Data Privacy Framework Services - For Consumers (original) (raw)

DPF Services Dispute Resolution Process

Welcome to the BBB National Programs consumer complaint system. BBB National Programs, a non-profit organization based in the United States, helps individual consumers resolve privacy complaints under the Data Privacy Framework (DPF) Program.

If you are an individual in the European Union, the United Kingdom, Switzerland, or other participating countries with a privacy complaint against a participating U.S. business, you may submit the complaint to our program. Our process is free of charge for individual consumers.

About the Process

We help you understand your redress options to ensure business accountability.
Our no-cost online process provides prompt, thorough handling of privacy inquiries and complaints.
Our long-established independent non-profit organization ensures consumer complaints are heard and addressed.
Procedures are detailed in our Rules and casework is published in our annual Procedure Reports.

How to File a Complaint

Step 1: Contact the business at the address listed in its privacy policy.

Step 2: Await a reply. The business must respond within 45 days.

Step 3: File your complaint with BBB National Programs.

Step 4: Engage in our dispute resolution process as we work to resolve your complaint with the business.

Step 5: If issues remain, you may have additional redress options.

BBB National Programs will review all eligible complaints and help you and the participating business reach a resolution as described in our program’s Rules. A Participating Business must comply with BBB National Programs' final determination of any dispute. However, our process is non-binding on the consumer, which means that using our dispute resolution process will not affect your legal rights as an individual.

Is your complaint eligible for resolution?

Your complaint must concern personal data about you that was collected in a covered country and received in the United States by a Participating Business.

1. Eligible individual.
Your complaint concerns personal data about you (or your child under 13 years old).

2. Covered country.
Your personal data was collected in one of the following countries:

European Union: Austria, Belgium, Bulgaria, Croatia, Cyprus Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden
European Economic Area: Iceland, Liechtenstein, Norway
The United Kingdom
Switzerland

3. Participating business.
Your personal data was received in the United States by a U.S. organization that is both:

Self-certified under the Data Privacy Framework Program, and
A Participating Business with BBB National Programs (you may search our list of current participants when you file your complaint).

4. Complaint or inquiry.
Your complaint must allege a violation of the Data Privacy Framework Principles by the Participating Business or assert your rights under the Principles in relation to your personal data.

Please reach out to the U.S. business via the contact information listed on its privacy policy before filing your complaint with BBB National Programs. The business has 45 days to respond to your inquiry.

Frequently Asked Questions (FAQs)

Privacy Shield was recently replaced by the Data Privacy Framework Program, a mechanism for legally transferring personal data from the European Union, the United Kingdom (and Gibraltar), Switzerland, or other participating countries to the United States. Designed by the U.S. Department of Commerce to support transatlantic commerce in coordination with the European Commission, these mechanisms promote greater transparency around international data processing and enable U.S. businesses to demonstrate that their privacy practices meet data protection requirements such as GDPR, including enhanced protections for consumers. Privacy Shield was officially replaced by the Data Privacy Framework Program in July 2023.

Among other requirements, a participating organization must provide you:

Information on the types of personal data collected;
Information on the purposes of collection and use;
Information on the type or identity of third parties to which your personal data is disclosed;
Choices for limiting use and disclosure of your personal data;
Access to your personal data;
Notification of the organization’s liability if it transfers your personal data;
Notification of the requirement to disclose your personal data in response to lawful requests by public authorities;
Reasonable and appropriate security for your personal data;
A response to your complaint within 45 days;
Cost-free independent dispute resolution to address your data protection concerns; and
The ability to invoke binding arbitration to address any complaint that the organization has violated its obligations under the Principles to you and that has not been resolved by other means.

For more than 20 years, BBB National Programs, a non-profit organization based in the United States, has operated an approved independent dispute resolution mechanism. We help EU, UK, and Swiss individuals resolve privacy complaints under the Data Privacy Framework Program, and previously under Privacy Shield.

You can learn more about the steps to file a complaint by visiting this page: For Consumers.

Principles & Procedures

When a U.S. business joins the Data Privacy Framework Program, it makes a public commitment that its processing of European Union, United Kingdom, and Switzerland, or other participating countries', personal data will meet the data protection standards embodied in the Principles.

A business that chooses BBB National Programs as its IRM agrees to follow our Procedure Rules when responding to privacy complaints, and to keep the same promise to the individuals who make use of our dispute resolution service.

Resources for Consumers