USA Operations Centers Confidential and Non-Confidential Employee Data May 2017

State/Area Exceptions

As this policy is reviewed, please note the following State for which exceptions exist:

None

Overview

This policy governs the responsibilities of Joyner Employees, Management, and the Human Resources Department for classifying, handling, and utilizing employee information or data.

When reviewing this policy "Employee Information or Data" refers to individual facts stored by Joyner on its employees along with analysis, information and reporting derived from such facts. It does not refer to Joyner policies or practices regarding how or why that data was determined, collected or stored.

General Information

Often employee data and information is requested and utilized within Joyner for business use. Joyner Human Resources is responsible for the proper classification, handling, distribution and use of employee data and information for Joyner. This includes but is not limited to setting standards, processes, determining its confidential status, and its proper distribution within the organization. Business Areas should work with their Human Resources Business Partner when requesting and utilizing employee information or data for business purposes.

It is important to also note this policy does not cover:

Requests for employee information or data related to litigation, lawsuits or subpoenas for employee information or data. More information on this topic can be found in the Employee Data for Litigation, Lawsuits, and Subpoenas policy.

Requests related to the release of employee information and data to parties outside of Joyner for employment and/or wage verification. More information on this topic can be found in the Employment Verifications, Government Inquiries and Letters of Reference policy.

Requests by current or former employees (or their designated representative) to review or obtain their employee information. This can be found in the Requests by Employees to Review Human Resources Information policy.

Release of current or former employee information regarding commercial driving information. This can be found in the Commercial Drivers - DOT policy.

Employee Actions

All Joyner Employees should follow the standards set forth in this policy, the Enterprise Privacy Policy and Enterprise Information Security Policy with regard to handling and utilizing employee information and data. All employees are also responsible for ensuring employee information and data is utilized and managed in accordance with any other Enterprise Policies, Human Resources Policies, and with all Federal, State and Local Laws. Employees should contact and work with both their Management and Human Resources Business Partner when they require employee data or information for a business need. Managers and the Human Resources Business Partner will work with the employee to review, gather, and provide appropriate employee information and data that meets the business need.

Managerial Actions

Managers and Supervisors should follow the standards set forth in this policy, the Enterprise Privacy Policy, Enterprise Information Security Policy and Joyner’s Employment Policy with regard to handling and approving the use of employee information or data. Managers and supervisors are also responsible for ensuring all employee information is utilized and managed in accordance with other Enterprise policies, Human Resources policies, and with all Federal, State and Local Laws. Managers should actively work with their Human Resources Business Partner to understand appropriate use of any employee data and to determine if the employee data is considered confidential by Joyner. The Human Resources Business Partner will work with the manager and employees to review, gather, and provide appropriate employee information and data that meets the business need.

Human Resources Role

The Human Resources Department is responsible for establishing and using procedures that align with this policy and with enterprise policies in regard to how employee information and data is handled, processed, maintained, and distributed. The responsibilities of Human Resources in regard to employee information and data include but are not limited to the following:

Ensuring the proper collection, maintenance, management, use and distribution of all employee related information and data for Joyner.

Review and approval of the business need for, access to, or use of employee information and data before access is granted or distribution occurs within Joyner.

Monitoring and restricting access to all employee information and data considered confidential by Joyner and Joyner Human Resources. Access to confidential employee information and data should be restricted to employees and management with an appropriate and approved business need or job related responsibility to view, handle, utilize or distribute confidential employee information and data.

All Human Resources Employees are responsible to review and appropriately communicate this policy to their business partners, employees and management before requesting or providing employee information and data.

Classification and Labeling of Employee Information and Data Employee Information and data should be classified as either non-confidential (internal use only) or confidential. Classifying and labeling of employee information and data must follow the standards set in the Enterprise Classification and Labeling of Joyner Information policy and with the Human Resources standards below:

Non-Confidential Employee Information and Data Non-Confidential employee information and data includes any employee information or data that meets all of the following criteria:

The employee data or information is not considered "confidential" or "trade secret" by the Enterprise Classification and Labeling of Joyner Information policy.

The employee data or information is not subject to laws, regulations or other Joyner policies and guidelines that would classify it as confidential.

The employee data or information is not limited in its distribution within Joyner based on business need.

Examples of non-confidential employee information can include but are not limited to:

Consolidated reporting such as: Department Counts, Turnover, Number of Hires, Number of Applicants, etc.

Measurement data such as: Termination Rates, Replacement Ratios, Employee Satisfaction, etc.

Non-employee specific information such as: HR Operating Budgets, Inventories, etc. not designated as confidential by Joyner or Joyner Human Resources.

If there are questions regarding how to classify and/or label employee information and data contact a member of HREC.

Confidential Employee Information and Data Joyner’s Office of Privacy maintains enterprise policies to protect the privacy of Joyner’s customer, consumer, and associate information. Employee information or data classified by the Office of Privacy as Sensitive Personal Information (SPI), Protected Health Information (PHI), or Payment Card Industry (PCI), is considered confidential by Joyner Human Resources.

In addition to the Enterprise standards above Human Resources also designates the following employee information and data as confidential if the data and information meets any of the following criteria:

An individual employee's personal or private information can be distinguished. Personal or Private Employee Information includes: Home Address, Personal Phone Numbers, Marriage Status, or other information designated by Joyner Human Resources as personal or private.

Is considered confidential due to laws, regulations and other Joyner guidelines, procedures, or policies. This can include but is not limited to: Race, Gender, Age, Disability, Gender Identity, Sexual Orientation, or other identified demographic groups protected by Federal, State or Local Law or Joyner policy.

Is specifically designated as confidential by the Joyner Human Resources department after reviewing an individual request and business need for employee information and data.

Examples of confidential employee information and data include but are not limited to:

Lists, reports, or other documentation containing employee: Home Addresses, Personal Phone Numbers, Marriage Status, or other personal or private information designated by Joyner Human Resources as personal or private.

Lists, reports, or other documentation containing personal or private employee Identification Information or Personal Employee History: Social Security Numbers, Driver’s License, Family History, Medical History, Genetic Information, or other personal or private identification information designated by Joyner Human Resources as personal or private.

Lists, reports, or other documentation containing employee demographics (whether consolidated or at an individual employee level) on: Race, Gender, Age, Disability, Gender Identity, Sexual Orientation, or other identified demographic groups protected by Federal, State or Local Law or Joyner policy.

If there are questions regarding how to classify and/or label employee information and data contact a member of HREC. Other resources include your Human Resources Manager or Director and Legal Services.