Agency Information Collection Activities; Submission to the Office of Management and Budget (OMB) for Review and Approval; Comment Request; Self-Certifications Under the Data Privacy Framework Program

AGENCY:

International Trade Administration, Department of Commerce.

ACTION:

Notice of information collection, request for comment.

SUMMARY:

The Department of Commerce, in accordance with the Paperwork Reduction Act of 1995 (PRA), invites the general public and other Federal agencies to comment on proposed, and continuing information collections, which helps us assess the impact of our information collection requirements and minimize the public's reporting burden. The purpose of this notice is to allow for 60 days of public comment preceding submission of the collection to OMB.

DATES:

To ensure consideration, comments regarding this proposed information collection must be received on or before May 30, 2023.

ADDRESSES:

Interested persons are invited to submit written comments to Leo Kim, ITA Paperwork Clearance Officer, International Trade Administration, Department of Commerce, Room 23016RA, 14th and Constitution Avenue NW, Washington, DC 20230 (or via the internet at PRAcomment@doc.gov). Do not submit Confidential Business Information or otherwise sensitive or protected information.

FOR FURTHER INFORMATION CONTACT:

Requests for additional information or specific questions related to collection activities should be directed to David Ritchie, Senior Policy Advisor, International Trade Administration, Department of Commerce via email at dpf.program@trade.gov, or by telephone at 202–482–1512.

SUPPLEMENTARY INFORMATION:

I. Abstract

The United States, the European Union (EU), the United Kingdom (UK), and Switzerland share a commitment to enhancing privacy protection, the rule of law, and a recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies, but take different approaches to doing so. Given those differences, the Department of Commerce (DOC) developed the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. Data Privacy Framework (UK Extension to the EU-U.S. DPF), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) in consultation with the European Commission, the UK Government, the Swiss Federal Administration, industry, and other stakeholders. These arrangements were respectively developed to provide U.S. organizations reliable mechanisms for personal data transfers to the United States from the European Union, the United Kingdom, and Switzerland while ensuring data protection that is consistent with EU, UK, and Swiss law.

The DOC is issuing the EU-U.S. DPF Principles and the Swiss-U.S. DPF Principles, including the respective sets of Supplemental Principles (collectively the Principles) and Annex I of the Principles, as well as the UK Extension to the EU-U.S. DPF under its statutory authority to foster, promote, and develop international commerce (15 U.S.C. 1512). The International Trade Administration (ITA) will administer and supervise the Data Privacy Framework program, including maintaining and making publicly available the Data Privacy Framework List, an authoritative list of U.S. organizations that have self-certified to the DOC and declared their commitment to adhere to the Principles pursuant to the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF. On the basis of the Principles, Executive Order 14086, 28 CFR part 201, and accompanying letters and materials, including ITA's commitments regarding the administration and supervision of the Data Privacy Framework program, it is the DOC's expectation that the European Commission, the UK Government, and the Swiss Federal Administration will respectively recognize the adequacy of the protection provided by the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF thereby enabling personal data transfers from each respective jurisdiction to U.S. organizations participating in the relevant part of the Data Privacy Framework program. The EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF will not enter into effect until they have respectively received such recognition ( i.e., until such formal recognition enters into effect).

In order to participate in the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF an organization must (a) be subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC), the Department of Transportation (DOT), or another statutory body that will effectively ensure compliance with the Principles; (b) publicly declare its commitment to comply with the Principles; (c) publicly disclose its privacy policies in line with the Principles; and (d) fully implement them.

While the decision by an organization to self-certify its compliance pursuant to the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF and by extension participate in the Data Privacy Framework program is voluntary; effective compliance is compulsory: organizations that self-certify to the DOC and publicly declare their commitment to adhere to the Principles must comply fully with the Principles. Organizations that only wish to self-certify their compliance pursuant to the EU-U.S. DPF and/or the Swiss-U.S. DPF may do so; however, organizations that wish to participate in the UK Extension to the EU-U.S. DPF must participate in the EU-U.S. DPF. Such organizations' commitment to comply with the Principles with regard to transfers of personal data from the European Union and, as applicable, the United Kingdom, and/or Switzerland must be reflected in their self-certification submissions to the DOC, and in their privacy policies. An organization's failure to comply with the Principles after its self-certification is enforceable by the FTC under Section 5 of the Federal Trade Commission (FTC) Act prohibiting unfair or deceptive acts in or affecting commerce (15 U.S.C. 45); by the DOT under 49 U.S.C. 41712 prohibiting a carrier or ticket agent from engaging in an unfair or deceptive practice in air transportation or the sale of air transportation; or under other laws or regulations prohibiting such acts.

To rely on the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF for transfers of personal data from the European Union and, as applicable, the United Kingdom, and/or Switzerland an organization must self-certify its adherence to the Principles to the DOC, and both be placed and remain on the Data Privacy Framework List. The DOC will update the Data Privacy Framework List on the basis of annual re-certification submissions made by participating organizations and by removing organizations when they voluntarily withdraw, fail to complete the annual re-certification in accordance with the DOC's procedures, or are found to persistently fail to comply. The DOC will also maintain and make available to the public an authoritative record of U.S. organizations that have been removed from the Data Privacy Framework List and will identify the reason each organization was removed. The aforementioned authoritative list and record will remain available to the public on the DOC's Data Privacy Framework program website. Any organization removed from the Data Privacy Framework List must cease making claims that it participates in or complies with the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF and that it may receive personal information pursuant to same. Such an organization must nevertheless continue to apply the Principles to such personal information that it received while it participated in the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF for as long as it retains such personal information.

To initially self-certify or subsequently re-certify for the EU-U.S. DPF and, as applicable, UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF, an organization must on each occasion provide to the DOC a submission that contains the relevant information specified in the Principles. The submission must be made via the DOC's Data Privacy Framework program website by an individual within the organization who is authorized to make representations on behalf of the organization and any of its covered U.S. entities regarding its adherence to the Principles. Such an organization must respond promptly to inquiries and other requests for information from the DOC relating to the organization's adherence to the Principles.

ITA has committed to follow up with organizations that have been or wish to be removed from the Data Privacy Framework List. ITA will direct organizations that allow their self-certifications to lapse to verify whether they intend to re-certify or instead intend to withdraw. An organization that intends to re-certify will be required to further verify to the DOC that during the lapse of its certification status it applied the Principles to relevant personal data received in reliance on its participation in the Data Privacy Framework program and clarify what steps it will take to address the outstanding issues that have delayed its re-certification. An organization that intends to withdraw will be required to further verify to the DOC what it will do and/or has done (as applicable) with the relevant personal data that it received in reliance on its participation in the Data Privacy Framework program ( i.e., (a) retain such data, continue to apply the Principles to such data, and affirm to the DOC on an annual basis its commitment to apply the Principles to such data; (b) retain such data and provide “adequate” protection for such data by another authorized means; or (c) return or delete all such data by a specified date) and who within the organization will serve as an ongoing point of contact for Principles-related questions. Organizations will be required to provide such verification to the DOC by completing and submitting appropriate questionnaires to the DOC.

ITA has also committed to conduct compliance reviews on an ongoing basis, including, as appropriate, through sending detailed questionnaires to participating organizations. The DOC will require that a participating organization complete and submit to the DOC such a questionnaire when: (a) the DOC has received any specific, non-frivolous complaints about the organization's compliance with the Principles; (b) the organization does not respond satisfactorily to inquiries by the DOC for information relating to the organization's adherence to the Principles; or (c) there is credible evidence that the organization does not comply with its commitments under the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF.

II. Method of Collection

Organizations would make their initial self-certification, as well as annual re-certification submissions under the Data Privacy Framework program ( i.e., the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF) to the DOC online via the DOC's Data Privacy Framework program website ( https://www.dataprivacyframework.gov/ ). An organization that already participates in the EU-U.S. DPF and intends to extend its participation to also cover personal data received from the United Kingdom would make its election to participate in the UK Extension to the EU-U.S. DPF either: (a) as part of its annual re-certification to the EU-U.S. DPF, or (b) outside of its annual re-certification to the EU-U.S. DPF provided it makes that election no later than six months from the effective date for the UK Extension to the EU-U.S. DPF (n.b., in either scenario the organization would make the relevant submission to the DOC online via the DOC's Data Privacy Framework program website). Organizations would complete and submit Data Privacy Framework program questionnaires to the DOC online via the DOC's Data Privacy Framework program website or via email at dpf.program@trade.gov (as applicable) in accordance with Data Privacy Framework program requirements.

The DOC previously requested and obtained approval of analogous information collection that has allowed the DOC, as represented by ITA, to collect information from organizations in the United States to enable them to self-certify their commitment to comply with the EU-U.S. Privacy Shield Framework Principles and/or the Swiss-U.S. Privacy Shield Framework Principles (OMB Control No. 0625–0276). Pursuant to the EU-U.S. DPF, the EU-U.S. Privacy Shield Framework Principles will be amended as the “EU-U.S. Data Privacy Framework Principles”; and pursuant to the Swiss-U.S. DPF, the Swiss-U.S. Privacy Shield Framework Principles will be amended as the “Swiss-U.S. Data Privacy Framework Principles”. Organizations that self-certified their commitment to comply with the EU-U.S. Privacy Shield Framework Principles and/or the Swiss-U.S. Privacy Shield Framework Principles that wish to enjoy the benefits of participating in the EU-U.S. DPF and/or the Swiss-U.S. DPF (as applicable) must comply with the amended Principles once those amendments have entered into effect. More information on self-certification, including annual re-certification under the Data Privacy Framework program will be made available on the DOC's Data Privacy Framework program website ( https://www.dataprivacyframework.gov/ ) once that is launched; however, such information will also be made available, as appropriate, on the DOC's Privacy Shield program website ( https://www.privacyshield.gov/welcome ).

III. Data

OMB Control Number: New Collection. Not yet assigned.

Form Number(s): None.

Type of Review: Regular submission, new information collection.

Affected Public: Primarily businesses or other for-profit organizations.

Estimated Number of Respondents: 4,000.

Estimated Time per Response: 40 minutes.

Estimated Total Annual Burden Hours: 3,062.

Estimated Total Annual Cost to Public: $3,260,000.

Legal Authority: The DOC's statutory authority to foster, promote, and develop the foreign and domestic commerce of the United States (15 U.S.C. 1512).

IV. Request for Comments

We are soliciting public comments to permit the Department/Bureau to: (a) Evaluate whether the proposed information collection is necessary for the proper functions of the Department, including whether the information will have practical utility; (b) Evaluate the accuracy of our estimate of the time and cost burden for this proposed collection, including the validity of the methodology and assumptions used; (c) Evaluate ways to enhance the quality, utility, and clarity of the information to be collected; and (d) Minimize the reporting burden on those who are to respond, including the use of automated collection techniques or other forms of information technology.

Comments that you submit in response to this notice are a matter of public record. We will include or summarize each comment in our request to OMB to approve this information collection request (ICR). Before including your address, phone number, email address, or other personal identifying information in your comment, you should be aware that your entire comment—including your personal identifying information—may be made publicly available at any time. While you may ask us in your comment to withhold your personal identifying information from public review, we cannot guarantee that we will be able to do so.