Western Union 2011 Annual Report Download - page 25

for a specified period of time, such as unpaid money transfers and money orders. We hold property subject to
unclaimed property laws and we have an ongoing program to comply with the laws. We are subject to audits with
regard to our escheatment practices.
Privacy and Information Security Regulations
The collection, transfer, disclosure, use and storage of personal information is required to provide our services.
These activities are subject to information security standards, data privacy, data breach and related laws and
regulations in the United States and other countries. In the United States, data privacy and data breach laws such
as the federal Gramm-Leach-Bliley Act and various state laws apply directly to a broad range of financial
institutions including money transmitters like Western Union, and indirectly to companies that provide services
to those institutions. Many state laws require us to provide notification to affected individuals, state officers and
consumer reporting agencies in the event of a security breach of computer databases or physical documents that
contain certain types of non-public personal information and present a risk for unauthorized use.
The collection, transfer, disclosure, use and storage of personal information required to provide our services is
subject to data privacy laws outside of the United States, such as laws adopted pursuant to the EU’s 95/46 EC
Directive of the European Parliament (the “Data Protection Directive”), Canada’s Personal Information
Protection and Electronic Documents Act, individual European national laws and data privacy laws of other
provinces or countries. In some cases, the laws of a country may be more restrictive than the Gramm-Leach-
Bliley Act, and the laws developed to comply with the Data Protection Directive may impose additional duties on
companies. Each of these laws may restrict the collection, transfer, processing, storage, use and disclosure of
sensitive personal information, require notice to individuals of privacy practices and may give individuals certain
rights to prevent the use or disclosure of personal information for secondary purposes such as marketing.
These regulations, laws and industry standards also impose requirements for safeguarding personal
information through the issuance of internal data security standards, controls or guidelines.
In connection with regulatory requirements to assist in the prevention of money laundering and terrorist
financing and pursuant to legal obligations and authorizations, Western Union makes information available to
certain United States federal and state, as well as certain foreign government agencies when required by law. In
recent years, these agencies have increased their requests for such information from Western Union and other
companies (both financial service providers and others), particularly in connection with efforts to prevent
terrorist financing or identity theft. During the same period, there has also been increased public attention
regarding the corporate use and disclosure of personal information, accompanied by legislation and regulations
intended to strengthen data protection, information security and consumer privacy. These regulatory goals—the
prevention of money laundering, terrorist financing and identity theft and the protection of the individual’s right
to privacy—may conflict, and the law in these areas is not consistent or settled. While we believe that Western
Union is compliant with its regulatory responsibilities, the legal, political and business environments in these
areas are rapidly changing, and subsequent legislation, regulation, litigation, court rulings or other events could
expose Western Union to increased program costs, liability and reputational damage.
Banking Regulation
We have subsidiaries that operate under banking licenses granted by the Austrian Financial Market Authority
and the Brazilian Central Bank which subject these subsidiaries to Austrian and Brazilian regulations. We are
also subject to regulation, examination and supervision by the New York Department of Financial Services (the
“Financial Services Department”), which has regulatory authority over our entity that holds all interests in these
subsidiaries, a limited liability investment company organized under Article XII of the New York Banking Law.
An Agreement of Supervision with the Financial Services Department imposes various regulatory requirements
including operational limitations, capital requirements, affiliate transaction limitations, and notice and reporting
requirements. Financial Services Department approval is required under the New York Banking Law and the
Agreement of Supervision prior to any change in control of the Article XII investment company.
18