Safe Harbor Privacy Policy - The Corporate Integrity Hotline of The Walt Disney Company

Walt Disney Internet Group

Safe Harbor Privacy Policy for the Corporate Integrity Hotline and the Integrated Workplace Management System of The Walt Disney Company

INTRODUCTION

The Walt Disney Company ("TWDC"), whose principal office is located in the State of California, United States of America (the "United States"), may process personal data that (a) concerns accounting, internal accounting controls and auditing matters, as well as improper payments to governmental officials, compliance with applicable tax laws and regulations, and certain other matters relating to its Standards of Business Conduct, and (b) is received by means of employee telephone communications and recorded by the staff of TWDC's corporate integrity hotline, the Guideline (the "Guideline Information"). The Guideline Information may contain personal information regarding officers, employees and other persons directly or indirectly associated with TWDC and/or legal entities that are affiliated with TWDC (the "Affiliated Entities"). TWDC may also process personal data that includes landlord contact information and employee contact information such as telephone number, address, or line of business. TWDC will process consumer data, including personally identifiable data collected in the European Union, for marketing purposes.

TWDC recognizes the privacy protections afforded to individuals in the European Union and the European Economic Area (collectively the "EEA") with regard to Personal Information (as defined below). For that reason, with respect to the Guideline Information, TWDC has subscribed and will adhere to the voluntary U.S.-EU Safe Harbor program ("Safe Harbor Program") by adopting and implementing this set of Safe Harbor Privacy Principles, which include a set of frequently asked questions (collectively, the "Principles").

SCOPE OF THESE PRINCIPLES

The Principles apply to all Personal Information that is: (1) collected by TWDC about an Individual located in the European Union; (2) with respect to an Individual's direct or indirect association with TWDC and/or an Affiliated Entity; (3) concerning compliance with one or more aspects of TWDC's Standards of Business Conduct and (4) transferred from the EEA to TWDC in the United States after the effective date of these Principles and included in the Guideline Information. The effective date of these Principles is December 5, 2006.

FREQUENTLY ASKED QUESTIONS

What is "Personal Information"?

Personal Information means any information relating to an Individual that identifies that Individual, or could reasonably be used to identify the Individual, and that is recorded in any form (e.g., paper, electronic, video, audio) and included in the Guideline Information.

Who is an Individual for Purposes of these Principles?

An Individual is any natural person whose Personal Information is included in the Guideline Information.

What is the relationship between the Principles and the Safe Harbor Program?

The Principles implement and satisfy the requirements of the Safe Harbor Program and establish the legally required level of protection for Individuals' Personal Information.

NOTICE AND CHOICE

Collection and Use of Personal Information

TWDC collects and uses Personal Information only in a lawful manner and in compliance with the Safe Harbor Program and these Principles.

FREQUENTLY ASKED QUESTION

Why is Personal Information transferred to TWDC in the Guideline Information?

The collection and use of Personal Information is for the purpose of maintaining compliance by TWDC and its Affiliated Entities with certain legal and accounting requirements.

Informing the Individual and Obtaining Consent

Except where an applicable legal exception exists, TWDC and/or the relevant Affiliated Entity is legally required to inform Individuals of the ways in which their Personal Information will be collected and used and the types of third parties to which such Information will be disclosed, and to obtain the Individuals' consent. Accordingly, except where an applicable legal exception exists, TWDC shall notify Individuals of the following:

The type(s) of Personal Information TWDC plans to use;
The purposes for which TWDC will process Personal Information;
How to contact the Affiliated Entity or TWDC with any inquiries or complaints about the use and processing of such Personal Information;
The types of parties to whom TWDC will disclose Personal Information; and,
The right of Individuals to access and, if necessary, correct Personal Information about them.

This information will be provided before TWDC uses or discloses Personal Information or as soon thereafter as is practicable.

FREQUENTLY ASKED QUESTIONS

Are there cases when TWDC may disclose Personal Information about an Individual without obtaining the Individual's consent?

In certain cases, and in accordance with the Safe Harbor Program, TWDC may disclose Personal Information about an Individual without the Individual's consent, such as, for example, when TWDC is required to disclose the Information by law or legal process, or in order to conduct an investigation of the facts alleged in a report received by TWDC's Guideline. In such circumstances, and at such time as may be required by law or the Safe Harbor Program, TWDC and/or the Affiliated Entity, as appropriate, shall inform the Individual whom to contact if the Individual has a legitimate reason to object to the disclosure of the Individual's Personal Information by TWDC.

Under what circumstances may TWDC disclose Personal Information to agents and contractors, and what steps does TWDC take to safeguard that Personal Information?

As a part of its normal business operations, TWDC may hire agents and contractors to carry out certain functions that require use of Personal Information. TWDC is not required by the Safe Harbor Program to provide notice or obtain the relevant Individual's consent in these circumstances, and TWDC does not generally do so. Those agents and contractors have obligated themselves to observe the relevant Principles (or adopt another form of adequate protection for the Personal Information) and TWDC restricts the use and retention of the Personal Information to the purposes and duration of the functions for which the agent or contractor was hired.

What happens if an Individual objects to the collection, use, or disclosure of his/her Personal Information by TWDC?

If an Individual objects to TWDC's collection, use, or disclosure of certain Personal Information, TWDC or the Affiliated Entity will make reasonable efforts to address the concerns of the Individual.

Will TWDC take adverse action against an Individual for refusing to permit his/her Personal Information to be collected, used, or disclosed?

The Safe Harbor Program prohibits a company that subscribes to the Safe Harbor Program from taking unreasonable actions in such circumstances. TWDC reserves the right, in circumstances permitted by applicable law and the Safe Harbor Principles to collect, use and disclose Personal Information without the consent of the relevant individual.

Sensitive Information

While recognizing that all Personal Information deserves to be protected in accordance with the Safe Harbor Program, TWDC exercises special precautions and safeguards for any sensitive information it may collect, as defined by the Safe Harbor Program.

FREQUENTLY ASKED QUESTIONS

What is "sensitive information"?

"Sensitive information" includes Personal Information specifying racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and health or sex life.

What safeguards are required for "sensitive information"?

Except as permitted by the Safe Harbor Program or applicable law, affirmative permission of the Individual is required to process "sensitive information" and to disclose such information to a third party or use such information for purposes other than those for which it was originally collected or subsequently authorized by the Individual.

ACCESS

TWDC provides Individuals about whom it maintains Personal Information with a reasonable opportunity to examine their information, to challenge its accuracy, and to have it corrected, amended or deleted as appropriate, subject to certain exceptions.

FREQUENTLY ASKED QUESTIONS

How do Individuals exercise their rights under the Access Principle?

Individuals may exercise a right to access Personal Information maintained about them by TWDC. Reasonable access applies to both the process of accessing Personal Information and the types of Personal Information to be accessed. In terms of process, reasonable access means, for example, that requests for access are made during normal business hours, following standard procedures, and that the frequency of access requests is not excessive. In terms of types of Personal Information to be accessed, reasonable access recognizes certain exceptions discussed in the immediately following FAQ 2. If TWDC or the Affiliated Entity denies an Individual access, however, such Individual will be provided with the reason(s) access was denied and a contact point for further inquiries.

If TWDC or an Affiliated Entity is notified that Personal Information it maintains is incorrect, is requested to correct the Personal Information, and is provided with appropriate supporting documentation, TWDC or the Affiliated Entity will either correct the information or direct the Individual to the source of the information for correction. If, upon review, TWDC or the Affiliated Entity believes that the existing information is correct, the Individual will be informed accordingly.

Is there any Personal Information about an Individual maintained by TWDC that such Individual would not be permitted to access?

Yes, there are some exceptions to the obligation to provide access permitted by the Safe Harbor Program. These include access to confidential or proprietary information of either an Affiliated Entity or TWDC, and situations in which granting access might have to be balanced against the privacy interests of others. In addition, access may be denied when the Personal Information requested relates to an ongoing investigation concerning the Individual, litigation or potential litigation, or where the burden or expense of providing access would be disproportionate to any risks to the Individual's privacy that would arise from not providing access.

DATA INTEGRITY

TWDC employs reasonable steps to keep Personal Information accurate, complete, and up-to-date for the purposes for which such Personal Information is used.

SECURITY

TWDC takes reasonable precautions, including administrative, technical, personnel, and physical measures to safeguard Personal Information against loss, theft and misuse, as well as unauthorized access, disclosure, alteration and destruction.

FREQUENTLY ASKED QUESTIONS

How are decisions reached about who has access to Personal Information about Individuals?

It is the policy of TWDC to give access to Personal Information about Individuals only to those entities and persons that TWDC determines have a legitimate need to know the information to carry out their responsibilities.

What keeps those with access to some of an Individual's Personal Information from browsing through other parts of that Personal Information for other reasons?

It is the policy of TWDC to limit the access to Personal Information given to employees, agents, and contractors to such information that TWDC determines is needed to carry out their responsibilities.

ENFORCEMENT

Compliance

TWDC maintains an active program to ensure compliance with the Principles, Safe Harbor Program, and TWDC's contractual agreements and other commitments regarding the handling of Personal Information.

The TWDC's Privacy Compliance Office is responsible for implementing and overseeing the administration of the Principles.

It is the responsibility of all TWDC's employees to act in accordance with the Principles with respect to Personal Information. Failure to do so may result in disciplinary action up to and including discharge from employment.

FREQUENTLY ASKED QUESTIONS

What are the responsibilities of the TWDC Privacy Compliance Office?

Responsibilities of TWDC's Privacy Compliance Office include:

Ensuring that the privacy guidelines, programs, procedures, training, and other measures necessary to implement the Principles are developed and put into practice;
Overseeing responses to inquiries and resolution of complaints relating to Personal Information;
Working with legal advisors to ensure TWDC's ongoing compliance with applicable privacy laws and agreements, as well as any obligations TWDC may enter into voluntarily, such as the Principles and the U.S.-EU Safe Harbor Program; and
Overseeing periodic assessments of TWDC's internal practices to ensure that they conform to the Principles and related company obligations.

What steps are taken to promote compliance with the Principles?

Compliance measures include:

Educating TWDC's employees as to the purpose and application of the Principles;
Training TWDC's employees with access to Personal Information on the purposes and application of the Principles;
Ensuring that TWDC's employees, agents, and contractors with access to Personal Information are legally obligated to abide by the Principles;
Holding TWDC's employees, agents, and contractors accountable for violations of the Principles, with sanctions up to and including termination of contracts and employment; and
Having designated points of contact in TWDC to answer questions regarding the Principles and TWDC's privacy practices and to investigate complaints regarding conduct inconsistent with the Principles or related obligations.

Complaint Resolution

TWDC recognizes the importance of having mechanisms in place to address and resolve complaints by Individuals about the processing of Personal Information. Therefore, if an Individual makes a complaint about the processing of his/her Personal Information, and the complaint is not resolved to the Individual's satisfaction through internal TWDC procedures, then TWDC will refer such Individual to the national data protection authority in the jurisdiction where the Individual resides as required by the Safe Harbor Program.

FREQUENTLY ASKED QUESTIONS

What are the procedures for filing an internal complaint about the handling of Personal Information by TWDC?

Individuals covered by the Principles should contact the TWDC's Privacy Compliance Office, which will provide particular information about the mechanics of the complaint process.

What types of independent dispute resolution mechanisms are available?

Member States of the European Union and the European Economic Area have established data protection authorities overseeing the processing of Personal Information that are willing to assist in the resolution of complaints.

Changes to the Principles

TWDC reserves the right to modify these Principles at any time and will notify affected individuals of such modifications in accordance with applicable law and the Safe Harbor Program. Nonetheless, as long as TWDC continues to store, use, or disclose Personal Information transferred to TWDC under these Principles, TWDC will apply to such Personal Information either these Principles or safeguards that provide no less privacy protection than the Safe Harbor Program then requires.