Universal Registration Document 2022

4.2.2.3 The proprietary tool: A.L.I.C.E. (Advertising Limiting Impacts & Carbon Emissions)

To determine the carbon emissions of goods and services, the first and simplest option is to apply emission factors to the total amount of purchases made, these emissions factors being public and international, and by category of products and services. The second option is to measure the impact of the components of a product or service as closely as possible. This has been Publicis Groupe’s commitment since 2017 with the creation of A.L.I.C.E. Since the end of 2019, the agencies have been using this ad hoc calculation tool, developed and monitored by Bureau Veritas on the calculation methodologies aligned with the GHG Protocol, and for updating the emission factors (emission factors issued by the IEA – International Energy Agency; DEFRA – Department for Environment, Food and Rural Affairs; ADEME – French Ecological Transition Agency). A.L.I.C.E. is a tool for the Company’s Climate objectives (see also Section 4.3) for clients, in order to more precisely assess our ability to reduce the impacts of our products and services. A.L.I.C.E. covers all major Groupe business lines: Creation, Production, Media, Events, Data, DBT (Digital Business Transformation) and makes it possible to respond to a request from clients on the calculation of the carbon impact of their marketing and communication activities. A.L.I.C.E. makes it possible to analyze the impacts on a project-by-project basis, identify reduction levers and increase the positive impacts through new, more frugal solutions, tested by the agency and offered to clients.

A.L.I.C.E. has already made it possible to reduce the impacts of the campaigns and projects that have been assessed, thanks to the upstream reflection that is undertaken well before measuring the impacts of a project. The simple measurement also makes it possible to identify levers that are easy to operate and which reduce impacts by 20-25%. In 2022, Prodigious in France carried out more than 700 assessments of different productions shared with clients. This exercise allowed the agency to have an impact framework enabling it to better anticipate certain aspects of production. For example, in terms of the size of visuals and/or video formats, reducing them can generate more than 50% savings on electricity consumption. The agency has defined new production standards to maintain visual quality and minimize these energy consumption impacts. These standards are then shared with the Media teams in a collaborative manner, then with partners and supports. A.L.I.C.E. is used with more than 180 clients.

A.L.I.C.E. has an educational role to play with employees, allowing them to materialize the concrete environmental impact in order to imagine less impactful solutions very early on. The objective is to sharpen everyone’s reflexes to reduce all environmental impacts. 700 key users from 75 agencies in 20 countries make regular estimates. They were carried out on behalf of 180 clients/brands. The clients for which the teams use A.L.I.C.E consider that the calculation method used is robust and that the cross-functional approach to the Groupe’s various business lines provides unparalleled homogeneity of calculation. A.L.I.C.E. is an open system, making it possible to interface with other internal tools such as Razoscan, built with the support of Green IT and Epsilon’s Digilab. And with respect to external partners, in 2022 A.L.I.C.E. hosted two APIs with experts in the measurement of media-related impacts: Impact+ & Scope3. These two interfaces make it possible to refine the calculations of digital impacts, particularly those related to programmatic. Other partnerships are underway.

A.L.I.C.E.’s governance is the responsibility of the Groupe’s CSR Department with a cross-functional project Groupe of around twenty employees from different business lines and countries, actively participating in A.L.I.C.E.’s improvements and developments. Bureau Veritas acts as a trusted third party and ensures compliance with the methodological framework. In 2022, a critical scientific review was conducted by an external third party, Resilio Solutions, based in Lausanne, in order to refine the measurement of digital impacts, particularly for calculations related to servers and data centers. A presentation methodological document is publicly available on the Groupe’s website in the CSR section of the Responsible Marketing section.

Publicis France launched its internal business transformation program, We Are Positivers (WAP), at the end of 2021. More than 2,200 employees had been trained by the end of 2022. NIBI is now available to all Groupe employees in French and English on Marcel Classes. WAP in 2022 won a Strategic Engagement Communication Award and Good Economy Award. Responsible Communication training was also rolled out to five of our clients (700 people trained). 2022 also marked the start of the international roll-out of NIBI in the Groupe, with the provision of training and tools to all.

Concerning the NIBI approach, more than ten major clients have already embarked on the process of operational transformation of their communication, and 30 others have been made aware. With A.L.I.C.E, more than 1,000 carbon assessments were carried out for production activities and 400 for media plans. Publics France continued to work on inclusion issues with its partners Singularist and Pic&Pick to be fairer in advertising representations, as well as with partners acting in the “behind the camera” business lines with “Séquences Clés” and “Collectif 50/50”. Since the end of 2022, to accelerate the internal transformation of agencies in France, Top managers now have a CSR objective and a DEI objective in their assessment. The eco/socio-designed campaign carried out for SNCF illustrates how to reconcile creativity and responsibility. It won the Good Economy Grand Prix and was the subject of numerous reports and interviews in the press. As for the NIBI program, it won two Ekopo awards, rewarding positive economy projects. 

Lastly, Publicis France continued to actively participate in the collective actions of the sector with the AACC, Udecam, CPP, UDM and also by participating in the discussions initiated by the French government. For example, Publicis has played an active role in raising awareness of the Climate & Resilience Act’s Climate Contracts by leading by example and writing its own, but also by encouraging its clients and other agencies to publish their Climate Contracts, via client webinars and at AACC. Publicis Conseil has published its 3rd CSR report and worked with its Expert Stakeholder Committee (including four clients, one representative of the ARPP, two representatives of NGOs, one representative of an Inclusion & Diversity association, one representative of Responsible Digital Services, two representatives of Media and one representative of a student association) which meets twice a year.

Publicis Health in the United States

The CSR and DEI program (Diversity, Equity, Inclusion) of Publicis Health is built holistically and aligned with the United Nations Sustainable Development Goals. The agency has adopted strong positions to defend the right of access to health for all, particularly for women, by encouraging each employee to take care of themselves and their loved ones.

In terms of priority, the agency focuses on the specific issues of women, in order to pay particular attention to under-represented Groupes, and to have teams that more closely reflect the patients, consumers and communities with whom the agency interacts regularly. The ultimate goal is that everyone can take full advantage of all professional opportunities.

Recurring partnerships have been set up with the National Alliance on Mental Illness (NAMI), the Skin Care Foundation (SCF) or with Multiple Sclerosis Association of America (MSAA). On each occasion, the agency’s commitment covers a wide range of activities: responsible marketing, pro bono information campaigns for the general public, volunteering, fundraising – and involves key stakeholders: employees, clients, NGOs. For NAMI, in 2022 the agency orchestrated the 3^rd Annual Talent Show Fundraiser in New York to raise funds to support several mental health assistance programs in the city. In 2022, the well-being at work program, promoting physical and mental health, welcomed various experts from these organizations to share their experiences with employees.

In 2022, the internal intern support program welcomed 65 young people. They were involved in the preparation of the HPV vaccination campaign for adults.

In terms of recruitment, the MAIP (Multicultural Advertising Intern Program) partnership in conjunction with the MCTP Group program, and various associations and NGOs, made it possible to welcome more diversified profiles and to help young people from less privileged backgrounds to access our jobs, as interns and then to be recruited. Publicis Health’s affinity Groupes (BRGs) were active and participation in conferences such as ADCOLOR, Black Enterprise Women of Power, Out & Equal, 4As Vanguard or 3AF Asians in Advertising were continued and are beneficial opportunities for the employees concerned to contribute to the inclusive internal culture.

Publicis Health is a recognized agency in the medical and paramedical ecosystem, in permanent contact with doctors and medical experts or health practitioners; the role of Chief Patient Officer is key and has been praised by Reuters (Patient Advocate of the Year). As the health sector is highly regulated, teams work with compliance officers on a daily basis.

4.2.3.2 Data protection: Role of the Global Data Privacy Office (GDPO)

1) Governance, organization and mission

GDPO (Global Data Privacy Office) is a team of specialized lawyers, legal experts and experienced professionals, experts in data protection issues, working under the supervision of the Chief Data Protection Officer (CDPO). The GDPO is part of the Groupe’s Legal Department, which reports to the Secretary General. Its role is to oversee the data protection program, advise agencies on protection issues and help them with risk management. It also participates in various professional bodies or joint initiatives such as IAB EU’s Transparency & Consent Framework, and the IAB, US’ CCPA Framework. From an operational point of view, the GDPO relies on its Global Data Privacy Operations Team (GDPOps) including Privacy Leads and Data Privacy Stewards in the various countries, in charge of implementing and monitoring the compliance program. The GDPO and GDPOps teams work closely with the GSO, the Global Security Office, as soon as there is a data security question. A Groupe process is dedicated to incident response (Incident Response Process) to manage cybersecurity incidents and data breaches.

The data protection policy is based on the principle of privacy-by-design and must ensure compliance with applicable laws and best practices. This very early stage approach facilitates cooperation with all teams from the earliest stages of a project, so that data protection is well integrated into systems and solutions, and in close contact with client-side teams and their partners. The following principles are applied:

i) ensure that each claimant can exercise his or her rights; ii) review data protection policies and procedures; iii) carry out regular assessments to identify any problems and, if necessary, implement rectification plans.

Even if the field of data protection requires a certain expertise, all Publicis Groupe employees must understand and apply the fundamental principles of data protection, and thus have a vision of each person’s obligations and role in the project. Training for all employees takes place every year with reminders on the European GDPR (General Data Protection Regulation), the CCPA (California Consumer Privacy Act) as well as on data security. Specific training was delivered also and as needed.

As required by law, the Groupe offers consumers access to their privacy rights. For example, with Epsilon, certain rights can be exercised using an automated tool: https://legal.epsilon.com/dsr. In addition, in the United States, Epsilon indicates in its privacy policy the number of requests received by consumers during the previous year: https://legal.epsilon.com/us/NA-products-privacy-policy

2) Certification

In 2022, for the second year, Publicis Groupe was assessed by CyberVadis and remained in the top 1% of companies in terms of security and data protection (score for 2022: 645/1000, thanks to the joint work between the GDPO and the GSO).

The Groupe’s data protection policy is publicly available on the Groupe’s website, in the CSR library. Data protection issues are centralized and each employee can directly contact the GDPO and its teams: privacyofficer@publicisgroupe.com.

3) With suppliers and partners

Suppliers are subject to an initial due diligence whose purpose is to assess their processes and policies in terms of data protection and security, to verify their compliance and to understand their practices. The various GDPO, GDPOps and GSO teams work together for these initial reviews. Suppliers and partners must also complete a self-assessment of compliance with laws and regulations or even best practices. The contracts contain strict contractual obligations, in particular data protection declarations and guarantees. A Data Processing Addendum (DPA) is systematically distributed to suppliers, partners and publishers. When it comes to sensitive data (HR, financial, health, etc.), in-depth analyses are conducted to verify protection, security and compliance issues. This work is carried out in cooperation with the Procurement Department (see Section 4.2.7 of this document).

The data protection policy is an integral part of the Janus Code of Ethics and publicly available on the Groupe’s website, in the CSR library.

4.2.3.3 Data security: Role of the Global Security Office (GSO)

1) Governance, role and mission

At Publicis Groupe, information security is everybody’s responsibility. This involves protecting sensitive information, particularly that of clients. The entire security program is led by a dedicated team from the Global Security Office (GSO), which brings together highly experienced professionals whose expertise is certified in CISSP, CISA, CISM, CRISC, etc. The GSO is responsible for policies, guidelines and standards applied throughout the Groupe. The entire program is based on a logic of continuous improvement, with an ongoing assessment of security risks and monitoring of the application of Groupe rules. The work of the GSO is managed and monitored by the Groupe’s top management.

The GSO oversees a number of programs such as compliance, risk management, security or vulnerability testing, technical reviews, service continuity plans and educating employees about these risks. Particular attention is paid to training all teams using different methods (blogs, articles, videos, tests, graphics, etc.) in six languages (French, English, Spanish, Chinese, Portuguese, German) to build a culture of security across the entire Groupe. All employees must complete a mandatory module on data and information security each year, in addition to on-demand training such as code security. The GSO team coordinates regular communication with all employees, recalling best security practices and detailing existing threats.

A dedicated team, the SOC (Security Operations Center) monitors cybercrime risks (ransomware, malware, phishing, etc.). The SOC is operational 24/7 and ready to intervene to protect infrastructure, systems, information and data and, where necessary, activate business continuity plans and disaster recovery plans.

2) Certifications and compliance

85% of GSO teams are ISO 27001 certified. The GSO program is subject to multiple independent external audits throughout the year. These audits are conducted by third parties but also at the request of our clients and partners, in order to maintain the highest levels of assurance and to continue improving the systems year after year. GSO teams work closely with agency project teams to ensure compliance with client expectations. This means following external certifications such as ISO 27001 or ISO 22301, as well as more specific standards such as Payment Card Industry Data Security Standard (PCI DSS) or Health Insurance Portability Accounting Act (HIPAA) or Service Organization Control (SOC) Trust Criteria. Groupe information security policies are aligned with ISO 27001 standards; the Groupe’s largest entities in the United States, India, the United Kingdom and Latin America are ISO 27001 certified. The GSO monitors these certifications. They work closely with the GDPO teams (see previous paragraph). Epsilon’s activities also have ISO 22301 certification for business continuity plans.

Data security issues are centralized and each employee can contact the GSO and its help desk teams directly at: askgso@publicisgroupe.com.

3) With suppliers and partners

One of the key principles is to extend internal security requirements to suppliers and partners. The GSO manages the Security Risk Management program, in cooperation with the Groupe Procurement Department (see Section 4.2.7 of this document). These are formal security risk assessments, reviewing various administrative, technical and physical security controls.

The Information Systems Security policy is an integral part of the Janus Code of Ethics; it is publicly available in the CSR library of the Groupe’s website.