WORLDLINE_REGISTRATION_DOCUMENT_2017

C

The Group’s business Regulation

C.5.5.2

Data processing carried out outside the European Economic Area

protection to the personal data they process, either as a data controller or as a data processor. The BCR constitutes stringent commitments for all Atos and Worldline Group entities, whatever the country they are located in (Europe, Latin America, Africa, Asia, etc.), whereby they commit to respect numerous principles related to the personal data they process. These principles are based on requirements defined by the Personal Data Protection Directive and subsequently GDPR. These commitments were recognized by a large number of European personal data protection authorities as enabling a high level of data protection, when such data is processed on behalf of the Group’s clients (the Group acting as a data processor) or for itself as a data controller. They allow Worldline entities to transfer such data out of the European Union to other Atos’ entities in a simplified, easy and secured fashion. These commitments are voluntary, unilateral, rare in the IT service industry as they cover both Atos and Worldline entities, acting not only as data controllers but also as data processors (i.e. when data is processed on behalf of their clients) and demonstrate the focus given to personal data protection.

The Worldline Group carries out personal data processing operations in numerous countries outside of the EEA. Such processing is in some instances conducted on behalf of customers themselves located outside the EEA, while in others it is conducted on behalf of customers located within the EEA to whom the Worldline Group provides “offshore” services as an integral part of the services it offers. Although there is no international regulation that harmonizes all of the principles applicable to personal data protection, the regulatory framework applicable within the EEA is seen as the authority on such matters due to its strict and pioneering nature and the influence it has had on legislation that has emerged in numerous countries that have used it as a model, such as in North Africa, Latin America and Asia. This is why the Atos group, which includes the companies of the Group, chose to adopt and implement the Binding Corporate Rules (or “BCR”) aimed to ensure that all entities worldwide whatever the country they are located in, give a high level of

66

Worldline 2017 Registration Document