ISS AS
ESRS disclosure: ESRS S4; ESRS S4 \ DR S4-1 \ Paragraph 15
Tags Tree
- Provide detailed information on your organization's policies designed to manage material impacts, risks, and opportunities concerning consumers and end-users. Specify whether these policies are applicable to specific groups or encompass all consumers and end-users, in alignment with ESRS 2 MDR-P on managing material sustainability matters.
-
Question Id: S4-1_01
We have not adopted policies specifically related to our end-users, but capture the interests of end-users as part of our data ethics, data protection and information security policies.
Our Data Ethics Policy provides the overarching framework for how we work with and manage data. It is aligned with the Charter of Fundamental Rights of the European Union and includes principles on the areas of self-determination, human dignity, responsibility, equality and fairness, progressiveness, diversity and inclusion and accountability. Further, it sets parameters around our use of AI systems. The policy applies to all ISS employees as well as suppliers and business partners that have access to data on behalf of or in collaboration with ISS. Implementation of the policy is the joint responsibility of our Group Data Privacy & Legal Compliance function and our Global IT, Digitalisation & Services function.
We collect and process personal data in accordance with our Group Data Protection Policy. It adheres globally to the principles of the EU General Data Protection Regulation, and additional higher standards, if required by local law and sets requirements around data protection principles, transfer of personal data, data breach, training & awareness and control & assurance. The Group Data Protection Policy is owned by our Group Legal function and our Group Data Protection Manager.
Where our Data Protection Policy establishes procedures for how we work with and manage personal data, our Group Information Security Policy aims at upholding the integrity of our IT ecosystem and among others prevent unauthorised access to personal data. It does so through an information security management system aligned with the ISO27001:2022 standard and is supported by documented procedures around organisational controls, employee controls, physical controls and technological controls.
Report Date: 4Q2024Relevance: 60%
- Provide a detailed description of your company's human rights policy commitments that pertain to consumers and/or end-users. Include information on the processes and mechanisms in place to ensure compliance with the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines for Multinational Enterprises. Focus on material matters and outline your general approach in this context.
-
Question Id: S4-1_02
Our human rights policy commitments do not particularly focus on data privacy related to our end-users. Please refer to S1-1 for a description of these commitments.
Report Date: 4Q2024Relevance: 20%
- Provide a detailed description of your company's human rights policy commitments relevant to consumers and end-users. Include the processes and mechanisms in place to ensure compliance with the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, or the OECD Guidelines for Multinational Enterprises. Focus on material matters and outline your general approach to respecting the human rights of consumers and end-users.
-
Question Id: S4-1_03
Our human rights policy commitments do not particularly focus on data privacy related to our end-users. Please refer to S1-1 for a description of these commitments.
Report Date: 4Q2024Relevance: 20%
- Provide a detailed description of your company's human rights policy commitments that pertain to consumers and end-users. Include information on the processes and mechanisms in place to ensure compliance with the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines for Multinational Enterprises. Focus specifically on material matters and outline your general approach to engagement with consumers and end-users.
-
Question Id: S4-1_04
Our human rights policy commitments do not particularly focus on data privacy related to our end-users. Please refer to S1-1 for a description of these commitments.
Report Date: 4Q2024Relevance: 20%
- Provide a detailed description of your company's human rights policy commitments relevant to consumers and end-users. Include the processes and mechanisms in place to ensure compliance with the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines for Multinational Enterprises. Focus on material matters and outline your general approach to implementing measures that provide and/or enable remedies for human rights impacts.
-
Question Id: S4-1_05
Our human rights policy commitments do not particularly focus on data privacy related to our end-users. Please refer to S1-1 for a description of these commitments.
Report Date: 4Q2024Relevance: 20%
- Provide a detailed account of whether and how your company's policies concerning consumers and end-users are aligned with internationally recognized instruments pertinent to these groups, such as the United Nations Guiding Principles on Business and Human Rights. Additionally, disclose any instances of non-compliance with the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, or the OECD Guidelines for Multinational Enterprises that have been identified within your downstream value chain, specifying the nature of such cases, if applicable.
-
Question Id: S4-1_06
Our human rights policy commitments do not particularly focus on data privacy related to our end-users. Please refer to S1-1 for a description of these commitments.
Report Date: 4Q2024Relevance: 20%
- Provide a detailed account of whether and how your company's policies concerning consumers and/or end-users align with internationally recognized instruments, specifically the United Nations (UN) Guiding Principles on Business and Human Rights. Additionally, disclose the extent to which instances of non-compliance with the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, or the OECD Guidelines for Multinational Enterprises, involving consumers and/or end-users, have been identified within your downstream value chain. If applicable, include an indication of the nature of these cases.
-
Question Id: S4-1_07
Our human rights policy commitments do not particularly focus on data privacy related to our end-users. Please refer to S1-1 for a description of these commitments.
Report Date: 4Q2024Relevance: 20%
- Can the company provide a detailed account of the process used to establish targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities, as outlined in Disclosure Requirement S4-5? This should include whether and how the company engaged directly with consumers, end-users, their legitimate representatives, or credible proxies with insight into their situation. Additionally, in accordance with Disclosure Requirement S4-1, the company is required to describe the key information necessary to ensure a faithful representation of the policies concerning consumers and end-users. This description must include explanations of any significant changes to the policies adopted during the reporting year, such as new expectations for business customers or new approaches to due diligence and remedy.
-
Question Id: S4-1_08
Our framework and approach to avoiding data breaches and resulting negative impact for end-users is considered sufficient to reasonably mitigate the risk exposure and we have therefore not defined specific targets or metrics in this regard.
Report Date: 4Q2024Relevance: 30%
- Provide a detailed account of the methods and channels utilized to communicate your policies to the relevant individuals, groups, or entities. This includes those expected to implement the policies, such as employees, contractors, and suppliers, as well as those with a vested interest in their execution, like workers and investors. Describe the tools and mediums employed, such as flyers, newsletters, dedicated websites, social media, face-to-face interactions, and workers' representatives, to ensure policy accessibility and comprehension among diverse audiences. Additionally, elucidate the strategies employed to identify and eliminate potential dissemination barriers, including translation into pertinent languages or the use of visual aids.
-
Question Id: S4-1_09
Our Group Data Protection Policy described above establishes a firm process for handling incidents of data breaches, which is the key enabler for us to provide remediation for negative impacts to end-users.
Just as for value chain workers our whistleblower channel is available to end-users for raising concerns though we would consider it a more natural and straight forward approach for end-users to raise concerns via their employer (our customer). During 2024 we have not received data privacy concerns from end-users via our whistleblower channel. For details on our whistleblower channel and Speak Up Policy, see S1-3 and G1-1. Our Speak Up Policy is publicly available to end-users at www.issworld.com.
Report Date: 4Q2024Relevance: 20%