Must a Carls franchisee cooperate with CJR in addressing Privacy Laws?
Carls Franchise · 2024 FDDAnswer from 2024 FDD Document
Franchisee must fully cooperate with CJR and its counsel in determining the most effective way to meet CJR's standards and policies pertaining to Privacy Laws, including those governing notification of a data breach. Franchisee is responsible for any financial losses it incurs or remedial actions that it must take as a result of breach of security or unauthorized access to Consumer Information in Franchisee's control or possession.
- (6) When required by applicable Privacy Law, CJR will inform Franchisee of any consumer request (e.g., deletion, correction, access, and opt-out) that requires Franchisee's compliance and will provide Franchisee with the information within CJR's possession that is necessary for Franchisee to comply with the request. Franchisee will cooperate with CJR, and promptly (and in any event within ten days following notice by CJR) provide any information and documents requested by Franchisee to respond to requests by customers under Applicable Laws. Franchisee will delete, modify, or correct any Consumer Information upon CJR's request unless Franchisee can prove that such request is subject to an exception under applicable law;
- (7) Franchisee shall make available to CJR all information necessary for Franchisee to demonstrate compliance with its obligations under this Section 13(P). Franchisee will cooperate with CJR, its internal auditors and external auditors for the purpose of inspecting, examining, and assessing Franchisee's compliance with its obligations under this Section 13(P). This Auditing may be conducted through measures including, but not limited to, manual reviews and automated scans, as well as technical and operational testing. Auditing may take place at least once every twelve (12) months; and
- (8) If Franchisee receives a Consumer Information request directly from a consumer under their state Privacy Law (e.g. a request to access, delete or correct Consumer Information ) that may pertain to Consumer Information , Franchisee shall inform CJR of that request within one business day and cooperate with CJR to ensure that the consumer receives an appropriate and timely acknowledgement and response. Typically, an acknowledgement is required within 10 business days and a final response is required within 45 calendar days.
Source: Item 22 — CONTRACTS (FDD page 80)
What This Means (2024 FDD)
According to the 2024 FDD, a Carls franchisee must fully cooperate with CJR and its counsel to effectively meet CJR's standards and policies regarding Privacy Laws, including those related to data breach notifications. This cooperation extends to providing information and documents requested by the franchisee to respond to customer requests under Applicable Laws, within ten days of notice by CJR. The franchisee is also obligated to delete, modify, or correct any Consumer Information upon CJR's request, unless they can prove that such a request is subject to an exception under applicable law.
Carls franchisees must inform CJR of any Consumer Information requests they receive directly from a consumer under their state Privacy Law within one business day and cooperate with CJR to ensure the consumer receives an appropriate and timely response. Typically, an acknowledgement is required within 10 business days and a final response is required within 45 calendar days. Franchisees must also make available to CJR all information necessary to demonstrate compliance with their obligations under Section 13(P) of the agreement.
Furthermore, Carls franchisees must cooperate with CJR, its internal auditors, and external auditors to inspect, examine, and assess the franchisee's compliance with its obligations, potentially through manual reviews, automated scans, and technical and operational testing, at least once every twelve months. The franchisee is responsible for any financial losses incurred or remedial actions required due to a security breach or unauthorized access to Consumer Information under their control.
In practical terms, this means a Carls franchisee must establish and maintain robust data protection and privacy measures, promptly address any data breach concerns, and actively participate in audits and assessments conducted by CJR. Failure to comply with these requirements could result in financial losses and the need for remedial actions, highlighting the importance of understanding and adhering to all applicable Privacy Laws and CJR's related policies.