L 231/210
EN
Official Journal of the European Union
20.9.2023
II.
Referral Prioritization and Investigations As we did under the U.S.-EU Safe Harbor Framework and the EU-U.S. Privacy Shield Framework, the FTC commits to give priority consideration to EU-U.S. DPF Principles referrals from the Department of Commerce and EU Member States.
We will also prioritize consideration of referrals for non-compliance with the EU-U.S. DPF Principles from privacy selfregulatory organizations and other independent dispute resolution bodies.
To facilitate referrals under the EU-U.S. DPF from EU Member States, the FTC has created a standardized referral process and has provided guidance to EU Member States on the type of information that would best assist the FTC in its inquiry into a referral.
As part of this effort, the FTC has designated an agency point of contact for EU Member State referrals.
It is most useful when the referring authority has conducted a preliminary inquiry into the alleged violation and can cooperate with the FTC in an investigation.
Upon receipt of such a referral from the Department of Commerce, an EU Member State, or self-regulatory organization or other independent dispute resolution bodies the FTC can take a range of actions to address the issues raised.
For example, we may review the organization’s privacy policies, obtain further information directly from the organization or from third parties, follow up with the referring entity, assess whether there is a pattern of violations or significant number of consumers affected, determine whether the referral implicates issues within the purview of the Department of Commerce, assess whether additional efforts to put market participants on notice would be helpful, and, as appropriate, initiate an enforcement proceeding.
In addition to prioritizing EU-U.S. DPF Principles referrals from the Department of Commerce, EU Member States, and privacy self-regulatory organizations or other independent dispute resolution bodies, (13) the FTC will continue to investigate significant EU-U.S. DPF Principles violations on its own initiative where appropriate, using a range of tools.
As part of the FTC’s program of investigating privacy and security issues involving commercial organizations, the agency has routinely examined whether the entity at issue was making EU-U.S. Privacy Shield representations.
If the entity made such representations and the investigation revealed apparent violations of the EU-U.S. Privacy Shield Principles, the FTC included allegations of EU-U.S. Privacy Shield violations in its enforcement actions.
We will continue this proactive approach, now with respect to the EU-U.S. DPF Principles.
III.
Seeking and Monitoring Orders The FTC also affirms its commitment to seek and monitor enforcement orders to ensure compliance with the EU-U.S. DPF Principles.
We will require compliance with the EU-U.S. DPF Principles through a variety of appropriate injunctive provisions in future FTC EU-U.S. DPF Principles orders.
Violations of the FTC’s administrative orders can lead to civil penalties of up to $50,120 per violation, or $50,120 per day for a continuing violation, (14) which, in the case of practices affecting many consumers, can amount to millions of dollars.
Each consent order also has reporting and compliance provisions.
The entities under order must retain documents demonstrating their compliance for a specified number of years.
The orders must also be disseminated to employees responsible for ensuring order compliance.
The FTC systematically monitors compliance with existing EU-U.S. Privacy Shield Principles orders, as it does with all of its orders, and brings actions to enforce them when necessary.
(15) Importantly, FTC orders will continue to protect all consumers worldwide who interact with a business, not just those consumers who have lodged complaints.
Finally, the FTC will maintain an online list of companies subject to orders obtained in connection with enforcement of the EU-U.S. DPF Principles.
(16) (13) Although the FTC does not resolve or mediate individual consumer complaints, the FTC affirms that it will prioritize EU-U.S. DPF Principles referrals from EU DPAs.
In addition, the FTC uses complaints in its Consumer Sentinel database, which is accessible by many other law enforcement agencies, to identify trends, determine enforcement priorities, and identify potential investigative targets.
EU individuals can use the same complaint system available to U.S. consumers to submit a complaint to the FTC at https://reportfraud.
ftc.gov/.
For individual EU-U.S. DPF Principles complaints, however, it may be most useful for EU individuals to submit complaints to their Member State DPA or independent dispute resolution body.
(14) 15 U.S.C. § 45(m); 16 C.F.R. § 1.98.
This amount is periodically adjusted for inflation.
(15) Last year the FTC voted to streamline the process for investigating repeat offenders.
See Press Release, Fed.
Trade Comm’n, FTC Authorizes Investigations into Key Enforcement Priorities (Jul.
1, 2021), https://www.ftc.gov/news-events/news/press-releases/2021/ 07/ftc-authorizes-investigations-key-enforcement-priorities.
(16) Cf.
FTC, Privacy Shield, https://www.ftc.gov/business-guidance/privacy-security/privacy-shield.