on the transfer of personal datafrom the European Union

BCRsseptembre 2008.doc

1

TABLE OF CONTENTSI.

PRELIMINARY REMARKS

3

II.

DEFINITIONS

3

III.

DELEGATED DATA PROTECTION MANAGER

4IV.

MICHELIN GROUP ENTITIES TO WHICH THE INTERNAL RULES APPLY5V.

DESCRIPTION OF PROCESSING OPERATIONS

5VI.

NATIONAL REQUIREMENTS REGARDING ENTITIES

5

VII.

UNDERTAKINGS OF THE DATA EXPORTER AS CONTROLLER

5

VIII.

UNDERTAKINGS OF THE DATA IMPORTER AS CONTROLLER6IX.

INFORMATION AND RIGHTS OF DATA SUBJECTS6X.

GUARANTEED APPLICATION7XI.

TRAINING AND AWARENESS-RAISING

7

XII.

DIFFICULTY FOR ENTITIES TO APPLY COMPANY RULES

7

XIII.

RESTRICTIONS ON SUBSEQUENT TRANSFERS

7

XIV.

CONFIDENTIALITY8XV.

DATA SECURITY

8

XVI.

RELATIONS WITH INTERNAL PROCESSORS BASED OUTSIDE THE
EUROPEAN UNION (IMPORTERS) AND NON-GROUP PROCESSORSBASED WITHIN THE EUROPEAN UNION

9

XVII. MONITORING APPLICATION OF THE INTERNAL RULES

9

XVIII. HANDLING OF COMPLAINTS

9

XIX.

LIABILITY – DISCIPLINARY ACTION

10

XX.

COOPERATION WITH THE SUPERVISORY AUTHORITIES

11

XXI.

UPDATING THE INTERNAL RULES

12

XXII. LAW APPLICABLE TO THESE INTERNAL RULES

12

XXIII. AMICABLE ARRANGEMENT: JURISDICTION

12

XXIV. EFFECTIVE DATE - DURATION

12APPENDICES

13

BCRsseptembre 2008.doc

2

I.

PRELIMINARY REMARKSIn accordance with European Union Directive 95/46/EC dated 24 October 1995 andEuropean Union Directive 02/58/EC dated 12 July 2002, these Internal Rules areintended to provide acceptable guarantees that personal data is protected duringtransfers from said Michelin Group entities based in one EU Member State or a country
providing an acceptable level of protection, to other Michelin Group entities based inother countries (outside the EU) that do not provide an acceptable level of protection.

II.

DEFINITIONSDefinitions: personal data, processing of personal data, Controller and Processor usedin these Internal Rules are taken from directive 95/46/EC dated 24 October 1995.
The terms and expressions used in these Internal Rules have the following meaning:“Personal data”,” Data” any information relating to an identified or identifiable natural
person (the data subject); an identifiable person is one who can be identified directly or
indirectly , in particular by reference to an identification number or to one or morefactors specific to his/her physical, physiological, psychological, economic, cultural orsocial identity.

“Sensitive data”, any information concerning racial or ethnic origin, political,
philosophical or religious views, health, or sexual orientation.

“Entity”, any legal entity of the Michelin Group that exports or imports Personal data.

“Exporter of personal data or Exporter”, a Michelin Group entity based in theEuropean Union or in a country that provides an acceptable level of protection, andwhich transfers personal data to another Michelin Group entity based in a country that
does not provide an acceptable level of protection.

“Purpose of processing”, objective(s) of an application, irrespective of the medium
used (electronic, paper or other) that processes personal data.

“Importer of personal data or Importer”, a Michelin Group entity based in a country
outside the EU that does not provide an acceptable level of protection, and which
receives personal data from the Exporter for processing in accordance with theprovisions of these Internal Rules.

“Country providing an acceptable level of protection”, 1) EU member states andalso 2) Liechtenstein, Norway and Iceland, 3) countries for which the European
Commission has issued an adequacy decision: Canada, Argentina, Switzerland, Isle of

BCRsseptembre 2008.doc

3Man, Guernsey and/or 4) all countries that may join the European Union and/or about
which a decision regarding adequacy will be taken.

“Data subject”, an identified or identifiable natural person to whom the transfer of
personal data applies.
“Privacy Officer”, any national representative (natural person) in charge of protecting
personal data in each legal department of the Michelin Group Companies.

“Data Controller (Exporter or Importer)”, the natural person or legal person, publicauthority, agency or any other body which alone or jointly with others, determines the
purposes and means of the processing Personal data. Where the purposes and meansof processing are determined by national or Community laws or regulations the Data
Controller or the specific criteria for his nomination may be designated by national or
Community law. Within the Michelin Group the Data Controller is the legal entity
represented by the employee, whether Head of Department or not, who determines the
purposes and means of processing.

“Data Processor”, the natural person or legal entity, public authority, department or any
other body which processes personal data on behalf of the Data Controller.

“Processing of personal data”, “Processing”, any operation or set of operations,which is performed upon Personal data whether or not by automatic means such ascollection, recording, organization, storage, adaptation or alteration, retrieval,consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, blocking, erasure or destruction.

“Transfer”, any disclosure of Personal data via a network or any disclosure from one
medium to another, irrespective of the type of medium, in so far as such data is
intended for processing in the recipient country, other than situations in which the data
merely crosses the European Union territory.

III.

DELEGATED DATA PROTECTION MANAGER

Due to its central role in the operational organisation in Michelin Group, the Michelin
Group's parent company, Compagnie Générale des Etablissements Michelin, which isconstituted under and governed by French law, has delegated to Manufacture
Française des Pneumatiques Michelin (hereinafter referred to as MFPM), which is also
constituted under and governed by French law, responsibility for applying the Binding
Corporate Rules for the protection of Personal data within the Michelin Group for thetransfer of Personal data from member states of the European Union.

BCRsseptembre 2008.doc

4

IV.

MICHELIN GROUP ENTITIES TO WHICH THE BINDING CORPORATE RULES
APPLYThe purpose of these Binding Corporate Rules is to organise cross-border flows of
Personal data between the Exporters and the Importers listed in Appendix 1.
The Exporters and Importers undertake to abide by these Rules. A group directive has
been drawn up and a system of group management organised. This has involved thecreation of a Personal Data Protection Committee chaired by the Group’s legal director
and composed of the directors of the personnel, IT systems and security Group
Services.

V.

DESCRIPTION OF PROCESSING OPERATIONS

These Binding Corporate Rules relate to the processing operations, whether automatedor otherwise, specified in appendix 2 comprising personal data that has been processedin the European Union and transferred outside the European Union for processing.

VI.

NATIONAL REQUIREMENTS REGARDING ENTITIESEach Exporter and/or Importer is to ensure that Personal data processing operations
comply with its local law and these Binding Corporate Rules.

VII. UNDERTAKINGS OF THE DATA EXPORTER AS CONTROLLER
The Exporters warrant that they have completed the prior formalities required by law
with the national supervisory authority with jurisdiction for the original processing as
regards the transfer of Personal data that is envisaged.
The Exporters undertake that the processing of Personal data carried out under theircontrol, including data transfers at their initiative, will continue to be carried out inaccordance with the provisions of these Binding Corporate Rules and in particular thefollowing:

7.1 Rules regarding the quality of Data collectedExporters undertake to ensure that personal data transferred to Importers is:-collected and processed in a fair, lawful manner;collected for specificied, explicit and legitimate purposes and not further
processed in a way incompatible with those purposes;
adequate, relevant and not excessive in relation to the purposes for which they arecollected and or further processed;
accurate, complete and, where necessary, keep up to date;

BCRsseptembre 2008.doc

5-stored in a form that allows the Data subjects to be identified for no longer thannecessary for the purposes for which they are collected and processed.

7.2 Limitation of data transfers to a specific purpose
Within the framework of transferring Personal data to Importers, Exporters warrant that:-the transfer of Personal data is carried out for a specific, explicit, legitimate
purpose;the Data transferred is not further processed such in a way incompatible withthose purposes.

7.3 Rules for Sensitive data
Subject to compliance with the national provisions made under Community Directive
95/46/EC dated 24 October 1995, processing operations related to Sensitive data
and/or use biometrics are prohibited in principle.

VIII. UNDERTAKINGS OF THE DATA IMPORTER AS DATA CONTROLLER
Importers undertake to process the Data transferred in accordance with the intended
purpose at the time of collection and consequently to process Personal data in amanner compatible with the purpose of the Transfer and in accordance with theprinciples for processing Personal data set out in Articles VII, IX, XII, XIII, XIV and XV ofthese Binding Corporate Rules.

IX.

INFORMATION AND RIGHTS OF DATA SUBJECTSIn the event of a Transfer of Personal data to an Importer, data subjects are entitled to:---obtain a copy of these Binding Corporate Rules from the people or departments
named in Appendix 3, on request and within a reasonable time frame,
be informed of the Transfer of their Personal data, the purpose of the Transfer, theplace in which the data Importer is based and the lack of adequate protection (asdefined in European Directive 95/46/EC dated 24 October 1995) provided by thecountry in which the Importer is based,
obtain access to all processed data relating to themselves and, where appropriate,obtain its rectification, erasure or blocking if it emerges that it has not beenprocessed in accordance with the principles laid down by these Binding Corporate
Rules,
object to the processing of their Personal data on compelling, legitimate grounds
relating to their particular situation,refer their complaints to the people or departments named in Appendix 3,
refer the matter to the relevant data protection authority,refer the matter to the court with jurisdiction.

BCRsseptembre 2008.doc

6

X.

GUARANTEED APPLICATION

Michelin Group entities undertake to take all the steps needed to implement these
Binding Corporate Rules.

XI.

TRAINING AND AWARENESS-RAISING

Michelin Group entities undertake to implement training programmes on the protectionof their employees’ Personal data, particularly those who have access to and retrieve
Data, those involved in developing data processing systems, managerial staff and thestaff of group personnel, IT, audit and security Group Services. An example of a user
guide for French employees is attached as appendix 6.
Relevant, up-to-date information on transferring Personal data and a copy of theBinding Corporate Rules are available on the Group Intranet: this information will also
be circulated by internal memo and posted on the notice boards provided for the
purpose.
Disciplinary action may be taken in response to breaches of these Binding Corporate
Rules. The relevant disciplinary measures are set out in Article XVII below.

XII. DIFFICULTY FOR ENTITIES TO APPLY COMPANY BINDING CORPORATE
RULES
If an Importer has reason to believe that the applicable legislation might prevent it from
fulfilling its obligations under these Rules and have a detrimental effect on theguarantees provided, said Importer shall immediately inform MFPM, unless prohibited to
do so by a judicial authority or proceedings.
Under such circumstances MFPM must take a managerial decision and consult theauthority with jurisdiction over data protection.

XIII. RESTRICTIONS ON SUBSEQUENT TRANSFERS
A distinction needs to be made between two different situations:
1. Transfers of Personal data to non-Michelin Group Data controllers.
For all subsequent Transfers, each Importer/Exporter undertakes to draw up a contract
with the non-Group company Data controllers. This contract will be based on thestandard contractual clauses adopted by the European Commission in Decision No.

BCRsseptembre 2008.doc

72001/497/EC dated 15 June 2001, modified on 27 December 2004 (for transfers to Data
controllers), made under Directive 95/46/EC dated 24 October 1995.

2. Data transfers to non-Group Data processors.
For all subsequent transfers to Data processors, each Importer/Exporter undertakes todraw up a contract with Data processors based in countries outside the EU. This
contract shall be based on the standard contractual clauses adopted by the European
Commission in Decision No. 2002/16/EC dated 27 December 2001 (for transfers toData processors), made under Directive 95/46/EC dated 24 October 1995.

XIV. CONFIDENTIALITY
Only people expressly designated to receive disclosure may have access to the
Personal data contained in a file.
They are prohibited from using such Data for personal purposes, transmitting it to nonexpressly designated third parties or using it in any way whatsoever.

XV. DATA SECURITY

Exporters and Importers have adopted a range of technical and organisational
measures to protect personal data from any form of damage, loss, misuse, intrusion,
disclosure, corruption or destruction. These measures apply to:---

the physical and environmental protection of IT rooms, computer hardware orcomputer media used for Data to ensure the continuity of processing or avoid theloss of information following theft or deterioration due to fire, water damage orother natural disasters,
the use of security devices (software or hardware) and the administration ofaccess rights that provide logical protection over processing and Data by
preventing unauthorised people from accessing them or human error fromdamaging their integrity, availability and confidentiality,
company networks protected against cyber-attacks by the use of firewalls and antimalware software,
Personal data transmitted outside the company network securely according to the
Data controller’s instructions,management of changes such that the continuity, integrity, confidentiality andsecurity of Data is ensured;organisation with functions being divided over several different people ororganisations.

BCRsseptembre 2008.doc

8XVI. RELATIONS WITH INTERNAL DATA PROCESSORS BASED OUTSIDE THE
EUROPEAN UNION (IMPORTERS) AND NON-GROUP DATA PROCESSORSBASED WITHIN THE EUROPEAN UNION
These Binding Corporate Rules cover transfers of Personal data to internal Data
Processors based outside the European Union, or to non-Group Data processors based
within the European Union. It is simply pointed out, where necessary, that Exporters
undertake to apply procedures to ensure that said data processors comply with theconfidentiality and security of the Data to which they are given access. Data processors,in turn, are to give the said Exporters sufficient guarantees that the prescribed security
and confidentiality measures are effectively implemented. To formalise this aspect,contracts between the data controller and the Data processor must set out the
obligations falling to the Data processor with regard to data security and confidentiality
and specify that the data processor must only act on instruction from the Data controller.
On termination of the contract, the data processor undertakes to either destroy any hardor soft copies of the file in which the information is stored, or return any media
containing Personal data that may have been provided, if the law of the country in which
said data processor is based allows this. Otherwise, the data processor is to ensure thatthe confidentiality of the Data is protected and that said Data does not undergo any
further processing.

XVII. MONITORING APPLICATION OF THE BINDING CORPORATE RULES
Exporters and Importers have appointed a number of Privacy Officers, who may also be
designated by the protection authority with jurisdiction if permitted by local law. The
Privacy Officers are responsible for ensuring that the operational data controllers
comply with these Internal Rules. They will also be accountable for their task to MFPM.
The Privacy Officers will also carry out regular, periodical compliance checks to ensurethat the principles laid down in these Internal Rules are effectively applied. Thesechecks will concern the accuracy of the first-level checks conducted by the operational
Data controllers, in accordance with the specific Michelin Group internal procedures set
out in appendix 4 and based on the compliance check programme appended as
Appendix 5.
On completion of the compliance check procedure, a report will be drawn up and sent to
the global privacy manager.
On request a copy of the report will be sent to the relevant data protection authority.

XVIII. HANDLING OF COMPLAINTS
1. In the event of dispute, Data subjects may lodge a complaint about any unlawfulprocessing or handling of their personal data that is incompatible with these Binding
Corporate Rules with the Privacy Officers of their country either directly or by letter.

BCRsseptembre 2008.doc

9Unless it proves particularly difficult to find the necessary information, complaints
must be investigated within one month of their being lodged.
2. Within the framework of these Binding Corporate Rules, the Privacy Officers are
responsible for:-identifying and registering individual complaints from Data subjects,
drawing up a list of such complaints,
conducting an enquiry into the reality of the alleged contraventions,seeking to mediate by offering compensation, after informing MFPM. There is asystematic mediation and amicable settlement procedure before matters arereferred to court or the supervisory authority with jurisdiction.

3. The fact that complaints handling is centralised with the Privacy Officers in no way
impedes or curbs Data subjects' right to lodge complaints with the supervisory
authority or the data protection court with jurisdiction.

4. Data subjects who have suffered damage caused by an Importer relative to Personal
data transferred by an Exporter based in the European Union to an Importer basedoutside the European Union that the European Commission does not recognise as
having an acceptable level of protection due to illicit processing or any action that is
incompatible with these Internal Rules are entitled to:-insist that the operations performed in breach of these Binding Corporate Rules becorrected,
compensation for the loss suffered.

5. The independence of Privacy Officers is guaranteed during the performance of theirduties and they are bound to strict neutrality in the cases they handle.

XIX. LIABILITY – DISCIPLINARY ACTION

Exporters and Importers of Data are answerable to Data subjects for failing to performtheir respective obligations. They may be either partially or fully exonerated if they can
prove that they are not responsible for the cause of such failure.
Each Exporter and/or Importer accepts that a Data subject is entitled to compensation
for damage caused by an Importer relative to Personal data transferred by an Exporterand consequently accepts the jurisdiction of the country in which the Exporter is based.
In situations where complaints are lodged alleging that the Importer has failed in its
obligations, the Data subject must first ask the Exporter to take acceptable steps inorder to assert its rights against the Importer. If the Exporter fails to take such steps
within a reasonable time (normally 1 month), the Data subject may then assert its rights
against the Importer directly. A Data subject is also entitled to take action directly

BCRsseptembre 2008.doc

10against an Exporter who has failed to make reasonable efforts to determine whether the
Importer is capable of satisfying its obligations under these Binding Corporate Rules.
Exporters and Importers have sufficient financial resources at their disposal to cover thepayment of compensation for breach of these Binding Corporate Rules.
MFPM may take disciplinary action, in particular in the event of:-breach of these Binding Corporate Rules,
failure to apply the recommendations and advice issued after the Privacy Officers
have checked for compliancy,
failure to cooperate in checks for compliancy with Binding Corporate Rules carriedout by Privacy Officers, or with the relevant authorities responsible for theprotection of Personal data.

In accordance with applicable labour law, company rules and employment contract,
disciplinary measures may be taken against anyone in breach of the rules.
If requested by the Group’s Personal Data Protection Committee such sanctions may
also include the following measures:-

publication of the Privacy Officer’s recommendations on the Group’s intranet,
publication of the sanctions decided by the authority responsible for dataprotection,
temporary or definitive ban on continued flow of data.

XX. COOPERATION WITH THE SUPERVISORY AUTHORITIESExporters and Importers agree to:-cooperate with the relevant data protection authorities:o during any enquiries they may conduct;o by replying to any requests they may make within a reasonable timeframe.

Exporters and Importers agree to lodge a copy of these Binding Corporate Rules withthe relevant authorities if required by the governing national law on data protection in
the State where the Exporter is based.
Exporters and Importers undertake to follow the advice and recommendations of therelevant authorities regarding the interpretation and application of these Binding
Corporate Rules.

BCRsseptembre 2008.doc

11

XXI. UPDATING THE BINDING CORPORATE RULES
Updating the content of the Binding Corporate Rules
The Binding Corporate may be amended in a decision by the Personal Data Protection
Committee.
As part of Michelin Group's undertakings under Article XX of these binding Corporate
Rules, the Data Protection Coordinating Authority must be notified of any amended textof the Binding Corporate Rules.

Updating the list of entities to which the company's Binding Corporate Rules
apply.
The Personal Data Protection Committee undertakes to appoint a person or department
to be in charge of drawing up a list of the Michelin Group entities to which the Binding
Corporate Rules apply, and to keep it up to date.
No personal data may be transferred to a new entity based in a country outside the EU
which does not provide an acceptable level of protection until the Michelin Group entity
exporting the Data has checked that the new entity is bound by these Binding Corporate
Rules and is capable of complying with them.
The relevant data protection authorities must be notified of any changes to the list ofentities.

XXII. LAW APPLICABLE TO THESE INTERNAL RULES
The provisions of these Binding Corporate Rules are governed by the law of theMember State in which the Exporter is based.

XXIII. AMICABLE ARRANGEMENT: JURISDICTION
Failing an agreement between the Data subject and the Michelin Group entity
concerned, or failing performance of the provisions contained in the amicableagreement as part of the mediation procedure specified in Article XVIII above,
jurisdiction shall be attributed to the court of the exporting or importing entity.

XXIV. EFFECTIVE DATE - DURATION
These Binding Corporate Rules take effect on the date of the Group Directive, for anunspecified duration.

BCRsseptembre 2008.doc

12

APPENDICES
These Binding Corporate Rules include the following appendices:-

Appendix 1: List of the Michelin Group entities exporting and importing Personal
data,

-

Appendix 2: Processing operations governed by these Binding Corporate Rules,-

Appendix 3: Job description of the Privacy Officers and mission of Privacy
Committee-

Appendix 4: Briefing note on Michelin Group internal procedures, group procedureand covering note, Michelin’s internal audit process-

Appendix 5: Binding Corporate Rules compliance programme;-

Appendix 6:French employee user guide

BCRsseptembre 2008.doc

13