2023-12192. Agency Information Collection Activities; Submission to the Office of Management and Budget (OMB) for Review and Approval; Comment Request; Applications for Inclusion on the Lists of Arbitrators Under the Data Privacy Framework Program

The Department of Commerce will submit the following information collection request to the Office of Management and Budget (OMB) for review and clearance in accordance with the Paperwork Reduction Act of 1995, on or after the date of publication of this notice. We invite the general public and other Federal agencies to comment on proposed, and continuing information collections, which helps us assess the impact of our information collection requirements and minimize the public's reporting burden. Public comments were previously requested via the Federal Register on March 30, 2023 during a 60-day comment period. This notice allows for an additional 30 days for public comments.

Agency: International Trade Administration, Department of Commerce.

Title: Applications for Inclusion on the Lists of Arbitrators Under the Data Privacy Framework Program.

OMB Control Number: New collection. Not yet assigned.

Form Number(s): None.

Type of Request: Regular submission, new information collection.

Number of Respondents: 36.

Average Hours per Response: 240 minutes.

Burden Hours: 144 hours.

Needs and Uses: The United States, the European Union (EU), the United Kingdom (UK), and Switzerland share a commitment to enhancing privacy protection, the rule of law, and a recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies, but take different approaches to doing so. Given those differences, the Department of Commerce (DOC) developed the EU–U.S. Data Privacy Framework (EU–U.S. DPF), the UK Extension to the EU–U.S. Data Privacy Framework (UK Extension to the EU–U.S. DPF), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) in consultation with the European Commission, the UK Government, the Swiss Federal Administration, industry, and other stakeholders. These arrangements were respectively developed to provide U.S. organizations reliable mechanisms for personal data transfers to the United States from the European Union, the United Kingdom (and, as applicable, Gibraltar), and Switzerland while ensuring data protection that is consistent with EU, UK, and Swiss law.

The DOC is issuing the EU–U.S. DPF Principles and the Swiss-U.S. DPF Principles, including the respective sets of Supplemental Principles (collectively the Principles) and Annex I of the Principles, as well as the UK Extension to the EU–U.S. DPF under its statutory authority to foster, promote, and develop international commerce (15 U.S.C. 1512). The International Trade Administration (ITA) will administer and supervise the Data Privacy Framework program, including maintaining and making publicly available the Data Privacy Framework List, an authoritative list of U.S. organizations that have self-certified to the DOC and declared their commitment to adhere to the Principles pursuant to the EU–U.S. DPF and, as applicable, the UK Extension to the EU–U.S. DPF, and/or the Swiss-U.S. DPF. While the decision by an organization to self-certify its compliance pursuant to the EU–U.S. DPF and, as applicable the UK Extension to the EU–U.S. DPF, and/or the Swiss-U.S. DPF and by extension participate in the Data Privacy Framework program is voluntary; effective compliance is compulsory: organizations that self-certify to the DOC and publicly declare their commitment to adhere to the Principles must comply fully with the Principles. Such commitments to comply with the Principles are legally enforceable under U.S. law. On the basis of the Principles, Executive Order 14086, 28 CFR part 201, and accompanying letters and materials, including ITA's commitments regarding the administration and supervision of the Data Privacy Framework program, it is the DOC's expectation that the European Commission, the UK Government, and the Swiss Federal Administration will respectively recognize the adequacy of the protection provided by the EU–U.S. DPF, the UK Extension to the EU–U.S. DPF, and the Swiss-U.S. DPF thereby enabling personal data transfers from each respective jurisdiction to U.S. organizations participating in the relevant part of the Data Privacy Framework program. It is the DOC's present expectation that the effective date of the EU–U.S. DPF Principles would coincide with the entry into force of the European Commission's anticipated recognition of adequacy, whereas the respective effective dates of the UK Extension to the EU–U.S. DPF and the Swiss-U.S. DPF Principles would occur before the entry into force of the anticipated, respective recognitions of adequacy ( i.e., to enable U.S. organizations from the earliest possible date to self-certify their compliance with multiple parts of the Data Privacy Framework program). Personal data cannot be received in reliance on the EU–U.S. DPF, the UK Extension to the EU–U.S. DPF, and the Swiss-U.S. DPF until they have respectively received such recognition ( i.e., until such formal recognition enters into force).

As respectively described in Annex I of the EU–U.S. DPF Principles, the UK Extension to the EU–U.S. DPF, and Annex I of the Swiss-U.S. DPF Principles the DOC commits separately with the European Commission, the UK Government, and the Swiss Federal Administration to implement an arbitration mechanism to provide EU, UK, and Swiss individuals with the ability under certain circumstances to invoke binding arbitration to determine, for residual claims, whether an organization has violated its obligations under the Principles as to those individuals. Organizations that self-certify their compliance pursuant to the EU–U.S. DPF, including those that also elect to participate in the UK Extension to the EU–U.S. DPF are obligated to arbitrate claims and follow the terms as set forth in Annex I of the EU–U.S. DPF Principles, provided that an EU or UK (as applicable) individual has invoked binding arbitration by delivering notice to the organization at issue and following the procedures and subject to the conditions set forth in Annex I of the EU–U.S. DPF Principles. Organizations that self-certify their compliance pursuant to the Swiss-U.S. DPF are obligated to arbitrate claims and follow the terms as set forth in Annex I of the Swiss-U.S. DPF Principles, provided that a Swiss individual has invoked binding arbitration by delivering notice to the organization at issue and following the procedures and subject to the conditions set forth in Annex I of the Swiss-U.S. DPF Principles. An individual's decision to invoke this binding arbitration option is entirely voluntary. Arbitral decisions will be binding on all parties to the arbitration. Under this binding arbitration option, a panel (consisting of one or three arbitrators, as agreed by the parties) has the authority to impose individual-specific, non-monetary equitable relief (such as access, correction, deletion, or return of the individual's data in question) necessary to remedy the violation of the Principles only with respect to the individual. No damages, costs, fees, or other remedies are available. The parties will select the arbitrators from the list(s) of arbitrators described below.

Pursuant to the EU–U.S. DPF and the UK Extension to the EU–U.S. DPF, the DOC and the European Commission will develop and seek to maintain a list of at least 10 arbitrators. The parties, including the EU or UK individual who has invoked binding arbitration, will select arbitrators for the arbitration panel from that list of arbitrators developed under the EU–U.S. DPF (EU–U.S. DPF List of Arbitrators). To be eligible for inclusion on the EU–U.S. DPF List of Arbitrators, applicants must be admitted to practice law in the United States and be experts in U.S. privacy law, with expertise in EU data protection law; and shall not be subject to any instructions from, or be affiliated with, either party, or any participating organization, or the United States, European Union, or any EU Member State or any other governmental authority, public authority, or enforcement authority. Arbitrators will remain on the EU–U.S. DPF List of Arbitrators for a period of 3 years, absent exceptional circumstances or removal for cause, renewable by the DOC, with prior notification to the European Commission for additional 3-year terms.

Pursuant to the Swiss-U.S. DPF the DOC and the Swiss Federal Administration will develop and seek to maintain a list of up to five arbitrators to supplement the list of arbitrators developed under the EU–U.S. DPF. The parties, including the Swiss individual who has invoked binding arbitration, will select arbitrators for the arbitration panel from the list of arbitrators developed under the EU–U.S. DPF, as supplemented by the list of arbitrators developed under the Swiss-U.S. DPF (Swiss-U.S. DPF Supplemental List of Arbitrators). To be eligible for inclusion on the Swiss-U.S. DPF Supplemental List of Arbitrators, applicants must be admitted to practice law in the United States and be experts in U.S. privacy law, with expertise in European or Swiss data protection law; and shall not be subject to any instructions from, or be affiliated with, either party, or any participating organization, or the United States, Switzerland, European Union, or any EU Member State or any other governmental authority, public authority, or enforcement authority. Arbitrators will remain on the Swiss-U.S. DPF Supplemental List of Arbitrators for a period of 3 years, absent exceptional circumstances or removal for cause, renewable by the DOC, with prior notification to the Swiss Federal Administration for additional 3-year terms.

Individuals interested in being considered for inclusion on the EU–U.S. DPF List of Arbitrators or the Swiss-U.S. DPF Supplemental List of Arbitrators would submit their applications to the DOC online via email at [e-mail].

The DOC has agreed with the European Commission to the adoption of arbitration rules that govern arbitration proceedings and a code of conduct for arbitrators under the EU–U.S. DPF (and similarly agreed with the UK Government as relates to arbitration proceedings under the UK Extension to the EU–U.S. DPF), and the Swiss Federal Administration to the adoption of arbitration rules that govern arbitration proceedings and a code of conduct for arbitrators under the Swiss-U.S. DPF. In the event that the rules governing the proceedings and/or the code of conduct for arbitrators need to be changed, the DOC and the European Commission and the Swiss Federal Administration will agree to amend those rules or adopt a different set of existing, well-established U.S. arbitral procedures, and/or amend the code of conduct for arbitrators (as applicable).

The DOC has selected the International Centre for Dispute Resolution (ICDR), the international division of the American Arbitration Association (AAA) (collectively ICDR–AAA) to administer arbitrations pursuant to and manage the arbitral fund identified in Annex I of the EU–U.S. DPF Principles, including as relates to the UK Extension to the EU–U.S. DPF, and Annex I of the Swiss-U.S. DPF Principles. Among other things, the ICDR–AAA facilitates arbitrator fee arrangements, including the collection and timely payment of arbitrator fees and other expenses.

Affected Public: Private individuals.

Frequency: Recurrent, depending on the number of arbitrators required to maintain active lists of arbitrators under the Data Privacy Framework Program.

Respondent's Obligation: Required to obtain or retain benefits.

Legal Authority: The DOC's statutory authority to foster, promote, and develop the foreign and domestic commerce of the United States (15 U.S.C. 1512).

This information collection request may be viewed at www.reginfo.gov. Follow the instructions to view the Department of Commerce collections currently under review by OMB.

Written comments and recommendations for the proposed information collection should be submitted within 30 days of the publication of this notice on the following website www.reginfo.gov/​public/​do/​PRAMain. Find this particular information collection by selecting “Currently under 30-day Review—Open for Public Comments” or by using the search function and entering the title of the collection.

Sheleen Dumas,

Department PRA Clearance Officer, Office of the Under Secretary for Economic Affairs, Commerce Department.