E.U.-U.S. PRIVACY SHIELD POLICY

Jazz Pharmaceuticals plc and its subsidiaries and affiliates (the “Jazz Pharmaceuticals Group”) respect the privacy of our customers, employees, clinical trial participants, consumers, business partners and others. The Jazz Pharmaceuticals Group strives to collect, use, protect and disclose Personal Information in a manner consistent with the laws of the countries in which it does business. In furtherance of this commitment, the members of the Jazz Pharmaceuticals Group located in the United States as listed below (“Jazz Pharmaceuticals US”) have certified compliance with the EU-U.S. Privacy Shield Framework (“Privacy Shield”) as set forth by the US Department of Commerce and the US Federal Trade Commission, regarding the collection, use and retention of Personal Information from Citizens in support of Jazz Pharmaceuticals Group human resources, and business operations. To find information about the Privacy Shield program and to view our certification page, please go to https://www.privacyshield.gov.

U.S. – Swiss Safe Harbor Framework

Jazz Pharmaceuticals US also complies with the U.S.–Swiss Safe Harbor Framework as set forth by the U.S. Department of Commerce regarding the collection, use and retention of Personal Information from Switzerland. Jazz Pharmaceuticals US has certified that it adheres to the Safe Harbor Privacy Principles of notice, choice, onward transfer, security, data integrity, access, and enforcement. To learn more about the Safe Harbor program, and to view the Jazz Pharmaceuticals US certification, please visit http://www.export.gov/safeharbor.

SCOPE

The Jazz Pharmaceuticals Group companies that are covered by this Privacy Shield Policy are Jazz Pharmaceuticals, Inc., Celator Pharmaceuticals Inc., and their respective affiliates successors, divisions and groups which are located in the United States.
This Privacy Shield Policy applies to all Personal Information received by Jazz Pharmaceuticals US in any format, relating to (i) Employees; (ii) operations involving current, prospective and former clients, customers, and patients (collectively “Clients”); and (iii) interactions with current, prospective and former Agents, suppliers, contractors, vendors, distributors, subcontractors and strategic partners (collectively, “Suppliers”), all as necessary for the pursuit of Jazz Pharmaceuticals Group business activities which involve the development, research, manufacture, distribution, and/or commercialization of certain approved pharmaceutical products for human use.

DEFINITIONS

For purposes of this Policy, the following definitions shall apply:

“Agent” means any third party that processes Personal Information under the instructions of, and for the use by or on behalf of, Jazz Pharmaceuticals US or to which Jazz Pharmaceuticals US discloses Personal Information for use on its or the Jazz Pharmaceuticals Group behalf.

“Citizen” or collectively, “Citizens” means a lawful citizen or citizens of any EEA country and Switzerland and includes Employees, Clients and Suppliers and job applicants.

“EEA” means the European Economic Area which is composed of the following thirty-one (31) countries: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Italy, Ireland, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and United Kingdom.

“Employee” or collectively, “Employees,” means any Jazz Pharmaceuticals Group Citizen-employee(s) (and any and all dependents thereof), including, but not limited to, temporary, permanent, and former employees, directors, contractors, workers and retirees.

“Personal Information” or “Personal Data” means any information or data about an identified or identifiable Citizen, including, but not limited to: (a) first name or initial and last name; (b) home or other physical address; (c) telephone number; (d) email address or online identifier associated with the Citizen; (e) Social Security number or other similar identifier; (f) employment, financial or health information; or (g) any other information relating to a Citizen that is combined with any of the above. The term “Personal Information” does not include anonymized information or information that is reported in the aggregate (provided that such aggregated information is not identifiable to a natural person) or publicly available information that has not been combined with non-public Personal Information.

“Sensitive Personal Information” means Personal Information that reveals race, ethnic origin, sexual orientation, political opinions, religious or philosophical beliefs, or trade union membership, or that relates to past, present or future medical or health condition (physical or mental), the processing of genetic data or biometric data for the purpose of identifying a natural person, or information relating to the commission of a criminal offense. In addition, Jazz Pharmaceuticals US will treat as Sensitive Personal Information any information received from a third party where that third party treats and identifies the information as sensitive.

Capitalized terms not defined above have the definitions set forth in the respective paragraphs of this Policy.

PRIVACY SHIELD PRINCIPLES

Jazz Pharmaceuticals US complies with the Privacy Shield Principles with respect to the processing of Personal Information as follows:

Notice: In the event Jazz Pharmaceuticals US collects Personal Information directly from a Citizen, it will provide a notice to the Citizen that informs them that it participates and subjects itself to the Privacy Shield Framework, and describes (i) the type of Personal Information collected, (ii) the purposes for which it collects and uses such information,(iii) the types (or identity) of third party Agents to whom the Company discloses or may disclose Personal Information and the purposes for which it does so, (iv) the choices and means, if any, that Jazz Pharmaceuticals US offers individuals for limiting the use and disclosure of their Personal Information and (v) how to contact Jazz Pharmaceuticals US with respect to any inquiries or complaints including any relevant establishment in the EEA that can respond to such inquiries or complaints. Except as provided under law or to protect the health or safety of individuals, notice will be provided in clear and conspicuous language at the time of collection, or as soon as practicable thereafter. Jazz Pharmaceuticals US will also provide additional notice (and choice) in the event that Jazz Pharmaceuticals US will use or disclose the Personal Information for a purpose other than that for which it was originally collected or processed.

Where Jazz Pharmaceuticals US receives Personal Information from its parent company, subsidiaries, affiliates or other entities in the Jazz Pharmaceuticals Group in the EEA or Switzerland, it will use and disclose such information in accordance with the notices provided by such entities and the choices and means made by the individuals to whom such Personal Information relates.

Choice: In the event that Personal Information is to be used for a new purpose that is materially different from the purpose(s) for which the Personal Information was originally collected or subsequently authorized, or transferred to a non-Agent third party, Citizens will be provided, where practical and appropriate, with an opportunity to decline to have their Personal Information so used or transferred.

With respect to Sensitive Personal Information, Jazz Pharmaceuticals US (through itself or through the members of the Jazz Pharmaceuticals Group that collected the Sensitive Personal Information) will give Citizens the opportunity to affirmatively and expressly consent to (i) the processing of the individual’s Sensitive Personal Information unless there is an exception under the Privacy Shield or the EU Data Protection Directive, and (ii) the disclosure of the information to a non-Agent third party or the use of the information for a purpose other than the purposes for which it was originally collected or subsequently authorized by the individual.

Data Integrity And Purpose Limitation: Jazz Pharmaceuticals US endeavors to use Personal Information only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the individual. Jazz Pharmaceuticals US will take all reasonable and necessary steps designed to ensure that Personal Information collected is reliable for its intended use, accurate, complete, and current. Jazz will collect the minimum amount of Personal Data necessary to support the Company’s legitimate business activities. Jazz Pharmaceuticals US shall also adhere to the Principles for as long as it retains such Personal Data.

Accountability for Onward Transfers: Jazz Pharmaceuticals US will enter into contracts with third parties, including Agents, to whom they send Personal Information covered by this Privacy Shield Policy, that provide that such third parties will (i) provide the same level of privacy protection for Personal Information as set forth in the Privacy Shield Principles, (ii) will process such Personal Information only for limited and specified purposes consistent with the consent provided by the individual; (iii) will provide appropriate technical and organizational measures to protect Personal Information against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access; and (iv) will notify Jazz Pharmaceuticals US if it makes a determination that it can no longer meet its obligations under the contract. Jazz Pharmaceuticals US agrees to provide a summary or representative copy of the relevant contractual provisions to the Department of Commerce upon request.

Where Jazz Pharmaceuticals US becomes aware that an Agent is using or disclosing Personal Information in a manner contrary to this Privacy Shield Policy, Jazz Pharmaceuticals US will take all reasonable and necessary steps to stop or remediate unauthorized processing. With respect to onward transfers to Agents, Privacy Shield requires that, to the extent it is responsible for the event, Jazz Pharmaceuticals US shall remain liable should its Agents process Personal Information in a manner inconsistent with the Privacy Shield Principles.

Security: Jazz Pharmaceuticals US will take all reasonable and appropriate administrative, technical and organizational security measures appropriate to the risks, that are designed to protect Personal Information in its possession from loss, misuse and unauthorized access, disclosure, alteration and destruction regardless of whether such Personal Information is in electronic or tangible, hard copy form.

Access: Citizens may seek confirmation regarding whether Jazz Pharmaceuticals is processing Personal Information about them, may request access to their Personal Information and ask that Jazz Pharmaceuticals US correct, amend, or delete Personal Information that is demonstrated to be inaccurate or has been processed in violation of the Privacy Shield Principles. Although Jazz Pharmaceuticals US makes good faith efforts to provide Citizens with access to their Personal Information, Jazz Pharmaceuticals US reserves the right to limit or deny such access where (i) the burden or expense of providing access would be disproportionate to the risks to the Citizen’s privacy, (ii) where the legitimate rights of Citizens other than such Citizen would be violated; or (iii) where granting full access would reveal confidential information or breach a legal or other professional obligation or where doing so is otherwise consistent with the Privacy Shield Principles. With respect to employees, Jazz Pharmaceuticals US will cooperate in providing access either directly or through the employee’s Jazz Pharmaceuticals Group employer company. If Jazz Pharmaceuticals US determines that access should be restricted in any particular instance, it will provide an explanation of why that determination has been made and a contact point for any further inquiries.

Recourse, Enforcement and Liability: Jazz Pharmaceuticals US has established internal procedures to verify its ongoing compliance with the Privacy Shield Principles and this Privacy Shield Policy. Any party that Jazz Pharmaceuticals determines is in violation of this Privacy Shield Policy will be subject to disciplinary action up to and including termination of employment.

Any complaints should be directed to the Jazz Pharmaceuticals Group Privacy Office at the address given below. Jazz Pharmaceuticals US will investigate and attempt to resolve any questions, complaints and disputes regarding use and disclosure of Personal Information in accordance with the terms of the Privacy Shield Principles. Jazz Pharmaceuticals US will respond to the initial request for information within 45 days after receipt of the questions or complaints.

For complaints or disputes that cannot be resolved between Jazz Pharmaceuticals US and the Citizen, Jazz Pharmaceuticals US has agreed to participate in the following dispute resolution mechanisms at no cost to the individual and by reference to the Privacy Shield Principles:

(a) For disputes involving employee and human resources Personal Information received by Jazz Pharmaceuticals US from the EEA or Switzerland, employees and data subjects may engage their local Data Protection and/or Labor Authority, or procedures of the panel established by the European data protection authorities and the Federal Data Protection and Information Commissioner of Switzerland, and Jazz Pharmaceuticals US shall respond directly to such authorities; and

(b) For all other disputes involving Personal Information transferred under the E.U.-U.S. Privacy Shield, Jazz Pharmaceuticals US has committed to refer unresolved privacy complaints to an independent dispute resolution provider at no cost to the complainant. Please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

In the event that the disputes are not able to be resolved through the independent dispute resolution process described in (a) or (b) above, an individual may (i) refer the matter to his or her relevant Data Protection Authority: (ii) refer the matter to the Department of Commerce or to the US Federal Trade Commission to grant a consent order; and (iii) in the event that the individual’s complaints are not able to be resolved through other means, invoke binding arbitration through referral to the Privacy Shield Panel as more fully described on the Privacy Shield website. The US Federal Trade Commission has jurisdiction over Jazz Pharmaceuticals US compliance with the Privacy Shield.

LIMITATION ON APPLICATION OF PRINCIPLES

Adherence by Jazz Pharmaceuticals US to these Privacy Shield Principles may be limited and Personal Information may be required to be disclosed (a) to the extent expressly permitted by an applicable law, rule or regulation; (b) to the extent required to respond to lawful requests by public authorities, including to meet national security, law enforcement, legal or government requirements, and (c) to protect the health or safety of a Citizen.

CONTACT INFORMATION

Questions or comments regarding this Privacy Shield Policy or complaints regarding the use or disclosure of Personal Information should be submitted to Jazz Pharmaceuticals US, by mail or email, or by telephone, as follows:
Jazz Pharmaceuticals Privacy Office
3180 Porter Drive
Palo Alto, CA 94304

Phone: (650) 496-3777

Email: privacy@jazzpharma.com

CHANGES TO THIS POLICY

This Privacy Shield Policy may be amended from time to time, consistent with the requirements of the Privacy Shield Principles. A notice will be posted on the Jazz Pharmaceuticals Group’s web pages (www.jazzpharma.com) whenever this Privacy Shield Policy is amended.

THIS STATEMENT HAS BEEN INITIALLY ADOPTED AS OF THE 26 DAY OF SEPTEMBER, 2016.
Last Updated: September 26, 2016