You should only transfer data to third parties consistent with the notice and choices you have given the consumers. You must ensure that if information is disclosed to agents or subcontractors that they will agree to abide by the shield principles. The transfer for such data is only for limited and specified purposes. Upon notice, take reasonable and appropriate steps to stop and remediate unauthorized processing. The participating company has liability in cases of onward transfer of data to third parties.
Additionally, upon request by the U.S. Department of Commerce, the participating company must provide a summary or a copy of relevant contract privacy provisions entered into with its agent.