1

GPHR
2022

Functional Area 06
Risk Management and
Compliance

Global Professional in Human Resources

INTERNATIONAL HUMAN RESOURCE CERTIFICATION INSTITUTE

IHRCI ® | www.ihrci.org
 Global Professional in Human Resources (GPHR) Workbook

Module Six: Risk Management and Compliance

2022 Edition

Copyright © 2022 by International Human Resource Certification Institute

All rights reserved. No part of this book shall be reproduced, stored in a retrieval
system, or transmitted by any means – electronic, mechanical, photocopying,
recording, or otherwise – without written permission from the International Human
Resource Certification Institute (IHRCI). No patent liability is assumed with respect
to the use of the information contained herein. Although every precaution has been
taken in the preparation of this book, the publisher and author assume no
responsibility for errors or omissions. Neither is any liability assumed for damages
resulting from the use of the information contained herein.

International Human Resource Certification Institute (IHRCI)

Flat/Rm, B, 5/F, Gaylord Commercial Building, 114-118, Lockhart Road.

Hong Kong

www.ihrci.org
Introduction
As a purchaser of the GPHR certification workbook serials, you have access to the
www.ihrci.org learning system. The system contains Glossary that provides a search box and
a description of the key terms in HR. Also, the system consists of over 1,000 practice exam
questions and answers with explanations in our database including pre-test, review-test, and
post-test:
Pre-test: It contains the same percentage of questions from each content area. Participants
can take a pre-test of that module to access their conceptual understanding of that specific
area of the GPHR Body of Knowledge. When the pre-test is completed, an overall correct
percentage is provided along with the number and percentage of questions answered
correctly. The answers with explanations to individual questions are also provided. Our
system allows users to save the results of the pre-test so that they can improve upon that
later.
Review-test: Every review test contains questions with explanations which help to
understand the concepts of that particular knowledge area for each section of the study
workbook. Once you successfully finish reviewing for one section text in the workbook; you
naturally get access to the next section. Every new section helps construct on the earlier
concepts learnt in the previous knowledge areas. Please do step-wise study for all the
knowledge areas.
Post-test: Once you complete with all the knowledge areas, have a post-test through the full
length simulated practice tests under the same testing conditions as the actual exams. With
165 questions covered during the 3 hours test. These tests are designed to help you get the
feel of the final GPHR Exam, with similar format and question types. Practice till you are near
to 80% correct answers in the post-test. This helped you in understanding areas where you
have improved since the last test as well as list down topics for which you needed more
revision.
Access to the learning system is valid for twelve (12) months from the date of purchase to
cover two test windows. Each practice for the pre-test, review-test, and post-test may be
taken as many times as you would like within the 12 months. Access to these practice exams
is for your individual use; your account is not to be shared with others. Your use of the online
practice exams signifies your acknowledgment of an agreement to these terms.
This workbook is not a textbook. These materials include workbooks and practice exams are
intended for use as an aid to preparation for the GPHR Certification Exam conducted by the
HR Certification Institute. By using all of the preparation materials, you will be well-versed in
the five key functional areas that make up the HR Certification Institute GPHR body of
knowledge. Studying these materials does not guarantee, however, that you will pass the
exam. These workbooks are not to be considered legal or professional advice.
Table of Content

Introduction ............................................................................................................................... iii

Table of Content ........................................................................................................................ iv
Part One: Risk Management and Compliance ........................................................................... 6
1. HR Risk Management ..................................................................................................... 6
2. Risk for International Assignment .................................................................................. 7
2.1. Safety and Security Risks ..................................................................................... 8
2.2. Health and Medical Risks .................................................................................... 9
2.3. Legal Prosecution Risk ......................................................................................... 9
3. Emergency Planning for Expatriates............................................................................. 10
3.1. Assessing Risk .................................................................................................... 11
3.2. Building a Framework for an Emergency Plan .................................................. 12
3.3. Putting Together an Evacuation Plan................................................................. 14
3.4. Working with the Right Service Providers ......................................................... 14
3.5. An Anecdote with a Moral ................................................................................ 15
3.6. Starting on the Right Foot ................................................................................. 15
3.7. Preparedness and Response ............................................................................. 17
4. Extraterritorial Laws ..................................................................................................... 17
4.1. U.S. Title VII of the Civil Rights Act .................................................................... 18
4.2. U.S. Americans with Disabilities Act (ADA) ....................................................... 18
4.3. U.S. Foreign Corrupt Practices Act (FCPA) ......................................................... 18
4.4. UK Bribery Act ................................................................................................... 19
5. Employee Records and Data ......................................................................................... 19
5.1. The General Data Protection Regulation (GDPR) .............................................. 20
5.2. EU Safe Harbor .................................................................................................. 25
5.3. Health Insurance Portability and Accountability Act (HIPAA) ........................... 39
5.4. Australian Privacy Principles (APPs) .................................................................. 42
6. Global HR Compliance .................................................................................................. 44
6.1. Assemble the compliance team ........................................................................ 44
6.2. Articulate audit context and scope ................................................................... 45
6.3. Create a master audit checklist template ......................................................... 45
6.4. Align local-country checklists off the master .................................................... 46
6.5. Conduct the audit .............................................................................................. 46
6.6. Report and implement remedial measures ...................................................... 47
7. Global employee investigation plan ............................................................................. 47
7.1. Take Necessary Immediate Action .................................................................... 48
7.2. Review applicable policies ................................................................................. 48
 7.3. Identify Investigator(s) ...................................................................................... 49
7.4. Assess special legal or cultural considerations .................................................. 49
7.5. Develop An Interview Strategy .......................................................................... 50
7.6. Preserve Evidence ............................................................................................. 50
7.7. Remediation across borders .............................................................................. 51
Reference .................................................................................................................................. 53
6

Part One: Risk Management and Compliance

1. HR Risk Management

Research from global independent organizations shows that risk related to human
resource management (”People Risk”) is largely ignored or misunderstood by HR and
strategic-level planners. Furthermore, People Risk does not commonly feature as part of
Enterprise Risk Management (ERM). A study by the Economist Intelligence Unit highlighted
risk associated with human resource management as the most significant threat to global
business operations. Another study by the Conference Board classified this risk as the
fourth biggest impact on business performance, but placed it tenth in terms of how
effectively it is measured and managed within the business.

By including the assessment of People Risk in regular HR planning activities, relevant

stakeholders can recognize its significance and potential impact and then determine the
necessary steps to mitigate those risks.

With the size and scope of People Risk, it’s important to get a clear understanding of the
various elements that sit under this concept and place them in a structure that allows a
business to include People Risk as an integral part of their risk management strategy.

The below figure illustrates a four-step process that Aon Hewitt has developed to allow HR
professionals and related stakeholders to begin implementing a review of People Risk
within their daily operations. The first step is for HR to prepare to handle People Risk by
aligning its processes and language with the other types of risk that are already managed
within the business. The second step is to identify People Risks based on the operational
processes and strategic decisions in which the business partakes. The third step is to
devise a strategy to minimize the impact of each risk on the business. Lastly, the fourth
step is to communicate your findings to the risk management stakeholders within the
organization and to ensure that HR is covered for the consequences of risk.
 7

HR Process for Including People Risk as Part of the Company’s Enterprise Risk Management Strategy

• Understanding the concept

Preparation • Assigning ownership
• Documenting strategic and operational processes involving HR

• Identifying risks for each strategic/operational event based on HR

processes
Identification • Categorizing into internal/external risks, calculating probability and
impact

• Devising mitigation technique for each risk

Mitigation • Formulating complete strategic plan for neutralizing people risk

• Align business language and communication strategy with ERM

stakeholders
Communication • Raise awareness of the importance of people risk due diligence
• Communicate findings from identification and mitigation steps

Source: Wade, G. (2012). Understand People Risk from Holistic Perspective. Aon Hewitt.

Once this is done, HR can return to identifying and monitoring risks as they appear. The
following pages flesh out each stage of the diagram in detail.

2. Risk for International Assignment

In most large firms, even though responsibility for employee health and safety resides in
the HR department, the HR manager responsible for international HR in the headquarters
of an MNE does not often deal with health and safety issues among foreign subsidiaries or
joint ventures. Responsibility for health and safety issues is normally left to the local
subsidiary.

Additional areas of concern to multinational international HR managers within this topic of

employee safety include the differences in medical systems in various countries (both in
the form and quality of the delivery of medical services and in access to high-quality health
care); the coverage of the health care system in different countries and who pays for
health care; and the form and level of support systems for various forms of disabilities.

Expats or business travelers may be exposed to both health and safety risks. To identify risk
areas, companies can check medical and political risk mappings. They can also take a look
at the recommendations and advice provided by various institutions or government
departments. Calling upon the services of a risk management specialist also is an option.
8

2.1. Safety and Security Risks

2.1.1. Terrorism

One aspect of the topic of health and safety for international HRM that has received a
small amount of attention, but is probably the least important (unless, of course, it
happens to you!), is the problem of terrorism and/or kidnapping (the subject of a
separate heading). International terrorists have at times targeted the facilities and
executives of MNEs (and/or their families). Even though the news media attention to
these acts when they occur makes it seem as though they happen all the time,
everywhere, to all expatriates and their families, the frequency of and danger involved
with terrorist acts demonstrates that people are more likely to drown in their own
bathtubs than to be killed by terrorists! This is not to say that expatriates and their
families don’t need to be briefed on such concerns and oriented to a constant
awareness of the potential risks.

Of course, some countries present greater risks than others. And when expatriates are
being asked to serve in locales of greater risk, greater precautions need to be taken.
Various corporate reactions have ranged from essentially trying to ignore such
terrorism to abandoning certain markets where such terrorism is seen as more likely.
Some firms have tried to protect their managers and their families in various ways,
such as fortifying their homes, providing trained chauffeurs and guards, and using
local-sounding names for their subsidiaries to try to hide the identities of the MNE
parents of their local operations. In addition, some firms have purchased kidnap and
other kinds of insurance to cover their key executives.

2.1.2. Crime

Actually, the biggest threat to international travelers is not terrorism but old-fashioned
crime, such as theft and pick-pocketing. In addition, the arrest and incarceration of
traveling employees who either knowingly or innocently break local laws can be a
major concern. “Travelers have been thrown in jail for exceeding a credit card limit,
buying artifacts from an unlicensed dealer, entering an Islamic country with alcohol, or
failing to meet a contract deadline.” Indeed, in some countries, even false arrest of
American personnel can be a problem, particularly where this is a practice of local, low-
paid government officers or police to earn extra income.

And, then, while some expatriates end up in jail because they unknowingly commit
what may seem (at least in their home countries) not very serious crimes, others may
commit quite serious crimes while on foreign assignment (such as extortion or drug
 9

trafficking). And yet others get involved with less serious but still quite illegal activities,
such as drug and alcohol use, use of illegal prostitution, taking illegal pictures, or black
market money exchange.

Here, as with the other areas described, international HR needs to prepare policies and
procedures for dealing with such contingencies. And it needs to brief IAs and families
on the seriousness of local law and how to access the support that the employer can
provide.

2.1.3. Kidnapping

For international HR this poses a significant issue that must be addressed. Employee
advising, special kidnap insurance, security for international assignment living quarters
and for foreign offices and plants, special trained drivers, response plans, etc., all need
to be addressed ahead of time by international HR. For any MNE with employees
traveling to or residing in a country where there is a risk of terrorism, extortion, or
kidnapping, IHR needs to do a thorough analysis of the risk and to employ security
professionals to provide security briefings and protection for executives and other
employees traveling to and/or residing in high risk cities and countries.

2.2. Health and Medical Risks

Business travelers and international assignees and their families frequently (if not
usually) suffer from health complaints ranging from intestinal disorders due to
exposure to new bacteria that the immune system is not used to major exotic illnesses.

The fear of ending up in situations where the sufficient level of medical care is not
available can spoil any expatriation, journey or holiday. Language barriers, cultural
differences, poor medical facilities or bad infrastructure can make expatriates feel
uncomfortable and unsafe. The lack of cooperation between medical and social
organizations excludes homeless people from medical care, and prevents health
professionals from providing follow-up care, resulting in chronic diseases that may lead
to recurring emergencies. MNCs can outsource these activities to vendors that provide
specific health advice and customized medical kits based on health risk assessments for
expatriates.

2.3. Legal Prosecution Risk

International assignees should be aware that the criminal prosecution process varies
from one country to the next. They and their family members should know how to
10

request immediate assistance from the nearest consular office or embassy in the event
of an arrest. A consular or embassy representative will explain the local judicial system;
provide a list of local attorneys; contact family and friends (if authorized by the
prisoner); facilitate the transfer of money, food, and clothing; ensure that the prison
conditions are humane and healthy; arrange medical examinations, if appropriate; and
protect against discriminatory treatment. Risk management begins with a clear
understanding of the existing laws. While the other actions may help, knowledge of the
law is most critical and is the logical place to begin.

Many firms find it important to retain one or more of the travelers’ assistance
programs or insurance programs that can provide help when the firm’s overseas
travelers or expatriates and their families experience difficulties.

3. Emergency Planning for Expatriates

Due to political and social unrest in many areas of the world, employers must be prepared
to bring international assignees and their family’s home if their safety is threatened. Many
global firms establish a corporate crisis team to create evacuation plans and make critical
decisions during emergency situations.

Further, in the event of serious illness or injury without adequate hospital or medical
facilities, civil strife, war, or similar emergencies in the host country, a Company may deem
it necessary to evacuate the expatriate and accompanying dependents to another location.
In such circumstances, the company may outsource a security institution to provide
services including site surveys and security risk assessment, traveler education and advice,
emergency response planning and security evacuation, crisis management services,
security consultancy, site management, and staffing and training services.

The following texts provide helpful hints on what defines a crisis location or situation, what
issues need to be considered, and offers a framework for "constructing" an emergency
plan.
 11

Assessing Risk

Building a Framework for an Emergency Plan

Putting Together an Evacuation Plan

Working with the Right Service Providers

An anecdote with a Moral

Starting on the Right Foot

Preparedness and Response

Emergency Planning Process

Source: Dwyer, T. (2001). Take a Proactive, Rather than Reactive, Approach to Emergency
Planning for Expatriates in Crisis Locations. KPMG.

3.1. Assessing Risk

Given the negative impact that the label "high risk" could have on inward investment
and tourism, political, economic, or social factors sometimes prevent governments or
their representatives from being completely candid about the degree of risk in certain
locations. Therefore, it is important to establish valid criteria for determining when a
location has become, or has the potential to become, high-risk. These factors can be
used to supplement home- and host-government information to provide a
comprehensive assessment of the host location. Such criteria could include:

• Anti-multinational/anti-"foreigner" demonstrations and/or riots;

• Rapid deterioration of the local economic or political environment;

• Threats from local political, religious, social, and other leaders;

• Evidence that military action may take place in the host country or a neighboring
country;
12

• History of incidents against foreigners during volatile times;

• Known risk of natural disasters (such as earthquakes, typhoons, floods, etc.).

It is important not only to establish criteria, but also to effectively monitor them.
Fortunately, the Internet has made this part of the job much easier, but it can still be
time-consuming for hard-pressed HR professionals. Many rely on outside service
providers for ongoing, updated risk assessments, which can help companies to make
more informed decisions about their business strategies — those currently in place,
and future — and, more importantly, evaluate the need to address real risks to their
employees, whether at home or abroad.

Companies can also use this information to determine when to move to the next stage
of their emergency plans, and to make sure that the company takes appropriate action,
thereby precluding (potentially costly) premature or unnecessary action.

3.2. Building a Framework for an Emergency Plan

Any workable emergency plan must be location-specific, and must address a wide
range of contingencies, incorporating both natural and man-made problems. However,
it is possible to identify certain "best practice" elements which should be incorporated
into all of them.

One thing most of these situations have in common is that there tends to be levels or
stages of a crisis, from the initial indications of disquiet to the full-fledged "storm."
Establishing a phased approach to emergency planning allows the company to avoid an
"all or nothing" response. An example of the way in which a phased plan might be
structured is set out below.

3.2.1. Stage 1: Warning

Your organization concludes that there is a greater-than-normal risk to your expatriate

population; perhaps the political climate is unstable, religious or social leaders are
stirring up anti-foreigner sentiment, or public demonstrations are larger and angrier
than usual. In this case, the following steps can be taken:

• A "warning" is communicated to all expatriates, urging them to be more aware of

their personal security and surroundings, and reminding them of
emergency/evacuation procedures;

• A full employee/dependent census is taken;

 13

• In-country travel by expatriates and dependents is strictly limited and tracked by

local HR;

• Relevant embassies and consulates are contacted for advice and information
specific to certain nationalities;

• New assignments to the host location are delayed and more carefully scrutinized
for justification;

• Emergency/evacuation arrangements are confirmed with all vendors

(transportation charter companies, security agencies, hotels, etc.).

3.2.2. Stage 2: Imminent Danger

At this point, it is clear that the risks to your employees have risen to the point where
the employees may be in imminent physical danger. There might be serious doubts
about the viability of political structures, people are being injured or killed in riots, and
there is no longer real confidence that local police will be able to control the situation.
Some of the steps at this stage might be:

• Evacuation of all dependents;

• Cancellation of all travel within the country, as well as of all new assignments;

• A review is conducted to ascertain if any segment of the local employee

population is in possible need of assistance, for reasons of religion, ethnicity, or
some other factor;

• Planning should take place (and procedures agreed and appropriately

communicated) so that if a total evacuation of expatriates is necessary, local
operations can be administered by "skeleton staffs" of non-expatriate personnel,
or perhaps long-distance from neighboring countries.

3.2.3. Stage 3: Crisis

Civil order has now disintegrated, perhaps the government has collapsed, military
action might be taking place, and given the risks, there is no business justification for
keeping expatriates in the country. Steps would include:

• Full evacuation according to pre-agreed procedures, of expatriate and "at-risk

local" population;

• Shut down of operations, or administration by local staff;

14

• Confirmation of census to ensure that no one is left behind.

It is important to note that the steps outlined above represent only guidelines. Each
plan should be adapted to the particular company and its expatriate population, and to
each specific host location and its circumstances. Internal and external experts should
review plans.

3.3. Putting Together an Evacuation Plan

An evacuation plan can be looked at as a subset of an emergency plan. While it is

hoped that an evacuation plan will never be used, it is absolutely essential to the
health and safety of your expatriate population. Much more than the sample outline of
the emergency plan above, an evacuation plan must be: location-specific; detailed;
familiar to every expatriate and all local management; and operational under the
assumption that much of the location's infrastructure (phone lines, cell phone towers,
Internet access, airports, etc.) will not be functioning.

Of course, the formulation of this plan ought to be driven by local expertise whenever
available — no amount of long-distance research can replace local insight. A wide
variety of emergencies may cause an evacuation. In some instances you may have a
day or two to prepare, while other situations might call for an immediate evacuation.
Planning ahead is vital to ensuring that you can evacuate quickly and safely, no matter
what the circumstances.

3.4. Working with the Right Service Providers

Many of the crucial steps involved in safeguarding expatriates, from the gathering and
analysis of information and providing added security to the physical evacuation, are
heavily dependent upon external service providers who will be available where and
when needed. Among the types of organizations which might play a role are:

• Informational/risk assessment organizations;

• Cross-cultural/counseling/employee assistance programs;

• Medical evacuation services;

• HRIS vendors to help accurately track populations and their whereabouts;

• Locally-based security firms to provide added protection to your personnel and

facilities;

• Insurance vendors to augment medical and life coverage as necessary;

 15

• Transportation companies, including bus, plane, boat, or car services;

• Hotels and/or other logical canvassing points.

The organization must determine, for each of these providers, the timing and scope of
services. It is crucial to remember that, by definition, the times when these services are
to be provided will be unusual and often difficult. Therefore, it is not enough to know
how the service providers operate when things are calm or during business hours, but
instead how good they are at "keeping their heads while all about them are losing
theirs."

3.5. An Anecdote with a Moral

In the early 1990's, during a particularly violent period in one South American country,
an expatriate challenged his employer's assertion (based on State Department data)
that the assignment location in question did not merit a danger premium. The
expatriate argued that he and his family felt in danger of kidnapping, that many in the
expatriate community had been subject to assaults and threats, and he did not even
feel safe in his home. Surely, this was what a danger premium was designed to address.
The employer offered to move the employee to more secure housing with gates and
24-hour guard protection. The employee refused, saying that his current home was
very comfortable, and the location was convenient to the office. The company also
offered to provide a security guard/driver to take his children to school and accompany
his wife on her errands. This, too, the employee refused, explaining that his wife liked
her freedom and flexibility, and a driver would be too constricting and intrusive. The
company even offered to repatriate the employee ahead of schedule, but this option
was also refused. However, he still wanted the money.

The "moral" of the story, of course, is that while an expatriate may be entirely justified
in demanding additional pay for undertaking a potentially risky assignment, no amount
of money itself can address the underlying goal of risk mitigation and personal safety
for expatriates and their families. No one should be under the illusion that paying a
danger premium provides any form of security. Taken in conjunction with other,
practical steps, it may very well be good policy, but it is not a useful policy on its own.

3.6. Starting on the Right Foot

There are also some steps that individual expatriates and their employers can take
which can lessen their chances of the expatriate coming into harm's way and, should
something life-threatening occur, can protect the expatriate and his or her loved ones;
16

some of these are described below.

Certainly among the most practical steps is that the expatriate and family become
familiar with the geography, and especially, the customs and laws of the assignment
location. Doing so may lessen the chances that an unintentional infraction or offense
will put the expatriate under a great degree of scrutiny or unnecessarily inflame an
already-heated situation. Expatriates should also note local emergency numbers (e.g., a
general "911"-type telephone number), and separately note the telephone numbers
for the police, fire department, and medical services.

It is also crucial that the expatriate register with his or her home country's nearest
embassy or consulate, and know to contact them immediately in case of trouble. The
employee's own government can bring enormous legal, logistical, and financial
resources to bear that can prove invaluable in "extracting" an expatriate from a tight
spot.

It is also helpful if expatriate employees and their families make contacts with other
expatriates, whether they are affiliated with the same employer or part of a broader
expatriate community in the host location. Generally, these contacts and connections
are useful in good times and, in bad, they can be extremely practical and valuable.

Recently, a company with only one expatriate in a high-risk location considered the
possibility of evacuating that employee until the regional situation stabilized. Other
organizations with expatriates in the region urged them not to, for fear that such a
move would send a wave of panic through the expatriate community and be viewed by
the locals as a vote of "no confidence" by the multinational community. Evacuation
plans were temporarily put on hold.

Remarkably enough, when this company approached those same organizations to see
if they would be willing to include this lone assignee in any future evacuation
arrangements, the company was advised that, due to potential liability issues,
evacuation assistance could not be extended to non-employees. Fortunately, this kind
of situation is not common. In fact, during times of crisis, most multinationals extend
an invaluable helping hand to each other. This is born partly of the camaraderie
typically found among expatriates, which is especially strong in remote or difficult
locations. From a public-relations standpoint, one is hard pressed to imagine any major
company that would be willing to evacuate its own expatriates and leave those of other
companies on the tarmac.

In areas where an organization does not have a large presence, much is to be gained by
 17

working closely with other companies, even competitors. Such cooperation can range
from sharing information to sharing charter planes, phone lines, and canvassing points.

Much is to be gained by ensuring that the expatriate is placed in reasonably secure

housing. Arrangements will vary widely depending upon the situation in the host
location, but can include secure compounds, "gated communities," buildings with 24-
hour security, or even just a home with a good electronic system wired to the local
police. This is an area where expatriates and their employers have sometimes been
known to try to cut corners (secure housing can be expensive), but surely is an
investment worth making.

The additional complications can be time consuming, expensive, and emotionally

taxing for the survivors. As much as we do not want to consider the possibility of
employees dying while on assignment, the potential complications are great enough to
warrant every company reimbursing a certain amount of estate planning, and strongly
urging all of their expatriates to address the issue.

3.7. Preparedness and Response

As memories of the crisis passed, HR professionals' attention soon turned back to the
time-consuming and difficult issues of expatriate pay and international taxation. It did
not help that HR departments found budgets and resources slashed in the pursuit of
greater corporate efficiency and increased shareholder value. It soon became apparent
that the time, effort, and resources necessary to plan for future crises would just not
be available. Many companies now find themselves again scrambling to make up for
lost time.

4. Extraterritorial Laws

Doing business globally means more opportunities, but also entails greater risks. Develop a
risk management plan is the first step for doing business globally. Global HR professionals
must comply with extraterritorial laws to mitigate risk to the organization. Extraterritorial
laws refer to laws that a country will enact which regard an offence committed abroad as
an offence committed within its borders. Just as local employment laws apply only to
those employees who work in the specific country, the U.S. employment laws generally
apply only to those employees who work in the United States or its territories. There are a
few exceptions though, as the following four major employment laws have some
application abroad:
18

• Prohibit employers from discriminating against

U.S. Title VII employees on the basis of sex, race, color, national origin,
and religion.

U.S. Americans • Prohibit discrimination against people with disabilities in

with Disabilities Act employment, transportation, public accommodation,
communications, and governmental activities.
(ADA)

U.S. Foreign
• Prohibit the payment of bribes to foreign officials to assist
Corrupt Practices in obtaining or retaining business.
Act (FCPA)

• Prevent various forms of bribery, open up how firms

UK Bribery Act conduct their business, and make sure appropriate
safeguards are in place to avoid any dishonest activities.

4.1. U.S. Title VII of the Civil Rights Act

Title VII, the United State (U.S.) federal law that prohibits most workplace harassment
and discrimination, covers all private employers, state and local governments, and
educational institutions with 15 or more employees. In addition to prohibiting
discrimination against workers because of race, color, national origin, religion, and sex,
those protections have been extended to include barring against discrimination on the
basis of pregnancy, sex stereotyping, and sexual harassment of employees.

4.2. U.S. Americans with Disabilities Act (ADA)

Disability discrimination also occurs when a covered employer or other entity treats an
applicant or employee less favorably because she has a history of a disability (such as
cancer that is controlled or in remission) or because she is believed to have a physical
or mental impairment that is not transitory (lasting or expected to last six months or
less) and minor (even if she does not have such an impairment). The law requires an
employer to provide reasonable accommodation to an employee or job applicant with
a disability, unless doing so would cause significant difficulty or expense for the
employer ("undue hardship").

4.3. U.S. Foreign Corrupt Practices Act (FCPA)

The Foreign Corrupt Practices Act was enacted for the purpose of making it unlawful
for certain classes of persons and entities to make payments to foreign government
 19

officials to assist in obtaining or retaining business. Specifically, the anti-bribery

provisions of the FCPA prohibit the willful use of the mails or any means of
instrumentality of interstate commerce corruptly in furtherance of any offer, payment,
promise to pay, or authorization of the payment of money or anything of value to any
person, while knowing that all or a portion of such money or thing of value will be
offered, given or promised, directly or indirectly, to a foreign official to influence the
foreign official in his or her official capacity, induce the foreign official to do or omit to
do an act in violation of his or her lawful duty, or to secure any improper advantage in
order to assist in obtaining or retaining business for or with, or directing business to,
any person.

4.4. UK Bribery Act

The Bribery Act is an act of Parliament that has been implemented into United
Kingdom (UK) law in order to not only prevent various forms and elements of bribery,
but also to open up how firms conduct their business, and make sure appropriate
safeguards are in place to avoid any dishonest activities. Bribery itself is defined as
both the giving and receiving of bribes in terms of someone who facilitates, gives or
receives an advantage (which is usually financial) in connection with a person
performing a function improperly.

The Act was introduced in response to international pressure from the Organization for
Economic Co-operation and Development (OECD) and in order to bring the UK in line
with efforts in other countries, particularly the US.

A company is under a positive duty under the act to ensure there are appropriate
procedures in place to prevent bribery. If these procedures have been put in place then
it is unlikely a company will be punished under the act; it is therefore extremely
important that companies are aware of this and act accordingly. Another key point to
note is that companies must continue to ensure that any hospitality offered to
potential clients is both reasonable and proportionate.

5. Employee Records and Data

Employers collect a substantial amount of personal information about their employees.

Companies need to be aware of their obligations under the profusion of data protection
laws and regulations that govern the collection, use and transfer of personal information.
This is an especially daunting task for companies that have operations subject to the laws
of multiple jurisdictions, as requirements vary widely from country to country.
20

Companies use employees' personal information for a variety of purposes—from

evaluating applicants during the hiring process to administering payroll and employee
benefit plans to managing separation and other post-employment benefits. And as more
employers adopt enterprise-level information management systems and outsource certain
human resources administration functions, increasing amounts of personal data is being
transferred and shared within and between organizations. Maintaining compliance with
applicable data privacy laws is a responsibility employers cannot afford to overlook.

Many (but not all) data privacy laws exempt Personal Data that has been encrypted.
Certain types of "Sensitive Data" are often given enhanced protection under
comprehensive data protection regimes. Sensitive Data may include, for example, race,
ethnicity or national origin, political opinions or associations, union membership, sexual
orientation, marital status, health-related information and criminal history. It should be
noted that data privacy laws are not restricted to protecting active employee information,
so companies' obligations extend to any non-employee groups whose Personal Data they
may acquire, such as clients and customers, but also job applicants, consultants,
independent contractors and terminated or retired employees.

Employee Records and Data Protection

5.1. The General Data Protection Regulation (GDPR)

Whenever you open a bank account, join a social networking website or book a flight