Capital One 2013 Annual Report Download - page 35

The EC has also issued a draft regulation which will replace the Data Protection Act 1998. This will be directly
effective without the need for additional U.K. legislation. The date on which the regulation will come into force
has not yet been confirmed, but it is expected to be placed before the European Parliament in spring 2014. There
will likely be a two-year grace period to work towards compliance with the regulation; however, a shorter
implementation period may be specified by the European Parliament. Key proposed changes that we expect
would impact COEP include:
• Requirement on companies to notify any breach of the regulations to the Information Commissioner’s
Office (“ICO”) and to individuals whose data has been affected or compromised as a result of the breach;
• Increased powers, including the ability to assess fines, given to the ICO;
• Requirement to conduct a Privacy Impact Assessment for all areas of the business, including any changes to
systems;
• Mandatory appointment of a data protection officer who must act independently and autonomously at all
times; and
• Widening of the definition of personal data.
Canada
In Canada, COBNA operates as an authorized foreign bank pursuant to the Bank Act (Canada) (the “Bank Act”)
and is permitted to conduct its Credit Card business in Canada through its Canadian branch, Capital One Bank
(Canada Branch) (“Capital One Canada”). The primary regulator of Capital One Canada is the Office of the
Superintendent of Financial Institutions Canada (“OSFI”). Other regulators include the Financial Consumer
Agency of Canada (“FCAC”), the Office of the Privacy Commissioner of Canada, and the Financial Transactions
and Reports Analysis Centre of Canada. Capital One Canada is subject to regulation under various Canadian
federal laws, including the Bank Act and its regulations, the Proceeds of Crime (Money Laundering) and
Terrorist Financing Act and the Personal Information Protection and Electronic Documents Act.
In 2013, there were three new, significant regulatory developments that affect credit cards issued by federally
regulated financial institutions in Canada. These amendments could increase our operational and compliance
costs and affect the types and terms of products that we offer in Canada.
In February 2013, amendments were made (the “Amending Regulations”) to the Proceeds of Crime (Money
Laundering) and Terrorist Financing Regulations under the Proceeds of Crime (Money Laundering) and Terrorist
Financing Act. The Amending Regulations prescribe additional requirements on financial institutions and
intermediaries in relation to customer identification, customer monitoring, enhanced due diligence and ongoing
scrutiny of customers’ activities. The Amending Regulations came into force on February 1, 2014.
In March 2013, Complaints (Banks, Authorized Foreign Banks and External Complaints Bodies) Regulations
were made under the Bank Act (Canada) (the “Complaints Regulations”). In April 2013, the FCAC published
Commissioner’s Guidance CG-12 Internal Dispute Resolution (the “IDR Guidance”). The Complaints
Regulations require financial institutions to provide a person requesting or receiving a product or service with
certain disclosures relating to contacting the FCAC and the financial institution’s complaint process and specify
the manner of such disclosures. The Complaints Regulations also require financial institutions to provide the
public with certain information about their complaints process on an annual basis (the “Annual Report”) and
require financial institutions to be members of an external complaint body that is approved by the Minister of
Finance under the Bank Act (Canada). The IDR Guidance provides specific guidance regarding financial
institutions’ internal dispute resolution (“IDR”) procedures including ensuring adequate resources, training,
retention of complaint information, procedures relating to the Annual Report requirement, and timeframes of the
IDR procedures. In addition, financial institutions’ written IDR procedures must be in language that is clear,
simple and not misleading and financial institutions must demonstrate that their IDR procedures are accessible to
consumers. The Complaints Regulations and the IDR Guidance came into force on September 2, 2013.
15