Gaze patterns:

“The service of UWV is based entirely on trust; trust on the part of the consumer that his data is in secure hands, trust on the part of the employee that the resources he needs for his job are in good working order”, says Chief Information Officer Frans Haverkamp, who led the European tender to revamp the office automation of UWV.

KPN was awarded the contract.

The selection process lasted a full eighteen months. KPN was on the final shortlist of three.

UWV conducted a “competition-oriented dialog” with KPN – an intensive discussion between principal and bidders. “We wanted the bid to respond totally to our demands and to what is suitable for our organization. It resulted in three good bids.”

There is just one reason why UWV ultimately chose KPN, says Haverkamp. “KPN was simply the best.” The scope of the contract, which was signed in mid-2012, is that for a period of at least five years KPN will manage for UWV 20,000 workstations, the WAN and LAN infrastructure and the technical areas of 150 locations.

Good office automation is a prerequisite for the e-service that UWV offers to an increasing degree. “We want to attain the level of the banking sector,” says Haverkamp. One of UWV’s requirements was a high level of security. “We work with the private data, a lot of it socio-medical, of a couple of million Dutch residents and we have to retain it for seven years. It is unthinkable that someone could make off with it, so security and privacy and an extremely robust infrastructure are of vital importance to us.”

To acquire and share knowledge and experience of digital security UWV took the initiative to found a center for information security. Independent authorities, government and suppliers, including KPN, take part in it; “Free of charge,” adds Haverkamp. The public-private initiative is in keeping with the government’s wish for a “compact government”, a program to make substantial annual savings on government services. “UWV wants to be the ‘landing strip’ for possible clustering of tasks, for shared services. That’s why we have to put our own house in order first. Our infrastructure plays a crucial role in this.”

KPN | Sustainability Report 2012

61

In late 2011 and early 2012 we did a baseline survey in which we asked respondents among other things whether they consider that their data is in safe hands with KPN. Although 67%

of the 500 respondents regard us as a reliable telecom provider as far as privacy protection is concerned, more than three out of ten customers answered “no”. We see this as a sign that we still need to improve. We will carry out a similar survey in 2013 and aim to achieve a

“yes” from 70% of respondents.

To clarify in our own mind what we mean by privacy and to make it clear to customers what they can expect from us, we instituted a privacy mission (www.kpn.com/privacy). The mission is the basis for all privacy and security matters and incorporates several promises: privacy and security have priority, we enter into dialog with our customers if problems arise, we are transparent about what we do with customer data, we never listen in to calls and never read messages, and in the event of a hack we do everything possible to protect customer data.

Joost Farwerck, Managing Director Netherlands, presented the privacy mission at the National Privacy Debate in The Hague in June.

We offer customers ToestelVeilig and PC Veilig to give better protection to smartphones and computers. ToestelVeilig is an app that helps protect personal and confidential data on a smartphone. A stolen or lost device can be traced via a special website (toestelveilig.kpn.com).

The app also enables a device to be locked and personal data to be erased remotely.

With PC Veilig we offer customers a complete security package that gives the computer optimal protection against viruses, spyware, pop-ups, spam and other internet hazards.

We are also working on a blocking system to enable access to the network to be barred via a unique IMEI code. This can be used for example to render a stolen cell phone unusable. Talks are on-going between the government and the various providers to agree on a standard for this.

We hope to have a suitable solution in 2013.

KPN takes a variety of measures on these five topics. As in previous years, we sponsored the Mijn Kind Online foundation, a knowledge and advice center for youngsters and digital media.

MyBee, the free browser of Mijn Kind Online that checks whether websites are suitable for children, is already very popular among families with young children. With our help, in 2012 Mijn Kind Online published the book “Social Media at Primary School”, which is distributed on a large scale as a free download. A simple and robust reporting tool has been provided in the form of Meldknop.nl (www.meldknop.nl).

Meldknop.nl is an initiative of organizations such as Digivaardig & Digiveilig, Meldpunt Kinderporno op Internet (which combats child pornography on the internet) and the Kindertelefoon.

Youngsters can use the website for information and tips that enable them to solve their internet problems, such as bullying, discrimination, harassment and identity fraud. It gives information on how and when a complaint can be made. Youngsters can also find contact details of organizations that can help them solve their problem. The program Digivaardig

& Digiveilig is a collaboration between industry, government and social organizations to reduce the number of people with little or no digital skill and to promote the responsible and secure use of digital media. KPN is a partner of Digivaardig & Digiveilig.

We also take part in the Internet Security Platform, other participants in which are the Ministry of Security and Justice and the Ministry of Economic Affairs, Agriculture and Innovation.

Within this platform we take part in groups such as the Task Force to Block Child Pornography and the Task Force Notice and Take Down.

2.6.4. PRIVACY

More and more data of a sensitive and personal nature is exchanged via internet. In a comparative survey among telecom providers about privacy, carried out by Capgemini Consulting in the spring of 2012, we ended as best in class. We still see challenges ahead, such as continuing to improve information security, more attention for internal awareness, taking account of the data protection and privacy of the user in innovation processes, communicating more clearly and transparently, and performing a greater opinion-forming role.

KPN | Sustainability Report 2012

62

Our social themes continued

We look not only at the privacy aspect in our own company, but also at that of subcontractors at home and abroad to whom we outsource work. We include explicit privacy requirements in new outsourcing and offshoring contracts for work in which they come into contact with personal data. A temporary team checked whether our current outsourcing and offshoring contracts comply with these requirements and we revised them where necessary.

We are also aware that customers have different perceptions of privacy and privacy protection. The rise of social media like Facebook and Twitter shows that opinions on this are still in development. Young people in particular share personal data with one another more than before. KPN regards the legal requirements for privacy as a minimum, but we are looking for ways to offer customers more choice in terms of data sharing.

Developing such a policy and implementing it and embedding it in our systems require a lot of effort. We will make a start on this in 2013 and will then be able to give more information about online security.

2.6.5. DILEMMAS AND CHALLENGES Developments in the ICT and telecom sector follow one another in rapid succession. From a commercial viewpoint it is of vital importance for KPN to put new or adapted products and services onto the market as soon as possible. In their turn, security and privacy procedures and specific provisions in the Telecommunications Act require care and time and can therefore delay the launch of a product. It is a challenge for us to continually find and maintain the balance between these two vital, but sometimes conflicting interests. But in the end we will launch a product or service only if it is fully in compliance with the requirements of privacy and security.

KPN | Sustainability Report 2012

63

SOCIALLY

INVOLVED IN ALL