Dispute Resolution Process

Many companies have to provide an internal and external dispute resolution process for individuals who think that their data are not collected, processed or used in compliance with the applicable privacy principles.

Internal dispute resolution

The individual first submits his or her complaint in the internal dispute resolution procedure. It includes an investigation based on the individual’s complaint and the evaluation of whether the company has collected, processed or used personal data of the individual without complying with one or more of the EU-US Privacy Shield Privacy Principles. The investigation as well as the evaluation is conducted by an internal working group or department of the company. The company must provide a summary of the results to the complainant.

External dispute resolution

Only if this procedure fails, the individual may use the external dispute resolution procedure. In this case 2B Advice will investigate and evaluate the facts based on the complaint filed by the individual. 2B Advice will take into account the facts the individual has provided as well as the facts the company has provided. The company has agreed to cooperate with 2B Advice in the course of such an investigation and to provide all necessary information for the dispute resolution process. The investigation and evaluation will be conducted by experienced data protection experts of 2B Advice.

Contact details for the internal and external dispute resolution

Companies which have certified under the EU-US Privacy Shield program have to provide a publicly available Privacy Statement, preferably on their Website. The Privacy Statement must include contact details for the internal and the external dispute resolution process. If you want to file a complaint in the internal dispute resolution procedure, you will find the necessary contact information in the Privacy Statement. The U.S. Department of Commerce maintains on its EU-US Privacy Shield website: www.privacyshield.gov a public list of those companies that have certified their compliance with the EU-US Privacy Shield Framework. A company’s EU-US Privacy Shield certification record includes contact details relevant to the internal dispute resolution process and identifies the external dispute resolution provider(s).