What are the material issues the company has identified?             

In its 2020 Sustainable Development Report Mediclinic identified a range of material issues, such as climate change, human rights, supply chain management, employee wellness and safety, waste and hazardous waste management. Among these, promoting information security stands out as a key material issue for Mediclinic.

Stakeholder engagement in accordance with the GRI Standards              

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Mediclinic engages with:

To identify and prioritise material topics Mediclinic engaged with its stakeholders through the following channels: 

Stakeholder Group	Method of engagement
Clients	·      Press Ganey® patient experience index surveys ·      Disclosure of clinical performance results ·      Systematic patient rounds during hospital stay ·      24-hour helplines ·      Health awareness days ·      Brochures and magazines ·      Websites and blogs offering health-related information ·       Social media ·      Client alliance programmes
Communities	·      Corporate social responsibility (‘CSR’) initiatives ·      Supporting employee volunteer initiatives ·      Participation at national level in health training and education ·      Public-private initiatives and joint ventures at Hirslanden, Mediclinic Southern Africa and Mediclinic Middle East ·      Participation in the Public Health Enhancement Fund (‘PHEF’) in South Africa
Employees and potential applicants	·      Annual Gallup® employee engagement surveys ·      Training and development ·      Growth opportunities ·      Intranet and social media ·      Newsflashes and regular electronic updates ·      Performance reviews and formal recognition ·      Leadership video conferences and roadshows ·      Employee wellness programmes ·      Magazines and newsletters ·      Non-executive director for workforce engagement
Governments and authorities	·      Regular meetings ·      Participation in conferences and seminars ·      Representation on industry bodies and government boards ·      Participation in PPPs to enable healthcare, training and research
Healthcare insurers	·      Regular meetings regarding possible cost savings, clinical quality and healthcare delivery improvements ·      Annual tariff negotiations in a fair and transparent manner
Industry associations	·      Membership of industry associations and representation on governing bodies ·      Participation in research commissioned by associations ·      Participation in conferences
Industry partners	·      Direct engagement based on industry knowledge and market reputations ·      Cooperation and PPPs ·      Introductions through advisors ·      Industry conferences and events
Investors	·      Investor Relations department ·      Shareholder annual general meetings ·      Financial results reporting and presentations ·      Investor meetings, roadshows and conferences ·      Operational site visits ·      Stock exchange announcements ·      Sell-side analyst and salesforce meetings ·      Corporate website
Media	·      Media releases ·      Press conferences ·      Financial results reporting and presentations ·      Interviews and responses to media enquiries ·      Paid advertisements ·      Monitoring industry-related news and proactive response ·      Social media ·      The Future of Healthcare blog
Medical practitioners	·      Regular meetings ·      Participation in hospital clinical committees ·      Continuous professional education events ·      Electronic newsletters ·      Networking and know-how exchange events at Hirslanden ·      Dedicated medical practitioner portals at Hirslanden and Mediclinic Southern Africa ·      Medical practitioner participation in hospital boards ·      Biannual engagement events at Mediclinic Middle East ·      Annual Research Day at Mediclinic Middle East
Suppliers	·      Regular meetings and business reviews ·      Contract negotiations and management post-signature ·      Electronic product approval processes ·      Product demonstrations and evaluations ·      Training on product specifications ·      Attendance at trade fairs ·      Factory visits ·      Annual Modern Slavery Act due diligence questionnaire

What actions were taken by Mediclinic to promote information security?

In its 2020 Sustainable Development Report Mediclinic reports that it took the following actions for promoting information security:

• Implementing a Group InfoSec programme
• Mediclinic implements an elaborate Group InfoSec programme to optimally manage, monitor, detect and respond to InfoSec. The Group InfoSec Committee is represented by all divisions through dedicated Divisional Information Security Officers, while the proceedings of this committee are governed and informed through information security best practices sourced from several internationally acclaimed information and cyber security institutions. The Group InfoSec programme is based on the following guiding principles:
  • Adopting a risk-based approach towards cyber threats, which considers the likelihood of any risk materialising as well as its potential impact and measures for prevention and detection.
  • Expanding responsibility for cyber security beyond ICT to the whole organisation.
  • Ensuring end-to-end security across business processes, for mobile workers and teams as well as for data flows across geographic borders.
  • Implementing cyber-security-by-design, i.e. provision for effective protection against cyber threats from the outset when ICT capabilities are acquired or developed.

• Promoting data privacy
• Mediclinic reaffirmed its commitment to protecting the personal data of its stakeholders by embarking on an extensive Group-wide data privacy project to align and ensure compliance with all relevant data protection legislation, as may be applicable in the various countries of operation, including the EU’s General Data Protection Regulation (‘GDPR’), widely regarded as the gold standard for data protection. The Group Privacy and Data Protection Policy has been reviewed to ensure alignment to the GDPR standards and various initiatives are underway to ensure that core components are compliant with the GDPR framework. The project has been rolled out to the entire Group to ensure that other applicable data protection legislation is also complied with, or where no such specific legislations exist (i.e. Namibia), GDPR standards are complied with as a minimum.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by Mediclinic, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to Mediclinic: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2018-2020 Sustainability Report Vodafone Egypt identified a range of material issues, such as Covid-19 pandemic and crisis management, market leadership, business continuity, customer service excellence, community development. Among these, promoting data security and privacy stands out as a key material issue for Vodafone Egypt.

Stakeholder engagement in accordance with the GRI Standards             

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Vodafone Egypt engages with:               

To identify and prioritise material topics Vodafone Egypt engaged with its stakeholders through the following channels:

Stakeholder Group	Method of engagement
Employees	·       Daily direct communication ·       Digital Communication ·       Workplace and Workchat ·       Annual surveys ·       Events and newsletters ·       Emails ·       Meetings ·       Social media
Consumer and enterprise customers	·       Call centres ·       Satisfaction surveys ·       Website ·       Social media ·       Sales channels and retail stores ·       My Vodafone application ·       Advertisements ·       Digital marketing
Shareholders, investors and Vodafone Group	·       Financial information disclosure ·       Annual reports ·       Quarterly updates ·       General assembly meetings ·       Website
Suppliers and partners	·       Direct communication channels ·       Suppliers events ·       Trainings and awareness campaigns ·       Evaluation and qualification
Regulator	·       Public forums ·       Meetings ·       Industry consultations ·       Financial information disclosure ·       Audits ·       Participation in public policies
Local communities	·       Vodafone Foundation’s activities ·       Employees volunteering activities ·       Community partnerships ·       Public participation ·       Social media ·       Events ·       Word of mouth
Civil society and NGOs	·       Vodafone Foundation’s activities ·       Events in universities ·       Partnerships and collaborations ·       Social media

What actions were taken by Vodafone Egypt to promote data security and privacy?

In its 2018-2020 Sustainability Report Vodafone Egypt reports that it took the following actions for promoting data security and privacy:

• Implementing the Vodafone Group GDPR Programme
• Vodafone Egypt follows and implements the Vodafone Group GDPR (General Data Protection Regulation) Programme to ensure compliance with the new European GDPR, since it is mandated by Vodafone Group even for non-European Markets that do not primarily deal with European personal data and are not directly impacted by the new regulation. This direction ensures consistency, maturity and standards for the Vodafone Privacy Programme across Vodafone’s global footprint, to meet the requirements of the changing global regulatory and reputational privacy landscape. In addition, it puts Vodafone Egypt in the leading position in the Egyptian Market, being pioneers in this field and allows Vodafone Egypt to be the first compliant telecom operator with the intended Data Protection Law that is adopting GDPR, to be released soon in Egypt. Vodafone sets the required controls for protection against transactions with a sanctioned entity in breach of the sanctions legislation, potentially resulting in reputational damage, large fines, criminal penalties for individuals, and termination of the Vodafone Group’s financing arrangements. The objective is to make sure that Vodafone Egypt has a clear and robust set of controls in place, to minimise the risk of Vodafone breaching sanctions legislation.

• Applying a Privacy Programme
• Vodafone Egypt has initiated a customised Privacy Programme to ensure compliance with GDPR and with the planned Egyptian Data Protection Law through its various domains that correspond to GDPR’s requirements. The Privacy Programme assumes 10 basic commandments, reflecting Vodafone Egypt’s obligations according to the legal and global standards:
  • Design for Privacy
  • Protect Confidentiality
  • Collect relevant data
  • Provide a Privacy Notice
  • Provide Choices
  • Manage Data Carefully
  • No unauthorised disclosure
  • Secure Data
  • Protect Children’s Privacy
  • Respect Individual Rights

• Implementing a Privacy Policy
• Vodafone Egypt’s Customer Privacy Policy concerns the handling of Data Subject’s personal information, including the collection, storage, access, use, updating, disclosure, disposal, destruction, or any other processing of such information. Gathering information from customers serves the purpose of operating Vodafone Egypt’s business and enhancing its customer experience. Vodafone Egypt’s Privacy Notice was updated in April 2020.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by Vodafone Egypt, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to Vodafone Egypt: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2018 Environmental, Social and Governance Report BMO identified a range of material issues, such as business conduct, corporate governance, diversity and inclusion, employee engagement, talent attraction and retention. Among these, promoting customer data security and privacy stands out as a key material issue for BMO.

Stakeholder engagement in accordance with the GRI Standards             

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups BMO engages with:

Stakeholder Group	Method of engagement
Customers	·       Advisory panels ·       Complaints management process (e.g., BMO’s Ombudsman Office) ·       Customer experience surveys ·       Dedicated mailboxes ·       Focus groups ·       Meetings, phone calls and email correspondence ·       Social media ·       Stakeholder ESG surveys
Employees	·       Dedicated mailboxes ·       Enterprise Resource Groups ·       Internal grievance mechanisms ·       Senior leader internal blogs ·       Stakeholder ESG surveys ·       Surveys (ad hoc surveys, annual employee survey) ·       Team meetings ·       Town halls
Shareholder and Investor Community	·       Annual meeting ·       Disclosure of interim and annual financial results ·       Investor conferences ·       Investor Relations website ·       Management proxy circular ·       Meetings, phone calls and email correspondence ·       Quarterly conference calls ·       Stakeholder ESG surveys ·       Shareholder and Investor dialogue
Government and Regulators	·       Meetings, phone calls and email correspondence ·       Regulatory submissions
Civil Society	·       Interviews ·       Meetings, phone calls and email correspondence ·       Questionnaires ·       Research papers (on key issues for BMO’s industry) ·       Stakeholder ESG surveys ·       Surveys (on key issues for BMO’s organisation)

How stakeholder engagement was made to identify material issues

To identify and prioritise material topics BMO surveyed over 3,300 individuals – a representative sampling of employees, customers, investors, communities/civil society organisations (CSO) and BMO leaders in North America, Europe and Asia – to find out how they rated potential material topics on a four-point scale.

What actions were taken by BMO to promote customer data security and privacy?

In its 2018 Environmental, Social and Governance Report BMO reports that it took the following actions for promoting customer data security and privacy:

• Evaluating the effectiveness of key controls
• To maintain its resilience in the face of cyber-attacks, BMO routinely evaluates the effectiveness of key controls through testing, reviewing best practices and benchmarking. In these evaluations, BMO refers to the ISO 27001 information security management standard and the U.S. National Institute of Standards and Technology cyber security framework. BMO also works with cyber security experts and suppliers to improve controls, strengthen internal resources and enhance its technological capabilities. BMO’s enterprise-wide information security programme sets out requirements for carrying out mandatory annual information security and privacy training for employees, complying with relevant regulations and reporting information security issues to management and the Board.

• Implementing a Privacy Code
• In Canada, BMO’s Privacy Code outlines its commitment to its customers and the 10 key privacy principles BMO embraces. The Code also outlines the channels through which BMO’s customers can make and escalate privacy complaints. In other jurisdictions, BMO complies with all local requirements for providing mechanisms to raise privacy concerns. Additionally, BMO’s Privacy Office oversees a privacy risk governance programme, which sets out BMO’s policies and procedures for identifying, measuring, managing, mitigating and reporting privacy risk. All incidents involving suspected or actual breaches of privacy must be reported to the Privacy Office, which then manages BMO’s response to these incidents.

• Assessing and monitoring privacy risks
• Privacy risk is assessed and monitored in BMO’s supplier management and enterprise compliance programme The Privacy Office has a data-driven reporting system that tracks key metrics. The Office reports quarterly to the Audit and Conduct Review Committee of the Board of the Bank, and to the Audit Committee of BFC. It also provides reports on privacy issues to all BMO’s operating groups and corporate support areas, to help them understand their state of readiness for protecting privacy and to identify opportunities for improvement. In addition, to provide another layer of security for online banking customers, BMO invited them to download third–party software from its website that helps protect information against malware and fraudulent activity. When prompted through an online marketing campaign, 61,755 customers downloaded the software and in March 2018, during Fraud Awareness Month, BMO also posted a video about phishing on the Security Centre page of its website that attracted nearly 163,500 views, with 6,891 visitors viewing the complete video.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by BMO, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to BMO: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2018 Sustainability Report United Internet identified a range of material issues, such as customer satisfaction, environmental impact of products and services, non-discrimination, compliance and anti-corruption, diversity and equal opportunities. Among these, promoting data privacy stands out as a key material issue for United Internet.

Stakeholder engagement in accordance with the GRI Standards              

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups United Internet engages with:

Stakeholder Group

Customers

Investors

Employees

Business partners

Non-governmental organisations

Politicians and associations

Communities

How stakeholder engagement was made to identify material issues

To identify and prioritise material topics United Internet carried out an online survey among its external stakeholders, to obtain their perspectives on material sustainability topics. Survey participants included representatives of investors /analysts, business partners /customers (including wholesale telecommunications partners and outsourcing service providers), other suppliers, and industry associations.

What actions were taken by United Internet to promote data privacy?

In its 2018 Sustainability Report United Internet reports that it took the following actions for promoting data privacy:

• Applying extensive and clearly understandable rules

• United Internet promotes compliance by designing its guidelines and processes in a way that makes data privacy requirements more transparent and easier to understand. United Internet’s information brochure Information Security and Data Privacy provides clear explanations on how to handle data and information in a responsible way. Among other things, this includes questions on compliance with the basic rules of data privacy, how e-mail and the internet can be used securely, and which aspects have to be observed when welcoming visitors to the company.

• Providing regular data privacy training

• United Internet seeks to make sure that every employee plays an active role in protecting data against loss or unauthorised access and trains employees personally on data privacy regulations. In 2018, United Internet held a variety of training sessions on data privacy and information security, especially in connection with the EU’s new General Data Protection Regulation (GDPR). In addition to basic staff training, there were classroom sessions which specifically addressed the responsibilities of United Internet’s managers with regard to data privacy. United Internet’s Privacy department and Data Privacy Coordinators also give advice on issues concerning data privacy legislation, for example, in the field of product design and product development, or with regard to contractual agreements.

• Conducting systematic dialogue with the regulatory authorities

• United Internet’s Privacy department is in regular contact with the relevant data privacy authorities, above all to process concerns from clients that have been forwarded by the regulatory authorities. United Internet also passes on reports of data privacy violations in accordance with GDPR (49 in the reporting year) to the Federal Network Agency (Bundesnetzagentur) and to the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragter für den Datenschutz und die Informationsfreiheit – BfDI). Additionally, members of the Privacy department regularly engage in discussions with the BfDI about the latest data privacy issues.

• Deploying complaint mechanisms

• United Internet processes customer inquiries and customer complaints about data privacy through the trained staff of a special Customer Care department, in close coordination with the Privacy department, and responds to any incidents internally by adapting guidelines and sensitising employees where necessary. Employees also have the possibility to confer in confidence with the Compliance and Privacy departments in order to review any questions relating to data privacy which may arise during their activities. The Privacy department also carries out event-driven internal data privacy checks and is additionally involved in conducting audits to make sure United Internet’s service providers comply with data privacy regulations.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Promote peaceful and inclusive societies for sustainable development, provide access to justice for all and build effective, accountable and inclusive institutions at all levels
• Business theme: Compliance with laws and regulations, Protection of privacy

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by United Internet, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to United Internet: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2018 Sustainable Business Report Idea Cellular identified a range of material issues, such as network reliability and availability, customer experience and satisfaction, product stewardship, digital inclusion. Among these, promoting customer data security and privacy stands out as a key material issue for Idea Cellular.

Stakeholder engagement in accordance with the GRI Standards              

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Idea Cellular engages with:

Stakeholder Group	Method of engagement
Customers	·      Customer Satisfaction (CSAT) Survey ·      Net Promoter Survey ·      Spot surveys
Employees	·      Group & Team level Employee Satisfaction survey
Franchisees	·      FSAT & Mystery Shopping
Rating Agencies	·      Annual financial statement along-with other details as may be required for Annual Review
Shareholders & Investors	·      Annual General Meeting (AGM) ·      Investor meeting ·      Analyst meeting ·      Major Event update call ·      Earning call
Regulators and Government authorities	·      Various Compliances ·      Regular Meetings ·      Correspondence ·      Report Filings
Suppliers	·      Supplier Assessments ·      RFP ·      Vendor Surveys ·      Vendor performance evaluation feedback ·      Contract ·      Supplier training ·      Supplier rejection
Lenders	·      Annual financial statement along with Auditor’s Report ·      Quarterly Financial Statements ·      Network Rollout ·      Compliance Certificate
Media	·      Media Events ·      Media Interactions ·      Press Releases ·      Letters to Editors

How stakeholder engagement was made to identify material issues

To identify and prioritise material topics Idea Cellular engaged with its stakeholders through a questionnaire (suppliers and vendors) and surveys (customers and employees).

What actions were taken by Idea Cellular to promote customer data security and privacy?

In its 2018 Sustainable Business Report Idea Cellular reports that it took the following actions for promoting customer data security and privacy:

• Carrying out privacy risk assessments
• Idea Cellular conducts periodic privacy risk assessments to identify potential areas of risks and mitigation. ISMS (information security management system) practices are implemented to address such risks and compliance verifications are performed, through regular internal and external audits. Additionally, changes to applicable privacy laws, regulations, and policies from across various geographies are monitored and assessed and data privacy specific training programmes are designed and imparted to employees of customer accounts on all applicable privacy regulations.

• Implementing the Data Privacy Framework
• Idea Cellular’s Data Privacy Framework consists of three major enterprise components: the people (customers, employees, third party vendors and suppliers), the business processes and the technology (enterprise platforms).
  • The enablers of data protection and privacy under the enterprise component of ‘people’ comprise of privacy policy and procedure, the privacy of organisation and the efforts of training and awareness about it.
  • The enablers under the enterprise component of ‘business processes’ include the Personally Identifiable Information (PII) elements inventory, the PII usage framework, the privacy impact assessment framework and the Process PII containers and privacy controls.
  • The enablers under the enterprise component of ‘technology’ are application privacy controls, Aadhaar data vault privacy controls and end user privacy controls.
• This Framework ensures a consistent approach to privacy across Idea Cellular and enables the company to have a robust privacy policy, improving privacy adherence levels. It also improves effectiveness in privacy incident management and helps Idea Cellular with improved contractual guidelines with vendors for privacy. 

• Applying the decoy deception tool
• Another privacy, cyber security tool deployed by Idea Cellular is the decoy deception tool, which creates virtual honeypots across the network mimicking real world systems. A honeypot is a closely monitored network decoy serving several purposes: it can distract adversaries from more valuable machines on a network, can provide early warning about new attack and exploitation trends, or allow in-depth examination of adversaries during and after exploitation of a honeypot. This helps to detect any infected systems which are scanning the entire network for further infections and entice even the stealthiest hacker into revealing themselves and drawing them away from real assets. This new generation of distributed decoy technologies that employ deception as a way to misdirect intruders and disrupt their activities at multiple points along the attack chain help delay attackers and force them to spend more time and effort figuring out what is real and whether to proceed with an attack or not.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

 

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Promote peaceful and inclusive societies for sustainable development, provide access to justice for all and build effective, accountable and inclusive institutions at all levels
• Business theme: Compliance with laws and regulations, Protection of privacy

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.

 

References:

1) This case study is based on published information by Idea Cellular, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to Idea Cellular: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2018 Corporate Sustainability Report SGS identified a range of material issues, such as professional and operational integrity, talent acquisition and retention, market presence, diversity and equal opportunities, respect for human rights. Among these, promoting data security and privacy stands out as a key material issue for SGS.

Stakeholder engagement in accordance with the GRI Standards              

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups SGS engages with: 

Stakeholder Group	Method of engagement
Employees and suppliers	·      Global employee engagement programme, CATALYST ·      SGS Sharepoint intranet portal ·      SGS Inside newsletter ·      Training programmes, videos and e-learning modules ·      SHINE Onboarding ·      Annual integrity training ·      Annual Safety Month ·      Spot the Orange Dot environmental behaviour campaign ·      Sustainability learning ·      Employee Representation Councils (e.g. European Works Council – Euroforum) ·      Supplier Self-Assessment ·      Supplier Code of Conduct ·      Supplier Audits ·      Supplier Innovation Programme
Customers	·      One-to-one meetings ·      SGS-hosted conferences, seminars and webinars ·      Customer surveys, e.g. Voice of the Customer ·      White papers ·      Customer portal
Governments and industries	·      SGS-hosted conferences, seminars and webinars ·      Membership meetings and events ·      White papers ·      Governments and Institutions business line
Investors	·      Annual General Meeting ·      SGS Investor Days ·      Meetings with investors and analysts ·      Responses to analyst questionnaires
Communities and the planet	·      Annual community survey to measure the impact of community investment ·      White papers ·      One-to-one meetings with NGOs and responses to questionnaires
Consumers	·      Certification and product labelling ·      Direct marketing and communication with certain B2C products

How stakeholder engagement was made to identify material issues

To identify and prioritise material topics SGS carried out a survey among approximately 850 stakeholders in 52 countries, who included customers, senior managers, employees, suppliers, non-governmental organisations, ratings agencies, sustainability professionals and academics.

What actions were taken by SGS to promote data security and privacy?

In its 2018 Corporate Sustainability Report SGS reports that it took the following actions for promoting data security and privacy:

• Promoting cybersecurity
• SGS has a framework and team in place to protect intellectual property, business services and customer data by governing and managing cybersecurity. It is the team’s responsibility to manage SGS IT Security and Anomaly Detection Systems, deploying new tools where needed while identifying vulnerabilities, threats and potential incidents. SGS utilises several detection systems that monitor its network, system infrastructure and applications. The most critical of these detection systems are monitored on a continuous basis, while the rest keep audit information for analysis in case of enquiries or suspicion of fraudulent activity. Response times to potential incidents are monitored according to specific timeframe requirements, depending on the severity of the threat and its criticality. Any major security issues are investigated by the IT Security Department and, once the root cause has been identified, the impact of any proposed mitigation is evaluated and communicated. To promote high levels of cybersecurity, technical standards ensuring a sound security baseline have been developed and SGS also runs a continuous security awareness programme. As part of this programme, SGS carries out IT security training several times a year, for all employees. Cybersecurity is also an area that is taken seriously when integrating the IT systems of acquisitions and partners into those of the SGS Group.

• Complying with the GDPR
• In 2018, SGS put in place measures and mechanisms to make sure it complies with the General Data Protection Regulation (GDPR). These are detailed in the SGS GDPR Compliance Statement, which describes the steps SGS is taking to update and expand data security and protection across the Group. It also outlines the dedicated internal team in place to develop and implement the GDPR roadmap – assessing gaps and implementing enhanced and new policies and procedures. At the same time, SGS launched the GDPRONLINE service, to support customers in complying with the EU regulation.

• Providing training
• In 2018, SGS rolled out global awareness training on data protection and privacy principles as an e-learning module. This training is relevant to all employees, whether they collect and process personal data or not. Accordingly, the aim is to reach all SGS employees and, currently, SGS’s awareness training has been rolled out to more than 93,000 employees, with a completion rate of 95%.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

 

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Promote peaceful and inclusive societies for sustainable development, provide access to justice for all and build effective, accountable and inclusive institutions at all levels
• Business theme: Compliance with laws and regulations, Protection of privacy

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.

 

References:

1) This case study is based on published information by SGS, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to SGS: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2018 Sustainability Report Sun Life identified a range of material issues, such as digital innovation, talent management, workforce wellness, diversity and inclusion, environmental impacts. Among these, promoting data security and privacy stands out as a key material issue for Sun Life.

Stakeholder engagement in accordance with the GRI Standards

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The organization should identify its stakeholders, and explain how it has responded to their reasonable expectations.”

Stakeholders must be consulted in the process s of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Sun Life engages with:   

To identify and prioritise material topics Sun Life listened to and consulted with internal and external stakeholders throughout the year via diverse channels that included the following:

Stakeholder Group	Method of engagement
Clients	·      Client experience surveys ·      Focus groups ·      Other feedback channels (in-person, mobile apps, email, social media, call centres, online communities) ·      User testing website
Employees/Advisors	·      Global Engagement Survey ·      Training and development activities ·      Internal social media and online forums ·      Manager/staff meetings, including formal performance appraisals ·      Town hall meetings with senior executives ·      Employee Ethics Hotline ·      Internal inclusion networks ·      Millennial think tank
Shareholders, Investors, ESG Analysts	·      Investor Days ·      Annual meetings ·      Quarterly earnings conference calls ·      Webcast presentations ·      Participation in conferences ·      Meetings with investor groups ·      Participation in surveys
Community Organisations and Members	·      Community outreach ·      Sponsorships ·      Employee and advisor giving and volunteerism ·      Media relations ·      Community consultations/meetings
Suppliers	·      Request for proposal processes ·      Regular meetings and briefings ·      Ongoing relationship management ·      Supplier risk assessment ·      Supplier Diversity Programme
Governments and Regulators, Industry Associations	·      Participation in consultation processes, conferences and events ·      Memberships and participation in industry/trade associations and working groups ·      Sun Life Political Action Committee (U.S.) ·      Ongoing dialogue

What actions were taken by Sun Life to promote data security and privacy?

In its 2018 Sustainability Report Sun Life reports that it took the following actions for promoting data security and privacy:

• Implementing a security awareness programme
• Sun Life’s global security awareness programme educates all employees on their security responsibilities and on Sun Life’s Security Policy. The programme includes compulsory security training, security alerts and bulletins, and additional training for specific groups, such as managers and system administrators. Sun Life’s security architecture includes firewalls, intrusion detection systems, network monitoring, encryption and other tools to prevent and detect cyber security attacks.

• Promoting privacy protection
• Sun Life’s Global Privacy Programme is embedded in its enterprise-wide risk management framework and includes various standards and processes. Additionally, Sun Life’s Global Privacy Commitment outlines principles to ensure personal information remains private and confidential. Sun Life employs privacy by design in its product development, and includes privacy clauses in contracts with third parties that handle client data. All employees receive privacy training and guidance through Sun Life’s privacy policies, to understand and fulfill Sun Life’s corporate privacy commitments and all relevant regulations.

• Strengthening defences
• To strengthen its defences, in 2018 Sun Life:
  • Initiated over 20 projects to increase its cyber security capabilities. Examples include enhancements to security alerting and incident response processes.
  • Continued to embed its privacy risk appetite statement and compass in internal processes, to better manage privacy risks and guide employees during the development and deployment of new products and initiatives.
  • Enhanced its privacy risk self-assessment processes to better identify risks and strengthen privacy controls in ongoing business processes, products and initiatives. 

• Promoting cyber safety
• To promote cyber safety, in 2018 Sun Life:
  • Carried out monthly phishing simulation tests with every employee.
  • Broadened its cyber security training and education to include new ways of reaching and engaging employees. For example, Sun Life:
    • used Workplace by Facebook to deliver a live streaming event that featured Q&As with executives, offering a forum for employees to ask questions about how to protect data and privacy both at work and at home; and
    • created topical blogs, posts and animated videos to bring cyber security issues to life. Topics addressed common questions and concerns raised by employees, such as online security, anti-virus protection, social media security and the Internet of Things.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed? 

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Promote peaceful and inclusive societies for sustainable development, provide access to justice for all and build effective, accountable and inclusive institutions at all levels
• Business theme: Compliance with laws and regulations, Protection of privacy

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.

 

References:

1) This case study is based on published information by Sun Life, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning.  If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to Sun Life: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2016 Corporate Responsibility Report State Street identified a range of material issues, such as compliance and business ethics, talent recruitment, development and retention, client satisfaction, wealth and income creation in society, ESG products and services, fair competition, local job creation, responsible sourcing. Among these, promoting client data protection and privacy stands out as a key material issue for State Street.

Stakeholder engagement in accordance with the GRI Standards

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The organization should identify its stakeholders, and explain how it has responded to their reasonable expectations.”

Stakeholders must be consulted in the process s of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups State Street engages with:   

Stakeholder Group

Shareholders

Clients

Employees

Academics

NGOs

Investment analysts

Business partners

How stakeholder engagement was made to identify material issues

To identify and prioritize material topics State Street conducted an online survey among employees, clients, investors, suppliers, NGOs and academics. The survey was supplemented with in-person and online workshops for employees and follow-up interviews with external stakeholders.

What actions were taken by State Street to promote client data protection and privacy?

In its 2016 Corporate Responsibility Report State Street reports that it took the following actions for promoting client data protection and privacy:

• Using a software data classification tool
• As accurate data classification is highly important for State Street, a software tool that helps classify information assets is deployed. The tool requires that emails and most common user-created documents fall into one of the following classifications: Highly Confidential, Personal Sensitive Data, Confidential, Limited Access, Company Internal or General. All information has to be properly labeled, distributed, stored and disposed of on the basis of this classification.

• Implementing a Data Loss Protection Program
• To monitor and prevent data leakage, State Street implements a Data Loss Protection Program. The Data Loss Protection Program includes tools that prevent endpoint data loss, web proxy controls, file transfer protocol (FTP) monitoring and internet usage monitoring. In addition, State Street has developed a corporate Data Loss Protection strategy. This strategy will help standardize and streamline such programs across the company.

• Employing endpoint protection software
• To promote threat detection, as well as analysis of activities on endpoint devices (e.g. laptops, desktops, virtual desktops), State Street applies endpoint protection software. Additionally, through a Shadow IT identification program, State Street is able to detect and analyze data communicated to external sites, so as to further control unauthorized activity and data exfiltration.

Which GRI indicators/Standards have been addressed?

The GRI indicator addressed in this case is: G4-PR8: Total number of substantiated complaints regarding breaches of customer privacy and losses of customer data and the updated GRI Standard is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.

 

References:

1) This case study is based on published information by State Street, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) http://www.fbrh.co.uk/en/global-reporting-initiative-gri-g4-guidelines-download-page

3) https://g4.globalreporting.org/Pages/default.aspx

4) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to  State Street: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2015 Corporate Responsibility Report Deutsche Telekom identified a range of material issues, such as ICT solutions for a low-carbon economy, service quality, ICT and child safety, cyber safety, talent acquisition, retention, development and staff reduction, climate change mitigation. Among these, promoting data privacy and security stands out as a key material issue for Deutsche Telekom.

Stakeholder engagement in accordance with the GRI Standards

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The organization should identify its stakeholders, and explain how it has responded to their reasonable expectations.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Deutsche Telekom engages with:   

Stakeholder Group	Method of engagement
General public / all stakeholders	·         Annual CR report ·         Telekom.com/responsibility ·         We Care app magazine
Employees	·         engagement@telekom corporate citizenship program ·         Telekom Social Network ·         Internal events such as Guiding Principles Day
Customers	·         Free 24-hour service ·         Used cell-phone collection campaigns ·         Involvement in product development
Suppliers	·         Development programs for suppliers ·         CR Stakeholder Forum
Analysts and investors	·         SRI roadshows ·         Webinars
Non-governmental organizations (NGOs)	·         Collaborations ·         Stakeholder dialog
Politics	·         Political advocacy at EU, Germany-wide and state level ·         Memberships, e.g., in the ZIRP Rhineland-Palatinate initiative for the future (www.zirp.de)
Journalists	·         Workshops, e.g., with Deutsche Journalistenschule students
Compliance experts	·         Exchange and membership in international and national organizations
Corporate partners	·         Collaborations and partnerships for the development of sustainable solutions

How stakeholder engagement was made to identify material issues

To identify and prioritize material aspects Deutsche Telekom evaluated the results of an online stakeholder survey among 312 stakeholders (including customers, employees, analysts and investors, NGO representatives, suppliers and others).

What actions were taken by Deutsche Telekom to promote data privacy and security?

In its 2015 Corporate Responsibility Report Deutsche Telekom reports that it took the following actions for promoting data privacy and security:

• Publishing an annual data privacy and Transparency Report
• Deutsche Telekom was the first DAX-30 company to publish an annual data privacy report in 2008, regarding all relevant processes, and since 2011 has been also publishing an integrated data privacy and data security report. Additionally, since 2014 Deutsche Telekom has been publishing an annual Transparency Report, relating to the amount and types of information shared by the company with German and international security agencies.

• Providing employees with data privacy training
• Every two years Deutsche Telekom’s employees receive data privacy training, with specific trainings carried out in the company’s customer and human resources departments to minimize the risk of data abuse, which include online courses, presentations, and face-to-face courses on topics such as “Data privacy at call centers”.

• Annually auditing data privacy standards
• Deutsche Telekom carries out an annual data privacy audit, intended to measure and improve the company’s general data privacy standards. In 2015, 30 per cent of Deutsche Telekom’s employees were randomly chosen and interviewed online, with the data privacy audit accompanied by data privacy officers’ self-assessments at Deutsche Telekom’s national companies, relating to the implementation of the Binding Corporate Rules on Privacy.

• Raising employee awareness about data privacy
• Deutsche Telekom launched, in January 2015, an international campaign aimed at increasing employee awareness of data privacy’s importance. Approximately 150 employees participated in the “Don’t give the data slob a chance” ideas competition, addressing the issue of dealing with data privacy lightly in a number of ways, including cartoons and videos.

Which GRI indicators/Standards have been addressed?

The GRI indicator addressed in this case is: G4-PR8: Total number of substantiated complaints regarding breaches of customer privacy and losses of customer data and the updated GRI Standard is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.

 

References:

1) This case study is based on published information by Deutsche Telekom, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) http://www.fbrh.co.uk/en/global-reporting-initiative-gri-g4-guidelines-download-page

3) https://g4.globalreporting.org/Pages/default.aspx

4) https://www.globalreporting.org/standards/gri-standards-download-center/

 

Note to Deutsche Telekom: With each case study we send out an email to your listed address in request for a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2014 Better Future Report BT has identified a range of material issues, such as climate change & energy, customer experience, pay & benefits, health and safety, fibre & Wi-Fi investment. Among these, online safety and privacy stands out as an issue of critical importance: in the digital age, staying one step ahead of potential cyber-attacks and using state-of-the-art technology to protect its own and its customers’ data, keeping customers’ devices secure, is key for any telecommunications company.

Stakeholder engagement in accordance with the GRI Standards

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The organization should identify its stakeholders, and explain how it has responded to their reasonable expectations.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups BT engages with:

Stakeholder Group

Customers

Suppliers

Investors

Employees

Government bodies

Non-governmental organisations

How stakeholder engagement was made to identify material issues

BT regularly talks to people with a stake in its business to explain its approach and to understand what they expect of BT and how well they think it is doing. This takes place during its daily dealings with different groups, through online discussion forums, phone conversations, meetings, focus groups, social media and regular dialogue with expert membership groups, such as Business in the Community (BITC) and Chatham House. In 2013 BT introduced innovative techniques to crowdsource opinion to help the company incorporate more stakeholder views and greater analysis into its Better Future programme.

In 2013/14, BT sought additional stakeholder views by identifying and analysing public content from blogs, social media and online news sites, as well as on TV and radio. This technique gives the company a better understanding of issues that are important across all stakeholder groups and of who is influential in relation to those issues. BT monitors how these issues affect its business and Better Future programme, feeding the insights into its business decisions and materiality process. This analysis supplements more traditional stakeholder engagement such as meetings and focus groups to give BT access to a much broader stakeholder perspective.

In July 2013, BT ran its first online Better Future Forum, bringing together almost 200 sustainability experts from 22 countries to discuss the potential for business to make a positive overall contribution to the environment. A panel of 15 experts moderated by GlobeScan shared their thoughts and participants globally responded with almost 800 comments. Driven by these insights BT worked with WWF-UK, Forum for the Future, The Climate Group and leading UK and multinational companies to launch the Net Positive Movement, a diverse group working together to promote the Net Positive approach and encourage other businesses to focus on having a positive impact on the environment.

What actions were taken to make BT’s customers feel secure using its technology and confident that BT will respect and protect their personal information?

In its Better Future Report 2014 the following targets were set by BT regarding the protection of its own and its customers’ data, based on the Group’s approach to materiality – on taking action on what matters, where it matters:

• Keeping BT’s network and customers’ devices secure

As well as protecting its own customers’ data, BT uses more than 70 years of experience to offer managed security services that help its enterprise customers protect their clients’ data. Its free advice and security software helps consumers to keep their devices secure from viruses – and their families safe while online. The company developed BT Protect, which helps prevent infection from all sorts of nasty viruses and spyware by warning a customer if he/she is about to visit a potentially harmful website whenever he/she is browsing online using his/her BT broadband connection. Behind the scenes, BT’s Security Operations Centres monitor its customers’ devices 24 hours a day, 365 days a year, to spot breaches and potential weaknesses and to keep its network secure.

• Combating cyber-threats

In 2013 BT launched a cyber-security operations centre to monitor all internal networks and cyber related incidents round the clock. The centre helped launch BT Sport safely and securely in August 2013 and provided enhanced network and systems monitoring during high-profile UK Premiership matches.

• Raising data security standards

BT collaborated with other internet service providers and UK Government to develop a set of Guiding Principles on Cyber Security, which were published in December 2013. As voluntary signatories, BT committed to help its customers understand online threats and to provide tools and advice on security software to help keep them safe while online.

• Promoting child safety online

Since 2010, BT has invested more than £5m in filtering tools and education to help children and young adults use the internet safely. In 2013 it launched a new filter, BT Parental Controls, which gives new customers the option to install network-based parental controls as standard. To help its Wi-Fi site partners stop pornographic and child abuse material being viewed on their premises, BT launched BT Wi-Fi Protect. This free filtering service is used by 50 of its Wi-Fi partners (representing 90% of its hotspot traffic) and all new partners receive this service as standard, unless they opt out. In 2013/14, BT launched The Right Click: Internet Safety Matters in partnership with UNICEF – a three-year programme providing practical advice about online child safety to up to 35,000 teachers, parents and children in the UK. Working in partnership with Sky, TalkTalk and Virgin Media, BT also created Internet Matters – an organisation that promotes child online safety to parents. The supporting campaign emphasises the message ‘Learn about it. Talk about it. Deal with it.’ In 2013 BT increased its annual funding to the Internet Watch Foundation (IWF), a hotline for reporting criminal child abuse content, from £40,000 to £75,000. To deter users from accessing child abuse material identified by IWF, BT also launched a new ‘splash page’ that makes clear why access has been denied, warns users that viewing indecent images of children is a criminal offence and provides the number of Stop it Now!, a confidential helpline for those with concerning or illegal internet use.

• Respecting BT customers privacy

BT ensures its employees understand the importance of privacy and their role in protecting its customers’ personal information. [tweetthis]All of BT’s 87,800 employees participate in mandatory privacy training[/tweetthis], and BT conducts awareness-raising workshops for employees across its operations who are directly involved in managing customers’ data. BT recognises that there is always room for improvement and has implemented a consequence management system for violations of its privacy policies to help employees learn from their mistakes.

Which GRI indicators/Standards have been addressed?

The GRI indicator addressed in this case is: G4-PR8: Total number of substantiated complaints regarding breaches of customer privacy and losses of customer data and the updated GRI Standard is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

 

References:

1) This case study was compiled using published information by BT which is located at the links below. For the sake of readability, we did not use brackets or ellipses but made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original please revert to the following links:

http://www.btplc.com/betterfuture/betterfuturereport/pdf/2014/Better_Future_report2014-complete_report.pdf (May 2014)

http://www.btplc.com/Purposefulbusiness/Safetyandsecurity/Privacyandsecurity/ (April 2016)

2) http://www.fbrh.co.uk/en/global-reporting-initiative-gri-g4-guidelines-download-page

3) https://g4.globalreporting.org/Pages/default.aspx

4) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to BT: With each case study we send out an email to your listed address in request for a comment on this case study. If you have not received such an email please contact us.