BBB EU Privacy Shield Dispute Resolution Process

The BBB EU Privacy Shield dispute resolution process helps individuals in the EU resolve privacy complaints under the EU-U.S. Privacy Shield Framework. 

BBB EU Privacy Shield is an independent dispute resolution program administered by BBB National Programs, a non-profit organization based in the U.S.

If you’re in the European Union and have a Privacy Shield complaint against a participating U.S. business, submit the complaint to us. This service is free.

If your complaint is eligible, BBB will review it and help you and the participating business resolve the complaint as described in our program’s procedure rules.

A participating business must comply with BBB EU Privacy Shield’s decision. However, our process is non-binding for the consumer and will not affect your legal rights as an individual.

Is your complaint eligible for resolution by BBB EU Privacy Shield?

Your complaint must concern personal data about you, collected in a covered country and received in the United States by a participating business under Privacy Shield.

1. Eligible individual

The complaint concerns your or your child’s data if your child is under 13 years old.

2. Covered country

The data was collected in one of the following countries:

European Union

Austria 

Belgium 

Bulgaria 

Croatia 

Cyprus 

Republic 

Denmark 

Estonia 

Finland 

France 

Germany 

Greece 

Hungary 

Ireland 

Italy 

Latvia 

Lithuania 

Luxembourg 

Malta 

Netherlands 

Poland 

Portugal 

Romania 

Slovakia 

Slovenia 

Spain 

Sweden 

European Economic Area

Iceland 

Liechtenstein 

Norway 

3. Participating business

Your data was received in the United States by a U.S. business that is both:

a. Self-certified under the Privacy Shield Framework. Current list of self-certified businesses.

b. A BBB EU Privacy Shield participating business – you can search our list of current participants when you file your complaint.

4. Privacy Shield complaint or inquiry

Your complaint must allege a violation of the Privacy Shield principles by the participating business and assert your rights.

Reach out to the U.S. business before filing your complaint with BBB EU Privacy Shield. Under the Privacy Shield Framework, the business has 45 days to respond to your inquiry.

Frequently Asked Questions

What is the EU-U.S. Privacy Shield Framework?

The U.S. Department of Commerce and the European Commission developed the EU-U.S. Privacy Shield Framework. It enables U.S. businesses to receive and process personal data from individuals in the EU and helps U.S. businesses to comply with EU data protection requirements.

What is personal data?

Under the Privacy Shield Framework, personal data is data about an identified or identifiable individual from a covered country, received and recorded in any form by an organization in the United States.

What are my rights under Privacy Shield?

Under the Privacy Shield Framework, if your data is collected in the EU and transferred to the United States for processing, the participating U.S. business must provide you with certain information and options regarding your data.

Your rights under Privacy Shield appear on the U.S. Department of Commerce Privacy Shield website.

What is the role of BBB EU Privacy Shield?

Many businesses participating in the Privacy Shield Framework have chosen BBB EU Privacy Shield to help resolve privacy disputes that might arise with individuals in the EU whose data the participating business received in the United States. 

The dispute resolution and enforcement requirements appear in Section 11 of the EU-U.S. Privacy Shield Framework.

The BBB EU Privacy Shield service is free to individuals in the EU and is accessible through a link in the privacy policy of each participating business.

The business agrees to participate in the dispute resolution process and abide by the final determinations, including any sanctions or corrective action.

Participating businesses may appear before the Federal Trade Commission if they fail to take corrective action.

How will BBB EU Privacy Shield help resolve my privacy complaint?

You can file a privacy complaint against a participating business using the BBB EU Privacy Shield complaint form.

The BBB EU Privacy Shield complaints process works as follows:

1. When you submit a complaint, BBB National Programs staff will verify that the complaint is eligible for resolution under our Procedure Rules and that you have provided sufficient information to proceed.

2. BBB will inquire if you have made an effort to resolve the complaint with the participating business. The business has 45 days to respond to your complaint.

3. BBB EU Privacy Shield will forward your complaint to the participating business and try to help you and the business resolve the complaint. If resolved, staff will send you and the business a settlement letter and close the case.

4. If conciliation does not resolve the dispute you will be able to seek a Data Privacy Review, a form of non-binding arbitration conducted by an independent and impartial panelist.

5. The panelist will be asked to decide the case within 10 business days of receiving the case record. They may require additional information from you or the business and request a telephone hearing.

6. If the panelist finds that a violation of the Privacy Shield Principles occurred, they may require the participating business to take corrective action.

7. The panelist’s finding is not binding on the individual complainant. It does not prevent you from seeking additional remedies available under the Privacy Shield Framework.