Received from the European Union
April 15, 2009
Iberdrola Renewables Holdings, Inc., domiciled at 1125 NW Couch Street, Portland, Oregon 97209 (together with its US subsidiaries and affiliates, "IRHI"), is a subsidiary of Scottish Power Renewable Holdings, Ltd. ("SPREHL"), a company based in the United Kingdom, a member of the European Union. SPREHL, in turn, is a subsidiary of Iberdrola Renovables, S.A., a company based in Spain, a member of the European Union. In accordance with the terms of European Union Directive 95/46 EC (the "EU Privacy Directive"), as implemented (1) in the United Kingdom by the Data Protection Act of 1998 (the "UK Data Protection Act") and (2) in Spain by the Basic Law 15/1999 on the protection of personal data (the "Spain Data Protection Act" and, together with the UK Data Protection Act, the "Data Protection Acts"), transfers of personal data as set forth in the UK Data Protection Act and Spain Data Protection Act, respectively, to the US may only take place if there are adequate safeguards in place with respect to the protection of privacy of individuals in relation to the transfer of their Personal Data (as defined below).
As a result of temporary and permanent employee exchanges between IRHI and SPREHL and of Iberdrola Renovables, S.A., IRHI may from time to time receive human resources, benefits or other personal information subject to a Data Protection Acts ("Personal Data"). Personal Data includes any personal information relating to a living individual relevant for carrying out the envisaged processing purposes as explained below and, thus. may include, but not be limited to, employee name and date of birth, remuneration (including base salary, incentives, pension deductions, share scheme deductions), emergency contact details, length of employment, salary history and performance ratings.
IRHI is committed to process the Personal Data consistently with the EU Privacy Directive and the Data Protection Acts and, to that end, has adopted the following policies with respect to the use and administration of Personal Data.
Uses of Personal Data: Processing Purposes
Personal Data will be processed solely in connection with the evaluation, administration and control of employment (including performance management, benefits programs, compensation, hiring, periodic audits and other diligence examinations of the compliance by the employee of his/her duties) and the compliance with applicable laws. To the extent required under applicable law, the consent of the relevant employee shall be obtained prior to process the Personal Data (including their disclosure to third parties) for any other purposes.
Control and Protection of Personal Data
Subject employees will be advised that IRHI has received and is maintaining Personal Data and shall, subject to applicable law, be given the opportunity to review, ensure the accuracy of and correct any Personal Data related to them as well as to object to certain processings.
IRHI will designate a single member of the Human Resources Department as a Data Protection Representative, who shall be responsible for monitoring and maintaining the Personal Data and for taking care of the requests referred to in the former paragraph. Personal Data will be maintained securely by and at the direction of the Data Protection Representative. Access to Personal Data in either physical or digital form will be limited, and will be restricted to the Data Protection Representative and persons specifically authorized thereby on a need to know basis for the performance of the processing purposes explained above or as otherwise permitted under applicable law.
IRHI will review its procedures for the maintenance, control and protection of Personal Data on an annual basis.