Part 1: Procedure Overview and Definitions
The BBB EU Safe Harbor dispute resolution procedure (“Procedure”) is administered by the Council of Better Business Bureaus, Inc. (“CBBB”). The Procedure provides for the resolution of complaints alleging that a U.S. business participating in the BBB EU Safe Harbor Program (a “Participating Business”) has failed to comply with the Safe Harbor Privacy Principles, as issued by the United States Department of Commerce, in the processing of Personal Data collected in the European Union, Iceland, Liechtenstein, Norway or Switzerland.
By participating in the Procedure, all parties agree to abide by the Rules set forth below.
The Procedure has two components:
- “Conciliation”, a voluntary process whereby the Parties explore Settlement options with the assistance of the CBBB staff.
- The Data Privacy Hearing (“Hearing”), in which an impartial decision maker (the “Panelist”) drawn from a Panel of privacy experts (the CBBB Data Privacy Board) hears the Case and renders a Decision after considering the evidence presented to him or her.
CBBB refers to the Council of Better Business Bureaus, which is the entity located in the United States that administers the Procedure.
Complaint means an allegation that a Respondent has failed to comply with the Safe Harbor Privacy Principles.
Complainant means an individual who has filed a Complaint with the Procedure.
Case means a Complaint that the CBBB has determined to be eligible in accordance with Part 2.
Decision means the judgment reached by the Panelist based on the merits of the Case after considering all the evidence presented to him or her.
Participating Business has the meaning set forth in Section 1.1.
Panelist has the meaning set forth in Section 4.2.
Parties are the Complainant and Respondent.
Personal Data is information relating to an individual that identifies that individual, or could reasonably be used to identify the individual, regardless of the medium involved (e.g., paper, electronic, video, or audio).
Position means all written testimony and supporting documentation submitted by the Complainant for consideration by the Panelist.
Procedure has the meaning set forth in Section 1.1.
Proprietary Information is information designated by a Party as proprietary in accordance with Section 8.5. It may include Personal Data relating to Complainant or Respondent’s customers; information concerning Respondent’s business records and plans; trade secrets; technological information; computer programs and listings; source code and/or object code; and financial information.
Rebuttal means all written testimony and supporting documentation submitted by the Respondent for consideration by the Panelist.
Respondent is a Participating Business that is alleged by Complainant to have failed to comply with the Safe Harbor Privacy Principles.
Safe Harbor Privacy Principles are the Safe Harbor Privacy Principles, Frequently Asked Questions, and related documents issued by the U.S. Department of Commerce on July 21, 2000 and February 6, 2009 respectively, and as they may subsequently be amended.
Settlement is an agreement reached by the Parties as resolution of a Complaint at any point during the Procedure. The terms of the Settlement must be recorded in writing to be effective.
Part 2: Eligibility
2.1 Initial review of Complaints
Upon contact by a potential Complainant, the CBBB will record basic information about the potential Complaint and will seek additional information needed to determine eligibility. The CBBB will open a Case when it determines, in its sole judgment, that the Complainant’s proposed Complaint is eligible for resolution by the Procedure.
2.2 Eligible Complainant
In order to be eligible, a Complainant must be either:
- The subject of Personal Data collected in the European Union, Iceland, Liechtenstein, Norway or Switzerland; or
- The parent or legal guardian of that data subject in the case of Personal Data collected from a child under 13.
2.2.1 Verifying Identity of Complainant
The CBBB shall take reasonable steps to verify the identity of the Complainant to ensure that he or she is the person he or she is representing himself or herself to be. If, in the sole discretion of the CBBB, the identity of the Complainant is not verified, the CBBB shall decline to open a Case.
2.3 Eligible Complaint
In order to be eligible, a Complaint must:
- Be filed by an eligible Complainant;
- Be made against a Participating Business;
- Allege that the Respondent failed to comply with the Safe Harbor Privacy Principles in relation to covered Personal Data;
- Include information to support Complainant’s allegations as required by Section 2.3.1;
- Follow a good faith effort to resolve the Complaint as required by Section 2.3.2;
- Have not been previously resolved by the Procedure, court action, arbitration, or other form of dispute settlement; and
- Unless both Parties agree otherwise, not be currently the subject of litigation or any other adjudicatory process (including claims submitted for resolution through binding arbitration).
2.3.1 Information Required to Support a Complaint
Information submitted by a Complainant must be sufficiently complete to permit both the CBBB and the Respondent to evaluate the Complaint adequately, and to enable the Respondent to respond to the Complaint.
The CBBB shall be the sole judge of whether the information submitted is sufficiently complete.
2.3.2 Prior Good Faith Attempt to Resolve Complaint
Prior to filing a Complaint with the Procedure, the Complainant must have made a good faith attempt to resolve his or her Complaint directly with the Respondent, including a good faith attempt to follow any reasonable specifications set out in the Respondent’s statement of privacy policies.
The CBBB will inquire into whether the Complainant has made a good faith attempt to resolve his or her Complaint directly with the Respondent. If the Complainant indicates there was a good faith attempt, he or she will be asked to describe the contact and results.
If there was no attempt to resolve the Complaint through direct contact with the Respondent, the CBBB will ask the Complainant to try to resolve the Complaint and will advise the Complainant that he or she can re-file the Complaint with the Procedure if the attempt to resolve the Compliant with the Respondent does not yield satisfactory results.
2.4 Eligibility Determination
The CBBB shall determine whether the Complaint is eligible and shall take one of the following actions:
- If the CBBB, in its sole judgment, concludes that the Complaint is eligible and contains all necessary information, it shall docket the Complaint as a Case.
- If the CBBB, in its sole judgment, concludes that additional information is needed to sustain the Complaint it shall promptly contact the Complainant and advise him or her of the need for further information. If the CBBB does not receive the requested information within fifteen (15) business days of its request, it shall advise the Complainant that it cannot proceed.
- If the CBBB, in its sole judgment, concludes that the Complaint is not eligible for reasons other than a lack of information, it shall advise the Complainant that CBBB cannot proceed with investigation of the Complaint and that it shall close the Complaint without prejudice to the right of the Complainant to file another Complaint if there are changed circumstances. Where appropriate, the CBBB shall provide the Complainant with the name and address of any other agency or group that may have jurisdiction over the Complaint.
After a Case has been opened, either Party may designate another individual or entity as the Party’s representative in the Procedure.
Part 3: Conciliation and Settlement
3.1 Role of the CBBB
The CBBB shall act as an impartial facilitator to assist the Parties in the Conciliation process. The role of the CBBB staff shall be to open communication between the Parties to encourage the discussion of Settlement options.
3.2 Settlement Discussions
The CBBB shall work with the Parties to help them take an objective look at the issues in dispute. This may include obtaining the facts as viewed by the Complainant, providing relevant information obtained from the Complainant to the Respondent, seeking the Respondent’s response to the Complainant, and presenting the response and any Settlement offers to the Complainant.
3.3 Settlement Teleconference
Following the exchange of information about the Case, the Parties may discuss Settlement options directly, or if agreed to by the Parties, a teleconference may be scheduled with a CBBB staff person to explore mutually-agreeable Settlement options.
3.4 Written Confirmation of a Settlement
If a Settlement is reached, the CBBB shall be informed of the terms of the Settlement and shall draft and circulate to the Parties a letter detailing the terms of the Settlement.
Part 4: Data Privacy Hearings
4.1 Overview and Available Remedies
If Conciliation efforts are unsuccessful in reaching a Settlement, either party may request a Data Privacy Hearing. A Complainant may utilize a Data Privacy Hearing as a forum in which to demand that the Respondent:
- Correct or suppress his or her Personal Data; or
- Otherwise process his or her Personal Data in a manner consistent with the Safe Harbor Privacy Principles.
The Hearing Decision shall order corrective action to change the Respondent’s privacy policies or practices if, based on the evidence presented, such action is found necessary to reverse or correct the effects of noncompliance and to assure that future processing by the Respondent will be in conformity with the Safe Harbor Privacy Principles.
A Complainant may not utilize the Data Privacy Hearing to seek, and the Hearing Decision may not order, any corrective action that:
- Requires payment of monetary damages; or
- Requires the Respondent to violate its legal obligations.
The CBBB may, pursuant to Section 8.8, refer the Respondent’s failure to take recommended corrective action or to respond to Procedure requests to the appropriate government agencies.
4.2 Data Privacy Board
The Data Privacy Board (the “Board”) shall consist of a panel of individuals recognized as experts in the field of data privacy (the “Panelists”). All Panelists shall be required to sign confidentiality agreements with respect to any confidential information or Proprietary Information either provided to them by CBBB or that they may receive otherwise in the course of their service as a Panelist.
Each Hearing will be determined by one randomly selected Panelist.
4.2.1 Eligibility of Panelists
An individual will be deemed ineligible to serve as a Panelist in a specific Case if (a) his or her employing company or corporate affiliate is the Respondent, or sells a product or service that competes directly with a product or service of the Respondent; (b) he or she represents an organization that competes directly with the Respondent; or (c) if he or she has a relationship with a Party, does business with a Party, is employed by a Party, or represents a Party in any capacity.
A potential Panelist shall disqualify himself or herself from service on a Case if for any reason arising out of past or present employment, affiliation or conflict of interest, the Panelist believes that he or she is unable to impartially examine a Case. In addition, either Party shall have the right to object to the selection of any Panelist for any of the conflicts of interest stated in this Section, and to request that a replacement be appointed to serve on the Case. Such request will be subject to approval by the CBBB, which shall act reasonably in determining whether good cause exists to disqualify a potential Panelist.
4.2.2 Panelist Responsibilities
The Panelist shall be responsible for evaluating, investigating, analyzing, and reaching a Decision on the merits of a Case.
4.3 Hearing Administration
The CBBB shall conduct the administrative work necessary for the Hearing. This work shall include collecting and forwarding the necessary documentation to the Panelist; coordinating an oral hearing if one is requested by the Panelist; and distributing requests for information and/or the Decision on behalf of the Panelist.
4.3.1 Communicating with the Panelist
The Parties agree not to communicate directly with the Panelist except during an oral hearing where both Parties are present, or where the absent party has received proper notice under Section 4.5.2. All written communication with the Panelist must be sent through the CBBB. If either Party violates this agreement, the CBBB may refuse to proceed with the Case. If the Party violating the agreement is a Respondent, the CBBB may refer the matter to the appropriate government agency.
4.3.2 Preparation and Forwarding of Case Record
The CBBB shall prepare the Case Record and forward it to the Panelist. The Case Record shall consist of documents comprising the Position and Rebuttal submitted pursuant to Section 4.4. No other submissions shall be considered by the Panelist except as expressly provided for in Section 4.5.
Copies of the Case Record shall be sent to the Parties with Proprietary Information appropriately redacted.
4.4 Pre-Hearing Submission and Exchange of Written Position and Rebuttal
If the Complainant requests a Hearing, CBBB shall ask the Complainant to submit a written Position within thirty (30) business days. If the Complainant so requests, CBBB may accept the Complaint information submitted under Section 2.3.1 in whole or in part as the Complainant’s Position. If the Complainant fails to submit a Position within the time frame provided the Case shall be closed.
The CBBB shall forward the Position to the Respondent. The Respondent shall, within thirty (30) business days after receipt of the Complainant’s Position, file a written Rebuttal.
4.4.1 Respondent’s Failure to File a Rebuttal
If a Respondent fails to file a Rebuttal in compliance with Section 4.4, the CBBB shall send the Respondent a written default notice, informing the Respondent that unless the Respondent files a Rebuttal within fifteen (15) business days after receipt of the notice, the default will be noted in the next Procedure report and the CBBB shall refer the matter to the appropriate government agency pursuant to Section 8.8.
If the Respondent files a timely Rebuttal after receipt of the default notice, the Rebuttal will be forwarded to the Complainant as provided for in Section 4.4.2 and the Case will move forward. If the Respondent still fails to file a timely Rebuttal, the default will be duly noted in the next Procedure report and the CBBB shall refer the matter to the appropriate government agency pursuant to Section 8.8.
4.4.2 Complainant’s Reply to Rebuttal
The CBBB shall forward the Rebuttal to the Complainant. The Complainant may, within ten (10) business days after receipt of the Rebuttal, submit a written reply, which shall then be filed as an addendum to the Complainant’s Position. If the Complainant fails to submit a reply within the time period provided, the Position and Rebuttal shall be sent to the Panelist and the Case will move forward as prescribed in Section 4.5.
4.4.3. Respondent’s Response to Reply
If the Complainant submits a reply under Section 4.4.2, the CBBB shall forward the reply to the Respondent. The Respondent may, within ten (10) business days after receipt of the reply, submit a written response, which the CBBB shall file as an addendum to the Respondent’s Rebuttal. Upon receipt of the Respondent’s response or upon the expiration of the time period provided, the Position and Rebuttal shall be sent to the Panelist and the Case will move forward as prescribed in Section 4.5.
4.5 Hearing Procedure
One Panelist will be appointed to the Hearing by the CBBB. The Panelist will preside over the Hearing deliberations and will decide any substantive questions before him or her. The Panelist will submit a written Decision determining all issues raised by the Hearing.
4.5.1 Examination by the Panelist
The Panelist may, in his or her discretion, request additional information or comments from either or both Parties. The Party receiving the request shall, within ten (10) business days after receipt of the request, submit a written response thereto. On receipt of any such response, the CBBB shall immediately forward it to the other Party, who may submit a response within ten (10) business days after receipt.
If a Party fails to respond to the Panelist’s request for additional information, the CBBB shall issue a default notice to the Party and provide the Party ten (10) business days to respond appropriately to the request. If the Party does not respond to the default notice with the requested information, the Panelist shall proceed with consideration of the Case and will give appropriate weight to the lack of response.
4.5.2 Oral Hearing
The Panelist may, in his or her discretion, render a Decision without an oral hearing. If the Panelist determines there should be an oral hearing, the hearing date will be set with due regard for the schedule of the Parties and the Panelist, and CBBB will send all Parties a written notice fifteen (15) business days before the hearing date, setting out the date and time of the hearing, and the procedure to be followed. The hearing will be conducted by teleconference or other electronic means. If either Party has submitted Proprietary Information, the Panelist will exclude the other Party from the hearing during any discussion of the Proprietary Information.
The CBBB may observe the oral hearing, or any other part of the Hearing proceedings, in order to represent the public interest in the integrity of the program, subject to the confidentiality provisions set forth in Section 8.2.
4.5.3 Failure to Participate in an Oral Hearing
If a Party fails to participate in an oral hearing after receiving proper notice, the Panelist will inquire of the CBBB as to any known reason for the Party’s absence and will decide, in his or her discretion, whether to reschedule the oral hearing or to proceed with the oral hearing and receive evidence and testimony from the other Party.
4.5.4 Late Filings
If a Party submits requested information after the specified time limits, the untimely document shall not be submitted to the Panelist unless the CBBB grants an extension for good cause.
4.6 Hearing Decision
4.6.1 Issuance of a Decision
The Panelist shall endeavor to forward a written Decision to the CBBB within thirty (30) business days after completion of the Hearing Procedure. The Decision shall include the Panelist’s findings along with a statement of whether corrective action is necessary and a time frame for such action. The CBBB shall promptly send the Decision to the Parties.
4.6.2 Respondent’s Statement Regarding Corrective Action
When corrective action is recommended by the Decision, the Respondent must, within fifteen (15) days of its receipt of the Decision, submit a statement indicating whether and how it will comply with the Decision and implement the recommended corrective action within the time frame provided.
4.6.3 Decision Impossible to Implement
If either Party believes that a Decision requiring corrective action cannot be implemented within the specified time frame or at all, that Party should immediately inform the CBBB in writing. The Panelist may request additional evidence, request another hearing, or do anything the Panelist deems appropriate to confirm or deny the claim of impossibility of implementation. If the Panelist confirms such impossibility, the original Decision may be amended to alter the specified time frame or to order any other remedy within the scope of the Procedure Rules.
4.6.4 Noncompliance with a Decision
If the Decision recommends corrective action and the Respondent fails to indicate within the time period specified in Section 4.6.2, either that it intends to implement the recommended corrective action, or that the corrective action is impossible to implement pursuant to section 4.6.3, the CBBB shall issue a Notice of Intent, advising the Respondent that the Case will be referred to the appropriate government agency unless the CBBB is notified, within five (5) business days of the Respondent’s receipt of the notice, of the Respondent’s intent to take the corrective action.
If the Respondent does not submit a timely response with respect to the required corrective action, the CBBB shall refer the matter to the appropriate government agency pursuant to Section 8.8. The CBBB shall make the Decision public, and the Respondent’s failure to agree to take corrective action and the government referral shall be noted in the next Procedure report.
Part 5: Verification of Performance of a Settlement or Decision
If a Settlement requiring corrective action is reached or a Respondent agrees to take corrective action recommended by a Decision, Respondent shall, within thirty (30) business days after the specified time for performance, certify to the CBBB that the corrective action required by the Settlement or Decision has been implemented The CBBB may ask for additional information to substantiate this certification. If the CBBB determines that the corrective action has not been implemented as required, it shall refer the file to the appropriate government agency pursuant to Section 8.8 and shall report its determination of noncompliance in the next Procedure report.
Part 6: Closing a Case
The Procedure shall close a Case when:
- The CBBB determines that a Complaint is not eligible;
- The CBBB determines additional information is needed to sustain the Complaint and that information is not timely received by the CBBB pursuant to Section 2.4(b);
- The Complainant withdraws his or her Complaint;
- The Parties have reached a Settlement that requires corrective action and the CBBB has determined that the corrective action has been taken;
- The Parties have reached a Settlement that does not require corrective action;
- The Panelist has issued a Decision that does not recommend corrective action;
- The Panelist has issued a Decision that recommends corrective action, the Respondent has agreed to implement the corrective action, and the CBBB has determined that the corrective action has been implemented;
- The CBBB has referred the matter to a government agency pursuant to Section 8.8;
- The CBBB refuses to proceed with the Case because of a Party’s failure to abide by its agreement under Section 8.4 to hold information in confidence;
- The CBBB refuses to proceed with the Case because of a Party’s failure to abide by its agreement under Section 4.3.1 regarding communication with the Panelist; or
- The CBBB refuses to proceed with the Case because of the conduct of a Party.
Part 7: Reporting of Procedure Activity and Publication of Decisions
The CBBB shall publish Procedure Reports annually when there is relevant data to report. Reports will not be published when CBBB has received no Complaints. These Reports, to be published online at www.bbb.org, shall:
- Provide a statistical summary of the number and nature of contacts from the public and the actions taken by the CBBB and Panelist with respect to those contacts. This statistical summary shall be comprised of aggregated data and shall not contain any Party-specific data.
- Provide a statistical summary of the number and nature of Complaints deemed ineligible for processing during the period, including the specific reason for a determination of ineligibility. This statistical summary shall be comprised of aggregated data and shall not contain any Party-specific data.
- For each Case which the CBBB refers to the appropriate government agency pursuant to Section 8.8, provide a summary report (including the Respondent’s name) of the nature of the Case and the Procedure action in the matter.
Panelist Decisions required to be published pursuant to Section 4.6.4 shall also be published online at www.bbb.org.
Part 8: General Provisions
8.1 Parties’ Waiver of Subpoena Rights and Liability Claims
By participating in the Procedure, the Parties agree that they will not subpoena any of the following in any legal proceeding arising out of the matters at issue in the Procedure: CBBB or CBBB staff; Board members; committee members; volunteers; independent contractors; Panelists; or any records of the Procedure.
The Parties also agree that the following shall not be liable for any act or omission in connection with the Procedure: CBBB or CBBB staff; Board members; committee members; volunteers; independent contractors utilized by CBBB; or Panelists.
8.2 Confidentiality of Procedure Files
All deliberations, meetings, proceedings and writings of the Procedure other than the Settlement Agreement or the Decision shall be sealed from public access and shall be treated as confidential by the CBBB. The Settlement Agreement or Decision shall be the only permanent record required to be kept as to the basis of a Complaint, the issues defined, the facts and information presented, and the agreement reached by the parties or the conclusions reached by the Panelist.
8.3 Retention of Procedure Files
CBBB shall destroy all materials in a Procedure file, except the Settlement Agreement or the Decision and any Proprietary Information submitted to CBBB or to a Panelist, after the Procedure has been concluded and the Case has been closed. Proprietary Information shall be returned to the submitting Party when the Case is closed.
8.4 Parties’ Treatment of Information Received During the Procedure
The Parties agree that during the course of the Procedure they will treat any information provided to them by the CBBB as information provided exclusively for the purpose of furthering the Procedure, and that they will not disseminate such information to anyone other than those persons directly involved in the handling of the Case. If a Party violates this agreement, the CBBB may refuse to continue processing the Complaint. The purpose of this protection is to maintain a professional, unbiased atmosphere to facilitate a timely and lasting resolution to a Case. If the Party violating the agreement is a Respondent, the CBBB may refer the matter to the appropriate government agency.
8.5 When Information May Be Treated as Proprietary
A Complainant or Respondent may submit information to the CBBB with the request that such information be treated as Proprietary Information and not made available to the other Party. A Party seeking such treatment must: (a) identify in its submission which materials include Proprietary Information; and (b) affirm that the information for which proprietary status is claimed is not publicly available.
If the CBBB does not agree that the information so identified should be treated as Proprietary Information, it shall immediately return the information to the submitting Party and inform the Party that the information will not be considered.
The CBBB shall promptly return any Proprietary Information to the submitting Party upon closing the case, and neither CBBB nor the Panelist shall make the information public in any report issued by the Procedure or otherwise.
8.6 Providing a Non-Confidential Summary of Proprietary Information
When a Party submits material with a request that it be treated as Proprietary Information, that Party must also submit a summary of such material that does not reveal any Proprietary Information but provides sufficient information about the material to allow the other Party to respond to it. Failure to provide an acceptable summary for this purpose will result in the information not being considered. The CBBB shall be the sole judge of the acceptability of a summary offered by a Party.
8.7 Transmittal of Documents
Any document that must be provided to a Party, the CBBB or the Panelist, shall be sent either (a) via overnight delivery or, in the case of overseas Parties, by express courier; or (b) electronically (via facsimile or electronic mail). Documents provided to any Party shall be addressed to the contact designated by that Party for purposes of the Procedure.
8.8 Referrals to Government Agencies
The CBBB, in its discretion, may refer matters to suitable government agencies if:
- The Respondent states that it is not willing to participate in the Procedure in response to a Case;
- The CBBB determines that the Respondent has not taken corrective action required by a Settlement;
- The Respondent fails to file a Rebuttal after receiving a default notice under Section 4.4.1;
- The Respondent does not agree to take corrective action required by a Decision; or
- The CBBB determines that the Respondent has not taken corrective action required by a Decision.
Before referring any matter to the appropriate government agency, the CBBB must first notify Respondent of the intended referral and give Respondent a reasonable opportunity of at least ten (10) business days to cure any failure leading to the referral.
Reports of referrals to government agencies shall be included in the Procedure report and may be included in other publications.
All proceedings will be conducted primarily in English. CBBB shall furnish translation and interpretation services as needed. Decisions and Statistical Reports will be published in English.