GE’s Binding Corporate Rules: Achievements, Challenges and Solutions Nuala O’Connor Kelly Chief Privacy Leader General Electric Company Nuala.o’connorkelly@ge.com

Six Businesses, Each with a Number of Business Units Aligned for Growth Infrastructure Commercial Finance Industrial Note: This is one slide that can be used instead of the individual slides for each business. GE’s six businesses are organized to serve customers, be they industries, markets, even countries. Commercial Finance Insurance • Leasing • Real Estate • Corporate Financial Services • Healthcare Financial Services Infrastructure Oil & Gas • Energy • Rail • Aircraft Engines • Water • Energy Financial Services • Aviation Financial Services Industrial Consumer & Industrial • Equipment Services • Plastics • Silicones/Quartz • Security • Sensing • Fanuc • Inspection Technologies Healthcare Diagnostic Imaging • Clinical Systems • Information Technology • Services • Bio Sciences Consumer Finance Europe • Asia • Americas • Australia/New Zealand NBC Universal Network • Stations • Entertainment • Universal • Sports/Olympics Healthcare NBC Universal GE Money

Meeting Global Challenges Population / Demography Resource Management Technology Innovation Knowledge Flows Global Integration Conflict & Security Institutional Governance Personalized Healthcare Philanthropy Renewables Nuclear Water/Desal Clean Coal H Turbine Engine Evolution Locomotive Global Research Centers NBCU Services in WTO/FTAs Energy Healthcare Financial Services Container Security Explosive Detection Transparency in Governance (Corp/Govt) Compliance Rigor Corporate Citizenship Mobilizing capital and resources. . . Bringing solutions through our customers. . . Leading with governments to find solutions. . .

A global company with operations in over 100 countries and 300,000+ employees 95,000+ employees in EMEA

The GE difference . . . Leadership commitment to integrity A culture of compliance supported by world-class systems: Policies Education & Training Communications Auditing & Control

GE Policies are the Foundation of GE’s Integrity 14 policies, including on privacy, outline GE’s core legal and ethical responsibilities GE’s global workforce commits to comply: New employees receive a copy of The Spirit and Letter handbook and acknowledge that they are required to comply with its policies Employees re-acknowledge commitment to S&L every 18 months Failure to comply can lead to termination of employment GE and controlled affiliates are also bound: “Subsidiaries and other controlled affiliates throughout the world must adopt and follow corresponding policies. A controlled affiliate is a subsidiary or other entity in which GE owns, directly or indirectly, more than 50% of the voting rights, or in which the power to control the entity is possessed by or on behalf of GE.”

BCRs Incorporated into GE Policy in 2003 Fair Employment Practices Policy (GE Spirit & Letter) Requires respect for “the privacy rights of employees by using, maintaining and transferring their personal data in accordance with applicable Company guidelines and procedures.” GE Employment Data Protection Standards (Binding Corporate Rules) Protects “Employment Data,” defined as “any information about an identified or identifiable person that is obtained in the context of the person’s working relationship with a GE entity.”

Today, GE’s BCRs Continue to Provide Strong, Global Data Protection Key Principles: Adduces adequate safeguards globally - a high, EU-like standard globally - plus stricter local laws prevail Key protections Transparency and fairness Purpose limitation Data quality Security Rights of access, rectification, objection Protections for onward transfer Enforcement Internal controls and audits Reporting channels for suspected violations Cooperation with Data Protection Authorities (DPA) Data subject right to seek remedy in home country Communication and training

Binding Corporate Rules: An Effective Compliance Approach for GE BCRs Consistent with GE’s compliance structure and practices Binding on GE entities and employees Harmonized global guidelines ensure a consistent, strong protection Policies are alive and visible to our employees Language is user-friendly and has been translated into many local languages for data handlers and employees around the world Company assumes responsibility for providing adequate safeguards for data Strong support for a privacy compliant culture from GE senior management Contracts: Complex administration with thousands of entities Complex language; not visible to data handlers or employees Safe Harbor: Covers only EU to U.S. transfers Does not cover GE’s financial services businesses

BCR Approval Process

BCR Approval Process: Prior to Coordinated Process GE sought recognition of its Standards as a BCR in each country; adopted by German DPAs in July 2003 Lessons Learned: Challenges for companies: Gaining individual approval by 28 EU/EEA countries was time- consuming Minor modifications suggested by individual DPAs triggered significant work: re-training of data handlers; revision of operating procedures; renegotiation with prior-approving DPAs Challenges for DPAs: Hard for DPAs to review BCRs and supporting documentation from many different companies

BCR Approval Process: Coordinated Process GE worked with UKIC as “lead authority” for coordinated approval of BCR (mid-2004 through present). As one of the first companies to undertake the BCR approval process, GE worked side-by-side with DPAs in a number of countries to facilitate approval. Lessons Learned: Significant effort required by Lead Authority (and UKIC was excellent!) Working collaboratively and transparently with DPA staff and commissioners was effective; in-person meetings essential – but the process took substantial time for GE, the UKIC and all DPAs GE resources (HR, Legal, Privacy, Compliance, Audit teams) heavily involved in demonstrating strong controls Process can work! GE has approvals in 13 countries; pending in 13 more

Managing Practical Implementation Regionally & Globally

Policy Compliance Review Board (PCRB) GE Privacy Structure Policy Compliance Review Board (PCRB) GE General Counsel Chief Privacy Leader Policy development Practice facilitator Poles US Privacy Leaders European Privacy Leaders Asian Privacy Leaders Corporate Employment Data Privacy Committee Global Privacy Council Corp Audit & Compliance Team Businesses Chief Privacy Leaders Data Protection Review Boards Senior HR/IT Leaders

A strong structure ensures daily compliance GE’s Policy Governance Structure Board of Directors Audit Committee Regular updates Policy Compliance Review Board (PCRB) Senior GE officers Policy oversight Business reviews Legal Organization lawyers in Europe & globally Dedicated compliance leader in each business Independent Auditors Report to BOD Audit Committee auditors in Europe & globally Global Ombudsperson Network Intake and resolve concerns Monitor trends/cases

GE’s policies are visible and user friendly 26 Languages Hotlinks 13 Policies in simple, reader-friendly language Report Concerns & Access Resources

Data handlers are trained on their obligations Training and Communication: For Data Handlers- authorized individuals who process employment data Human Resources Information Technology Managers Legal Sourcing Messages via: On-line courses Live training Web articles

Substantial guidance is provided to data handlers Business self-audit checklists Data protection FAQs Country toolkits Country experts Links to external sites Privacy reviews before new systems are implemented

BCRs Benefit Companies and DPAs! Benefits for companies: Unified, global standard In-house policy driven by/tailored to a company’s unique culture or business/compliance processes More ability to communicate rules, values to employees (better than contracts or safe harbor) Benefits for DPAs: Simplified approval process for BCR Fewer unique data processing approvals, if activity covered by BCR Better awareness of data protection rights on part of individual Increased and clarified role for DPAs in enforcing/approving BCRs of global companies Some DPAs and the Commission are more pragmatic than others; some DPAs require contracts on top of the BCRs.