Alternative Dispute Resolution: The BBBOnLine Privacy Program

Brenda McCracken Sooy, Senior Privacy Compliance Analyst
Gary Laden, Director, Privacy Program
Council of Better Business Bureaus

Alternative Dispute Resolution: The BBBOnLine Privacy Program [pdf]

Executive Summary

The Council of Better Business Bureaus (CBBB) is the umbrella organization for the Better Business Bureau (BBB) system that was founded in 1912 and is today supported by over 250,000 local business members nationwide. It is dedicated to fostering fair and honest relationships between businesses and consumers, instilling consumer confidence and contributing to an ethical business environment. BBBOnLine Inc. is a wholly owned subsidiary of the CBBB with a mission to similarly promote trust and confidence on the Internet through its Privacy and Reliability Seal Programs.

For close to a century, the BBB system has used alternative dispute resolution to help resolve marketplace problems between businesses and consumers. In the past few years, the CBBB has kept pace with advancing technology and utilized its extensive experience to design and implement dispute resolution processes for online privacy disputes. This effort offers a global online dispute resolution mechanism designed to foster six basic consumer-oriented principles: user-friendliness, confidentiality, transparency, low cost, expeditiousness, and fairness.

BBBOnLine's Privacy Program Dispute Resolution Process

The BBBOL Privacy Program Dispute Resolution Process provides a free process for review of an eligible complaint by the Privacy Policy Review Service (PPRS) of BBBOnLine, Inc. (BBBOL). This process is two tiered. The first tier, the PPRS, initiates review and processing of the complaint. PPRS consists of qualified staff members from BBBOL. The second tier, the Privacy Review Appeals Board (PRAB), hears appeals of decisions rendered by PPRS about BBBOL Privacy Program participants. PRAB consists of a chairman and persons appointed by the chairman. Members of the PRAB serve in specific capacities to represent the public, data experts and industry. Although members of PRAB are appointed by BBBOL, the objective of PRAB is to remain impartial and to render decisions based on the facts presented. The chairman will initially decide whether an appeal is granted. If it is, the full board will convene to analyze and decide the case.

BBBOL considers complaints against all companies regardless of whether or not they participate in a BBB program as long as certain eligibility criteria are met. Companies that participate in the BBBOL Privacy Program must agree to participate in the Dispute Resolution Process and abide by resulting decisions, as outlined in the BBBOL Privacy Seal license agreement. The process also accepts online privacy complaints regardless of the consumer's place of residence or the company's location. PPRS handles, albeit infrequently, complaints where both the company and complainant are located in countries outside the U.S.

Individuals are encouraged to review the eligibility criteria prior to filing an online complaint through the BBBOL Web site, as only certain complaints are eligible for processing. PPRS will assist in the resolution of an individual's dispute when possible, but should the complaint be found ineligible, he or she will be re-directed to another dispute resolution alternative. For example, the BBBOL complaint process accepts complaints about companies that do not participate in the Privacy Program, however, if a company participates in a different privacy program the individual may be referred to that program or, alternatively, to the local BBB where the company is located.

In general, to be eligible for the BBBOL dispute resolution process a complaint must meet three requirements. First, the complaint must be about personally identifiable information collected online by an organization through a Web site or online service displaying the BBBOL Privacy Seal or that displays a privacy statement advising users that safeguards will apply to the information collected about them. Second, the organization named in the complaint must have been alleged to have either misused personal information in a manner inconsistent with its published privacy notice or, in the case of a BBBOL Privacy Participant, engaged in actions or practices that are at odds with BBBOL Privacy guidelines applicable to that site or online service. Finally, the individual bringing the complaint must have made a good faith effort to resolve his/her concern directly with the organization that is the subject of the complaint. To demonstrate that this good faith effort has occurred, the online dispute resolution program specifically requests that the individual submit their correspondence with the company about their complaint between themselves and the organization. Occasionally, BBBOL may request additional information to determine whether the complaint is an eligible one.

The individual would also need to decide on the remedies available through BBBOL. The individual can seek to have his or her information used in a manner consistent with the organization's privacy notice and, if applicable, the BBBOL Privacy Program guidelines. The individual can also seek to have that information corrected. If the organization is one of BBBOL's Privacy seal participants, BBBOL may impose its own remedy and require a change in privacy policies or practices, if necessary to avoid a similar occurrence. Complaints seeking monetary damages or alleging fraud are ineligible for the BBBOL process and will be re-directed to another means of dispute resolution, if available.

For ease of use, the entire complaint process can be conducted online beginning with the filing of a complaint through the BBBOL Web site and the exchange of email between the parties and BBBOL's PPRS. Once the complaint is considered eligible, a specific timetable is followed which provides both parties with guidance about the amount of time entailed in the dispute resolution process. To encourage smooth operation of the process, PPRS ensures that it has received sufficient information from the individual prior to sending the complaint to the organization. Procedural fairness dictates that BBBOL provides both the complainant and organization with an opportunity to submit information as well as respond to each other's submission. The PPRS will make two attempts to reach an organization that is the subject of a complaint. If the organization fails to respond, the complaint will be referred to the appropriate government agency, such as the Federal Trade Commission.

Once the complaint is deemed complete it is sent to the organization, which must respond within a specified time to PPRS. BBBOL will forward the organization's response to the individual who is then given the same opportunity to respond within a specific time. If an agreement is reached between the parties, BBBOL considers the complaint satisfactorily resolved. If an agreement is not reached, PPRS, acting on behalf of BBBOL, will render a decision based on the evidence received, including initial complaint paperwork, parties' responses, and any other information requested by PPRS. If the organization that is the subject of the complaint is a participant in the BBBOL Privacy Program, either party to the complaint may request appeal of a PPRS decision to the Privacy Review Appeals Board (PRAB).

To help assure confidentiality, all parties must agree that only those directly involved in the resolution of the complaint will have access to the complaint materials. Either party may also request that information submitted to PPRS not be made available to the other party for confidentiality reasons. However, if such a request is made, the other party has the right to a summary of such materials to enable them to respond. The PPRS staff is available to provide assistance in drafting this summary.

Once a complaint is closed, it will either appear in summary form in the quarterly report generated by PPRS and be posted on the BBBOL Web site or, if a decision was rendered by PPRS and/or PRAB, the decision will be promptly published on the BBBOL Web site. Publication of decisions and statistical summaries of the number and nature of complaints and the outcomes of the dispute resolution process help provide transparency.

How It Works In Practice

The BBB system's alternative dispute resolution services are recognized as a fast and inexpensive means of settling a dispute and keeping it out of court. The work of BBBOL's PPRS is no different. It blends conciliation and mediation, using email as the primary tool of communication. PPRS facilitates the informal resolution of disputes between individuals and organizations. If it is determined that the individual has not made a good faith effort to resolve his or her complaint directly with the organization, PPRS will advise them that this is a necessary first step and attempt to provide them with additional information such as guidance found within the Web site's privacy notice or contact information for a company representative if it is a member of one of BBBOL's seal programs. If the attempt to resolve the complaint does not yield satisfactory results the individual is invited to return to the dispute resolution process.

When a complaint is classified as eligible and officially opened, PPRS sends the complainant's information to the organization. This information includes the complainant's contact information, the company's information, the steps taken to resolve the concern, and what the individual is seeking as a remedy (e.g., having an email address removed from a marketing database if an opt-out option is available per the company's privacy notice). When the organization responds, this information is immediately shared with the individual. In the initial phase of the dispute, PPRS does not attempt to determine who is right or wrong. Rather it serves as a neutral third party to help develop a record of relevant information for each party and to facilitate a resolution. This process frequently settles the matter simply and quickly. However, if the parties do not come to a resolution, PPRS assumes the role of decision-maker. If an individual is not satisfied with the resolution of his/her complaint, judicial remedies are preserved and the individual can pursue his/her case in court.

Some Emerging Best Practices

BBBOL's work in online dispute resolution has played a role in the development of some emerging best practices in protecting privacy online:

Transparency: BBBOL's dispute resolution process promotes transparency and good business ethics that enables both the business and consumer to feel confident when following the process. For example, the complete rules are published online with additional easy-to-follow consumer guidance about how to file a complaint and the type of remedies available. In addition, detailed statistics are published quarterly and all decisions are made public when rendered. The individual should be able to come to the BBBOL Web site to understand what types of privacy violations were received and resolved.
Quick, Low Cost Alternative: The use of BBB dispute resolution services is a fast and inexpensive way to settle a problem for both the business and the consumer and keep the dispute out of court. Judicial remedies are preserved should the complaint not be resolved. The dispute resolution process is free to consumers and is funded by the annual license fees paid by those participating in the BBBOL Privacy Program.
Confidentiality: BBBOL rules provide that all communications made during the course of the complaint proceedings are confidential. By participating in a BBBOL dispute resolution process, the parties agree that during the course of the process they will maintain any information provided to them by the PPRS staff or PRAB panel exclusively for the purpose of resolving the complaint and that they will not provide the materials to anyone except persons directly involved in handling the complaint. All deliberations, meetings, proceedings and writings of a PPRS reviewer or PRAB panel other than their decision are treated as confidential. Confidential materials submitted to PPRS are returned when PPRS issues its decision or closes a case without a decision.
If a party violates this confidentiality agreement, PPRS or PRAB can refuse to proceed with the case. The purpose of this right of refusal is to maintain a professional, unbiased atmosphere in which PPRS or PRAB can effect a timely and lasting resolution to a case in the spirit of furthering voluntary self-regulation of online privacy and the voluntary cooperation of the parties involved.
Fairness: Both parties � the consumer and the business � are given a fair opportunity to participate in the dispute resolution process. Each party has the occasion to submit information, and to review and respond to the other's position and findings.
Convenience: Because the BBBOL process relies primarily on email as a means of communication with parties to the dispute resolution process, individuals can often resolve their complaints from home and business representatives are not required to leave their office.

Looking Ahead

BBBOL continues to work to make online privacy complaint eligibility and processing easy to use and understand for both consumers and businesses. BBBOL combines this effort with new initiatives to provide resources to members of the public � both consumers and businesses � who seek more information about online privacy. BBBOL believes that through public education, businesses will be able to understand and follow best online business practices and consumers will be better able to understand privacy, how to protect it, and what both parties can do when a problem occurs.