Operation of DPA Panels
  • i.    The cooperation of the DPAs will be provided in the form of information and advice in the following way:
  • 1.    The advice of the DPAs will be delivered through an informal panel of DPAs established at the European Union level, which will inter alia help ensure a harmonized and coherent approach.
  • 2.    The panel will provide advice to the U.S. organizations concerned on unresolved complaints from individuals about the handling of personal information that has been transferred from the EU under the Privacy Shield.  This advice will be designed to ensure that the Privacy Shield Principles are being correctly applied and will include any remedies for the individual(s) concerned that the DPAs consider appropriate.
  • 3.    The panel will provide such advice in response to referrals from the organizations concerned and/or to complaints received directly from individuals against organizations which have committed to cooperate with DPAs for Privacy Shield purposes, while encouraging and if necessary helping such individuals in the first instance to use the in-house complaint handling arrangements that the organization may offer.
  • 4.    Advice will be issued only after both sides in a dispute have had a reasonable opportunity to comment and to provide any evidence they wish.  The panel will seek to deliver advice as quickly as this requirement for due process allows.  As a general rule, the panel will aim to provide advice within 60 days after receiving a complaint or referral and more quickly where possible.
  • 5.    The panel will make public the results of its consideration of complaints submitted to it, if it sees fit.
  • 6.    The delivery of advice through the panel will not give rise to any liability for the panel or for individual DPAs.
  • ii.    As noted above, organizations choosing this option for dispute resolution must undertake to comply with the advice of the DPAs.  If an organization fails to comply within 25 days of the delivery of the advice and has offered no satisfactory explanation for the delay, the panel will give notice of its intention either to refer the matter to the Federal Trade Commission, the Department of Transportation, or other U.S. federal or state body with statutory powers to take enforcement action in cases of deception or misrepresentation, or to conclude that the agreement to cooperate has been seriously breached and must therefore be considered null and void.  In the latter case, the panel will inform the Department of Commerce so that the Privacy Shield List can be duly amended.  Any failure to fulfill the undertaking to cooperate with the DPAs, as well as failures to comply with the Privacy Shield Principles, will be actionable as a deceptive practice under Section 5 of the FTC Act or other similar statute.