with the guidelines, procedures, requirements, or re-
strictions of the program. 
(b) APPROVAL BY COMMISSION.— 
(1) APPROVAL.—The Commission shall, within 
90 days after submission of an application for ap-
proval of a self-regulatory program under this sec-
tion (or of a material change in a program pre-
viously approved by the Commission), approve such 
program (or change) if the Commission finds that 
the program (or change) complies with the require-
ments of subsection (c). 
(2) FORM OF APPLICATION.—The Commission 
shall accept an application for approval under para-
graph (1) in any reasonable form the applicant may 
submit. 
(3) DURATION UNTIL RENEWAL.—A self-regu-
latory program approved by the Commission under 
paragraph (1) shall be approved for a period of 5 
years. 
(4) REVOCATION OF APPROVAL.—The Commis-
sion may, after notice and opportunity for a hearing, 
revoke approval granted under paragraph (1), if the 
Commission finds that a self-regulatory program 
fails to meet the requirements of subsection (c).
(5) JUDICIAL REVIEW.—Any order by the Com-
mission denying approval of a self-regulatory pro-
gram shall be subject to judicial review, as provided 
in section 706 of title 5, United States Code. 
(c) REQUIREMENTS
OF SELF-REGULATORY PRO-
GRAM.—A self-regulatory program complies with the re-
quirements of this subsection if the program provides each 
of the following: 
(1) Guidelines and procedures requiring a pro-
gram participant to provide substantially equivalent 
or greater protections for consumers and their per-
sonally identifiable information as are provided 
under sections 101 through 105. 
(2) Procedures and requirements to provide 
for— 
(A) an initial review of a participant’s pri-
vacy statement and privacy policy, and subse-
quent review whenever such statement or policy 
is substantively changed, to determine whether 
the participant complies with the self-regulatory 
program’s guidelines; 
(B) an initial self-review and self-certifi-
cation of a participant’s privacy policy and 
practices to ensure compliance with the guide-
lines, procedures, requirements, and restrictions
of the program established under this sub-
section; 
(C) subsequent periodic self-reviews and 
self-certifications, which shall occur at least an-
nually, of the participant’s privacy policy and 
practices to ensure continued compliance with 
such guidelines, procedures, requirements, and 
restrictions; 
(D) submission of self-reviews and self-cer-
tifications under this paragraph to any adminis-
trator of the program; and 
(E) random compliance testing of partici-
pants, which may concentrate on selected com-
pliance issues, if the self-regulatory program 
conducts— 
(i) a random compliance test with re-
spect to each participant not less fre-
quently than every 3 years; 
(ii) a full compliance test in any case 
where non-compliance with any of the se-
lected compliance issues is identified; and 
(iii) full compliance tests of partici-
pants with a high number of complaints 
against them.
(3) Procedures and requirements that ensure 
that a program participant provides a process for re-
solving disputes with consumers relating to the pri-
vacy policy and practices of the participant. Such 
dispute resolution process— 
(A) must be available without charge to a 
consumer; 
(B) must be available at a cost to the par-
ticipant that is reasonable and does not discour-
age participation by the participant in such 
process; 
(C) must ensure that consumers are in-
formed of how to utilize the process; 
(D) may include, as one choice among oth-
ers, binding arbitration; and 
(E)(i) must be completed within 60 days 
after submission of the dispute by the con-
sumer; or 
(ii) must be completed within 90 days after 
submission of the dispute by the consumer, if 
the participant— 
(I) determines that additional time is 
required to obtain information to make an 
informed decision with respect to the dis-
pute; and
(II) notifies the consumer and the 
self-regulatory program that such addi-
tional time is required. 
(4) Provisions for the use by participants in the 
program of a means (including the use of a seal) to 
represent the participant’s participation in the pro-
gram. 
(5) With respect to any nonvoluntary suspen-
sion or termination of participation in the program 
because of the participant’s failure to comply with 
the program, procedures or requirements to provide 
for the following: 
(A) Publication of notice and the reasons 
for any such suspension or termination, except 
that no personally identifiable information re-
lated to such suspension or termination may be 
published. 
(B) Notice to the Commission of any such 
termination. 
(6) Requirements and restrictions that assure 
independence with respect to program eligibility, 
compliance, and dispute resolution mechanisms and 
decisions from improper interference by management 
or ownership of the self-regulatory program partici-
pant.