Data Privacy: Essentials for Payroll Presented by: Melissa Harkcom Director, Fitzgerald & Law

1. Data Privacy: Essentials for Payroll Presented by: Melissa Harkcom Director, Fitzgerald & Law Date: October 12th (9-10:30am)

2. Agenda • Introduction • About me • Why is data privacy important for Payroll? • What type of data is protected? • Who is responsible for protecting data? • How should data be protected? • Use and retention of data • Upcoming changes • What happens if there is a breach? • Conclusion • Q&A

3. About me • F&L Director with over 16 years’ global expansion experience • Advise companies of all sizes • Spent many years in both Silicon Valley and Europe working with high-growth tech companies in the public sector and financial services industry • Arrived in San Francisco in 2010 to help US companies ensure international success when expanding overseas • Advise on: company set-up, accounting, banking, corporate & expatriate taxes, global mobility/international assignment advice, HR, payroll & employee benefits

4. Introduction Data Privacy: Essentials for Payroll This session is designed to provide the essential information that all payroll professionals in the US require when managing European payrolls. We will look at both the current data privacy rules and the planned changes in 2018. You will learn which data is protected, what you can do with the data and the legal rights of your employees. This session will also guide you through how your role may be impacted and may impact other departments within your organization.

5. Why is data privacy important for Payroll? • Payroll is one of many key stakeholders that collect, use and protect Personal Data. • Other stakeholders include: • Local HR Business Partner • Recruitment Team • Global HR Team • Compensation/Benefits Manager • Local Finance Team • Global Finance Team • Treasury Manager • The Employee

6. What type of data is protected? • Determining ‘Personal Data’ and ‘Sensitive Personal Data’ • Name • Address • Date of Birth • Phone Number • IP Addresses • Aggregated Data • Health Information • Religion • Sexual Orientation

7. Sources of data • How and where is data collected? • Internal • Employees • HR teams • Managers • External • Recruiters • Insurers • 3rd party payroll • Benefits providers

8. Tracking data • Identify and track the data flow in your organization. • For example:

9. Tracking data • Identify and track the data flow for your vendors. • For example:

10. Who is responsible for protecting data?

11. Use and retention of data

12. How should data be protected? • Levels of protection within your organization • 3rd party vendors: RFP, management, risk assessments • Security requirements • Using technology • Using practical solutions • Data Security Team • Procedures • Internal training • External training

13. What happens if there is a breach? • Implement Data Breach Process • Identify the breach and extent • Convene the Data Security team • Is the breach continuing? • External breach • Internal Breach

14. What happens if there is a breach? • If the breach has ended, identify what data was disclosed and to whom • Disclosure within set time periods • Internal notification • Prevention and fixes

15. Some BIG changes

16. Thank You!