BBB EU Privacy Shield Dispute Resolution Process
The BBB EU Privacy Shield dispute resolution process helps individuals in the EU resolve privacy complaints under the EU-U.S. Privacy Shield Framework.
BBB EU Privacy Shield is an independent dispute resolution program administered by BBB National Programs, a non-profit organization based in the U.S.
If you’re in the European Union and have a Privacy Shield complaint against a participating U.S. business, submit the complaint to us. This service is free.
If your complaint is eligible, BBB will review it and help you and the participating business resolve the complaint as described in our program’s procedure rules.
A participating business must comply with BBB EU Privacy Shield’s decision. However, our process is non-binding for the consumer and will not affect your legal rights as an individual.
Is your complaint eligible for resolution by BBB EU Privacy Shield?
Your complaint must concern personal data about you, collected in a covered country and received in the United States by a participating business under Privacy Shield.
1. Eligible individual
The complaint concerns your or your child’s data if your child is under 13 years old.
2. Covered country
The data was collected in one of the following countries:
European Economic Area
3. Participating business
Your data was received in the United States by a U.S. business that is both:
a. Self-certified under the Privacy Shield Framework. Current list of self-certified businesses.
b. A BBB EU Privacy Shield participating business – you can search our list of current participants when you file your complaint.
4. Privacy Shield complaint or inquiry
Your complaint must allege a violation of the Privacy Shield principles by the participating business and assert your rights.
Reach out to the U.S. business before filing your complaint with BBB EU Privacy Shield. Under the Privacy Shield Framework, the business has 45 days to respond to your inquiry.
Frequently Asked Questions
What is the EU-U.S. Privacy Shield Framework?
The U.S. Department of Commerce and the European Commission developed the EU-U.S. Privacy Shield Framework. It enables U.S. businesses to receive and process personal data from individuals in the EU and helps U.S. businesses to comply with EU data protection requirements.
What is personal data?
Under the Privacy Shield Framework, personal data is data about an identified or identifiable individual from a covered country, received and recorded in any form by an organization in the United States.
What are my rights under Privacy Shield?
Under the Privacy Shield Framework, if your data is collected in the EU and transferred to the United States for processing, the participating U.S. business must provide you with certain information and options regarding your data.
Your rights under Privacy Shield appear on the U.S. Department of Commerce Privacy Shield website.
What is the role of BBB EU Privacy Shield?
Many businesses participating in the Privacy Shield Framework have chosen BBB EU Privacy Shield to help resolve privacy disputes that might arise with individuals in the EU whose data the participating business received in the United States.
The dispute resolution and enforcement requirements appear in Section 11 of the EU-U.S. Privacy Shield Framework.
The business agrees to participate in the dispute resolution process and abide by the final determinations, including any sanctions or corrective action.
Participating businesses may appear before the Federal Trade Commission if they fail to take corrective action.
How will BBB EU Privacy Shield help resolve my privacy complaint?
You can file a privacy complaint against a participating business using the BBB EU Privacy Shield complaint form.
The BBB EU Privacy Shield complaints process works as follows:
1. When you submit a complaint, BBB National Programs staff will verify that the complaint is eligible for resolution under our Procedure Rules and that you have provided sufficient information to proceed.
2. BBB will inquire if you have made an effort to resolve the complaint with the participating business. The business has 45 days to respond to your complaint.
3. BBB EU Privacy Shield will forward your complaint to the participating business and try to help you and the business resolve the complaint. If resolved, staff will send you and the business a settlement letter and close the case.
4. If conciliation does not resolve the dispute you will be able to seek a Data Privacy Review, a form of non-binding arbitration conducted by an independent and impartial panelist.
5. The panelist will be asked to decide the case within 10 business days of receiving the case record. They may require additional information from you or the business and request a telephone hearing.
6. If the panelist finds that a violation of the Privacy Shield Principles occurred, they may require the participating business to take corrective action.
7. The panelist’s finding is not binding on the individual complainant. It does not prevent you from seeking additional remedies available under the Privacy Shield Framework.