Western Union 2014 Annual Report Download - page 157

2014 FORM 10-K
19
Privacy Regulations and Information Security Standards
We must collect, transfer, disclose, use and store personal information in order to provide our services. These activities are
subject to information security standards, data privacy, data breach and related laws and regulations in the United States and other
countries. In the United States, data privacy and data breach laws such as the federal Gramm-Leach-Bliley Act and various state
laws apply directly to a broad range of financial institutions including money transfer providers like Western Union, and indirectly
to companies that provide services to or on behalf of those institutions. The United States Federal Trade Commission ("FTC") has
an on-going program of investigating the privacy practices of companies and has commenced enforcement actions against many,
resulting in multimillion dollar settlements and multi-year agreements governing the settling companies' privacy practices. The
FTC, several states and data protection authorities in other countries have expanded their area of concern to include privacy
practices related to online and mobile applications. Many state laws require us to provide notification to affected individuals, state
officers and consumer reporting agencies in the event of a data breach of computer databases or physical documents that contain
certain types of non-public personal information and present a risk for unauthorized use or potential harm.
The collection, transfer, disclosure, use and storage of personal information required to provide our services is subject to data
privacy laws outside of the United States, such as laws adopted pursuant to the EU's 95/46 EC Directive of the European Parliament,
and other national and provincial laws throughout the world. In some cases, these laws are more restrictive than the Gramm-Leach-
Bliley Act and impose more stringent duties on companies. These laws, which are not uniform, do one or more of the following:
regulate the collection, transfer (including in some cases, the transfer outside the country of collection), processing, storage, use
and disclosure of personal information, require notice to individuals of privacy practices, and give individuals certain access and
correction rights with respect to their personal information and prevent the use or disclosure of personal information for secondary
purposes such as marketing. Under certain circumstances, some of these laws require us to provide notification to affected
individuals, data protection authorities and/or other regulators in the event of a data breach.
These regulations, laws and industry standards also impose requirements for safeguarding personal information through the
issuance of internal data security standards, controls or guidelines. Western Union maintains and upgrades its systems and processes
to protect the security of our computer systems, software, networks and other technology assets. For further discussion of these
risks, see Part I, Item 1A, Risk Factors - "Breaches of our information security policies or safeguards could adversely affect our
ability to operate and could damage our reputation, business, financial condition and results of operations."
In connection with regulatory requirements to assist in the prevention of money laundering and terrorist financing and pursuant
to legal obligations and authorizations, Western Union makes information available to certain United States federal, state, and
foreign government agencies when required by law. In recent years, Western Union has experienced increasing data sharing requests
by these agencies, particularly in connection with efforts to prevent terrorist financing or reduce the risk of identity theft. During
the same period, there has also been increased public attention to the corporate use and disclosure of personal information,
accompanied by legislation and regulations intended to strengthen data protection, information security and consumer privacy.
These regulatory goals - the prevention of money laundering, terrorist financing and identity theft and the protection of the
individual's right to privacy - may conflict, and the law in these areas is not consistent or settled. While we believe that Western
Union is compliant with its regulatory responsibilities, the legal, political and business environments in these areas are rapidly
changing, and subsequent legislation, regulation, litigation, court rulings or other events could expose Western Union to increased
program costs, liability and reputational damage.
Banking Regulation
We have subsidiaries that operate under banking licenses granted by the Austrian Financial Market Authority and the Brazilian
Central Bank. We are also subject to regulation, examination and supervision by the New York State Department of Financial
Services (the "Financial Services Department"), which has regulatory authority over our entity that holds all interests in these
subsidiaries. Further, an Agreement of Supervision with the Financial Services Department imposes various regulatory
requirements including operational limitations, capital requirements, affiliate transaction limitations, and notice and reporting
requirements on this entity. However, because this entity and its subsidiaries do not exercise banking powers in the United States,
we are not subject to the Bank Holding Company Act in the United States.