Western Union 2015 Annual Report Download - page 121

19
Privacy Regulations and Information Security Standards
We must collect, transfer, disclose, use and store personal information in order to provide our services. These activities are
subject to information security standards, data privacy, data breach and related laws and regulations in the United States and other
countries. In the United States, data privacy and data breach laws such as the federal Gramm-Leach-Bliley Act and various state
laws apply directly to a broad range of financial institutions including money transfer providers like Western Union, and indirectly
to companies that provide services to or on behalf of those institutions. The United States Federal Trade Commission ("FTC") has
an on-going program of investigating the privacy practices of companies and has commenced enforcement actions against many,
resulting in multimillion dollar settlements and multi-year agreements governing the settling companies' privacy practices. The
FTC, CFPB, and several states have expanded their area of concern to include privacy practices related to online and mobile
applications. Many state laws require us to provide notification to affected individuals, state officers and consumer reporting
agencies in the event of a data breach of computer databases or physical documents that contain certain types of non-public personal
information and present a risk for unauthorized use or potential harm.
The collection, transfer, disclosure, use and storage of personal information required to provide our services is subject to data
privacy laws in countries outside of the United States, such as laws adopted pursuant to the EU's 95/46 EC Directive of the European
Parliament, and other national and provincial laws throughout the world. In some cases, these laws are more restrictive than the
Gramm-Leach-Bliley Act and impose more stringent duties on companies. As in the United States, areas of concern include online
and mobile applications. These laws, which are not uniform, do one or more of the following: regulate the collection, transfer
(including in some cases, the transfer outside the country of collection), processing, storage, use and disclosure of personal
information, require notice to individuals of privacy practices, and give individuals certain access and correction rights with respect
to their personal information and prevent the use or disclosure of personal information for secondary purposes such as marketing.
Under certain circumstances, some of these laws require us to provide notification to affected individuals, data protection authorities
and/or other regulators in the event of a data breach. The European Parliament and the Council of the European Union are expected
to adopt a comprehensive general data privacy regulation (“GDPR”) in 2016 that will replace the current EU Data Protection
Directive and related country-specific legislation. The GDPR is anticipated to take effect in mid-2018. We are analyzing the GDPR
to determine its potential effects on our business practices. Complying with the enhanced obligations imposed by the GDPR may
result in significant costs to our business and require us to amend certain of our business practices.
These regulations, laws and industry standards also impose requirements for safeguarding personal information through the
issuance of internal data security standards, controls or guidelines. Western Union maintains and upgrades its systems and processes
to protect the security of our computer systems, software, networks and other technology assets. For further discussion of these
risks, see Part I, Item 1A, Risk Factors - "Breaches of our information security policies or safeguards could adversely affect our
ability to operate and could damage our reputation and adversely affect our business, financial condition, results of operations,
and cash flows."
In connection with regulatory requirements to assist in the prevention of money laundering and terrorist financing and pursuant
to legal obligations and authorizations, Western Union makes information available to certain United States federal, state, and
foreign government agencies when required by law. In recent years, Western Union has experienced increasing data sharing requests
by these agencies, particularly in connection with efforts to prevent terrorist financing or reduce the risk of identity theft. During
the same period, there has also been increased public attention to the corporate use and disclosure of personal information,
accompanied by legislation and regulations intended to strengthen data protection, information security and consumer privacy.
These regulatory goals - the prevention of money laundering, terrorist financing and identity theft and the protection of the
individual's right to privacy - may conflict, and the law in these areas is not consistent or settled. While we believe that Western
Union is compliant with its regulatory responsibilities in all material respects, the legal, political and business environments in
these areas are rapidly changing, and subsequent legislation, regulation, litigation, court rulings or other events could expose
Western Union to increased program costs, liability and reputational damage.
201 FORM 10 K
5 -