| The Safe Harbor Privacy Dispute Resolution Procedure ("Procedure") is administered by the Council of Better Business Bureaus, Inc. ("CBBB"). The Procedure provides for the review of complaints by European Union ("EU") citizens alleging that a participating business has failed to comply with the Safe Harbor Privacy Principles, as issued by the United States Department of Commerce.
|
| By participating in the Procedure, all parties agree to abide by the Rules set forth below.
|
| The Procedure has two components:
|
| (a) The Data Privacy Review ("Review"), which consists of determining Claim eligibility, receiving evidence, investigating Claims, and issuing a decision on the merits of a Complaint. The Review shall be conducted by CBBB staff.
|
| (b) The Data Privacy Appeal ("Appeal"), in which a party may appeal the decision issued during the Review process. The Appeal shall be conducted by industry experts who have agreed to participate in the Procedure.
|
| A Complainant may utilize the Procedure as a forum in which to demand that the Respondent use the Complainant’s Personal Data in a manner consistent with the Safe Harbor Privacy Principles. A Complainant may also seek to have his or her Personal Data corrected or suppressed.
|
| The Review and/or Appeal processes, as appropriate, shall recommend corrective action to change Respondent’s privacy policies or practices if, based on the evidence presented, such action is found to be necessary to reverse or correct the effects of noncompliance and to assure that future processing by Respondent will be in conformity with the Safe Harbor Privacy Policy. The Review Staff may, as necessary, refer the Respondent’s failure to take recommended corrective action or respond to Procedure requests to the appropriate government agencies.
|
| The Review or Appeal may not order any corrective action that:
|
| (a) requires payment of monetary damages; or
|
| (b) requires the Respondent to violate legal requirements.
|
| Appeal has the meaning set forth in Section 1.1.
|
| Appeal notice letter has the meaning set forth in Section 4.2.
|
| Appeal Panel has the meaning set forth in Section 4.4.1.
|
| Case has the meaning set forth in Section 1.14.
|
| Case Record has the meaning set forth in Section 4.2.4.
|
| Claim means the allegation that a Respondent has failed to comply with the Safe Harbor Privacy Principles.
|
| Complainant is the individual, including his or her representative, who has filed a Claim.
|
| Complaint means a Claim that the Review has determined to be eligible in accordance with Part 2.
|
| Decision means the conclusion reached by the Review Staff after considering all the evidence presented in an eligible claim.
|
| Final Decision means the conclusion reached by the Appeal Panel after considering the Case Record and all the evidence presented to the Panel.
|
| Parties are the Complainant and Respondent.
|
| Personal Data is information relating to an individual that identifies that individual, or could reasonably be used to identify the individual, regardless of the medium involved (e.g., paper, electronic, video, or audio).
|
| Procedure has the meaning set forth in Section 1.1.
|
| Proprietary Information is information designated by a Party as proprietary in accordance with Section 1.9. It may include Personal Data relating to Complainant or Respondent’s customers; information concerning Respondent’s business records and plans; trade secrets; technological information; computer programs and listings; source code and/or object code; and financial information.
|
| Respondent is a business that has agreed to participate in the Procedure and is alleged by Complainant to have failed to comply with the Safe Harbor Privacy Principles.
|
| Review has the meaning set forth in Section 1.1.
|
| Review Staff means the CBBB staff personnel conducting the Review process and the administrative work necessary for the Appeal.
|
| Safe Harbor Privacy Principles are the Safe Harbor Privacy Principles, Frequently Asked Questions, and other relevant documents issued by the U.S. Department of Commerce on July 21, 2000, and as they may subsequently be amended.
|
| A Party may designate another individual as his or her representative in the Procedure.
|
| By participating in the Procedure, the Parties agree that they will not subpoena any of the following in a subsequent legal proceeding arising out of the matters at issue in the Procedure: CBBB or CBBB staff; Board members; committee members; volunteers; independent contractors; industry experts conducting the Appeal process; or any records of the Procedure.
|
| The Parties also agree that the following shall not be liable for any act or omission in connection with the Procedure: CBBB or CBBB staff; Board members; committee members; volunteers; independent contractors utilized by CBBB; or industry experts conducting the Appeal process.
|
| All deliberations, meetings, proceedings and writings of the Procedure other than its decisions shall be sealed from public access and shall be treated as confidential by the CBBB. Procedure decisions shall be the only permanent record required to be kept as to the basis of a Complaint, the issues defined, the facts and information presented, and the conclusions reached by the Procedure.
|
| Procedure materials, other than Proprietary Information, shall be destroyed by CBBB staff at the conclusion of the Procedure after the Case has been closed. Proprietary Information submitted to the Review or the Appeal shall be returned to the submitting Party when the Case is closed.
|
| The Parties agree that during the course of the Procedure they will treat any information provided to them by Review and Appeal Staff as information provided exclusively for the purpose of furthering the Procedure, and that they will not disseminate such information to anyone other than those persons directly involved in the handling of the Complaint. If a Party violates this agreement, CBBB staff may refuse to proceed with the Case. The purpose of this protection is to maintain a professional, unbiased atmosphere to facilitate a timely and lasting resolution to a Case. If the Party violating the agreement is a Respondent, the CBBB may refer the matter to the appropriate government agency.
|
| A Respondent or Complainant may submit information to the Review with the request that such information be treated as Proprietary Information and not made available to the other Party. A Party seeking such treatment must: (a) identify in its submission which materials are Proprietary
|
| Information and which are not; and (b) affirm that the information for which proprietary status is claimed is not publicly available.
|
| If the Review does not agree that the information should be treated as Proprietary Information, it shall immediately return the information to the submitting Party and inform that Party that the information will not be considered in the Review or Appeal.
|
| Any Proprietary Information shall be retuned to the submitting Party promptly upon closing the Procedure’s case and shall not be made public in any report issued by the Procedure or otherwise.
|
| When a Party submits material with a request that it be treated as Proprietary Information, that Party must also submit a summary of such material that does not reveal any Proprietary Information but provides sufficient information about the material to allow the other Party to respond to it. Failure to provide an acceptable summary for this purpose will result in the information not being considered in the Review. The Review Staff shall be the sole judge of the acceptability of a summary offered by a Party.
|
| Any document that must be provided to a Party, the Review Staff or the Appeal experts, shall be sent either (a) via overnight delivery; or (b) electronically (via facsimile or electronic mail), but such electronic delivery must be followed by a copy sent via first class mail. Documents provided to the opposing Party shall be addressed to the contact designated by that Party.
|
| The Review Staff or the Appeal Staff, as appropriate, shall refer matters to suitable government agencies if:
|
| (a) The Respondent states that it is not willing to participate in the Procedure in response to a Complaint or an Appeal;
|
| (b) The Respondent fails to file a written answer responsive to the Complaint after receiving a default notice under Section 3.2.3;
|
| (c) The Respondent does not agree to take corrective action recommended by the Review and does not appeal that decision;
|
| (d) The Respondent does not agree to take corrective action recommended by the Appeal decision; or
|
| (e) The Review Staff or Appeal Panel determines that the Respondent has not taken required corrective action after Respondent agreed to do so in response to a Review or Appeal decision.
|
| Before referring any matter to the appropriate government agency, the Review or Appeal Staff must first notify Respondent of the intended referral and give Respondent a reasonable opportunity of at least ten (10) business days to cure any failure leading to the referral.
|
| Reports of referrals to government agencies shall be included in the Procedure report and may be included in other publications.
|
| All proceedings will be conducted in English and all Decisions will be published in English.
|
| Upon contact by a potential Complainant, the Review Staff will record basic information. The Review Staff will open a Case when it determines that the Complainant wishes to file an eligible Claim for resolution by the Procedure.
|
| The Review Staff, in its sole judgment, will determine whether the Claim is eligible and may be docketed as a Compliant.
|
| In order to be eligible, a Complainant must be:
|
| (a) The person who provided the Personal Data to the Respondent;
|
| (b) The parent or legal guardian of that person in the case of a Personal Data collected from a child under 13; or
|
| (c) The subject of the Personal Data in the case of information collected from another individual.
|
| The Review shall take reasonable steps to verify the identity of the Complainant to ensure that he or she is the person he or she is representing himself or herself to be. If the person making the Claim is doing so in a representative capacity, the Review may also undertake to verify that capacity as well as the person’s identity. If, in the sole discretion of the Review, the identity of the Complainant or representative is not verified, the Review shall close the Case.
|
| In order to be eligible, a Claim must:
|
| (a) Be filed by an eligible Complainant;
|
| (b) Be made against a company that has agreed to participate in the Procedure;
|
| (c) Allege that the Respondent failed to comply with the Safe Harbor Privacy Principles in relation to Personal Data;
|
| (d) Include information to support Complainant’s allegations as required by Section 2.3.1;
|
| (e) Follow a good faith effort to resolve the Claim as required by Section 2.3.2;
|
| (f) Seek remedies available pursuant to Section 1.2;
|
| (g) Have not been previously resolved by the Procedure, court action, arbitration, or other form of dispute settlement; and
|
| (h) Unless both Parties agree otherwise, not be currently in litigation or the subject of any other adjudicatory process (including claims submitted for resolution through binding arbitration).
|
| Information submitted by a Complainant should include a description of the Respondent’s disposition of the Complainant’s good faith attempt to resolve the Claim directly with the Respondent and must be sufficiently complete to permit the Review to evaluate the Claim adequately. The information must also be sufficiently complete to permit the Respondent to evaluate and respond to the Claim.
|
| The Review Staff shall be the sole judge of whether the information submitted is sufficiently complete.
|
| Prior to filing a Claim, the Complainant must have made a good faith attempt to resolve his or her Claim directly with Respondent, including a good faith attempt to follow any reasonable specifications set out in Respondent’s statement of privacy policies.
|
| The Review Staff will inquire into whether the Complainant has made a good faith attempt to resolve his or her Claim directly with respondent. If the Complainant indicates there was a good faith attempt, he or she will be asked to describe the contact and results. If there was no attempt to resolve the Claim through direct contact with Respondent, the Complainant will be asked to try to resolve the Claim and will be advised that he or she can refile the Claim if his or her attempt to resolve the Claim does not yield satisfactory results.
|
| The Review Staff shall determine whether the Complaint is eligible and shall take one of the following actions:
|
| (a) If the Review Staff, in its sole judgment, concludes that the Claim is eligible and contains all necessary information, it shall docket the Claim as a Complaint.
|
| (b) If the Review Staff, in its sole judgment, concludes that additional information is needed to sustain the Claim, it shall promptly contact the person who submitted the Claim and advise him or her of the need for further information. If the Review Staff does not receive the requested information within fifteen (15) business days of its request, it shall advise the person who submitted the Claim that it cannot proceed with investigation of the Claim and the Review Staff shall close the Case.
|
| (c) If the Review Staff, in its sole judgment, concludes that the Claim is not eligible for reasons other than a lack of information, it shall advise the Complainant that it cannot proceed with investigation of the Claim and it shall close the case without prejudice to the right of the Complainant to file another Claim if there are changed circumstances. Where appropriate, the Review Staff shall provide the Complainant with the name and address of any agency or group that may have jurisdiction over the Complaint.
|
| The Review Staff shall be responsible for evaluating, investigation, analyzing, and making a Decision on the merits of a Complaint.
|
| After docketing the Complaint, the Review Staff shall forward the Complaint to Respondent and request an answer that includes any supporting facts or information. In addition to the Complaint, the Review Staff shall provide the Respondent with any supporting documentation that is not Proprietary Information and any summary of Proprietary Information that has been submitted.
|
| Respondent shall, within fifteen (15) business days after receipt of the Complaint, submit a written answer that includes supporting facts or information. If the Review Staff considers an answer to be deficient, it shall send the Respondent a written request for a further answer within a reasonable time that it shall designate.
|
| If a Respondent fails to file a written answer to the Complaint in compliance with Section 3.2.2, or fails to make a timely response to a Review Staff request for a further answer pursuant to that Section, the Review Staff shall send the Respondent a written default notice. The written default notice shall inform the Respondent that, unless the Respondent responds appropriately within fifteen (15) business days after receipt of the default notice, the default will be noted in the next Procedure report and the Review Staff shall refer the matter to the appropriate government agency.
|
| If the Respondent files a timely answer after the default notice, the answer will be forwarded to the Complainant as provided for in Section 3.2.4 and the Case will move forward from that point on in the manner prescribed in this Part 3.
|
| If the Respondent fails to file a timely answer after the default notice, the Review Staff shall refer the file to the appropriate government agency pursuant to Section 1.12 and shall report the matter and the referral in the next Procedure report.
|
| When the Respondent submits a written answer in compliance with Section 3.2.2, the Review Staff shall promptly forward that answer to the Complainant, except for any Proprietary Information so designated pursuant to Section 1.9. The Complainant may, within ten (10)
|
| business days after receipt of the answer, submit to the Review Staff a written reply to the answer. If the Complainant does not submit a reply, the Review Staff shall proceed to decide the Case following the expiration of the Complainant’s time to reply, subject to further investigation by the Review Staff under this Part 3.
|
| If the Complainant submits a reply, the Review Staff shall promptly forward that reply to the Respondent. The Respondent may, within ten (10) business days after receipt of the reply from the Review Staff, submit a written response. The Review Staff shall forward this written response to the Complainant. Upon receipt of Respondent’s response or the expiration of the time period for submission of response, the Review Staff shall proceed to decide the Case, subject to further investigation by the Review Staff under this Part 3.
|
| The Review Staff may request additional information or comments from either Party. The Party receiving the request shall, within ten (10) business days after receipt of the request, submit a written response thereto. On receipt of any such response, the Review Staff shall immediately forward it to the other Party, who may submit a response within ten (10) business days after receipt.
|
| If a Party fails to respond to a Review Staff request for additional information or comments, the Review Staff shall issue a default notice to the Party and provide the Party ten (10) business days to respond appropriately to the request. If the Party does not respond to the default notice with the requested information, the Review Staff shall proceed with its consideration of the Case and will give appropriate weight to the lack of response.
|
| The Review Staff may, in its discretion, seek the assistance of one or more persons with technical expertise relevant to the dispute. Such persons shall enter into confidentiality agreements with the Review Staff and be subject to the confidentiality and Proprietary Information provisions set forth in Part 1. The Review Staff may, in its discretion, share with the Parties any written submissions from these persons and request a response from the Parties.
|
| The Review Staff may, in its discretion, request an on-site review of Respondent in relation to issues relevant to the dispute. Any on-site review shall be subject to reasonable restrictions imposed by Respondent.
|
| The Review Staff may, in its discretion, schedule a conference with the Parties. The conference may be held by teleconference or other electronic means.
|
| (a) For a submission under this Section 3.2 to be timely, it must be received by the Review Staff within the specified period for submission. The Parties may agree between themselves to extend the time limits specified. In such case, the agreed upon limits will be controlling upon the Review Staff’s receipt of a copy of the Parties’ agreement.
|
| (b) If a Party files a reply or response or submits requested information after the specified time limits, the untimely document shall not be considered by the Review Staff, unless the Review Staff grants an extension for good cause or the time is extended in accordance with (a) above.
|
| Within twenty (20) business days after it completes its Case review, the Review Staff shall formulate a judgment based on the merits of the Claim and announce that judgment as a Review Staff Decision. The Review Staff Decision shall include statement of findings. The Decision shall be promptly sent to the Parties.
|
| If the Review Staff’s Decision requires corrective action by Respondent, Respondent shall, within fifteen (15) business days of its receipt of the Review Staff Decision, submit a statement indicating whether it will comply with the recommended corrective action and, if so, shall state the specific action (including time frame) that it proposes to take with regard to its privacy policies or practices.
|
| If Respondent indicates that it will not agree to take the recommended corrective action, or does not provide a timely response to the issuance of the Review Staff’s Decision, the Review Staff shall refer the file to the appropriate government agency pursuant to Section 1.12.
|
| The Review Staff’s decision will be made available to the public and noted in the next Procedure report.
|
| Either Party may appeal a Review Staff Decision that is adverse in whole or in part to that Party’s position.
|
| In order to Appeal, a Party must, within fifteen (15) business days after receipt of the formally issued Review Staff Decision, submit a letter to the Review Staff stating that it appeals the decision. This Appeal notice letter shall specify the grounds for such appeal. A copy of the Appeal notice letter shall be sent by the party initiating the appeal to the other Party.
|
| The Appeal part of the Procedure will be administered by CBBB Staff, who will distribute the Case Record and Appeal documents to the Appeal Panel. The Appeal Panel consists of independent volunteers who are recognized experts in the privacy field who volunteer their services to the Procedure.
|
| Each Party shall have the right to appeal any additional issues considered by the Review Staff that have not been appealed by the other Party. To exercise this right, such Party shall submit a letter of appeal within ten (10) business days of receiving the original Appeal notice letter. This notice of cross appeal letter shall be sent to the other Party as well as the Review Staff, and shall specify the issues such Party wishes to appeal.
|
| If there is an appeal, the Review Staff shall prepare the Case Record. The Case Record shall consist of the Complaint, answer, reply, responses, and any other documents or information submitted pursuant to Part 3. No other submissions shall be considered by the Appeal Panel, except as provided for in Section 4.3.
|
| Copies of the Case Record shall also be sent to the Parties with Proprietary Information appropriately redacted.
|
| Within ten (10) business days of receiving a copy of the Case Record, each Party may submit a response to the other Party’s appeal to the Review Staff with a copy to the other Party.
|
| If a Party files an appeal or cross appeal or submits an explanation of the reasons for appeal after the specified time limits, the untimely document shall not be considered by the Appeal Panel, unless the Party receives an extension for good cause or both Parties agree it may be included.
|
| The record on appeal shall consist of the Case Record (as specified in Section 4.2.4) furnished by the Review Staff, the Review Staff’s Decision, the letters of appeal, and the submissions under Section 4.2.5. No other written submissions shall be made during the appeal unless the Appeal Panel requests further information.
|
| The Appeal Panel shall consist of individuals recognized as experts in the field of privacy data and information. All Appeal Panel members shall be required to sign confidentiality agreements with respect to any confidential information or Proprietary Information provided to them as a result of their role on the Appeal Panel.
|
| Each Appeal will be determined by one randomly selected Appeal Panel member.
|
| The Review staff will conduct the administrative work necessary for the Appeal. This work shall include collecting and forwarding the necessary paperwork to the Appeal Panel; coordinating
|
| telephone conferences as requested by the Appeal Panel; and distributing requests for information and/or the Decision on behalf of the Appeal Panel.
|
| An individual will be deemed ineligible to sit on an Appeal Panel if (a) his or her employing company or corporate affiliate is the Respondent, or sells a product or service that directly competes with a product or service of the Respondent; (b) he or she represents an organization that competes with the Respondent; or (c) if he or she has a relationship with a Party, does business with a Party, is employed by a Party, or represents a Party in any capacity, or has any other conflict of interest.
|
| A potential Appeal Panel member shall disqualify himself or herself from service on a Case if for any reason arising out of past or present employment, affiliation or conflict of interest, he or she believes himself or herself unable to reach a completely unbiased decision. In addition, the Parties shall have the right to object, for cause, to the inclusion of any Appeal Panel member, and to request that a replacement member be appointed. Such request will be subject to approval by CBBB staff, who shall act reasonably in determining whether good cause exists to disqualify a potential Appeal Panel member.
|
| One Panel member will be appointed to an Appeal by CBBB staff. The Panel member will preside over the Appeal Panel meetings, hearings, and deliberations and will decide any substantive question before the Appeal Panel. The Panel member will submit a written decision determining all issues raised in the Appeal.
|
| The Appeal shall proceed with informality and speed. The Appeal Panel member may, in his or her discretion, decide the matter without an oral hearing. If the Appeal Panel member determines there should be an oral hearing, all Parties shall be given fifteen (15) business days notice of the hearing. Such notice shall set out the date, time, and place of the hearing, and the procedure to be followed. Oral hearings may be held, at the Appeal Panel member’s discretion, either in-person, by teleconference, or by other electronic means.
|
| The Review Staff may participate in the hearing, or any other part of the appeal proceedings, in order to represent the public interest in the integrity of the program, subject to the confidentiality provisions set forth in Part 1.
|
| In the absence of the agreement of the Parties, no facts or arguments will be considered by the Appeal Panel member if they are outside the facts in the Case Record or inconsistent with the arguments made before the Review Staff as reflected in the Case Record. In the event a Party offers newly discovered evidence germane to the issues before the Appeal Panel member which was not reasonably available to it during the Review proceeding, the Appeal Panel member may remand the Case back to the Review Staff for its further consideration and decision.
|
| The decision of the Appeal Panel member will be based upon the record on appeal and any summaries or arguments presented during the hearing. If a Party has submitted Proprietary Information that is contained in the Case Record, the Appeal Panel member will exclude the other Party from the hearing during any discussion of the Proprietary Information.
|
| The Appeal Panel member shall endeavor to forward its written decision to CBBB staff within twenty (20) days after the hearing. The decision shall include the Appeal Panel member’s findings along with a statement of whether corrective action is necessary and a time frame for such action. CBBB staff shall promptly transmit the decision to the Parties.
|
| When corrective action is recommended by the decision, the Respondent must, within ten (10) days of its receipt of the Appeal Panel Decision, submit a statement indicating whether it will comply with the Decision and take the recommended corrective action within the time frame provided.
|
| If the Appeal Panel’s Decision recommends corrective action and the Respondent fails to indicate within the specified time period described in Section 4.6.2 that it intends to take the recommended corrective action, CBBB staff shall issue a notice of intent to the Respondent. The notice shall advise the Respondent that the Case will be referred to the appropriate government agency unless CBBB is notified, within five (5) business days of the Respondent’s receipt of the notice, of the Respondent’s intent to take the corrective action.
|
| If the Respondent does not submit a timely response indicating intent to take corrective action, CBBB staff shall refer the matter to the appropriate government agency pursuant to Section 1.12. CBBB staff shall also make the decision public, and the Respondent’s failure to agree to take corrective action and the government referral shall be noted in the next Procedure report.
|
| If Respondent agrees to take corrective action recommended by the Review Staff or Appeal Panel decision, Respondent shall, within thirty (30) business days after the specified time for performance, certify to the Review Staff that the corrective action has been taken. The Review Staff may ask for additional information to confirm that the corrective action has been taken. If the Review Staff determines that the corrective action has not been taken, it shall refer the file to the appropriate government agency pursuant to Section 1.12 and shall report its determination of noncompliance in the next Procedure report.
|
| The Procedure shall close a Case when:
|
| (a) The Review Staff determines that a Claim is not eligible;
|
| (b) The Review Staff determines additional information is needed to sustain the claim and that information is not timely received by the Review Staff pursuant to Section 2.4(b);
|
| (c) The Complainant withdraws his or her Claim;
|
| (d) The Review Staff has issued a decision that does not recommend corrective action and there is no appeal;
|
| (e) The Review Staff or Appeal Panel has issued a decision that recommends corrective action, the Respondent has agreed to take the corrective action, and the Review Staff has determined that the corrective action has been taken;
|
| (f) The Review Staff has referred the matter to a government agency pursuant to Section 1.12; or
|
| (g) The Review Staff or Appeal Panel, as appropriate, refuses to proceed with the Case because of a Party’s failure to abide by its agreement under Section 1.8 to hold information in confidence.
|
| The CBBB shall publish Procedure reports annually when there is data to report. Reports will not be published when CBBB has received no Complaints. These reports shall be published online at www.bbb.org and shall summarize matters concluded during the previous period, and shall:
|
| (a) Provide a statistical summary of the number and nature of contacts from the public and the actions taken by the Review Staff and Appeal Panel with respect to those contacts. This statistical summary shall be comprised of aggregated data and shall not contain any Respondent-specific data.
|
| (b) Provide a statistical summary of the number and nature of Claims deemed ineligible for processing during the period, including the specific reason for a determination of ineligibility. This statistical summary shall be comprised of aggregated data and shall not contain any Respondent-specific data.
|
| (c) For each Complaint which the Review Staff refers to the appropriate government agency pursuant to Section 1.12, provide a summary report (including the Respondent’s name) of the nature of the claim and the Procedure action in the Case.
|
Review Staff and Appeal Panel decisions shall be published online at www.bbb.org.
| Listed below are the annual contract fees for participation in the EU Safe Harbor Privacy Dispute Resolution Program. These fees may be subject to change on renewal. |
| $1 million or less |
$300.00 |
| $1,000,001-$5,000,000 |
$500.00 |
| $5,000,001-$10,000,000 |
$750.00 |
| $10,000,001-$50,000,000 |
$2,000.00 |
| $50,000,001-$100,000,000 |
$3,000.00 |
| $100,000,001-$500,000,000 |
$4,000.00 |
| $500,000,001-$2,000,000,000 |
$5,000.00 |
| Over two billion |
$7,000.00 |
|