First Data 2007 Annual Report Download - page 19

Escheat Regulations
We are subject to unclaimed or abandoned property (escheat) laws in the United States and abroad which require us to turn over to certain government
authorities the property of others held by us that has been unclaimed for a specified period of time such as, in the Integrated Payment Systems segment,
payment instruments that have not been presented for payment or, in the Commercial Services segment, account balances that cannot be returned to a
merchant following discontinuation of its relationship with us. A number of our subsidiaries hold property subject to escheat laws and we have an ongoing
program to comply with those laws. We are subject to audit by the states with regard to our escheatment practices.
Privacy and Information Security Regulations
Each of our segments provides services that may be subject to various state, federal and foreign privacy laws and regulations. Relevant federal privacy
laws include the Gramm-Leach-Bliley Act, which applies directly to a broad range of financial institutions and indirectly to companies that provide services to
financial institutions, and the Health Insurance Portability and Accountability Act, which applies directly to certain healthcare-related businesses and
indirectly to companies that provide services to such businesses. Relevant foreign privacy laws include Directive 95/46 EC of the European Parliament and of
the Council of 24 October 1995, as such directive is implemented in each member state of the European Union (however each member state has its own
privacy laws which in some cases may be more restrictive than the Directive and impose additional duties on companies regarding handling/transfer of
personal data); the Australian Privacy Act of 1988; and the Personal Information Protection and Electronic Documents Act in Canada. Each of these laws
restricts the collection, processing, storage, use and disclosure of personal information, requires notice to individuals of privacy practices and provides
individuals with certain rights to prevent use and disclosure of protected information. These laws also impose requirements for safeguarding personal
information through the issuance of data security standards or guidelines. Certain state laws impose similar privacy obligations as well as, in certain
circumstances, obligations to provide notification to affected individuals, state officers and consumer reporting agencies, as well as businesses and
governmental agencies that own data, of security breaches of computer databases that contain personal information.
Other
In the European Union, Directive 2007/60 EG, the "Payment Services Directive", was released by the European Parliament and by the Council on
November 13th, 2007, setting a framework for future regulation of bodies and corporations such as the national central banks, financial institutions, e-money
institutes and payment institutions. The Payment Services Directive has to be implemented in the EU member states via national legislation by November 1st,
2009. It is expected that the new member state legislation will have a material impact on the development of our industry in the EU.
Stored-value services offered to issuers by First Data Prepaid Services ("FDPS") in the United States and outside the United States by First Data's
International businesses ("First Data International") are subject to various federal, state and foreign laws and regulations, which may include laws and
regulations related to consumer and data protection, licensing, escheat, anti-money laundering, banking, trade practices and competition and wage and
employment. These laws and regulations are evolving, unclear and sometimes inconsistent and subject to judicial and regulatory challenge and interpretation,
and therefore the extent to which these laws have application to, and their impact on, FDPS, First Data International, financial institutions, merchants or others
is in flux. At this time we are unable to determine the impact that the clarification of these laws and their future interpretations, as well as new laws, may have
on FDPS, First Data International, financial institutions, merchants or others. These services may also be subject to the rules and regulations of the various
international, domestic and regional schemes, Networks and Associations in which FDPS, First Data International and the card issuers participate. These
schemes, Networks or Associations may, generally in their discretion, modify these rules and regulations and such modifications could also impact FDPS,
First Data International, financial institutions, merchants and others.
18