Privacy Policy Relating to Personal Data Received from the European Union
April 1, 2007
PPM Energy, Inc. (together with its US subsidiaries and affiliates, "PPM") is an indirect subsidiary of ScottishPower, a company based in the United Kingdom, a member of the European Union. In accordance with the terms of European Union Directive 95/46 EC (the "EU Privacy Directive"), as enacted in the United Kingdom by the Data Protection Act of 1998 (the "Data Protection Act"), transfers of "personal data," as defined by the Data Protection Act, to a non-EU country may only take place if there are adequate safeguards in place with respect to the protection of privacy of individuals in relation to the transfer of their Personal Data.
As a result of temporary and permanent employee exchanges between PPM and its US affiliates and their respective affiliate companies in the United Kingdom, PPM may from time to time receive human resources, benefits or other personal information that constitutes "personal data" under the Data Protection Act or that is otherwise subject to the EU Privacy Directive ("Personal Data"). Personal Data includes any personal information relating to an living individual, and may include, but not be limited to, employee name and date of birth, spouse and children's names and dates of birth, remuneration, including base salary, incentives, pension deductions, share scheme deductions, emergency contact details, length of employment, salary history and performance ratings.
PPM is committed to maintaining the confidentiality of Personal Data consistent with the EU Privacy Directive, the Act, and the Safe Harbor Privacy Principles relating to the EU Privacy Directive issued by the U.S. Department of Commerce on July 21, 2000, and to that end has adopted the following policies with respect to the use and administration of Personal Data.
Uses of Personal Data
Personal Data will be used solely in connection with the evaluation and administration of employment, performance management, benefits programs, compensation, hiring and other company business (including periodic audits and in connection with other diligence examinations). To the extent permitted under applicable law, the consent of the relevant employee shall be obtained prior to use or disclosure of Personal Data to third parties for any other purposes.
Control and Protection of Personal Data
Subject employees will be advised that PPM has received and is maintaining Personal Data, and shall, subject to applicable law, be given the opportunity to review, ensure the accuracy of and correct any Personal Data.
PPM will designate a single member of the Human Resources Department as a Data Protection Representative, who shall be responsible for monitoring and maintaining the Personal Data. Personal Data will be maintained securely by and at the direction of the Data Protection Representative. Access to Personal Data in either physical or digital form will be limited, and will be restricted to the Data Protection Representative and persons specifically authorized thereby.
PPM will review its procedures for the maintenance, control and protection of Personal Data on an annual basis.

