Data Protection

Binding Corporate Rules

To consistently regulate the way in which personal information is handled or processed among the group companies of the business segments Fresenius Kabi (Fresenius Kabi AG and its affiliated companies) and Fresenius Corporate, we adopted Binding Corporate Rules (BCR). These BCR are approved by the European data protection authorities.

BCR are internal rules for data processing within multinational organizations and, together with the associated security policies and procedures, aim to create a globally uniform and adequate level of data protection for the participating companies.

Commitment to a common standard for the processing of personal data and to an effective approach to data protection, compliance reinforces our commitment to protect your privacy at the global and local level.

In case you are interested in our Binding Corporate Rules, please have a look at the document or the summary below:

Fresenius Kabi Binding Corporate Rules Document (415 KB)

Summary of the Binding Corporate Rules

Below summary does not replace the Binding Corporate Rules (BCR) document. The BCR document will in all cases be the only document that is legally applicable.

An adequate and uniform level of data protection

Fresenius needs to follow many data protection laws around the world. The Binding Corporate Rules (BCR) set a uniform and adequate level of data protection. This enables the internal exchange of personal data between the Fresenius entities in scope.

Applicable around the world

The BCR apply to the following Fresenius entities:

Fresenius Kabi AG including all subsidiaries / affiliates
Fresenius Digital Technology GmbH
Fresenius SE & Co. KGaA

Applicable for certain activities

The BCR apply to the following personal data processing activities:

All activities by European entities
Activities of non-European entities:
- When they collect personal data on behalf of a European Fresenius entity or
- When they collaborate with a European Fresenius entity
- When they receive personal data from European entities
- When they collect personal data from people located in Europe for the offering of goods and services or related to monitoring behaviour

BCR apply to both paper based and IT based processes.
The BCR apply to all processes that allow structured search for personal data.

BCR sets the minimum level

If any local data protection laws require stricter or additional rules on processing of personal data, these need to be observed additionally.

If a local law contradicts the BCR, the Data Protection Officer (DPO) needs to be informed. The DPO will assess the impact and resolves the conflict.

If an entity receives an order of an authority to disclose personal data that is not in line with the BCR requirements, the DPO needs to be informed. The DPO will inform the supervisory authority in Germany.

The BCR are binding to the organisation and our employees

The BCR need to be obliged and are binding for:

All entities: they sign a contract
All employees: they have the duty to follow corporate policies based on their employment contract

Organisations and people can derive rights under these obligations.

The enforcement of the BCR and potential sanctions because of violations are the same as any other policy violation.

When processing personal data, we will follow several principles to protect the fundamental rights and freedoms of individuals in accordance with the BCR. Each entity must comply with the following principles when processing personal data:

Principle 1: Lawfulness

Have a documented legal basis when collecting, using and processing personal data. These legal bases are limitative listed. Examples are:

The processing is necessary for the performance of a contract with the individual, such as employee contracts and sales contracts
The individual has given consent
The legitimate interests of Fresenius are bigger than the negative consequences for the individuals
The need to fulfil other legal obligations, such as tax laws, vigilance requirements or GxP requirements

Special categories of data, such as health data, need additional legal grounds.
If local laws require additional or divergent provisions, these must also be followed (this might for example be relevant for employee data).

Principle 2: Transparency and Fairness

Handle personal data fairly and in a transparent manner. Inform individuals before or at the moment of collecting and using the personal data about:

Who is responsible and how we can be contacted
What data is collected
How the data is collected
Why we need the data (purpose)
With what organisations the data is shared
If data is shared with other countries
How long the data will be stored
The legal basis for collecting and using data and an explanation of this legal basis (principle 1)
If the individuals are profiled
If we make any decisions by automated means
If the data must be provided and what happens if that is not done
The contact details of the DPO and the authority
The rights that the individuals have

All this information must be provided in a comprehensive and in an easily accessible form, using clear and plain language.

Principle 3: Purpose Limitation

Only use personal data for the specified, explicit and legitimate purposes for which it is collected. Further use is not allowed, unless this further use is in line with the original purpose and/or additional measures are taken.
Purposes for further processing which are generally deemed in line with the original purpose are:

Archiving
Internal audit
Investigations

The LDPA/DPA will be able to provide guidance if a change of purpose might be permitted. In case of a permitted change of purpose, individuals must be informed of any such changes.

Principle 4: Data Minimization

Only collect and use personal data that is necessary for the defined purpose as communicated to the individual. That means to ensure that personal data is relevant and not excessive in light of the purpose.

Principle 5: Accuracy

Keep personal data accurate and up-to-date. Procedures must be implemented to ensure that inaccurate data is deleted, corrected or updated without delay.

Principle 6: Storage Limitation

Do not keep personal data longer than is necessary for the purpose it has been collected for, unless it is required by law. In such case access to it has to be restricted. Delete or anonymise personal data if there is no legal reason or purpose anymore.

Principle 7: Security, Integrity and Confidentiality

Take appropriate technical and organizational measures to protect personal data against destruction, loss, alteration, disclosure or access to personal data (e.g. through appropriate roles & rights concept, backup and restore or by using encryption).
When implementing such measures, the risks to the individual must be considered. The security of IT systems must be assessed in light of these risks when installing and maintaining IT systems.
Document and report any breach of security that is likely to result in a risk for the affected individuals to the data protection organization. Depending on the situation such breaches must also be notified to the supervisory authority, the individuals or other organisations.

Principle 8: Accountability

Be able to demonstrate compliance with the BCR. This is done by creating and maintaining appropriate documentation such as:

Records of processing activities
Technical and organizational measures taken to comply with the data protection principles and to address the risks
Data protection risk and control assessments

Engagement of Processors

Only engage processors that provide sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of the BCR and local data protection laws. This must be ensured by a data protection contract between the respective entity and the processor.

(Onward) Transfers of personal data

Implement measures to adequately safeguard transfers of personal data to other organisations situated outside of the EEA in compliance with these BCR's. This could be done by agreeing standard contractual clauses as adopted by the European Commission with the other organisation.

Individuals must be enabled to exercise their rights (data subject rights):

Right to access personal data: The individual can ask to access/receive information about individual personal data processed by Fresenius (e.g. the purpose of processing, the categories of personal data concerned, the recipients, storage periods, any existence of automated decision-making).
Right to rectify personal data: The individual can ask to correct inaccurate or incomplete personal data.
Right to erase personal data: The individual can ask to delete his/her personal data unless it must be maintained e.g. due to legal retention requirements.
Right to restrict processing of personal data: The individual can ask to restrict the processing of his/her personal data if either the accuracy of the personal data is contested, or the processing is unlawful (no longer required for the pursued purposes).
Right to receive personal data in a portable format: The individual can ask to receive their personal data in a commonly used and machine-readable format, if the following conditions are met:
- Personal data have been provided by the individual
- The processing is based on the individual’s consent or on a contract with the individual
- The processing is carried out by automated means.
Right to object to the processing of personal data: The individual can, due to his or her personal situation, object to processing of his or her personal data based on legitimate or public interest. Such request must be assessed. Further the individual can object to direct marketing and profiling. The processing must then stop.
Right not to be subject to automated decision making: The individual has the right not to be subject to automated decision making (incl. profiling) which could lead to legal or similar significant effects on the individual, unless:
- It is necessary for entering into or performance of a contract between the individual and the respective entity
- It is based on the individual’s explicit consent.

Access to BCR

The BCR must be available for individuals in an appropriate manner. The BCR will be published on the internet and intranet.
Individuals can also access the BCR by contacting the respective DPO or any member of the data protection organization.

BCR complaint handling

Each individual is entitled to:

Claim violation of the BCR, local data protection laws, orders by supervisory authorities, internal policies and guidelines, or voluntary self-commitments related to data protection
Address its individual rights
Enforce any other right of the BCR

Any such complaints can be submitted e.g. via phone, by email or letter, orally by approaching the respective DPO, the respective LDPA/DPA or the compliance hotline.
In case the complaint is considered justified, the entity will take adequate action(s) to address the complaint and inform the individual respectively within a month.

Liability and Enforcement

Individuals who are affected by or have suffered damages as a result of the processing of their respective personal data, are entitled to enforce these parts of the BCR and if applicable to receive compensation before a competent court.
In case of proven violations by parties established outside the EU/EFA, Fresenius SE & Co. KGaA (FSE) accepts responsibility and liability for any damages towards the individuals. The entity, who caused the damage, shall provide reasonable assistance to FSE to respond to such complaints or requests in a timely manner.

Cooperation with Supervisory Authorities

Each entity is required to cooperate with the supervisory authorities, to comply with advice concerning the interpretation of these BCR and to accept being audited by the concerned supervisory authorities.

Training

Each entity will enrol and oblige their employees to participate in a training on the BCR and data protection and to regularly repeat such training. General training must be provided at least bi-annually to all relevant employees. Furthermore, role specific training (e.g. for HR or procurement departments) is provided considering the specific needs of certain roles/persons.

Auditing

All parties will commit to be regularly audited (through planned or ad hoc audits) to evaluate and test compliance with the BCR and implement adequate and sufficient mechanisms to remedy non-compliance of an entity with the BCR. The data protection organization will follow up on any conducted audit to assess whether proposed corrective actions have been appropriately implemented and document any outcomes in the audit report. Each entity will make audit reports available to supervisory authorities upon request.

Update of BCR

Parties will review local data protection laws and indicate if changes to BCR are necessary. Fresenius can amend the BCR if needed. Any significant changes to the BCR will promptly be reported to each entity and to the supervisory authority. Any other non-substantive amendments to the BCR will be reported to the parties as soon as practicable.