Western Union 2010 Annual Report Download - page 18

has been unclaimed for a specified period of time, such as unpaid money transfers. We hold property subject to
escheat laws and we have an ongoing program to comply with the laws. We are subject to audits with regard to our
escheatment practices.
Privacy and Information Security Regulations
The collection, transfer, disclosure, use and storage of personal information is required to provide our services.
These activities are subject to information security standards, data privacy, data breach and related laws and
regulations in the United States and other countries. In the United States, data privacy and data breach laws such as
the federal Gramm-Leach-Bliley Act and various state laws apply directly to a broad range of financial institutions
including money transmitters like Western Union, and indirectly to companies that provide services to those
institutions. Many state laws require us to provide notification to affected individuals, state officers and consumer
reporting agencies in the event of a security breach of computer databases or physical documents that contain
certain types of non-public personal information and present a risk for unauthorized use.
The collection, transfer, disclosure, use and storage of personal information required to provide our services is
subject to data privacy laws outside of the United States, such as laws adopted pursuant to the EU’s 95/46 EC
Directive of the European Parliament (the “Data Protection Directive”), Canada’s Personal Information Protection
and Electronic Documents Act, individual European national laws and data privacy laws of other provinces or
countries. In some cases, the laws of a country may be more restrictive than the Gramm-Leach-Bliley Act, and the
laws developed to comply with the Data Protection Directive may impose additional duties on companies. Each of
these laws may restrict the collection, transfer, processing, storage, use and disclosure of sensitive personal
information, require notice to individuals of privacy practices and may give individuals certain rights to prevent the
use or disclosure of personal information for secondary purposes such as marketing.
These regulations, laws and industry standards also impose requirements for safeguarding personal information
through the issuance of internal data security standards, controls or guidelines.
In connection with regulatory requirements to assist in the prevention of money laundering and terrorist
financing and pursuant to legal obligations and authorizations, Western Union makes information available to
certain United States federal and state, as well as certain foreign government agencies when required by law. In
recent years, these agencies have increased their requests for such information from Western Union and other
companies (both financial service providers and others), particularly in connection with efforts to prevent terrorist
financing or identity theft. During the same period, there has also been increased public attention regarding the
corporate use and disclosure of personal information, accompanied by legislation and regulations intended to
strengthen data protection, information security and consumer privacy. These regulatory goals—the prevention of
money laundering, terrorist financing and identity theft and the protection of the individual’s right to privacy—may
conflict, and the law in these areas is not consistent or settled. While we believe that Western Union is compliant
with its regulatory responsibilities, the legal, political and business environments in these areas are rapidly
changing, and subsequent legislation, regulation, litigation, court rulings or other events could expose Western
Union to increased program costs, liability and reputational damage.
Banking Regulation
We have subsidiaries that operate under banking licenses granted by the Austrian Financial Market Authority and
the Brazilian Central Bank which subject these subsidiaries to Austrian and Brazilian regulations. We are also
subject to regulation, examination and supervision by the New York State Banking Department (the “Banking
Department”), which has regulatory authority over our entity that holds all interest in these subsidiaries, a limited
liability investment company organized under Article XII of the New York Banking Law. An Agreement of
Supervision with the Banking Department imposes various regulatory requirements including operational
limitations, capital requirements, affiliate transaction limitations, and notice and reporting requirements.
Banking Department approval is required under the New York Banking Law and the Agreement of Supervision
prior to any change in control of the Article XII investment company.
Since these subsidiaries do not operate any banking offices in the United States and do not conduct business in
the United States except as may be incidental to their activities outside the United States, our Company’s affiliation
16