1. Employee privacy in a global company Sandra Kelman Privacy Manager (Asia Pacific) Privacy Issues Forum 30 March 2006

2. Context BP is of one of the world's largest energy companies, providing its customers with fuel for transportation, energy for heat and light, retail services and petrochemicals products for everyday items Over 100,000 people work in 100 countries across six continents Exploration activities cover 26 countries 27,800 service stations serve around 13 million customers each day “Mega data centres” in Singapore, Houston & London

3. Structure Digital Communications & Technology Digital Security Strategy – Compliance (Privacy & Data Protection) Compliance Manager 4 Privacy Managers (UK & Western Europe, Germany & Eastern Europe, Americas, MoW) Data Privacy Co-ordinator in each country (Privacy Officer)

4. Foundation Documents Privacy & Data Protection Policy & Security of Information Policy International Intra-Group Data Protection Agreement Codes of Practice (applied globally) Fair Processing Statements Employee Code of Conduct

5. Privacy & Data Protection Policy Applies where no local legislation Ties in with IGA Based on EU Data Protection Directive Principles for information processing Rights and responsibilities On Intranet – provided in induction phase Security of Information Policy Retention Guidelines/Schedules

6. International Intra-Group Data Protection Agreement (IGA) Signed off by Country President Permits individual BP operations to meet legislative obligations where data transfers are regulated Allows trans-border data flows via gaining the consent of individuals through the issue of a Fair Processing Statement (FPS) Commits businesses to respect relevant local legislation Creates a common business standard through implementing the Global Data Protection Policy. Implementation Designate a Country Data Protection Coordinator (full or part- time) Education & Support Compliance through monitoring

7. Codes Of Practice CCTV Consistent application Model signage 40 pages Employment UK model Suggested standards 91 pages (plus supplementary guidance)!

8. Fair Processing Statements Information for employees about information collected, held and its uses Authority to process information as described Explanation of data held in HR systems Third Party Processor’s privacy notice (UK) Campaign to issue one to each BP employee – new and existing!

9. Code of Conduct “ Our Commitment to Integrity” Specifically refers to privacy –“…there should be no gap between what we say and what we do…” –Misuse of information –Privacy and employee confidentiality –Data quality –Protecting BP’s assets (includes information) –Intellectual property –Security

10. Privacy Quiz

11. Privacy Quiz 2

12. Privacy Quiz 3

13. Privacy Compliance Audits Use UK Information Commissioner’s methodology Adapted for local legislation or BP Privacy Policy “Heavy” and “Light” Monitor privacy compliance at that time Interviews with staff – functions or processes Audit report – non-compliances and observations Risk Register – checks follow up actions