technicolor - 2018 Registration document

5 DISCLOSURE ON EXTRA-FINANCIAL PERFORMANCE SAFETY OF CUSTOMERS AND PROTECTION OF CONTENT

tungsten and gold) provided to Technicolor. Note that based on current suppliers surveyed in 2017, 100% of the smelters identified in the Connected Home supply chain are classified under the RMI. Some are still engaged in the CFSP. The majority of smelters are located in South East Asia and China. Regarding consumer product health and safety, the Group ensures that all products sold comply with all consumer safety regulations applicable in each country where the product is marketed. Additionally, in some emerging markets where safety regulations may not yet be robust, the Group applies its knowledge of appropriate product safety regulations and ensures that emerging market products comply with a higher product safety standard. Content security, cyber risks and respect of Intellectual Property 5.6.2 GRI [103-1 Customer privacy] [103-2 Customer privacy] [103-3 Customer privacy]

Besides the traditional objective of Content & IP protection, the Connected Home products have a key role to play in Privacy protection, and defense against massive scale cyberattacks. Physically positioned at the border between the private sphere of the end-user, and the Internet operators’ networks, the Technicolor Customer Premise Equipment (CPE) need to achieve best-in-class protection to contribute to global security and privacy efforts, and to provide security added value to our customers. An internal team of certified hackers assesses the security of Technicolor products, sites and systems. A responsible disclosure process is also implemented together with a public form to report vulnerabilities on Technicolor products and systems. Relations are established with skilled cybersecurity partners, and the CERT-CC to coordinate response to cybersecurity incidents. As a French company with headquarters in Paris, the Group has also nominated a global Data Protection Officer (DPO) to the French Data Protection Authority (CNIL). Technicolor Data Control Organization (DCO) is in place worldwide, to support compliance to Technicolor Privacy Policy and the General Data Protection Regulation (GDPR). The DCO supports the DPO and works in close relation with Legal and Security teams. Even if Technicolor activity does not directly collect sensitive personal information of private customers, a privacy-by-design approach is used for Technicolor products and systems, and the DCO is involved when a Data Protection Impact Analysis seems relevant.

As major stakeholder of the content creation and distribution industry, Technicolor is eager to carefully respect and protect Intellectual Property of its own assets and of its customers and suppliers assets. The Group policies and practices cover protection of invention, of physical media content, of physical and online content distribution, and of content creation within our premises and using our network. Respective risks description and risks management are presented in section 3.1.1 (Operational risks): cyber and physical content security for the Production Services • division (post production, visual effects, animation and games); physical security for the DVD Services division; • products development and cybersecurity for the Connected Home • segment. Technicolor information technologies security procedures as well as security processes of people and assets are presented in section 3.3.5. Prevention of growing cybersecurity issues is critical for Technicolor. As a major actor involved in all steps of the delivery of Media & Entertainment content to the end user, Technicolor has anticipated the new threats in cybersecurity, and implemented an internal program to address them. Organized at the corporate level around an Information Security Management System (ISMS), this program is now further implemented in the three Business Units (Production Services, DVD Services, Connected Home) focusing on their specific risks.

162

TECHNICOLOR REGISTRATION DOCUMENT 2018