing the terms of the Settlement.
3.4 Timely Resolution
CBBB Staff and the Parties shall make best efforts to conclude a settlement within fifteen (15) days after CBBB opens a Case.
Part 4: Data Privacy Review
4.1 Overview and Available Remedies
If Conciliation efforts fail to reach a Settlement, either party may request a Data Privacy Review, in which a Complainant may seek the following remedies from the Respondent:
Following a Review, the Decision shall order corrective action to change the Respondent’s privacy policies or practices if, based on the evidence presented, such action is found necessary to reverse or correct the effects of noncompliance with the Privacy Shield Principles.
A Complainant may not use the Data Privacy Review to seek, and the Decision may not order, any corrective action that:
4.2 Data Privacy Board
The Data Privacy Board (the “Board”) shall consist of a panel of individuals, unaffiliated with CBBB, and recognized as experts in the field of data privacy (the “Panelists”). All Panelists shall be required to sign confidentiality agreements with respect to any confidential information or Proprietary Information either provided to them by CBBB or that they may receive otherwise in the course of their service as a Panelist.
4.2.1 Eligibility of Panelists
CBBB shall find an individual ineligible to serve as a Panelist in a specific Case if (a) his or her employing company or corporate affiliate is the Respondent, or sells a product or service that competes directly with a product or service of the Respondent; (b) if he or she has a relationship with a Party, does business with a Party, is employed by a Party, or represents a Party in any capacity.
A potential Panelist shall disqualify himself or herself from service on a Case if for any reason arising out of past or present employment, affiliation or conflict of interest, the Panelist believes that he or she is unable to impartially examine a Case. In addition, either Party shall have the right to object to the selection of any Panelist for any of the conflicts of interest stated in this Section, and to request that a replacement be appointed to serve on the Case. Such request will be subject to approval by CBBB, which shall act reasonably in determining whether good cause exists to disqualify a potential Panelist.
4.2.2 Panelist Responsibilities
The Panelist shall be responsible for evaluating, investigating, analyzing, and reaching a Decision on the merits of a Case.
CBBB staff shall administer the Review process. Administration shall include communicating with the Panelist; collecting and forwarding necessary documentation to the Panelist; and distributing requests for information and/or the Decision on behalf of the Panelist.
4.3.1 Communicating with the Panelist
The Parties agree not to communicate directly with the Panelist, except at a hearing where the other party is present or has received notice. All written communication with the Panelist must be through CBBB. If either Party violates this agreement, CBBB may refuse to proceed with the Case. If the Party violating the agreement is a Respondent, CBBB may immediately refer the matter to the appropriate government agency.
4.3.2 Preparation and Forwarding of Case Record
CBBB shall prepare the Case Record and forward it to the Panelist. The Case Record shall consist of documents comprising the Position and Response submitted pursuant to Section 4.4. No other submissions shall be considered by the Panelist except as expressly provided for in Section 4.5.
Copies of the Case Record shall be sent to the Parties.
4.4 Submission and Exchange of Written Position and Response
If the Complainant requests a Review, CBBB shall ask the Complainant to submit a written Position within ten (10) days of the request. If the Complainant so requests, CBBB may accept the Complaint information submitted under Section 2.3.1 in whole or in part as the Complainant’s Position. If the Complainant fails to submit a Position within the time limit provided, the Case shall be closed.
CBBB shall forward the Position to the Respondent. The Respondent shall, within ten (10) days after receipt of the Complainant’s Position, file a written Response. If the Respondent files a timely Response, CBBB shall forward it to the Complainant as provided for in Section 4.4.2 and the Case will move forward.
4.4.1 Respondent’s Failure to File a Response
If a Respondent fails to file a Response in compliance with Section 4.4, the default will be noted in the next Procedure report and CBBB shall initiate a referral to the appropriate government agencies pursuant to Section 8.8.
4.4.2 Late Filings
If either Party submits requested information outside the time limits specified in section 4.4., CBBB may, in its sole discretion, grant the Party an extension of the applicable time limit and include the information in the Case Record.
4.5 Review Procedure
CBBB will assign a single Panelist to conduct the Review. The Panelist will decide any substantive questions presented in the Case Record, within the scope of the Procedure Rules. The Panelist will submit a written Decision determining these issues, and including reasons for the determination.
4.5.1 Examination by the Panelist
The Panelist may, in his or her discretion, request additional information or comments from either or both Parties. The Party receiving the request shall, within five (5) days after receipt of the request, submit a written response thereto. On receipt of any such response, CBBB shall immediately forward it to the other Party, who may also submit a response within five (5) days after receipt.
4.5.2 Telephone Hearing
The Panelist may, in his or her discretion, render a Decision entirely on the case record. If the Panelist determines at any point in the Review process that there should be an oral hearing, it shall be conducted by telephone conference call, and the hearing date and time will be set with due regard for the schedule of the Parties and the Panelist. CBBB will send all Parties a written notice five (5) days before the hearing date, setting out the date and time of the hearing, and the procedure to be followed. If either Party has submitted Proprietary Information, the Panelist will exclude the other Party from the hearing during any discussion of the Proprietary Information.
4.5.3 Failure to Participate in Telephone Hearing
If a Party fails to participate in a telephone hearing after receiving proper notice, the Panelist will inquire of CBBB as to any known reason for the Party’s absence and will decide, in his or her discretion, whether to reschedule the hearing or to proceed with the hearing and receive evidence and testimony from the other Party
CBBB may observe the telephone hearing in order to represent the public interest in the integrity of the program, subject to the confidentiality provisions set forth in Section 8.2.
4.5.4 Late Filings
If a Party submits requested information after the time limits specified in section 4.5, the untimely document shall not be submitted to the Panelist unless, pursuant to Section 4.2.2, CBBB grants an extension for good cause. In that case, the Panelist shall proceed with consideration of the Case and may give appropriate weight to the lack of response.
4.6.1 Issuance of a Decision
The Panelist shall make best efforts to forward a written Decision to CBBB within ten (10) days after completion of the Review Procedure. The Decision shall include the Panelist’s reasons for decision, and should (a) state whether or not corrective action is necessary; and if so, (b) provide a time frame for such action.
4.6.2 Respondent’s Statement Regarding Corrective Action
When a Decision requires corrective action the Respondent must, within five (5) days of its receipt of the Decision, submit a statement indicating whether and how it will comply with the Decision and implement the recommended corrective action within the time frame provided.
4.6.3 Decision Impossible to Implement
If either Party believes that a Decision requiring corrective action cannot be implemented within the specified time frame or at all, that Party should immediately inform CBBB in writing. CBBB shall return the Case to the Panelist, who may request additional evidence, request a hearing with all parties via telephone conference call, or do anything the Panelist deems appropriate to confirm or deny the claim of impossibility of implementation. If the Panelist confirms such impossibility, the Panelist may amend the original Decision to alter the specified time frame or to order any other remedy within the scope of the Procedure Rules.
4.6.4 Noncompliance with a Decision
If the Decision recommends corrective action and the Respondent fails to indicate within the time period specified in Section 4.6.2, either that it intends to implement the recommended corrective action, or that the corrective action is impossible to implement pursuant to section 4.6.3, CBBB shall initiate a referral of the Case to the appropriate government agencies (usually the Federal Trade Commission and the Department of Commerce) pursuant to Section 8.8.
In the event of a referral for noncompliance, CBBB shall publish a Case Report summarizing the facts of the case, including the Respondent’s name, the fact of the Respondent’s noncompliance with the Decision, and the government referral. Information regarding the referral may also be released to the press and the public.
The case details shall also be noted in the next Procedure Report.
Part 5: Verification of Performance of a Settlement or Decision
If a Settlement requiring corrective action is reached or a Respondent agrees to take corrective action recommended by a Decision, Respondent shall, after the specified time for performance, certify to CBBB within ten (10) days that the corrective action required by the Settlement or Decision has been implemented. If CBBB is in doubt as to whether the corrective action has been implemented as required, it may return the case to the Panelist for verification. The Panelist may request additional evidence, request a telephone hearing with all parties via telephone conference call, or do anything else the Panelist deems appropriate to verify performance of the corrective action as required by the Decision.
If CBBB and the Panelist determine that the corrective action has not been implemented as required, CBBB shall initiate a referral to the appropriate government agencies pursuant to Section 8.8.
In the event of a referral for nonperformance, CBBB shall publish a Case Report pursuant to section 4.6.4., summarizing the facts of the case, including the Respondent’s name, the fact of the Respondent’s noncompliance with the Decision, and the government referral. Information regarding the referral may also be released to the press and the public.
The case details shall also be noted in the next Procedure Report.
Part 6: Closing a Case
The Procedure shall close a Case when:
Part 7: Reporting of Procedure Activity and Publication of Case Reports
CBBB shall publish a Procedure Report annually. This Report, to be published online at www.bbb.org, shall:
Case Reports required to be published pursuant to Section 4.6.4 shall also be published online at www.bbb.org.
Part 8: General Provisions
8.1 Parties’ Waiver of Subpoena Rights and Liability Claims
By participating in the Procedure, the Parties agree that they will not subpoena any of the following in any legal proceeding arising out of the matters at issue in the Procedure: CBBB or CBBB staff; Board members; committee members; volunteers; independent contractors; Panelists; or any records of the Procedure.
The Parties also agree that the following shall not be liable for any act or omission in connection with the Procedure: CBBB or CBBB staff; Board members; committee members; volunteers; independent contractors utilized by CBBB; or Panelists.
8.2 Confidentiality of Procedure Files
All deliberations, meetings, proceedings and writings of the Procedure other than the Settlement Agreement or the Decision shall be sealed from public access and shall be treated as confidential by CBBB. The Settlement Agreement or Decision, and where applicable, any published Case Report, shall be the only permanent record required to be kept as to the basis of a Complaint, the issues defined, the facts and information presented, and the agreement reached by the parties or the conclusions reached by the Panelist.
8.3 Retention of Procedure Files
CBBB shall destroy all materials in a Procedure file, except the Settlement Agreement or the Decision after the Procedure has been concluded and the Case has been closed. Proprietary Information shall be returned to the submitting Party when the Case is closed.
8.4 Parties’ Treatment of Information Received During the Procedure
The Parties agree that during the course of the Procedure they will treat any information provided to them by CBBB as information provided exclusively for the purpose of furthering the Procedure, and that they will not disseminate such information to anyone other than those persons directly involved in the handling of the Case. If a Party violates this agreement, CBBB may refuse to continue processing the Complaint. The purpose of this protection is to maintain a professional, unbiased atmosphere to facilitate a timely and lasting resolution to a Case. If the Party violating the agreement is a Respondent, CBBB may refer the matter to the appropriate government agency.
8.5 When Information May Be Treated as Proprietary
A Complainant or Respondent may submit information to CBBB with the request that such information be treated as Proprietary Information and not made available to the other Party. A Party seeking such treatment must: (a) identify in its submission which materials include Proprietary Information; and (b) affirm that the information for which proprietary status is claimed is not publicly available.
If CBBB does not agree that the information so identified should be treated as Proprietary Information, it shall immediately return the information to the submitting Party and inform the Party that the information will not be considered.
CBBB shall promptly return any Proprietary Information to the submitting Party upon closing the case, and neither CBBB nor the Panelist shall make the information public in any report issued by the Procedure or otherwise.
8.6 Providing a Non-Confidential Summary of Proprietary Information
When a Party submits material with a request that it be treated as Proprietary Information, that Party must also submit a summary of such material that does not reveal any Proprietary Information but provides sufficient information about the material to allow the other Party to respond to it. Failure to provide an acceptable summary for this purpose will result in the information not being considered. CBBB shall be the sole judge of the acceptability of a summary offered by a Party.
8.7 Transmittal of Documents
Any document that must be provided to a Party, CBBB or the Panelist, shall be transmitted electronically (via facsimile or encrypted electronic mail). Documents provided to any Party shall be addressed to the contact designated by that Party for purposes of the Procedure.
8.8 Referrals to Government Agencies
CBBB, in its discretion, may refer matters to the appropriate government agencies (usually the Federal Trade Commission and the Department of Commerce) if:
Before referring any matter to any government agency, CBBB must send Respondent a Notice of Intent stating the reason for the intended referral and give Respondent three (3) days to cure any failure leading to the referral. Reports of referrals to government agencies shall be included in the Procedure Report and may be included in other publications.
All proceedings will be conducted primarily in English. CBBB shall furnish translation and interpretation services as needed. Decisions and Statistical Reports will be published in English.