ARTICLE 29 DATA PROTECTION WORKING PARTY

Alternatively, complaints could be directly made with the Federal Trade Commission, even if
there is no duty for the FTC to deal with them. A DPA could also refer a complaint and the
DoC has committed to review and undertake best efforts to facilitate resolution of complaints
(Annex I) which will be given ‘priority consideration’ by the Federal Trade Commission
(Annex II, III.7.e). However, the prioritisation of complaints by the FTC does not give any
certainty to the data subject that its complaints will be dealt with.
As a last resort, individuals will have the possibility to invoke binding arbitration. The
arbitration panel will be based in the U.S. and will be subject to review by U.S. Courts.
The Privacy Shield also offers the possibility for the organisation to choose cooperation with
EU DPAs (Annex II, III.5.a). This is even mandatory for human resources data collected in
the context of an employment relationship (Annex II, III.9.d.ii). In such a scenario, alternative
dispute resolution (ADR) will not be applicable (Annex II, III.5.a). The Privacy Shield does
not clearly establish how the cooperation with EU DPAs will be organised in practice. In
particular, it is unclear whether the panel will deal with all cases or if each different case will
be dealt with by a different panel.
The WP29 considers that more detail is required in the adequacy decision where the
competence of DPAs to deal with complaints is concerned. This apparently depends on the
qualification of the organisation, but it is unclear in what way.
Where the organisation is acting as an Agent on behalf of an EU controller, individuals will in
any case have the possibility to complain to the competent EU DPA. The situation will be
similar for both human resources and other commercial data processing.
Where the Privacy Shield organisation is acting as a data controller, the competence of a DPA
to deal with the complaint will be restricted to processing subject to EU law (processing under
responsibility of EU controller – including joint controllership with US organisation – or
where the Privacy Shield organisation would be directly subject to EU law, for example by
using of equipment in EU). However, for data processing carried out only under U.S. law, the
Privacy Shield mechanisms will apply exclusively. In order to overcome language barriers
and lack of knowledge of the U.S. legal system, it could be helpful if EU DPAs are entitled to
act as an intermediary for the individual’s complaint or to assist him/her in ADR proceedings
with U.S. organisations or during their contacts with the U.S. authorities if the DPA considers
this appropriate.
The WP29 stresses that the mechanism explained in the Privacy Shield does not follow the
earlier recommendation according to which EU individuals should be “able to bring claims
for damages in the European Union” as well as be “granted the right to lodge a claim before a
competent EU national court.” 28 It would be welcomed if Privacy Shield organisations were
to include such a possibility in their privacy policies.
28 See WP29 letter to Vice-President Reding, 10 April 2014
27