Contact the organization
  • Many of your questions or concerns can be addressed most quickly by contacting the Privacy Shield organization directly. This should be your first step. You can do this by typing the organization’s name into the search bar within the Privacy Shield List, clicking on the organization’s name, and then clicking “Questions or Complaints?” The organization must respond to you within 45 days, though most issues can be addressed more quickly.
Contact the free independent recourse mechanism
  • If your question or concern is not addressed by contacting the organization directly, you can submit a complaint to the Privacy Shield organization’s independent recourse mechanism. The contact information for the independent recourse mechanism is in the Privacy Shield organization’s privacy policy and can also be found by clicking on the same “Questions or Complaints?” tab mentioned above.
Contact your data protection authority (DPA)
  • You can always submit a complaint directly to your local DPA or the Swiss Federal Data Protection and Information Commissioner. Your DPA or the Swiss Commissioner may refer your complaint directly to the Department of Commerce on your behalf. If referred to the Department of Commerce, the Privacy Shield Team will then work with the organization to seek to resolve your concern.
Invoke binding arbitration
  • If your complaint is not resolved after following the recourse mechanisms described above, you may have the ability to invoke binding arbitration. Additional information is available here for EU individuals and here for Swiss individuals.
Contact the U.S. enforcement authority
  • Each organization’s Privacy Shield record indicates the relevant U.S. enforcement authority. In most instances, the relevant U.S. enforcement authority is the Federal Trade Commission (FTC). To submit a complaint to the FTC, click here.  The FTC uses complaints in its database, which is accessible by many other law enforcement agencies, to identify trends, determine enforcement priorities, and identify potential investigative targets.  Please note that the FTC does not resolve or mediate individual complaints, so you are encouraged to use the other complaint resolution mechanisms noted above as well. The only Privacy Shield participants not regulated by the FTC are U.S. and foreign air carriers, in which cases complaints can be submitted to the U.S. Department of Transportation (DOT) here.  The FTC and DOT share jurisdiction over ticket agents that market air transportation.