This Statement is Bloomberg's description of the measures it puts in place to protect personal information it transfers. It is issued by Bloomberg Finance L.P., its operating agent Bloomberg L.P., and affiliates, who are together called "Bloomberg", and it states that they are committed to complying with their data protection obligations worldwide.
Supporting quotations
Bloomberg Finance L.P., its operating agent Bloomberg L.P., and affiliates (“Bloomberg”)
sets out information about the measures we put in place to protect personal information we transfer
Qualifications & exceptions
Describes measures Bloomberg says it has in place; it is a statement of practice and does not itself grant rights to any individual.
"Bloomberg" is defined to include Bloomberg Finance L.P., Bloomberg L.P. and affiliates.
Not stated here
The Statement does not say which personal information is transferred, whose it is, which countries it goes to, or which Bloomberg products or services it relates to.
The Statement does not name the specific data protection laws it refers to.
Sharing & Disclosure · Company practice
Transfers to Bloomberg group members overseas use intra-group agreements
When Bloomberg transfers personal information to Bloomberg group members overseas, the relevant group members enter into Intra-Group Personal Data Protection Agreements (IGAs). Each IGA identifies which group member is the data exporter and which is the data importer. Bloomberg says the IGAs ensure the transferred information is subject to appropriate safeguards, as applicable data protection laws require.
Supporting quotations
where Bloomberg transfers personal information to Bloomberg group members overseas, the relevant Bloomberg group members enter into appropriate Intra-Group Personal Data Protection Agreements (“IGAs”)
which identify the Bloomberg group members acting as data exporter and data importer
ensure that personal information transferred overseas is subject to appropriate safeguards, as required by applicable data protection laws
Qualifications & exceptions
Applies where Bloomberg transfers personal information to Bloomberg group members overseas.
The safeguards are described as those "required by applicable data protection laws"; the Statement does not say what those laws require.
Not stated here
The text of the IGAs is not supplied in this source.
This passage covers transfers to Bloomberg group members only; transfers to other recipients are not addressed in it.
Legal Rights & Agreement Rules · Company practice
IGAs incorporate Standard Contractual Clauses for EU, Swiss and UK information
As an example, for personal information that originates in the European Union, Switzerland or the United Kingdom, the IGAs incorporate EU Commission-approved Standard Contractual Clauses (SCCs), which include specific obligations and rights around transfers. The IGAs also contain amendments that applicable data protection law requires so that their application extends to transfers from non-EU jurisdictions, where relevant.
Supporting quotations
for personal information originating in the European Union, Switzerland or the United Kingdom, the IGAs incorporate EU Commission-approved Standard Contractual Clauses (“SCCs”), which include specific obligations and rights around transfers of personal information
The IGAs will also contain amendments required by applicable data protection law to extend their application to transfers of personal information from non-EU jurisdictions, where relevant
Qualifications & exceptions
Introduced as an example ("For example"), so the Statement does not present it as a complete list of the regimes it handles.
The non-EU amendments apply only "where relevant" and only to the extent applicable data protection law requires them.
Not stated here
The Statement does not list the non-EU jurisdictions or say how the IGAs are amended for them.
The SCC text and the contents of the amendments are not supplied.
Security & Safeguards · Company commitment
IGAs carry operating and security measures meant to keep protection in place after transfer
Bloomberg says the IGAs include the operational procedures and security measures it uses to maintain the accuracy and integrity of personal information and to protect it adequately. It also says the IGAs include safeguards meant to keep personal information protected to the standard applicable data protection laws require, including after it has been transferred overseas. The bullet items that follow in the Statement are presented as examples of these safeguards.
Supporting quotations
The IGAs include the operational procedures and security measures used by Bloomberg to maintain the accuracy and integrity of personal information and adequately protect personal information
The IGAs include the safeguards we put in place to ensure that personal information continues to be protected to a standard required under applicable data protection laws, including after it has been transferred overseas
Qualifications & exceptions
Described as measures included in the IGAs; the Statement does not say how Bloomberg checks that importers follow them.
The standard of protection is tied to what "applicable data protection laws" require.
Not stated here
The specific operational procedures and security measures in the IGAs are not supplied beyond the bulleted summaries.
Legal Rights & Agreement Rules · Company practice
Governance program and compliance working group
Bloomberg says it maintains a personal information governance program, regularly reviews and updates its governance framework (including personnel roles and responsibilities), and maintains a working group that oversees compliance with data protection regulation and documents results and decisions about personal information management.
Supporting quotations
We maintain a robust personal information governance program
maintain a working group to oversee data protection regulation
document results and decisions as they relate to personal information management
Qualifications & exceptions
This is Bloomberg's description of its own internal practice, given as one of the safeguards in the IGAs.
Not stated here
The Statement does not say how often "regularly" is, who sits on the working group, or whether results are reported outside Bloomberg.
Use & Processing · Company practice
Mapping of personal information and recording of disclosures
Bloomberg says it maps the personal information life cycle and maintains a personal data map inventory. The inventory documents how personal information flows within Bloomberg's systems and any disclosures to third-party systems.
Supporting quotations
We map the personal information life cycle
maintain a personal data map inventory
any disclosures to third-party systems
Qualifications & exceptions
Described as an internal recordkeeping practice, not a right or report available to individuals.
Not stated here
The Statement does not say who the third parties are, what personal information is disclosed to them, or whether the inventory is shared with individuals or regulators.
Security & Safeguards · Company commitment
Organizational, technical and physical security safeguards
Bloomberg says it invests in and maintains organizational, technical and physical safeguards intended to protect personal information, and that it engages in ongoing monitoring and testing of how effective they are. It also says its data centers are dedicated solely to its products, services and operations and have secure and monitored access controls.
Supporting quotations
We invest in and maintain organizational, technical, and physical safeguards
We engage in ongoing monitoring
Our data centers are dedicated solely to our
have secure and monitored access controls
Qualifications & exceptions
The safeguards are described as "intended to" protect personal information; the Statement does not promise that protection will always succeed.
The dedicated-data-center statement is about Bloomberg's own data centers; it does not mention third-party hosting.
Not stated here
The specific controls, testing frequency and results are not stated.
The Statement does not say whether any personal information is stored or processed outside the data centers it describes.
Use & Processing · Company practice
Privacy built into product design and development
Bloomberg says it integrates mapping of, and accountability for, personal information into its product design processes, and builds personal information security into its development and product life cycles.
Supporting quotations
We integrate mapping of and accountability for personal information
build personal information security into our
Qualifications & exceptions
Stated as general company practice for product design and development.
Not stated here
The Statement does not identify which products or what design review steps are involved.
Legal Rights & Agreement Rules · Company practice
Policy reviews and privacy training
Bloomberg says it regularly reviews and updates its policies, procedures and controls to address its data protection obligations. It also says it conducts company-wide privacy training, data protection executive education and tailored training programs for data protection compliance.
Supporting quotations
We regularly review and update our policies, procedures, and
controls to address our data protection obligations
We conduct company-wide privacy
data protection executive education and tailored training programs for data
Qualifications & exceptions
Internal administrative practice described in general terms.
Not stated here
The Statement does not give review or training frequency, or who is covered by the tailored programs.
Sharing & Disclosure · Company practice
Company-wide approach to government and law enforcement requests
Bloomberg says it takes a company-wide approach to disclosure to law enforcement, government and regulatory agencies. The approach goes beyond personal information and applies to all client data. For more detail the Statement points readers to Bloomberg's Law Enforcement Data Request Statement, which is not part of this source.
Supporting quotations
We take a company-wide approach to law
enforcement, government, and regulatory agency disclosure, which extends beyond personal
and applies to all client data
Please see our Law Enforcement Data Request
Qualifications & exceptions
The approach is described as covering all client data, not only personal information.
Not stated here
The Statement does not say when Bloomberg discloses information to authorities, whether it notifies the people affected, or whether it challenges requests; those details are left to the separate Law Enforcement Data Request Statement, which is not supplied here.
Legal Rights & Agreement Rules · Company commitment
Data Privacy Framework certification for certain group members
Bloomberg says it has certified to the U.S. Department of Commerce that certain Bloomberg group members adhere to the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework. It points to a separate Data Privacy Framework Notice for more information.
Supporting quotations
Bloomberg has also certified to the U.S. Department of Commerce that certain Bloomberg group members adhere to the EU-U.S. Data Privacy Framework
the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework
Qualifications & exceptions
The certification is for "certain" Bloomberg group members, not stated to be all of them.
Not stated here
The Statement does not name the certified group members.
The Data Privacy Framework Notice it links to is not supplied in this source.
Legal Rights & Agreement Rules · Procedure
Where to send questions or comments
Questions or comments about this Statement should be submitted to privacy@bloomberg.com.
Supporting quotations
Contact information
Questions or comments regarding this Statement should be submitted to
privacy@bloomberg.com
Qualifications & exceptions
Covers questions or comments about the Statement itself.
Not stated here
The Statement does not describe a response time or process, or any rights request procedure.
Legal Rights & Agreement Rules · Permission or license
Bloomberg may change the Statement at any time
Bloomberg reserves the right to change this Statement at any time. Revisions are indicated through the date at the top of the Statement, and changes take effect when posted. The version supplied here carries the date "As of October 29. 2024".
Supporting quotations
Bloomberg reserves the right to change this Statement at any time by indicating revisions through the date at the top of the Statement
Such changes will be effective upon posting
As of October 29. 2024
Qualifications & exceptions
Notice of changes is described only as a revised date at the top of the Statement.
Changes are "effective upon posting", with no advance period stated.
Not stated here
The Statement does not say Bloomberg will notify people directly of changes.
The date line reads "October 29. 2024" with a period after the day; the Statement does not say whether that is the effective date or the last revision date, and it names no successor version.