Nestlé in society Creating Shared Value and meeting our commitments 2015

Nestlé in society:
Creating Shared Value
Nutrition, health
and wellness
Rural development
Water
Environmental
sustainability
Human rights
and compliance
Our
people
G4-56, Security practices G4-DMA, G4-HR7, G4-SO2, Anti-corruption G4-DMA, G4-SO3, G4-SO5, Customer privacy G4-DMA, G4-PR8
In 2015, we continued to work on the mitigation of the risks
identified in an assessment completed in 2014, in which the
following risks of corruption were identified:
• Facilitation payments;
• Gifts to government officials and third parties (purpose and
value); and
• Charitable contributions and non-commercial sponsorships
(due diligence, records and documentation).
To help mitigate these risks we:
• Deployed the Guidance on Nestlé’s Commitment against
Bribery and Corruption as an attachment to the Nestlé Code
of Business Conduct, providing additional and
complementary guidance on this topic;
• Deployed a new e-learning tool designed to raise awareness
and promote discussion; and
• Made progress towards our commitment to train all officebased
employees (by 2017) and to adopt local anticorruption
procedures in those markets and businesses
where there is a need for further reinforcement.
Security
All security personnel working on Nestlé’s behalf are expected
to respect human rights, act within the law and comply with
the company’s rules, as outlined by our Nestlé Group Security
Policy and Corporate Business Principles.
Two webinars for regional security managers, covering key
human rights concepts and generating discussion on concrete
examples (such as due diligence for security companies, and
CCTV cameras and privacy), were attended by 80 employees
in 2015. Two new mandatory online training modules for site
security representatives, both including specific points on
human rights, were developed and rolled out. The first module
covers the principles and security governance; the second is
more technical, but included guidance on where to install
surveillance cameras so as to respect privacy. In total, 579 site
security representatives attended one or both modules.
We also incorporated an audit component for security
within the CARE programme, which revealed 21 minor gaps
and one major gap in 2015.
Furthermore, in 2015, we continued with the active
application of our Responsible Sourcing Audit Programme for
security providers. This audit, guided by ethical principles, is
applied to our Tier 1 suppliers who have a direct commercial
relationship with Nestlé. The audit process promotes
continuous improvement in line with the standards established
in the Nestlé Supplier Code.
Data privacy
Protecting the personal data of our consumers, employees and
other stakeholders is of paramount importance to Nestlé. The
digital landscape is constantly and rapidly changing, with new
challenges arising continually. In this environment, Nestlé
seeks to anticipate and respond to consumer expectations,
data security threats, and regulation regarding data privacy.
Our approach is founded on an evolving internal data privacy
governance framework of clear, robust internal standards and
an organisational structure empowered to enforce it.
Our Privacy Policy
Nestlé’s Privacy Policy lies at the heart of our consumer
privacy framework. It features six key principles that all
employees and contractors of Nestlé companies must comply
with when processing personal data. Such data must:
• Only be processed for specific and legitimate business
purposes;
• Be processed fairly and lawfully;
• Be properly managed;
• Be protected against unauthorised processing and damage;
• Be accessible when in the form of data collections; and
• Not be transferred to third parties or other countries without
adequate safeguards.
Additional restrictions apply to processing sensitive personal
data. We are strengthening this further through the development
of a new Data Processing Standard, covering the processing of
all personal data from collection through to deletion.
To the best of our knowledge, we had no substantiated data
breach complaints to report for 2015.
Our Data Privacy Organisation
Nestlé’s Group Data Privacy Organisation is tasked with
seeking to reinforce capabilities and controls across the Group.
It manages the Nestlé Data Privacy Framework and provides
advice, support and guidance on its implementation. It is
increasingly supported by data privacy officers and champions,
who are being progressively appointed in our businesses and
markets, creating a broad Nestlé Data Privacy Organisation.
The Data Privacy Organisation works closely with our
internal IS/IT Security, Marketing and HR functions in
executing the Nestlé Data Privacy Framework.
Additionally, a number of individuals of our Data Privacy
Organisation are members of professional bodies and actively
contribute to the wider data privacy debate through
international conferences and other forums. We also engage
with national and regional data privacy regulators, either
directly or through representatives.
Key data privacy initiatives in 2015
Our data protection work was further strengthened during
2015, when we carried out the following actions:
• Implemented a standard on privacy in digital marketing;
• Worked with the CGF to adopt Consumer Engagement
Principles (CEPs). The CEPs are intended to act as a
framework for how companies engage with their
consumers to promote an environment of trust, particularly
in relation to personal data;
• Adding to the network of data privacy specialists by
appointing several new data privacy officers and champions
in Switzerland in 2015, with further appointments to be
made globally next year;
• Rolled out e-learning across the company; and
• Launched new, more transparent and clear communications
about privacy for Nestlé websites.
Nestlé in society – Creating Shared Value and meeting our commitments 2015 248