Safe Harbor Privacy Policy

I. Overview

MeadWestvaco Corporation is committed to protecting the privacy and security of its Employee Personal Information and has certified that it abides by the Safe Harbor privacy principles as set forth by the United States Department of Commerce.  The principles regulate the use, collection, storage and transfer of data between the European Union and the United States.  This Policy outlines the practices and procedures for implementing these principles. 

II. Scope of the Policy

This Safe Harbor Privacy Policy is limited to certain data transfers between the U.S. and EU where there is a receipt, storage, transfer or other processing of Employee Personal Information as further explained herein.

III. Definitions

Employee:  Any current or former employee of the Company. 

Employee Personal Information:  Information pertaining to Employees and other individuals such as contractors, consultants or job applicants that: (i) is transferred from the European Union (“EU”) to the U.S., (ii) is recorded in any form, (iii) is about, or relates to, an identified or identifiable Employee, and (iv) can be linked to that Employee.  Personal Information includes but is not limited to details such as name, national identification number, telephone number, postal address and email address.  Personal Information does not include data that is anonymous.

MeadWestvaco Corporation: MeadWestvaco Corporation and its subsidiaries and affiliates (“MWV” or the “Company”).

Safe Harbor: Information about the Safe Harbor principles and certification process is available at www.export.gov/safeharbor.

IV. Safe Harbor Privacy Principles

MWV’s privacy and information security program includes the Company’s privacy business rules and other applicable policies and procedures.  The Company’s practices regarding the collection, storage, transfer, use and other processing of Employee Personal Information comply with the Safe Harbor principles of notice, choice, onward transfer, access, security, data integrity, and enforcement and oversight.  The Company also takes reasonable steps to process Employee Personal Information in accordance with local and country laws.

a) Notice

The Company notifies Employees located in the EU about the purposes for which it collects and uses their Personal Information, the types of third parties to which the Company discloses the information, the choices Employees have for limiting the use and disclosure of their information, and how to contact the Company with questions and comments regarding Employee Personal Information.

1. Purposes of Collection and Use of Employee Personal Information

MWV collects and processes certain Employee Personal Information in connection with the administration of the Company’s various business functions, including the provision of support and services to Employees.  MWV may collect and use Employee Personal Information for purposes such as:

• evaluating and selecting prospective Employees;
• administering Employee remuneration plans, including tax and other withholdings and deductions;
• assisting in Employee development, planning, reviews, performance appraisals, training, transfers and promotions;
• identifying Employees for security and other business-related purposes, including to provide identification cards, access to facilities, networks and directories;
• maintaining training records, including acknowledgements of the Company’s Code of Conduct and other training;
• administering Employee benefits, including compensation, insurance and pension plans, and maintaining applicable records;
• administering the reimbursement of qualifying work-related, and tuition expenses;
• contacting Employees and other individuals in the event of a work-related inquiry or emergency;
• administering charitable and civic time as well as monetary donations in which Employees choose to participate;
• maintaining Employee health and Employee and facility safety and security;
• maintaining the security and appropriate use of the Company’s physical premises, communications networks, computer systems, email and voicemail, and implementing appropriate technical updates;
• complying with the Company’s legal obligations, policies and procedures; and
• managing internal administration.

b) Choice

MWV does not use Employee Personal Information for purposes incompatible with the purposes for which the information was originally collected without notifying the relevant individuals of such uses and offering an opportunity to opt out.

MWV provides Employees located in the EU with an opportunity to direct the Company not to share their Personal Information with third parties, except as further described: 

The Company may disclose Employee Personal Information without offering Employees an opportunity to opt-out (i) to service providers the Company has retained to perform services on its behalf, (ii) if it is required to do so by law or legal process, (iii) to law enforcement authorities or other government officials, or (iv) when the Company believes the disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity. 

c) Onward Transfer of Employee Personal Information

The Company requires service providers to whom it discloses Employee Personal Information and who are not certified under the Safe Harbor or subject to laws based on the EU Data Protection Directive to contractually agree that they provide at least the same level of protection for Employee Personal Information as required by the relevant Safe Harbor principles. 

d) Access to Employee Personal Information

MWV provides Employees with reasonable access to the Personal Information the Company maintains about them.  The Company also provides Employees a reasonable opportunity to correct, amend or delete that information where it is inaccurate.  The Company may limit or deny access to Employee Personal Information where providing such access is unreasonably burdensome or expensive under the circumstances, or as otherwise permitted by the Safe Harbor principles.  To obtain access to their Employee Personal Information, Employees and others may contact their local Human Resources representative.

e) Security

MWV maintains reasonable and appropriate administrative, technical and physical safeguards to protect Employee Personal Information from loss, misuse and unauthorized access, disclosure, alteration and destruction.  Security measures include the use of password protection, limiting access to Employee Personal Information to Employees, service providers and third parties that have a legitimate need to access the information and requiring user identification and passwords to access the information. 

f) Data Integrity

MWV takes reasonable and appropriate steps to ensure that Employee Personal Information the Company collects is relevant for the purposes for which it is to be used and that the information is reliable for its intended use and is accurate, complete and current.  The Company depends on its Employees to update and correct their Employee Personal Information whenever necessary.  To update their information, Employees should contact their local Human Resources representatives.

g) Enforcement and Oversight

MWV has established procedures for periodically verifying the implementation of and compliance with the Safe Harbor principles.  The Company conducts annual self-assessments and periodic internal audit compliance reviews of its practices with respect to Employee Personal Information to verify that representations the Company makes about its relevant privacy practices are true and that related privacy policies and procedures have been implemented as represented.

Employees may submit questions and complaints to their local Human Resources representative in connection with the processing of their Employee Personal Information under the Safe Harbor principles.  Complaints that cannot be resolved by the Human Resources Representative should be forwarded to the Company’s Global Information Privacy Office, as specified in the “Contacting the Company” section of this Policy.  The Company will also cooperate with the relevant EU data protection authorities to resolve Employees’ complaints concerning the handling of their Employee Personal Information.  The Company will take steps to remedy any issues arising out of a failure to comply with the Safe Harbor principles.

V. Updates to the Safe Harbor Privacy Policy

MWV may periodically update this Safe Harbor Privacy Policy, consistent with the requirements of the Safe Harbor principles.  The Company will post a prominent notice on this site to notify Employees of any significant changes to the Policy and indicate at the top of this webpage the date of the most recent update.

VI. Implementation of the Safe Harbor Privacy Policy

MWV implements this Safe Harbor Privacy Policy by providing Employees with training, awareness programs and business rules for collecting, storing, transferring, using, disclosing, disposing of and otherwise processing Employee Personal Information.  The training programs encompass applicable procedures and guidelines contained in the Company’s Information Privacy Business Rules published by the MWV Global Information Privacy Office.

VII. Contacting the Company

Employees should address any questions or concerns regarding this Safe Harbor Privacy Policy or the Company’s practices concerning Employee Personal Information by contacting their local Human Resources Representative or by:

Writing to: 
MWV
Global Information Privacy Office
501 South Fifth Street, Sixth Floor
Richmond, VA 23219-0501
USA

Sending an e-mail to:
mwv_global_privacy_office@mwv.com