Privacy Policy

MetLife has a long-standing commitment to privacy, data protection and information security.

MetLife, Inc. operates worldwide through subsidiaries, affiliates, branches, and joint ventures (collectively “MetLife” or the “Company”). Customers, Personnel1, and business partners around the world provide the Company with personal and other confidential information every day in order to conduct its global operations. MetLife is firmly committed to the protection of the confidential information of the Company and its customers, Personnel and business partners, as well as the responsible use of personal information, respecting individual’s privacy rights, and processing personal data in compliance with applicable laws and regulations.

This document describes key aspects of MetLife’s Global Privacy, Data Protection & Information Security Program (the “Program”). The objectives of the Program are to:

• Protect the privacy and security of individuals’ personal information and our customer’s confidential information by adopting and implementing administrative, technical, including cybersecurity controls, and physical safeguards;
• Protect against known and unknown threats or hazards to the availability, confidentiality, and integrity of personal information and other confidential information; and,
• Protect against loss or destruction or unauthorized access to personal information and other confidential information.

The Program is shared by the Privacy Compliance Group (“PCG”) and Information Security Office (“InfoSec”).

MetLife’s Privacy Compliance Group

MetLife’s Privacy Compliance Group (“PCG”), part of the Compliance Risk Management program in Global Risk Management, has oversight of MetLife's Privacy and Data Protection Compliance Program and is responsible for establishing and maintaining the internal Global Privacy and Data Protection Policy (“Global Privacy Policy”), supporting the implementation of and ongoing compliance with the Global Privacy Policy and advising business management on privacy risks. The Global Privacy Policy establishes enterprise-wide principles and global minimum standards designated to facilitate compliance with applicable privacy laws and regulations in the countries in which MetLife conducts business.

The PCG tracks privacy and data protection trends, developments, and emerging risks, in part, through active membership and participation in professional organizations. It employs a highly skilled staff of privacy professionals, a majority of whom hold one or more industry-recognized designations from the International Association of Privacy Professionals (“IAPP”) and attend professional conferences and training to stay abreast of emerging privacy and data protection developments.

The authority and responsibility for managing the Privacy Compliance Program resides with MetLife’s Chief Privacy Officer (“CPO”). The CPO is a senior-level executive responsible for establishing and maintaining the vision and strategy for MetLife’s Privacy Compliance Program. The CPO is supported by the PCG and appointed regional privacy leads.

The PCG works in partnership with our locally appointed Data Protection Officers (“DPOs”), who are consulted on issues of data protection and privacy matters related to the processing of personal information.

1 Employees and non-employee individuals working on MetLife’s behalf

Information Security

The mission of the InfoSec program is to protect MetLife’s information and technology assets, personal and confidential information, and technology dependent business processes from known and unknown risks and security threats, and to provide enterprise-wide IT risk identification, prioritization, reporting, and mitigation services. InfoSec pursues this mission through the establishment of programs to protect against, monitor and/or report threats to MetLife’s information and technology assets, associated with the risks of operational disruption and unauthorized or accidental access, modification, destruction, exposure and/or disclosure. This program is centered on fostering and raising awareness on appropriate IT and physical security practices, along with establishing integration points with business process operations to protect MetLife data.

The authority and responsibility for managing the InfoSec program resides with MetLife’s Enterprise Chief Information Security Officer (“CISO”). The Enterprise CISO is a senior-level executive responsible for establishing and maintaining the vision and strategy of the InfoSec program so that information and technology assets are protected among all MetLife affiliates and that IT risks are reported, remediated and managed.

Administrative Safeguards

MetLife’s Program includes a set of written policies, standards and procedures, which are readily available to MetLife Personnel.

Certain policies and standards are established at the enterprise level and apply generally to all MetLife affiliates and businesses. Each of MetLife’s affiliates and businesses may adopt supplementary policies and standards as appropriate to reflect the circumstances of their own operations. MetLife’s polices, standards and procedures are accessible to MetLife Personnel. MetLife’s Global Privacy and Data Protection Policy.

MetLife’s Global Privacy and Data Protection Policy includes the following standards based on its key principles:

(i) Provide individuals notice about the use and purpose for processing personal information;

(ii) Limit the amount of personal information collected and processed;

(iii) Perform Privacy Risk Assessments for projects, products or technologies prior to processing personal information;

(iv) Conduct due diligence and ongoing monitoring of the Company’s third parties;

(v) Ensure that the cross-border transfer of personal information is compliant with governing laws and regulations;

vi) Respect individual’s privacy rights;

(vii) Incorporate end-to-end privacy in the development of technologies and business solutions;

(viii) Implement safeguards and report events impacting the availability, confidentiality and integrity of personal information;

(ix) Retain and dispose of Personal Data in accordance with MetLife retention and disposal policies, legal/ regulatory obligations, and legitimate business purposes; and

(x) Escalate, report, contain, and assess Personal Data Incidents (also referred to as PDIs) in accordance with legal and regulatory obligations.

Privacy Policy and Key Data Uses

Dear Valued Customer,

We are MetLife Lebanon, with Main Office located in Beirut , Verdun, JM Plaza Bldg., Concorde Sq., Verdun, Beirut, Lebanon (hereinafter "MetLife" or "Company"). MetLife will act as the controller of your personal data. MetLife strongly believes in protecting the confidentiality and security of its customers' personal data. This document refers to our "Privacy Policy" and describes how we use your personal data that we collect and receive in compliance with the Law No. 81/2018 on Electronic Transactions and Personal Data.
We wish to inform you that, in order to provide the services, benefits and insurance products requested by you or in your favor, as well as to verify the quality of the service provided, MetLife needs to process only the personal data concerning you that is necessary to enter into and perform your policy (e.g. name, contact details, including e-mail and telephone numbers, age, date of birth, gender, occupation, etc.) which can be acquired:

i. directly by you; Or

ii. through third parties, in the case of group or individual policies that qualify you as an insured or beneficiary, also through agents, brokers or other insurance intermediaries, or in the event that, for the correct and safe assumption and management of risks, it is necessary to acquire additional information through commercial information companies or through the consultation of databases, lists or registers that can be legitimately consulted.
Taking into account that in the stipulation and management of this contractual relationship you may provide data of third parties whose processing is instrumental to the management of the insurance relationship (e.g. for the designation of the beneficiary or the third party contact person, for the extension of coverage to other subjects, such as the family unit, witnesses, etc.), we specify that it is your responsibility to provide this information to the aforementioned third parties, acquiring consent where necessary. In the case of processing data of minors, the expression of the required consent must be expressed by one of the subjects exercising parental authority after having read this Privacy Policy. For the purposes of issuing and managing the policy, it may provide MetLife or other insurance intermediaries who collaborate with MetLife, any data that the legislation qualifies as "particular categories of personal data" essential for carrying out the checks necessary for the establishment of the insurance relationship such as medical information or for the execution of the requested services. "Sensitive data" means any personal information that may reveal racial and ethnic origin, religious, philosophical or other beliefs, political
opinions, as well as personal data that may reveal the state of health (such as, for example, certain information attesting to your state of health reported in questionnaires medical certificates or medical records) and sex life. The provision of your data is therefore necessary for the pursuit of the aforementioned purposes and, in some cases, mandatory at a regulatory level (e.g. for the fulfilment of the obligations provided for by anti-money laundering legislation or to carry out checks on the consistency of the insurance product offered with your insurance needs). Without them, we would not be able to properly provide you with the services, benefits and insurance products requested, nor to contact you for needs related to the management of the contract. We would also like to inform you that this Information is also provided by MetLife in the interest of the other data controllers in the context of the so-called "insurance chain".

Processing of Health and Sensitive Personal Data

In connection with the underwriting, issuance, administration, servicing and renewal of insurance policies, claims assessment and management, reinsurance arrangements, fraud prevention, compliance with legal and regulatory obligations, and the establishment, exercise or defense of legal rights, MetLife may collect, use, store, disclose, transfer and otherwise process health and other sensitive personal data relating to you and, where applicable, your beneficiaries, dependents or insured persons.

Such information may include medical history, medical reports, diagnoses, treatment information, disability information, genetic or hereditary information where relevant, and other health-related information necessary for insurance purposes.

By applying for, obtaining, maintaining or claiming under an insurance policy, and where required by applicable law by providing your express consent, you authorize MetLife, its affiliates, reinsurers, service providers, professional advisers, claims administrators, medical professionals, healthcare providers and other authorized third parties, whether located inside or outside Lebanon, to collect, access, review, use, disclose, transfer and process such information to the extent necessary for the purposes described in this Privacy Notice.

MetLife will process health and other sensitive personal data only where permitted by applicable Lebanese law, including where explicit consent is provided or another legal exception applies, and subject to appropriate confidentiality, security and organizational safeguards designed to protect such information against unauthorized access, disclosure, alteration, loss or misuse.

Where health information is no longer required for the purposes for which it was collected, MetLife will retain or dispose of such information in accordance with applicable legal, regulatory, contractual, record-retention and legitimate business requirements.

Subject to applicable Lebanese law, you have the following rights regarding your personal data:

Right to be Informed. You have the right to receive clear and transparent information regarding the collection, use, disclosure, storage, transfer and other processing of your personal data, including the purposes for which your personal data is processed and the categories of persons who may receive it.

Right of Access. You have the right to request confirmation as to whether MetLife processes your personal data and to obtain information regarding such processing in accordance with applicable law.

Right to Rectification, Completion and Updating. You have the right to request the correction, completion or updating of your personal data where such data is inaccurate, incomplete or outdated.

Right to Erasure. You may request the deletion of your personal data where such data is inaccurate, incomplete, ambiguous, outdated, incompatible with the purposes for which it is being processed, or where its collection, storage, use, transfer or other processing is not permitted by applicable law. This right is not absolute. MetLife may retain personal data where retention is necessary for policy administration, claims handling, fraud prevention, legal or regulatory compliance, anti-money laundering requirements, audit purposes, record-retention obligations, reinsurance arrangements, or for the establishment, exercise or defense of legal rights.

Right to Object. Subject to applicable law, you may object, for legitimate reasons, to the processing of your personal data, including processing for direct marketing purposes, subject to applicable legal exceptions.

Right to Withdraw Consent. Where processing is based on your consent, you may withdraw your consent at any time, subject to applicable legal and contractual limitations. Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal. MetLife may continue to process or retain personal data where required by law or where necessary for the administration of insurance products and services, claims management, fraud prevention, legal proceedings or regulatory compliance.

International Transfers of Personal Data 
In order to provide insurance products and services, MetLife may transfer personal data to its affiliates, reinsurers, service providers, professional advisers, auditors, regulators and other authorized recipients located inside or outside Lebanon. Where such transfers occur, MetLife implements appropriate contractual, organizational and security measures designed to protect the confidentiality and security of personal data. 

Consequences of Failure to Provide Information 
Certain personal data is required to issue, administer and service insurance products and to comply with legal and regulatory obligations. Failure to provide such information may prevent MetLife from issuing, maintaining or administering an insurance policy, processing claims, providing requested services or otherwise fulfilling contractual obligations. 

How to Exercise Your Rights 
To exercise any of the rights described above, please contact MetLife's Data Protection Officer using the contact details provided in this Privacy Notice. We may request information necessary to verify your identity before processing your request. 

Complaints and Legal Recourse 
If you believe that your personal data has been processed in a manner inconsistent with applicable Lebanese law, you may contact MetLife using the contact details provided in this Privacy Notice. You may also seek recourse before the competent Lebanese courts as permitted by applicable law. 

How to contact us or ask for help
If you have any questions or requests for help in relation to our Privacy Policy, please contact our Data Protection Officer, whose contact details are as follows: Telephone 961 1 753 111 ext. 1130 or e-mail lebanoncompliance@metlife.com

Please contact us if you are not satisfied with the way we collect, share or use your personal data or to withdraw your consent where possible. You can contact us using the contact details above. If you are not satisfied with our response, you have the right to lodge a complaint.

How we can contact you
We may contact you through one or more of the following communication channels: telephone, email, email, SMS messages, instant messaging or other electronic means of communication. We store calls and other recordings of communications securely in accordance with our retention policies and other Applicable Laws. Access to such records is limited to individuals who need to access them for the purposes set out in this Policy.

How we protect your personal data

The security and confidentiality of your personal data is essential to us. We have technical, administrative and physical measures implemented to:

• protect your personal data from unauthorized access and misuse;
• secure our IT systems and safeguard information;
• ensure that you can restore your data in cases where it has been corrupted or lost in disaster recovery situations.

Subject to your consent, we offer you the opportunity to be contacted to receive promotional material in relation to products, special offers or services that we think may be of interest to you and commercial communications (so-called direct marketing). These communications may be made, subject to consent, on the basis of a prior profiling activity, aimed at identifying your specific interests.

If you no longer wish to receive advertising or promotional material, we offer you simple ways to let us know. Each time you receive a commercial communication directly, you will be told how you can obtain the cancellation of your subscription. You may also select the "unsubscribe" option for any marketing communication we send you by email or change your preferences through our www.metlife.lb  or by email lebanoncompliance@metlife.com.

Global and Local Privacy Policies and Procedures

MetLife and its Personnel are subject to, and must comply with, the applicable privacy laws of the jurisdictions in which MetLife conducts business. If the privacy laws or regulations in a country where MetLife operates establish requirements that are higher than those established under the Global Privacy Policy, Personnel in that country follow those requirements through local policies, standards and procedures.

MetLife’s Code of Business Ethics & MetLife Policies
MetLife’s Code of Business Ethics (the “Code”) requires Personnel to protect personal information. MetLife’s Code, together with MetLife’s policies, gives Personnel information they need to perform their jobs ethically and in line with MetLife’s standards and applicable laws and regulations. Personnel are responsible for protecting and limiting their use of personal information and to respect the privacy of MetLife Personnel, customers, business partners and all other individuals whose personal information MetLife processes.

MetLife’s Information Security Policy
MetLife's Information Security Policy sets forth the fundamental principles for the protection of the Enterprise’s information resources and the controls required for MetLife to comply with internal and external regulation. All Personnel are responsible for complying with MetLife's Information Security Policy. The Policy applies to all electronic communication resources, including, but not limited to the Company’s network, computers, workstations, software, hardware, Internet/Intranet, electronic messaging systems (email, video), fax machines, and mobile devices. MetLife’s polices and standards are certified annually and accessible to Personnel via the corporate intranet.

Email Communication
Disclosure of confidential and personal information about MetLife operations, Personnel, services or systems to any recipient not authorized to receive such information is prohibited. MetLife’s Information Security Policies include guidance on the use of communication resources, cryptographic controls, exchange agreements with other organizations and methods to protect sensitive data sent external to MetLife including use of Transport Layer Security (“TLS”) and Send Secure to encrypt the confidential information. Encryption is designed to prevent the information from being read or corrupted as it travels from MetLife, over the Internet, to the recipient’s mailbox. In addition, MetLife utilizes Data Loss Prevention (“DLP”) measures on outbound email communication that are designed to protect the unauthorized disclosure of confidential and personal information.

Software
Software developed at MetLife is the property of MetLife. Decisions to upgrade to a new release of software take into account the security of the release (i.e., the number and severity of security vulnerabilities affecting the version). Such upgrades are conducted in accordance with MetLife's Information Security Policy Change Management requirements.

Devices Equipped with Photographic, Audio or Video Recording and/or Transmission Capabilities
Use of photographic, audio and video recording devices in the workplace is governed by a policy that states Personnel may not use recording or transmitting devices to record or retransmit any MetLife documents or confidential or personal information, except for MetLife business purposes consistent with MetLife policies and practices.

Privacy and Information Security Training and Awareness
MetLife written policies are reinforced by communications and training programs, instructing Personnel to treat information we collect about our customers, Personnel, business partners and other individuals as confidential.
MetLife requires third parties to whom personal and confidential information is shared in the course of business dealings to safeguard that information from improper use and disclosure.

Policy Lifecycle Management disciplines are in place to govern aspects of intake (i.e., proposed changes to existing policies and standards), impact analysis, change management, approvals, voting and communication. Policy Voting and Policy Communication committees regularly convene to support such activities.

MetLife has mandatory online training programs for MetLife Personnel, including but not limited to Privacy, Code of Business Ethics and Information Security. The courses are regularly updated and have been designed to complement and reinforce MetLife policy and culture around the confidentiality of personal and confidential information. Upon being hired, new Personnel are required to complete such mandatory trainings so that Personnel understand expected behaviors, in compliance with applicable policies, laws, and regulations. MetLife continues to provide ongoing training and updates to Personnel on emerging issues, information and best practices. Policies and training topics include but are not limited to:

• Share only on a “need to know” basis. Personal and confidential information should be accessed, used and disclosed by Personnel, and others who are MetLife service providers, only on a business “need to know” basis and with the proper management approvals;
  
• Secure desks and/or offices, including home offices. Secure any confidential information when Personnel leave their desk or leave for the day; and,
  
• For remote Personnel, connect to the MetLife’s Virtual Private Network (VPN), utilize only trusted networks, and abide by MetLife’s privacy principles.
  

MetLife regularly communicates to Personnel about emerging risks, policy requirements, and the importance of protecting company and personal information through email reminders, intranet posts, ad-hoc trainings, and internal social channels sponsored by the PCG and InfoSec.

Information Lifecycle Management (“ILM”) Program
Information is a corporate asset, and its proper management enables MetLife to improve operational efficiency and customer satisfaction, make more informed business decisions, and remain in compliance with laws and regulations.
MetLife has a global corporate ILM program that manages all its information no matter how it is created or where it is located or stored in the Company. At MetLife, information is classified into two categories: records and non-records. The ILM program governs the management of MetLife information through a governance structure that:

• Provides leadership and guidance to manage information as a corporate asset;
  
• Ensures the lines of business, corporate functions and regions are in compliance with the ILM Policy;
  
• Supports the effective management of information through ILM policies, standards, processes, procedures and the record retention schedule; and,
  
• Monitors compliance with legal/regulatory obligations regarding the retention and disposal of records.
  

The ILM Program Office, in partnership with the PCG and InfoSec, works with Personnel to manage information strategically and holistically throughout its lifecycle including the creation, storage, usage, collaboration, preservation, archiving and disposal of MetLife information. Below are the key aspects of the ILM Program.

Ownership of Information
MetLife information is MetLife’s property and does not belong to any employee or third-party, unless agreed to by the employee or third-party and MetLife. All Personnel and third parties with access to MetLife’s Information, including system/applications containing MetLife information, are responsible for managing information in accordance with MetLife’s ILM governance framework that includes policies, standards, processes, procedures, guidelines and MetLife’s record retention schedule. MetLife information that is created or received from third parties is managed in accordance with MetLife’s ILM framework. When an employee’s employment ends or the contractual relationship of a third-party with access to MetLife information ceases, neither the employee nor third-party shall retain or possess any MetLife information after the employment or contractual relationship ceases unless required by law. Originals and copies of MetLife information in the possession of the employee or third-party, must be returned to MetLife or be destroyed.

MetLife Record Retention Schedule
MetLife's Global Record Retention Schedule (“Schedule”) establishes the requirements for retaining and disposing of corporate records in compliance with legal and regulatory requirements, as well as MetLife business needs. The ILM Program Office conducts an annual recertification of the Schedule so that it aligns with business needs as well as legal and regulatory requirements. MetLife records are retained until the retention requirement stated in the Schedule has been met. Non-records have a maximum retention period of six years but may be disposed of at any time prior to six years when no longer needed.

Disposal of Information
Once the record retention requirement has been met, MetLife’s ILM policy requires information to be securely disposed of when no longer required to meet business or regulatory obligations, absent a legal hold or preservation obligation in place.

Records Management Vendors
MetLife has records management vendors that provide secure services for storage, retrieval, and disposal of paper and electronic records once the records have met their retention requirements, unless there is a preservation obligation or legal hold in place.

All Shred Program and Clean Desk Guidelines
MetLife operations follow an “All Shred Program,” in which secure shred bins or consoles are used to securely dispose of information on paper that has met its retention or is no longer needed for business purposes, absent a legal hold or other preservation obligation, mandating their further preservation. Globally, Personnel are required to comply with MetLife Clean Desk guidelines to help MetLife reduce the risk of information theft, fraud, or a security breach caused by sensitive information being left unattended.

ILM Training Course
MetLife’s ILM mandatory training course is provided to Personnel. The course helps Personnel better understand how to manage information through its lifecycle and the role of the Information Lifecycle Management Program in ensuring Personnel and our business partners retain the right information, for the right time and the right purpose.

Call Center Procedures
MetLife’s call center consultants follow documented procedures to authenticate callers before disclosing any confidential information about individuals. Before disclosing any information about policy owners, insured individuals, claimants, beneficiaries or others, consultants follow authentication procedures to verify a caller’s identity. 

Technical and Cybersecurity Safeguards 
MetLife reviews and updates policies and procedures to keep them current considering evolving cybersecurity law and regulation, emerging threats and new and changing technologies. InfoSec works with IT and business management to institute controls for IT systems, applications, and databases, and for vendor and application service provider arrangements.

MetLife’s approach to securing our environment is based on the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”). The CSF is based on existing standards, guidelines, and practices for MetLife to better manage and reduce cybersecurity risk. The core high level functions of the framework are Identify, Protect, Detect, Respond and Recover. InfoSec controls, products and initiatives align to these core functions.

As a component of the CSF “Prevent” function, MetLife utilizes a three-tier approach to data protection. Our Demilitarized Zone (“DMZ”) is the presentation tier, and where our Internet-facing servers reside. It provides an area where MetLife can place its content servers for access by the Company’s customers and creates an area that, if compromised, would limit the exposure to MetLife data. Under normal conditions, traffic is limited from the Internet to the DMZ only. Our second tier, known as the Bastion, is the application tier. The Internet application servers reside in this area and can communicate, on a limited basis, with both the DMZ and our internal network. The third tier, the data tier, resides inside the MetLife internal network. Application and database servers and business logic are in the Bastion behind both sets of firewalls. MetLife uses redundant firewalls in the DMZ and Bastion. InfoSec employs security scans to monitor for policy noncompliance and vulnerabilities at various levels of the technology infrastructure, as well as on various applications. Performance measures for key security processes critical to the security of the IT environment (e.g., anti-malware reports and spam totals) have been defined and aligned to the CSF “Detect” function. InfoSec has oversight responsibilities over these processes through IT internal risk reporting.

As a component of the CSF “Respond” function, MetLife has a Cyber Security Incident Response Team (“CSIRT”) that is charged with responding to internal and external threats and taking appropriate action. The CSIRT is responsible for establishing and maintaining visibility and situational awareness of threats, vulnerabilities and incidents. The team implements proactive measures in response to changes in the threat environment and works to rapidly contain security incidents. The primary goals of the CSIRT are to rapidly detect, triage, contain, eradicate and recover from computer security incidents, working closely with other teams across MetLife throughout the incident lifecycle.
The team is staffed with dedicated incident responders and forensics investigators and manages multiple third-party contracts to assist MetLife with its response anywhere it operates.

PCI DSS Requirements
The Payment Card Industry Data Security Standard (PCI DSS) is a set of global standards designed for companies that process, store, or transmit payment card information to maintain secure environments that protect cardholder data. The Payment Card Industry was founded by five of the major credit card brands, Visa, MasterCard, Discover, American Express and JCB, who also enforce the requirements.
MetLife and its affiliates accept credit and debit cards as payment for some of their products and services using the brands’ networks, and to that extent, they comply with the PCI DSS.

Technical Controls
MetLife implements the following technical controls that align to protect against threats and unauthorized access.

Access Security, Recertification and Removal
Electronic records are protected using multiple computer software products that employ such security features as passwords, user identification and personal identification numbers to guard against unauthorized access.
Based on risk, MetLife IT systems, applications and databases must periodically undergo employee access recertification. Managers must recertify that it is appropriate for Personnel to continue to have access to these systems, applications, and databases. In addition, the recertification process is in place at the platform level for when Personnel change job responsibilities. Access of any departing employee to our platforms is removed as soon as the departure is processed through Human Resources.

Anti-Malware Software; Standard Configuration;
Electronic points of entry, as well as servers, email, and workstations, are protected by anti-malware software. MetLife follows industry best practices for configuration of initial builds and vulnerability management to integrate security controls.

Anti-Phishing/Anti-Fraud
MetLife utilizes a vendor that actively scans the web for sites that may be masquerading as legitimate MetLife websites. The intent of this scanning is to identify websites that could obtain confidential information from MetLife customers who believe that they are interacting with the MetLife site. This vendor seeks out potentially fraudulent activity and notifies MetLife upon any discoveries. It also can assist MetLife in shutting down these offending sites. MetLife also partners with an industry-leading vendor for frequent phishing exercises to test employee awareness.

Application Testing
MetLife leverages independent application vulnerability scans and ethical hacks to test the controls implemented to protect the confidential and personal information.

Business Continuity/Disaster Recovery/Cyber Resiliency
To minimize potential losses and to permit resumption of processing in line with business recovery objectives, there are centrally coordinated business continuity and disaster recovery plans for MetLife systems and data consistent with the impact of any system failures on the business. These plans include a suitable backup and disaster recovery plan that is maintained, properly documented, periodically tested, and appropriate for the system covered, and each includes exercises in crisis management, IT recovery, business resumption, and security incident management. 

MetLife’s backup strategy has been engineered to maximize the ability to recover in a timely manner while protecting personal information. MetLife core systems are replicated from primary data centers to our secondary data centers. In addition, MetLife maintains an enterprise grade backup strategy, including immutable backup technology, in alignment with best industry practices to further ensure systems resiliency and capacity to recover from emergency situations with minimum impacts.

Data Loss Protection
MetLife employs an enterprise-wide data loss protection infrastructure at the network perimeter and workstation level, which monitors for and alerts MetLife about confidential data being moved from MetLife over the Internet or via insecure channels including web uploads, removable devices, physical printing, and email.

Encryption
MetLife encrypts data at rest on personal computers, including both laptops and desktops, mobile devices, and servers. Mobile phones are managed by a mobile device management solution that encrypts the device. Email encryption is enforced centrally using Transport Layer Security (TLS) or our encrypted messages Internet facility via our “Send Secure” email function. External websites leverage up-to-date secure versions of TLS.

Two-Factor Authentication
MetLife strictly controls access to its networks and high risk external applications through two-factor authentication. Using various token technology and authentication, MetLife can control access to MetLife systems for any Personnel who require access to MetLife networks while out of the office.

Vulnerability Management
MetLife utilizes several vulnerability management tools to filter and risk rank security alerts that are received daily, assisting in distinguishing between alerts relevant to MetLife versus alerts that have no bearing on MetLife’s infrastructure, allowing MetLife to focus on the most significant threats.

Risk Assessment
MetLife has developed an IT risk management framework to assess MetLife’s information technology risks. This program includes assessment of risks for MetLife’s IT organizations and technology infrastructure. The goals of the risk assessment process include prioritization of identified risks, and evaluation by IT management as to whether risks are being appropriately managed.

MetLife also assesses the sufficiency of Information Security policies, standards, procedures, information systems and other arrangements in place to control risks. MetLife reviews these policies, standards, procedures and other arrangements on an ongoing basis and updates them as warranted. MetLife Personnel can submit a change request for review by the policy owner and approval processes are in the IT Security policies system.

Monitoring, Testing, and Auditing
MetLife monitors the effectiveness of its information security practices. Business applications that are either new or undergoing major enhancements are evaluated through an internal application assessments process. New applications and major changes to existing applications go through a review process, which requires key project stakeholders and senior management approval at primary project milestones from deployment to production. Servers are scanned regularly so that they meet the current security standards.

MetLife works with leading third-party security companies who help periodically assess prevalent threats and vulnerabilities to enhance our security program. These services include periodic penetration testing and review.
MetLife employs network surveillance software to determine if any abnormal activity occurs, such as an attempt to gain unauthorized access to MetLife’s internal systems from outside MetLife’s network. Incidents are escalated to MetLife executive management in accordance with incident handling procedures. On top of internal measures, all Intrusion Detection System (“IDS”) components are centrally monitored by a managed security services supplier 24 hours a day, seven days a week. If any suspicious or abnormal network traffic occurs, appropriate IT security personnel are alerted.

Additionally, MetLife’s Internal Audit organization conducts periodic audits for the security and confidentiality of MetLife and MetLife’s personal information.

Physical Safeguards
MetLife facilities, including offices and data centers, have physical security controls in place designed to prevent unauthorized access.

MetLife’s facilities dedicated to computer processing are physically restricted and access is only granted to persons who have legitimate business responsibilities in the facility. MetLife buildings that house critical IT facilities use electronic and mechanical locks, employ trained security guards, use pictured badges for individual display and are applied for electronic access controls, and operate video surveillance to protect against unauthorized physical access. Any potential incidents of unauthorized access are required to be reported immediately to the site security management for immediate action. 

Personal Data Incident Handling
MetLife maintains policies and procedures outlining what Personnel and business units must do if a Personal Data Incident occurs. MetLife’s data incident management procedures establish a framework to facilitate a coordinated, efficient response across the enterprise.

When a Personal Data Incident (“PDI”) is reported, the PDI is analyzed by the PCG and DPOs, together with MetLife’s Legal Department. The definition of data breach varies from country to country, as do the reporting obligations to the authorities and notification requirements of the affected individuals. If notification to impacted individuals or regulators is required or desired, the PCG, Compliance Department, and DPO, as appropriate, work with the business to notify and, as appropriate, provide credit monitoring.

The incident response process is designed so that (i) the appropriate MetLife individuals are alerted, (ii) the Personal Data Incident is appropriately assessed, managed, contained, and remediated, and (iii) root cause, lessons learned, and remediation activities are appropriately reviewed and addressed to prevent future incidents.
Personnel receive training on how to identify, report and prevent PDI’s from occurring.

Third-Party Service Providers
MetLife exercises due diligence in selecting its service providers, including review of vendor applications, general IT controls and the IT facilities used to service MetLife’s business.

MetLife’s Corporate Functions (“CFs”) and Lines of Business (“LOBs”) are responsible for ensuring that engagements with third-party suppliers comply with the requirements set forth in the Global Sourcing and Third-Party Risk Management Policy (“TPRM Policy”). Service providers acting on behalf of MetLife are obligated to protect the security and confidentiality of MetLife’s systems and information.

When selecting service providers who may have access to confidential and personal information, MetLife Personnel must exercise care and follow MetLife’s TPRM Policy and procedures. Before onboarding new providers, MetLife Personnel query prospective service providers about their information security policies and procedures as part of their due diligence during the selection process and perform due diligence if the service provider or its personnel will have access to confidential and/or personal information. Through this process, MetLife can assess whether a potential service provider has the appropriate policies, procedures, controls and personnel to be entrusted to process such information pursuant to MetLife standards and in compliance with applicable regulatory and legal requirements.

MetLife service providers must enter into a MetLife-approved written contract that includes terms and conditions that require that MetLife and MetLife customer information be treated confidentially and used only as necessary to perform the contracted services.

In accordance with the criteria (e.g., materiality thresholds) set in the Global Sourcing & Third-Party Risk Procedures for the applicable region or country, a Request for Proposal (“RFP”) may be employed. Among other things, the RFP documentation alerts potential vendors that they must agree to appropriately ensure the security and confidentiality of MetLife data and personal information, and that this applies similarly to any person or entity with whom they share such information. A MetLife contract form containing appropriate provisions to protect MetLife data and/or personal information typically accompanies the RFP. In addition, potential vendors are generally asked to provide references.

MetLife reviews third party provider compliance with information security and privacy requirements with the vendor. A comprehensive privacy review is conducted through privacy risk assessment. InfoSec reviews controls to make sure that any MetLife data and/or personal information planned to be resident and processed at the vendor’s site will be secured and protected from unauthorized use or disclosure.

Through the MetLife Third-Party Risk Management process, service providers must periodically update the assessment documentation and be reevaluated relative to their internal controls. Vendors deemed critical and high risk are continuously monitored by various industry solutions and services to ensure risks are identified and addressed timely.

Non-Domestic Service Providers
As a result of its ongoing risk assessment, MetLife developed a set of guidelines that detail the special arrangements MetLife expects for non-domestic service providers.

MetLife business management must be informed of any offshore arrangements when their applications and data fall within the scope of that arrangement.

For non-domestic service providers, MetLife’s requirements include:

• A Third-Party Risk Assessment;
  
• Cross-border data transfer mechanisms where legally required, or as appropriate;
• Access to MetLife systems and data must be granted, reviewed and removed in accordance with MetLife’s Information Security standards;
  
• Provide security and privacy awareness training to personnel working on MetLife projects; and,
  
• Provide MetLife with the steps they have taken to assure that MetLife’s information is treated confidentially, and that the information is accessed on a need-to-know basis. The description must outline:
  

– Physical safeguards of MetLife data (e.g., separate workspaces, locking cabinets, building security)

– Technical safeguards (e.g., encryption, two-factor authentication)

– Administrative safeguards (e.g., log review, documented procedures, audits)

The contractual requirements outlined within the scope of the relationship apply not only to any agreements between the service provider and MetLife, but also between the service providers and any of its subcontractors hired for MetLife-related work.