Employee, Job Applicant and Contractor Notice

Your privacy

Your privacy is a priority for PG&E Corporation and Pacific Gas and Electric Company (together, "PG&E" or "we").

This Employee, Contractor and Job Applicant Privacy Notice ("Personnel Privacy Notice") describes what personal information we collect from PG&E employees, contractors and job applicants, the purposes for the collection, and to whom we may disclose your personal information. Under California law, PG&E employees, contractors and job applicants who are California residents have certain rights with respect to their personal data. This Personnel Privacy Notice describes how California residents can exercise their California privacy rights with respect to their personal information. This privacy notice only applies to the personal information we collect in your capacity as an employee, contractor or job applicant of PG&E. For information about how we collect and use your information as a consumer, please visit PG&E's public privacy notice.

We do not knowingly collect, use, sell or share the information of anyone under the age of 16.  If you believe a child under 16 years of age has provided us with personal information, please contact us at pgeprivacy@pge.com with a brief description of your concern.

How we collect your personal information

In order to manage your employment or other professional working relationship with us, we collect and process personal information about you. In the past 12 months, we may have collected personal information about you from the following sources:

Directly From You: We collect your personal information directly from you during the onboarding process and otherwise in the context of your employment or other professional working relationship with us, such as when you contact the Human Resources Department or when you apply for a job.

From PG&E Equipment and Authorized “Bring Your Own Devices” ("BYOD"): Through devices installed on utility vehicles and other devices used in the context of your employment with PG&E.

From Your Use of the PG&E Intranet: We collect information about your visits and use of our intranet, including information through cookies and other logging technologies.

From Other Parties: When we work with other parties such as recruiters, consumer reporting agencies, service providers, vendors, contractors, credit agencies, market researchers, or service providers who provide services on our behalf.

From Other Sources: We may supplement the information described above with information we obtain from other sources, including from both online and offline data providers.

What information we collect

We collect the following categories of personal information from you, including in the past 12 months:

Identifiers, such as your name, Social Security number, passport number, driver's license or state identification card number, insurance policy number, phone number, email address, and address. We use this information to provide you with benefit services, comply with legal obligations, manage activities related to your employment, and to otherwise communicate with you. We may provide this information to service providers, regulators, and or with other third parties as required by law.

Information Subject to Protection Under California Law, such as the Identifiers above, your signature, physical characteristics or description, your educational history, bank account number, corporate credit card number, medical information and health insurance information. We use this information to provide you with benefit services such as payroll and insurance, and to comply with our legal obligations, and otherwise manage activities related to your employment. We may provide this information to service providers, regulators or with other third parties as required by law.

Protected Classification Characteristics, such as your gender, veteran status, racial or ethnic origin. For more information, please see the "Sensitive Personal Information" description below.

Sensitive Personal Information, such as your Social Security information, driver's license or government issued identification number, and certain protected classification characteristics, such as your race or ethnic origin, your specific geolocation, information about your health and sexual orientation. We may also collect the contents of your email or other electronic communications from your PG&E accounts or issued devices. We use this information for identity verification purposes, to provide you with benefit services, to protect and defend against legal claims, fraud or other malicious conduct, and to advance diversity, equity and inclusion practices. PG&E only uses your Sensitive Personal Information to deliver its services, perform certain internal business functions, and as otherwise permitted under applicable law. We may provide this information to service providers, regulators, or with other third parties as required by law. We do not sell or share your sensitive personal information. We only use and disclose your Sensitive Personal Information for purposes that do not infer characteristics about you.

Biometric Information, such as your fingerprint when your role requires access to a highly secure facility. PG&E may provide this information to service providers and/or to other third parties as required by law.

Geolocation Data, including your precise geolocation when using our PG&E equipment or BYODs for employment/professional purposes. We use this information to manage activities related to your employment, monitor security, and comply with legal obligations. We may provide this information to service providers or with other third parties as required by law.

Sensory Information, including information captured about you through surveillance cameras, audio recordings and photos. We use this information to monitor security at PG&E facilities. We may provide this information to service providers or third parties as required by law.

Professional and Employment-Related Information, such as the information on your resume, reference letters, interview notices, academic/professional qualifications, educational background, office location, hire dates, employment contracts, emergency contacts information, performance evaluations and other information, awards and achievements, training and development records, compensation information, time off information, work eligibility information, and other information relevant to your employment or professional working relationship with us. We use this information to provide you with employment-related services, comply with legal obligations, manage activities related to your employment, and inform analytical activities to improve our business. We may provide this information to service providers, regulators, or with other third parties as required by law.

Internet and Other Electronic Network Information, such as your log files, login information, software/hardware inventors, information relating to your use of PG&E equipment including, but not limited to vehicle telematics, intranet and BYODs used for employment/professional purposes, and information collected from cookies. We use this information to manage activities related to your employment, monitor security, and comply with legal obligations. We may provide this information to service providers or to other third parties as required by law. For more information on how we use cookies, please review the “Cookies and other tracking technologies” section below.

How we use your personal information

We may use the personal information we collect for a variety of purposes:

Employment Related Activities: Such as managing payroll, salary, payment, sick pay, and leaves of absences; tax and Social Security management; work eligibility monitoring; performance evaluation; scheduling, establishing emergency contact information; processing personnel work-related claims, evaluating your job application, and administering and processing benefits, including determining eligibility for you and your dependents and beneficiaries

Security Monitoring: Analyzing our electronic systems, networks and other equipment and property for security purposes, including to protect against fraud, and for ensuring compliance with our Code of Conduct

Legal Obligations: We may use your information to comply with our legal obligations. For example, if we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.

Internal Business Purposes: including performing analytics and applying algorithms to discover ways to improve our business, identify trends in our workforce, and enhance our service offerings.

Sensitive Personal Information: We do not use or disclose your sensitive personal information for any purpose other than as permitted by applicable law.

How we may disclose your personal information

We do not sell your personal information or share your personal information for targeted advertising purposes. We may share your personal information for a variety of purposes, including to:

With Your Consent: We may disclose your data if you have given us specific consent to use your personal information for a specific purpose.

Service Providers: We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work in connection with providing you the services or delivering information to you that you have requested. We disclose information to these other parties only where (a) the sharing of your personal information is necessary for them to carry out such support services and (b) those service providers agree to use any personal information they receive in accordance with our instructions.

Legal Obligations. We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).

Safeguarding Our Workplace. We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person, and illegal activities; or as evidence in litigation in which we are involved.

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Aggregated Data Sharing: PG&E may also disclose aggregated, non-employee specific data and information derived from personal information with other entities for the purpose of:

• informing California energy policy as directed by the California Public Utilities Commission and other California government agencies which regulate PG&E;
• maintaining safe and healthy workplace and the health and safety of our employees, customers and communities, among other things due to the COVID-19 pandemic

Cookies and other tracking technologies

When you visit or use internal PG&E websites, our server may create cookies, which are small text files that a website can send to your internet browser and may be stored in your browser or elsewhere on your computer. PG&E uses cookies and other technologies that are necessary for the operation of our intranet or its features. Third party Cookies may also be used on our internal PG&E websites where a third party provides functionality to our website. You may disable our usage of cookies through your browser settings. Please note that if you disable your browser's ability to accept cookies, you will be able to navigate PG&E's intranet, but you will not be able to take advantage of certain features.

Additional information for California residents

If you are a California Resident, you have certain privacy rights related to your personal information, including the following:

• Right to Know: You have the right to know and access the personal information PG&E collects about you, and how it uses, and discloses your personal information.
• Right to Request Deletion: You have the right to request deletion of your personal information.
• Right to Correct Inaccuracies: You have the right to request PG&E to correct inaccurate personal information.

You may exercise any of these rights by submitting your employee privacy rights request under California Consumer Privacy Act. or calling us at 1-800-788-2363.

PG&E cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. When you submit a request, we will take steps to verify your identity using identity verification services. If you have an account with us, we may use existing account authentication methods to verify your identity. You are not required to create an account with us to submit a request though. If you do you have an account with us, we may ask you to provide us with information about yourself in order to verify your identity.

We will only use personal information you provide in connection with identity verification to verify the requestor's identity or authority to make the request and whenever feasible, we will attempt to match the information you provide with information we may already have about you.

If you wish to authorize a third party to make a request on your behalf through an authorized agent, your agent must contact the PG&E Privacy Team directly at PGEPrivacy@pge.com. We will require the agent to demonstrate authority to act on your behalf. We may also require you to verify your identity directly with PG&E or confirm with us that you have provided the authorized agent permission to submit a request on your behalf.

You may also make a privacy request on behalf of your minor child/beneficiary/dependent.

We will not discriminate or retaliate against you for exercising any of your Privacy Rights identified in this privacy policy.

Global Privacy Control Recognition

Global Privacy Control signals are used by some web browsers to attempt to limit tracking related to your visits to a website. Not all browsers offer a Global Privacy Control option and these signals are not yet uniform. The PG&E intranet website does not respond to Global Privacy Control signals.

Retention

We retain your personal information based on legal requirements or business needs. We retain employee data for 6 years from when all retirement benefits have been paid to former employees under their respective plan, subject to legal or business needs for a longer retention period. Job applicant data (non-hires) is retained 10 years from the requisition closure, subject to legal or business needs for a longer retention period date.

Changes to this privacy notice

We will review this Privacy Notice regularly. If we make material changes to this privacy notice, we will attempt to notify you and/or obtain your consent, as required by law. We recommend that you regularly review this privacy notice.

If you have any questions about this Personnel Privacy Notice. Please contact the PG&E Privacy Team directly at PGEPrivacy@pge.com.