GDPR & ILLUMINA PROACTIVE
Introduction
The General Data Protection Regulation (GDPR) is a European Union (EU) regulation that went into effect May 25, 2018 to establish
obligations for organizations that collect or process personal data of EU citizens. This regulation is part of an evolving body ofprivacy laws that establish data protection rules. The basic requirement for legal protection is the existence of personal data,
defined under Article 4(1) as any information related to an identified or identifiable natural person (e.g., name, address, email, etc.).
As a global leader in next-generation sequencing, Illumina handles personal data, including genetic data, which is a special
category of personal data under the GDPR. At Illumina, we have measures in place to protect personal data that are outlined
in our Privacy Policy. It is important to note that the GDPR is not implicated when personal data is not involved.

Is the data collected by Proactive subject to GDPR protection?
No. Illumina Proactive is a monitoring service in which instrument performance data and not personal data are sent to Illumina
to enable more accurate diagnosis of failures and detection of failure risks. By activating Proactive, users maximize instrument
uptime through preemptive detection and notification of elevated instrument risk. Direct access to the instrument throughProactive accelerates efficient troubleshooting.
At no point does Proactive access personal data. Illumina instruments are designed to capture instrument performance data,
which are any metric that can characterize the operational performance of the instrument, including software logs, instrument
configurations and other file types.
The instrument performance data captured by Proactive do not contain personal data. Since the GDPR applies only to personaldata, it is not applicable to Proactive services.

Doesn’t GDPR have different requirements for special categories of datasuch as the genomic data being processed by Illumina’s instruments?
Yes. Under Article 9 of the GDPR, certain types of sensitive personal data require a higher level of protection because of the risk
associated with processing this data. Genetic data, biometric data for the purpose of uniquely identifying a natural person, anddata concerning health all fall under the GDPR’s special category of personal data. Genetic data files that are processed on Illumina
instruments such as fastq and BAM files may qualify as special categories of data. However, as stated above, the performance data
captured and transmitted to Illumina by the Proactive service never contains personal data, including special categories of data.
Proactive does not collect personal data or genetic data – the tool only captures instrument performance data, therefore, GDPR is
not applicable.

Illumina • 5200 Illumina Way • San Diego, CA 92122 • Tel 858.202.4500 • Fax 858.202.4766 • www.illumina.com

Since Illumina is based in the United States, if Proactive is enabled, arethere international data transfer terms that need to be put in place tocomply with GDPR?
No. Since Proactive does not capture or transmit personal data, GDPR data transfer requirements are not an issue. Other Illumina
cloud-based solutions such as BaseSpace Sequence Hub, Clarity LIMS and Illumina Connected Analytics may have data transfer
implications separate from Proactive. Those solutions were developed with a Privacy by Design methodology and, where possible,
limit international data transfer issues.

If Proactive is enabled on an instrument, does Illumina have access to thegenomic or other personal data on that instrument?
Illumina Proactive sends instrument performance data, which includes software logs and instrument configurations (refer to Tables
8 through 13 of the Illumina Proactive Technical Note for specific data files.). Illumina Proactive does not send sequencing run datawith genetic sequences (fastq files), sample sheets or personal data.

What terms govern the use of Proactive?
There are legal terms of use associated with Proactive – Instrument Performance Data Legal Terms. These terms include provisions
that Illumina may collect, maintain, process, and use diagnostic, functionality, and performance related data and related information
to facilitate the provision of Hardware and Software updates, product support, verification of compliance with the terms of
the Software’s end user license agreements and Illumina’s standard Terms and Conditions applicable to this Hardware, makeimprovements to Illumina’s products and services, and make recommendations and/or provide products or services to customers.

M-GL-01198 v1.0

Illumina • 5200 Illumina Way • San Diego, CA 92122 • Tel 858.202.4500 • Fax 858.202.4766 • www.illumina.com