ANA DPF Dispute Resolution — Business Services | ANA
Log in Search

ANA DPF Dispute Resolution logo

Business Services

For global marketing companies and service providers that transfer personal data from the European Union (EU), United Kingdom (U.K.) and Gibraltar, or Switzerland to the United States, you can choose ANA to serve as your approved mediator and compliance provider for such international data transfers. The ANA DPF Dispute Resolution offers the safeguards and protection to handle potential unresolved data privacy complaints.

Companies participating in the Data Privacy Framework (DPF) Program as administered by the U.S. Department of Commerce's International Trade Administration (ITA) are required to adhere to core data privacy principles established by the DPF program. This includes the requirement that the company select an independent, third-party dispute resolution services provider like ANA to serve as a mediator should the need arise.

As a government-approved mediator, the ANA DPF Dispute Resolution is available to all ANA members as a value-added, free member benefit. Nonmembers can also select the ANA DPF Dispute Resolution for an applicable fee. Prices depend on a company's annual revenue.

Apply for ANA DPF Dispute Resolution

 

DPF Program Overview

In this webinar, get a tour through the new Data Privacy Framework (DPF) and learn how the ANA can help.

The Data Privacy Framework (DPF) program, which is administered by the U.S. Department of Commerce’s International Trade Administration (ITA), provides a set of robust and enforceable protections for the transfer of personal data of individuals from the EU, U.K. (and Gibraltar), and Switzerland to the United States. The DPF program provides transparency regarding how participating companies use personal data, strong U.S. government oversight, and increased cooperation with data protection authorities and regulators in EU, U.K. and Gibraltar, and Switzerland. The DPF program offers EU, U.K. and Gibraltar, and Swiss individuals’ access to multiple avenues to address any concerns regarding participating companies' compliance with the DPF Principles, including access to free dispute resolution such as that provided by the ANA DPF Dispute Resolution.

It is important to note that the ANA DPF Dispute Resolution does not cover issues relating to the transfer of human resources data under the DPF program. For transfers of such data under the DPF program, participating companies must agree to cooperate with and comply with the advice of the applicable European data protection authority/ies (i.e., the EU data protection authorities (EU DPAs), U.K. Information Commissioner's Office (ICO) and the Gibraltar Regulatory Authority (GRA), and/or the Swiss Federal Data Protection and Information Commissioner (FDPIC) would serve as the independent resource mechanism for this type of data. The ANA DPF Dispute Resolution covers all other types of data with the exception of human resources data.

Joining the DPF program administered by the U.S. Department of Commerce’s ITA is voluntary. Once an eligible company makes the public commitment to comply with the DPF program’s requirements, the commitment will become enforceable under U.S. law. Please review your data flows and privacy practices with your legal counsel to ensure that your program is meeting the DPF program requirements. The information provided by ANA is for your background only and should not be relied upon as legal advice for your company.

 

DPF Principles

For your company to be compliant with the DPF program, you must abide by and incorporate certain principles into your privacy policy and corporate practices. By adhering to the core principles of notice; choice; security; accountability for onward transfer; data integrity and purpose limitation; access; and recourse, enforcement and liability, as well as the supplemental principles (collectively, the DPF Principles), your company is indicating that you place great value on data privacy protection and will make every effort to respect EU, U.K. and Swiss individuals' requests regarding use of their personal information. These principles pertain to the personal information that your company transfers from the EU, U.K., Gibraltar, and/or Switzerland to the United States. You can visit the U.S. Department of Commerce's ITA to learn more about the DPF program or contact the ITA's DPF Team at https://www.dataprivacyframework.gov/s/assistance.

 

ANA DPF Dispute Resolution

ANA will:

  • Serve as your third-party dispute and enforcement mechanism. EU, U.K. and Gibraltar, and/or Swiss residents, companies and governments can be assured that your company will adhere to the third-party dispute and enforcement requirements of the DPF program. This will solidify EU, U.K. and Gibraltar, and Swiss individual's trust and confidence in your organization.
  • Provide companies with guidance on developing a privacy policy that is based on the DPF Principles. By adhering to these core principles, your company is indicating that you place great value on data privacy protection and will make every effort to respect EU, U.K. and Gibraltar, and Swiss individual's requests regarding use of their personal information.
  • Provide participating companies with regular updates on matters impacting global marketing companies.
  • Provide the ANA DPF Dispute Resolution mark. This mark will provide consumers with an easily recognizable symbol that signifies and distinguishes your organization as being in compliance with the relevant dispute resolution requirements of the DPF program.

ANA stands ready to assist your company in:

  • Meeting the ITA's registration requirements for the DPF program,
  • Serving as your independent third-party dispute resolution mechanism, and
  • Addressing questions or concerns your company has regarding the DPF program.

 

ANA's Complaint Handling Process: Fair, Responsive, Accessible

The DPF program requires that the independent mediator be readily available to consumers and free-of-charge to EU, U.K. and Gibraltar, and Swiss individuals, and be able to ensure compliance with the DPF program's privacy protections. ANA has never charged consumers for this service, and it will remain free to EU, U.K. and Gibraltar, and Swiss consumers. The ANA DPF Dispute Resolution adheres to the belief that an independent dispute resolution mechanism should:

  • provide a fair and unbiased redress of the consumer’s concerns;
  • be visible so that consumers with concerns know where to turn for resolution of their problem;
  • be accessible so that there are no barriers to the filing of a complaint, whether they be financial or otherwise;
  • provide resolution in a timely manner;
  • provide finality for the consumer by reaching an independent determination of the dispute in a fair and timely manner; and
  • provide enforceability of the final conclusions in the determination of the consumer’s dispute.

To provide a mechanism that is fair, ANA has an Ethics Review Committee that is comprised of respected experts from the data and marketing industry. The Committee hears both sides of a dispute and provides a final determination. When businesses join the ANA DPF Dispute Resolution, they are required to sign a contract; whereby, they agree to abide by the decisions of the Committee. The contract specifies that the Committee has the authority to issue certain sanctions as a result of its decision. The sanctions available to the Committee include, but are not limited to:

  • Correction of actions found not to be in compliance with the DPF Principles.
  • Correction or deletion of inaccurate personal information.
  • Requiring company reimbursement of actual, direct monetary damages incurred by the consumer.
  • Removal from the ANA DPF Dispute Resolution and revocation of the company's ability to display the ANA DPF Dispute Resolution Mark.
  • Public notification of the decision and action taken by the Committee.
  • Notification to the U.S. Department of Commerce's ITA of the Committee's decision and a request for removal from the Data Privacy Framework List due to failure to comply with the appropriate Privacy Principles.
  • Referral of the matter to the Federal Trade Commission or other appropriate governmental agency for enforcement action.

The linchpin to any dispute resolution mechanism is that it be impartial. One way to assure impartiality is to assure openness of the results of the program by publishing an annual report regarding the types of complaints processed during the reporting period, and for ANA staff to be constantly vigilant that the results are fair and legal. To assure accessibility, there will be no cost to the consumer, and businesses will be required to notify consumers of the availability of the ANA DPF Dispute Resolution in an open and conspicuous manner and prominently display the ANA DPF Dispute Resolution Mark. The ANA DPF Dispute Resolution will provide consumers with an easy method to bring their disputes before the Committee. It is the goal of the ANA DPF Dispute Resolution to obtain a determination of all cases in a quick and timely manner, but in no case longer than 60 days.

Complaint Procedures

  1. When a complaint is received, staff will verify that the complaint involves matters over which the ANA DPF Dispute Resolution has jurisdiction.
  2. Staff will verify that the business' in-house complaint handling system has had a reasonable opportunity to address the EU, U.K. or Gibraltar, and/or Swiss's individual's complaint.
  3. Staff will contact the business requesting that the complaint be reviewed and that a response be provided within 10 days.
  4. Staff will provide the company response to the complainant and after checking with the complainant, if the complaint has been resolved, the matter will be closed out.
  5. If the matter is still in dispute, the complaint (all written materials from both the consumer and the business) will be presented to the Committee for a determination (Initial Decision) on the matter. The meeting will take place virtually, unless the Committee decides that another meeting format is more appropriate.
  6. The Committee can either find no violation of the appropriate DPF Principles and close out the case or find that a violation(s) of the DPF Principles has occurred and set a remedy that the Committee determines is appropriate.
  7. The business and the consumer will be notified by letter or email of the Initial Decision of the Committee. Within ten (10) days of their notification, either the consumer or the business can request a Further Consideration Hearing before the Committee. The request must state the reason(s) why the Further Consideration Hearing is being requested. If no request by either party has been made within 10 days, then the Initial Decision automatically becomes the Final Decision. The case will be followed-up by staff to verify adherence to the remedies stated in the Committee's decision.
  8. If the matter is appealed within 10 days by either party, the Committee will meet virtually for a Further Consideration Hearing. Both the consumer and the business may submit further informational materials for the Committee's consideration, and both may take part in the virtual Further Consideration Hearing.
  9. After the Hearing, a Final Decision on the case will be made by the Committee. The consumer and the business will be notified by email or letter of the Committee's Final Decision. Staff will provide any necessary follow-up to verify adherence to the Committee's Final Decision.
  10. The cost of the virtual meeting will be the responsibility of the ANA.

To view the latest compliance information regarding the former ANA Privacy Shield Program, download the 2023 ANA Privacy Shield Report.

For EU, U.K. and Gibraltar, and Swiss individuals who would like to file a complaint under the ANA DPF Dispute Resolution, visit our consumer complaint handling site.