Privacy & Cybersecurity Law Blog

On February 20, 2017, the Article 29 Working Party (“Working Party”) issued a template complaint form and Rules of Procedure that clarify the role of the EU Data Protection Authorities (“DPAs”) in resolving EU-U.S. Privacy Shield-related (“Privacy Shield”) complaints.

The Working Party’s template complaint form indicates that it is intended for use by EU individuals who wish to have their commercial-related complaints associated with Privacy Shield-certified organizations resolved by their national DPAs. Individuals are not required to use the form to submit a complaint to their DPA, but the form indicates that the information requested in the form is necessary to facilitate the handling of individuals’ complaints. The form asks for relevant information about the complaint, such as which companies may be involved in processing the individual’s personal data, the reasons why the data has been transferred, the alleged violation and what relief is being sought. Importantly, the form advises individuals that “in most cases, it would be advisable that you first contact the U.S. Privacy Shield-certified company to attempt to resolve your case.” Once the DPA receives the complaint, it is the DPA’s responsibility to determine whether a DPA panel would be the “competent body” to resolve the complaint. A DPA panel is the competent body only if the complaint is related to a Privacy Shield-certified organization that has committed to cooperate with the DPA panel or that processes human resources data collected in the context of an employment relationship. Otherwise, the complaint may be forwarded to another competent body, such as the U.S. Department of Commerce or the FTC.

The Rules of Procedure clarify the roles of the DPA panel and lead DPA in resolving individuals’ complaints. The Rules of Procedure indicate that upon a DPA receiving a relevant complaint or referral, a DPA panel will be formed (only if competent to resolve the complaint, as described above) in a “timely manner” and “in principle, be confirmed within two weeks’ time from the receipt of the initial complaint/referral.” Each DPA panel will consist of a lead DPA and at least two co-reviewer DPAs. The lead DPA typically will be the DPA that received the complaint. Additional co-reviewer DPAs may be added in “appropriate circumstances...if more than two DPAs are interested in participating in the panel and can put forward a specific interest.” Where fewer than two DPAs indicate an interest in acting as a co-reviewer, the lead DPA has the power to appoint two co-reviewers and should take into account such factors as (1) where the company’s EU headquarters or significant subsidiaries are located, (2) where in the EU the relevant data processing is facilitated, (3) the place in the EU from which most of the data transfers take place, (4) the place where a large number of EU individuals are likely to be affected by the alleged violation and (5) available resources.

The Rules of Procedure also specify additional roles of the lead DPA, such as (1) informing all Working Party members about which DPAs are participating in the panel, (2) informing the company of the substance of the complaint, (3) offering both sides in the dispute a reasonable opportunity to comment and provide any evidence they wish on the matter within a reasonable timeframe, (4) drafting a binding advice opinion that includes remedies, where appropriate, and (5) considering DPA co-reviewers’ advice and attempting to reach a consensus on the advice. If the lead DPA and co-reviewer DPAs cannot reach a consensus on the advice, the lead DPA may request that the Working Party Chair mediate a solution or, as a last resort, a simple majority vote may be used to determine the advice. According to the Rules of Procedure, the DPA panel will “seek to deliver advice as quickly as the requirement for due process allows [and] [a]s a general rule, the panel will aim to provide advice within 60 days after receiving a complaint...and more quickly where possible. However, advice will be issued only after both sides in a dispute have had a reasonable opportunity to comment and to provide any evidence they wish.”

Importantly, if the company fails to comply with the DPA panel’s advice within 25 days after receipt, the lead DPA is required to (1) give notice of the panel’s intention to refer the matter to the FTC or other U.S. Federal or state body with statutory powers to take enforcement action in cases of deception or misrepresentation, or (2) conclude that the company’s agreement to cooperate with the DPA panel has been seriously breached and must therefore be considered null and void, and inform the Department of Commerce so that the Privacy Shield list can be duly amended.