Western Union 2013 Annual Report Download - page 129

2013 FORM 10-K
19
Privacy and Information Security Regulations
We must collect, transfer, disclose, use and store personal information in order to provide our services. These activities are
subject to information security standards, data privacy, data breach and related laws and regulations in the United States and other
countries. In the United States, data privacy and data breach laws such as the federal Gramm-Leach-Bliley Act and various state
laws apply directly to a broad range of financial institutions including money transfer providers like Western Union, and indirectly
to companies that provide services to or on behalf of those institutions. The United States Federal Trade Commission ("FTC") has
an on-going program of investigating the privacy practices of companies and has commenced enforcement actions against many,
resulting in multimillion dollar settlements and multi-year agreements governing the settling companies' privacy practices. The
FTC and several states have expanded their area of concern to include privacy practices related to mobile applications. Many state
laws require us to provide notification to affected individuals, state officers and consumer reporting agencies in the event of a
security breach of computer databases or physical documents that contain certain types of non-public personal information and
present a risk for unauthorized use.
The collection, transfer, disclosure, use and storage of personal information required to provide our services is subject to data
privacy laws outside of the United States, such as laws adopted pursuant to the EU's 95/46 EC Directive of the European Parliament
(the "Data Protection Directive"), and national and provincial laws throughout the world. In some cases, these laws are more
restrictive than the Gramm-Leach-Bliley Act and impose more stringent duties on companies. These laws, which are not uniform,
do one or more of the following: restrict the collection, transfer, processing, storage, use and disclosure of personal information,
require notice to individuals of privacy practices and give individuals certain rights to prevent the use or disclosure of personal
information for secondary purposes such as marketing.
These regulations, laws and industry standards also impose requirements for safeguarding personal information through the
issuance of internal data security standards, controls or guidelines.
In connection with regulatory requirements to assist in the prevention of money laundering and terrorist financing and pursuant
to legal obligations and authorizations, Western Union makes information available to certain United States federal and state, as
well as certain foreign, government agencies when required by law. In recent years, Western Union has experienced increasing
data sharing requests by these agencies, particularly in connection with efforts to prevent terrorist financing or reduce the risk of
identity theft. During the same period, there has also been increased public attention to the corporate use and disclosure of personal
information, accompanied by legislation and regulations intended to strengthen data protection, information security and consumer
privacy. These regulatory goals - the prevention of money laundering, terrorist financing and identity theft and the protection of
the individual's right to privacy - may conflict, and the law in these areas is not consistent or settled. While we believe that Western
Union is compliant with its regulatory responsibilities, the legal, political and business environments in these areas are rapidly
changing, and subsequent legislation, regulation, litigation, court rulings or other events could expose Western Union to increased
program costs, liability and reputational damage.
Banking Regulation
We have subsidiaries that operate under banking licenses granted by the Austrian Financial Market Authority and the Brazilian
Central Bank which subject these subsidiaries to Austrian and Brazilian regulations. We are also subject to regulation, examination
and supervision by the New York State Department of Financial Services (the "Financial Services Department"), which has
regulatory authority over our entity that holds all interests in these subsidiaries, a limited liability investment company organized
under Article XII of the New York Banking Law. An Agreement of Supervision with the Financial Services Department imposes
various regulatory requirements including operational limitations, capital requirements, affiliate transaction limitations, and notice
and reporting requirements. Approval is required from the Financial Services Department under New York Banking Law, and
from the Austrian Financial Market Authority and the Brazilian Central Bank under Austrian and Brazilian regulations, respectively,
prior to certain direct or indirect changes in control of the Article XII investment company and its banking subsidiaries, including
a change in control of its ultimate parent, the Company.
Since these subsidiaries do not operate any banking offices in the United States and do not conduct business in the United
States except as may be incidental to their activities outside the United States, our Company's affiliation with these subsidiaries
does not cause them to be subject to the provisions of the Bank Holding Company Act in the United States.