DATA PROTECTION SCHEDULE

Introduction

  1. Production Services Company/Producer (“data exporter”) has agreed to produce, complete and deliver for Netflix(“data recipient”) an original, premium, quality, production pursuant to that certain production services  agreement (“Agreement”) between the parties (therein “Project,” “Series” or “Film” and herein “Production”).
  2. Where acting as an exporter, each party shall (1) only disclose the personal data for one or more defined purposes which are consistent with the terms of this Schedule and (2) ensure that it has made a notice available to the relevant individual(s) informing them that their personal data will be disclosed to the data recipient; and obtained any applicable and necessary consents or authorisations required to permit the data recipient to freely process the personal data.
  3. Where acting as a data recipient, each party shall (1) only process personal data for one or more defined purposes which are consistent with the terms of this Schedule, (2) not process personal data for longer than is necessary to carry out the above mentioned purposes, and (3) shall implement and maintain administrative, physical and technical safeguards (“Safeguards”) designed to prevent any collection, use or disclosure of, or access to personal data that the Schedule does not authorize. Data recipient’s Safeguards, including, without limitation, its information security program, will meet industry standard practices for safeguarding data.
  4. Each party shall cooperate with the other to the extent reasonably requested, in relation to any individual’s requests or any other communication from an individual concerning the processing of their transferred personal data, and any communication from a supervisory authority concerning the processing of the transferred personal data, or compliance with the applicable data protection or privacy laws.
  5. The data exporter wishes to transfer certain personal data of to the data recipient in relation to the Production.  The data recipient accepts such transfer. The description of the transfer of the personal data is set out in the Appendix to this Schedule, which forms an integral part of this Schedule.
  6. The parties agree to enter into such additional agreements or documentation as may be required to ensure an adequate level of protection for the rights and freedoms of the data exporter's individuals in relation to the processing of personal data in connection with the Production.  
  7. For the avoidance of doubt, each party hereby acknowledges receipt of good and valuable consideration from the other party in respect of the covenants and agreements set forth herein.
  8. For the purposes of this Schedule:
  1. individual” shall mean an individual engaged in connection with the Production;

  1. "personal data"  shall mean any personal data that can directly or indirectly (including when used in combination with other data) identify an individual;

  1. "special categories of data/sensitive data" shall mean and personal data regarding an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health or sex life, criminal convictions or alleged commission of an offence, if any;
  2. "process/processing" shall mean activities in performance of the Agreement and this Schedule;

  1. "supervisory authority/authority” shall mean the competent data protection authority in the territory in which the data exporter is established;

  1. "the data exporter" shall be the entity who transfers the personal data;

  1. "the data recipient" shall mean the entity who agrees to receive from the data exporter personal data for further processing in accordance with this Schedule.

APPENDIX

Description of the Transfer

  1. Individuals. The personal data transferred  concern  the following categories of individuals: Past and present directors, writers, cast and crew and other personnel (including independent contractors) (collectively “Talent and Crew”) involved in the making of the Production; individuals identified by such Talent and Crew (if any) as beneficiaries, domestic partners, family members and emergency contacts; and employees, directors, and other individuals employed by or otherwise representing service providers and business partners of the data exporter (past, current and prospective).
  2. Purposes of processing and transfer(s). The data will be processed and the transfer made for some or all of the following purposes:

For past and present Talent and Crew: management and administration of personnel; payroll and benefits management; planning and allocating work; human resources management, including managing and administering training, leave, promotions, transfers, and managing coaching, disciplinary matters and terminations; communications (including in emergencies), ensuring business continuity, protecting the health and safety of Talent and Crew and others, safeguarding IT infrastructure, office equipment and other property; complying with applicable legal and other requirements, recordkeeping and reporting obligations, conducting audits, compliance with law enforcement, pursuing legal rights and remedies, defending litigation and managing any internal complaints or claims; and complying with internal policies and procedures.

For individuals identified by Talent and Crew as beneficiaries, domestic partners, family members and emergency contacts: payroll and benefits management; communications (including in emergencies), ensuring business continuity, protecting the health and safety of Talent and Crew and others.

For employees, directors, and other individuals employed by or otherwise representing service providers and business partners of the data exporter (past, current and prospective): administration of vendors, including accounting and VAT tax reporting; communications and emergencies, including ensuring business continuity; safeguarding IT infrastructure, office equipment and other property; business operations; and complying with applicable legal and other requirements, recordkeeping and reporting obligations, conducting audits, compliance with law enforcement, pursuing legal rights and remedies, defending litigation and managing any internal complaints or claims; and complying with internal policies and procedures.

  1. Categories of data. The personal data processed and transferred concern the following categories of personal data.

For past and present Talent and Crew: personal details, contact details, documentation required under immigration laws, payroll data, leave and vacation records, Talent and Crew contract information, qualifications and talent management information, and compensation information.

For individuals identified by Talent and Crew as beneficiaries, domestic partners, family members and emergency contacts: personal details and contact details.

For employees, directors, and other individuals employed by or otherwise representing service providers and business partners of the data exporter (past, current and prospective): identification information; contact details; payment details; and other relevant vendor information as may be necessary to facilitate data exporter’s business dealings with vendors, including VAT number, goods and services provided and received, professional and work details, and security credentials information.

  1. Recipients of data. The personal data transferred may be disclosed only to the following recipients or categories of recipients: relations of the individual in the event of an emergency or following the death of an employee; former employers and other third party referees of individuals who are prospective Talent and Crew of the data exporter so that HR staff at the data recipient can procure references on behalf of the data exporter; companies in the same group as the data controller as necessary for the purposes described in, and subject to the protections set out in, this Schedule; duly authorized human resources and other employees, managers and directors of the data recipient will have access to the personal data on a need to know basis for the fulfillment of their roles and strictly for the purposes described above; third-party service providers including accountants, auditors, lawyers and other outside professional advisors; call center service providers; IT systems, support and hosting service providers; recruiting services; employee screening services; payroll and benefits administrators; banks and financial institutions; document and records management providers; and similar third-party vendors and outsourced service providers assisting data recipient in carrying out business activities; and duly authorized staff at public bodies and law enforcement authorities who make enquiries of the data recipient in accordance with applicable law.
  2. Sensitive data. The personal data transferred concern the following categories of sensitive data:

For past and present Talent and Crew: Sensitive Data as required and permitted by Applicable Law, for example, diversity-related personal data (such as sex and racial or ethnic origin) in order to comply with legal obligations and internal policies relating to diversity and anti-discrimination; physical and mental health data if required for the purpose of providing disability access and procuring medical and health insurance benefits for employees. Also trade union membership, if applicable; any health data required for the purpose of assessing working capacity; any criminal record or criminal history data where the individual may be required to work with children.

For employees, directors, and other individuals employed by or otherwise representing service providers and business partners of the data exporter (past, current and prospective): None.

November 2018_ROW Data Protection Schedule