Draft
Frequently Asked Questions (FAQs)

FAQ 6 - Self-Certification

Q: How does an organization self-certify that it adheres to the safe harbor principles?

A: To self-certify for the safe harbor, organizations can provide to the Department of Commerce, or its designee, a letter, signed by a corporate officer, that contains at least the following information:

2. description of the activities of the organization covered by its safe harbor commitments;

3. description of the organization's privacy policy, including:
        a.    where it is available for viewing by the public,
        b.    its effective date of implementation
        c.    a contact person for the handling of complaints, access requests, and any other issues arising under the safe harbor,
        d.    the specific statutory bodies that have jurisdiction to hear any claims against the organization regarding possible unfair or deceptive practices,
        e.    name of any privacy programs in which the organization is a member,
        f.     method of verification (e.g. in-house, third party)*, and
        g.    the independent recourse mechanism that is available to investigate unresolved         complaints.

Such self certification letters should be provided not less than annually thereafter. The Department (or its designee) will maintain a list of all organizations that file such letters, thereby assuring the availability of safe harbor benefits, and will update such list on the basis of annual letters and notifications received pursuant to FAQ 11. Both the list and the self-certification letters submitted by the organizations will be made publicly available. All organizations that self certify for the safe harbor must also state in their published privacy policy statements that they adhere to the safe harbor principles. Any misrepresentation to the Department or to the general public concerning an organization's adherence to the safe harbor principles may be actionable by the Federal Trade Commission or other relevant government body.

*See FAQ on verification