Western Union 2009 Annual Report Download - page 28

requirements for offering payment services within the EU. Previously, those requirements differed significantly
among these countries. The PSD also imposed new rules on payment service providers like Western Union. In
particular, the PSD makes us responsible for the compliance of our agents in the EU who are engaged by one
of our payments institution subsidiaries. Thus, the risk of adverse regulatory action against us because of the
actions of our EU agents and their subagents has increased. Under the PSD, we are now subject to investment
safeguarding rules and periodic examinations similar to those we are subject to in the United States. These
rules have resulted in increased costs to comply with the new requirements. The PSD could also increase
competition in our areas of service.
Escheat Regulations
Our Company is subject to unclaimed or abandoned property (escheat) laws in the United States and
abroad. These laws require us to turn over to certain government authorities the property of others held by our
Company that has been unclaimed for a specified period of time, such as unpaid money transfers. We hold
property subject to escheat laws and we have an ongoing program to comply with the laws. We are subject to
audits with regard to our escheatment practices.
Privacy and Information Security Regulations
The collection, transfer, disclosure, use and storage of personal information is required to provide our
services. These activities are subject to information security standards, data privacy, data breach and related
laws and regulations in the United States and other countries. In the United States, data privacy and data
breach laws such as the federal Gramm-Leach-Bliley Act and various state laws apply directly to a broad
range of financial institutions including money transmitters like Western Union, and indirectly to companies
that provide services to those institutions. Many state laws require us to provide notification to affected
individuals, state officers and consumer reporting agencies in the event of a security breach of computer
databases or physical documents that contain certain types of non-public personal information and present a
risk for unauthorized use.
The collection, transfer, disclosure, use and storage of personal information required to provide our
services is subject to data privacy laws outside of the United States, such as laws adopted pursuant to the EU’s
95/46 EC Directive of the European Parliament (the “Data Protection Directive”), Canada’s Personal
Information Protection and Electronic Documents Act, individual European national laws and data privacy
laws of other provinces or countries. In some cases, the laws of a country may be more restrictive than the
Gramm-Leach-Bliley Act or the laws developed to comply with the Data Protection Directive may impose
additional duties on companies. Each of these laws may restrict the collection, transfer, processing, storage,
use and disclosure of sensitive personal information, require notice to individuals of privacy practices and may
give individuals certain rights to prevent the use or disclosure of personal information for secondary purposes
such as marketing.
These regulations, laws and industry standards also impose requirements for safeguarding personal
information through the issuance of internal data security standards, controls or guidelines.
In connection with regulatory requirements to assist in the prevention of money laundering and terrorist
financing and pursuant to legal obligations and authorizations, Western Union makes information available to
certain United States federal and state, as well as certain foreign government agencies when required by law.
In recent years, these agencies have increased their requests for such information from Western Union and
other companies (both financial service providers and others), particularly in connection with efforts to prevent
terrorist financing or identity theft. During the same period, there has also been increased public attention
regarding the corporate use and disclosure of personal information, accompanied by legislation and regulations
intended to strengthen data protection, information security and consumer privacy. These regulatory goals—the
prevention of money laundering, terrorist financing and identity theft and the protection of the individual’s
right to privacy—may create a conflict, and the law in these areas is not consistent or settled. While we
believe that Western Union is compliant with its regulatory responsibilities, the legal, political and business
environments in these areas are rapidly changing, and subsequent legislation, regulation, litigation, court
14