Last updated: 24 July 2018
This privacy statement explains how Reuters Limited in the United Kingdom (“Thomson Reuters” “we”, “us” or “our”) collects, handles, discloses, stores and protects information about you in the context of our World-Check service (“World-Check”). It also provides information about your rights and about how you can contact us if you have questions about how we handle your information. You can also access more information on how World-Check works by clicking here.
- What this privacy statement covers
- Who World-Check holds information about
- What personal information we process
- How we use information about you
- What legal grounds do we use to process your information
- Who we disclose your personal information to
- How we secure your personal information
- Why information may be transferred abroad
- How long we keep your information
- Your rights
- How to contact us
- Changes to this privacy statement
- Your questions answered
What this privacy statement covers
This privacy statement only covers World-Check. Alternative privacy statements apply to other products, services and websites made available by us or our holding companies, subsidiaries or affiliated companies (together the “Thomson Reuters Group”).
Who World-Check holds information about
- World-Check holds information that helps financial institutions, corporates, professional services firms, governments, law enforcement agencies, regulators and other WC Customers (“WC Customers”) to perform due diligence and other screening activities in accordance with their legal or regulatory obligations and risk management procedures carried out in the public interest (“Checks”).
- It is designed and maintained to improve the speed, accuracy and transparency of Checks which are carried out on customers and counterparties, and which relate to anti-money laundering, countering terrorist financing and other unlawful acts (for example, illegal trafficking and environmental crime), ‘know your customer’, and anti-bribery and corruption requirements.
- World-Check is not aimed at children. In the limited circumstances where we collect and use personal information about children (for example, because they are the children of a PEP (as defined below)), we comply with industry guidelines and applicable laws.
- Your information is only included on World-Check if Public Domain Data (as defined below) suggests that there is information about you that WC Customers ought to be aware of for the purposes of Checks.
When WC Customers carry out Checks, they can also choose to carry out searches of Public Domain Data contained within media sources using media search tools available in World-Check. For example, they may conduct media searches against names of their customers or counterparties. For more information on this, click here.
The inclusion of information about you on World-Check does not prevent you from doing business with WC Customers such as financial institutions. You can find out if information about you is on World-Check here. To see our FAQs on how World-Check works, click here.
Your information may be included on World-Check if Public Domain Data indicates that:
- you are a “politically exposed person” (“PEP”) as defined by the FATF Recommendations or fall into a similar category of persons (for example, you are a senior diplomat, member of the judiciary, religious leader, military figure or trade unionist) under national laws or regulations against money-laundering, terrorist financing, bribery or corruption. The FATF Recommendations are global standards against money laundering and terrorist financing issued by the Financial Action Task Force (“FATF”), an inter-governmental body originally established by the G7 in 1989 and now with approximately 40 members;
- you are a close associate of a PEP, again as defined in the FATF Recommendations. Close associates may include children (for example, the children of a PEP and other minor dependents of a PEP). Where we do collect information about children we will comply with applicable laws and industry guidelines.
- you are listed on the website of a regulator, law enforcement authority or governmental body in connection with money-laundering, terrorist financing, bribery, corruption or similar activities;
- you are included on a government or international body’s sanctions list (such as the sanctions lists issued by the European Union);
- you are linked to terror-related or financial crime-related activities;
- you have been accused, investigated, arrested, charged, or convicted of crimes which are a possible pre-cursor to money laundering or terrorist financing (e.g. arms trafficking, smuggling, fraud, membership of an organised crime group, environmental offences, war crimes), which are also known as a predicate offences, or you are suspected of involvement in these activities; or
- you have been accused, investigated, arrested, charged, or convicted of statutory or regulatory offences;
- you have been disqualified or are prohibited from holding positions of responsibility (such as company directorships).
Inclusion of information about you in World-Check does not suggest that you are involved in, or linked to, financial crime, terrorism or any other criminality or unlawful act. For example, being identified as a PEP simply tells a WC Customer that you perform, or performed, a prominent political or related function or are connected to someone holds or held such a position.
WC Customers make their own decisions about how to use the World-Check data they receive in order to conduct their Checks. If you have any questions about these decisions, please refer them to the relevant WC Customer. For further information on how World-Check works, click here.
For the purpose of this privacy statement, “Public Domain Data” means personal information originally available to the public and typically over the internet. Examples include personal information found on: (i) sanction or watch lists; (ii) law enforcement, court, regulatory or other government websites; (iii) political websites and publications such as parliamentary, local government or individual politician websites; (iv) reputable news media and publications; and (v) information sources made public by an individual themselves, for example on their website, blog or any social media application.
What personal information we process
As part of World-Check, we may collect and process information that is derived from Public Domain Data, where relevant for Checks.
WC Customers can also choose to carry out optional searches of Public Domain Data contained within media sources using search tools within World-Check, in order to enhance or supplement their Checks. These search tools allow WC Customers to enter names of their customers and counterparties alongside keywords used for research purposes into a search engine that searches media sources and returns results based on those names and keywords. Keywords can be selected by WC Customers, but they are aimed at discovery of the type of information listed below. If such a search is conducted about you, your name would appear alongside any articles in which your name (or a similar name) appears, alongside any relevant keywords found in that article. However, WC Customers know that this does not mean that either the person named in the article is actually you or that everything contained in Public Domain Data is true. They are obliged to take further steps to verify information and to determine how to use it.
World-Check may hold the following types of information about you.
- Information that helps identify you (e.g. your name; alias (if any) age; date of birth; gender; country of residence; passport details; citizenship).
- Personal identification numbers (e.g. social security numbers; national insurance numbers) that are Public Domain Data.
- Family circumstances information (e.g. your marital status and dependents) if you are a PEP or a close associate of a PEP.
- Employment/role and education details (for example, the organisation you work for, public roles (including political, diplomatic, religious, judicial, military and trade union roles), your job title and your education history).
- Professional and personal affiliations (for example, organisations (including sanctioned vessels and aircraft) and individuals that you may be associated with in your professional or personal capacity).
- Financial information relevant to understanding your income or wealth (for example, bankruptcy or insolvency filings).
- Your inclusion (if any) on sanctions lists or on public lists of disqualified directors or other positions of responsibility.
- Public Domain Data about actual or alleged money laundering or terrorist financing crime, or crimes that are a pre-cursor to money laundering or terrorist financing which are also known as predicate offences (e.g. financial crime, illegal trafficking, environmental offences, smuggling, membership of an organised crime group).
- Your postings on website, blogs or social media applications.
In some cases, the personal information on World-Check includes so-called ‘sensitive’ or ‘special categories’ of personal information such as: information relating to your political opinions (for example, if you are a PEP holding a position in a political party); information relating to your sexual orientation (for example, if World-Check records that you are the spouse or partner of a PEP); information relating to your religious beliefs (for example, if you are a senior religious leader that qualifies as a PEP); information relating to your racial or ethnic origin (for example, if this can be reasonably inferred from other information about you on World-Check, such as your name, location and citizenship); information on your trade union membership (for example, if you are a senior trade unionist that qualifies as a PEP); information relating to any criminal offences actually or allegedly committed by you (for example, if these are money-laundering or terrorist financing offences, or pre-cursor crimes to such offences).
We have in place robust controls designed to ensure that information about you on World-Check is accurate, relevant and not excessive. We comply with detailed research and screening processes for sourcing World-Check information and we monitor compliance with these processes.
How we use information about you
We use information to facilitate Checks by World-Check customers, to comply with regulatory requests and for other purposes connected with the proper management of World-Check and protection of our rights. More information on these purposes is contained below.
If your information is included on World-Check, it is processed (e.g. collected, used, shared and retained) for the purposes of:
- facilitating Checks by World-Check customers;
- if you contact us, dealing with your requests and enquiries;
- complying with requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, including where they are outside your country of residence;
- exercising our rights, and to defend ourselves from claims and to comply with laws and regulations that apply to the Thomson Reuters Group or third parties with whom we work;
- services we receive from our professional advisors, such as lawyers, accountants, consultants or information security professionals;
- protecting our rights; and
- supporting the operation of World-Check.
What legal grounds do we use to process your information
Some laws require us to explain our lawful reason for processing your personal information. We process standard personal information on the basis that it is in our or others’ legitimate interests. We generally process special category and criminal data for reasons of substantial public interest on the basis of applicable law.
We are required by laws in Europe to set out in this privacy statement the legal grounds on which we rely in order to process your information.
We process your standard personal information on the basis that it is in World-Check Customers’ legitimate interests to carry out Checks to ensure that they can comply with their legal and regulatory obligations and protect the public from financial crime, fraud and serious misconduct or dishonesty. It is also in our legitimate interests to carry on a business to facilitate those Checks. We and the public also have a legitimate interest in ensuring that financial crime, fraud and serious misconduct or dishonesty are prevented and detected. It is reasonable for you to expect that your information may be used for the carrying out of Checks in the public interest. You may feel that your interests differ from our and WC Customers’ interests, as inclusion of your personal information on World-Check results in further Checks being carried out by WC Customers prior to a decision being made about whether to enter into an arrangement with you. However, the legitimate interests in carrying out Checks would not be overridden by your interests, given the significant public interest in the carrying out of Checks.
We process your special category information on the basis that:
- you have made the information manifestly public ; and
- in all other cases, the processing is necessary for reasons of substantial public interest, on the basis of applicable law (including laws designed to combat money-laundering, bribery and corruption and avoidance of sanctions).
We process information about actual or alleged criminal offences on the basis that it is authorised by applicable law.
Who we disclose your personal information to
We make World-Check information available to WC Customers, members of the Thomson Reuters Group that require World-Check data for products or services that they offer, third parties who provide advice and services to us, business partners that work with us to make World-Check data available for the purpose of Checks and as required by, or desirable in order to comply with, law. Our third-party service providers are not permitted to share or use personal information we make available to them for any purpose other than to provide services to us.
If information about you is included on World-Check, it is made available to the following parties.
- WC Customers. We only make World-Check information available to WC Customers that have a legitimate need to access information on World-Check. We also require that they only use it for the purposes of carrying out Checks or to otherwise comply with law. If any World-Check customer uses information on World-Check beyond the limited purposes permitted by us, we may act to terminate the customer’s access to World-Check.
- The Thomson Reuters Group. We disclose information about you to other members of the Thomson Reuters Group that require World-Check data for products or services that they offer, subject to compliance with robust procedures designed to protect your information.
- Third Party Service Providers, Professional Advisors and Business Partners. In order to assist us in supplying and maintaining World-Check, we allow a limited number of third party service providers to access information held by World-Check (e.g. IT systems providers, hosting providers, providers of technical support). We also allow a limited number of business partners with whom we deliver co-branded services or provide content to access World-Check data. In some cases, we also disclose information about you to our professional advisors (including lawyers, accountants, consultants and information security professionals) in connection with one or more of the purposes outlined in the “How we use information about you” section.
- Authorities, Courts and Tribunals. We also disclose information about you to competent authorities (including any national and/or international regulatory or enforcement body or court or other form of tribunal) in connection with one or more of the purposes outlined in the “How we use information about you” above where we are required to do so or at their request.
- Business Transfers. In order to participate in, or be the subject of, any sale, merger, acquisition, restructure, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings), we share information about you with prospective buyers, sellers, advisers or partners and your information may be a transferred asset in a business sale
As we continue to develop our business we may sell assets that currently form part of our business. In those circumstances, we may include information collected about you, or control of that personal information, as a business asset in any such sale. Also, in the unlikely event that we, or substantially all of our assets, are acquired, information about you, or control of such information, may be one of the transferred assets.
How we secure your personal information
We take information security seriously and use a range of physical, electronic and managerial measures to keep your personal information secure, accurate and relevant. These measures and our information security policies are closely aligned with widely accepted international standards, reviewed regularly and updated as necessary to meet our business needs and changes in technology and regulatory requirements.
These policies and measures include:
- robust controls around the inclusion and maintenance of World-Check information which are designed to ensure that information about you on World-Check is accurate and relevant;
- education and training to relevant staff to ensure that they are aware of and comply with our policies, procedures and controls designed to keep World-Check information (including any information about you) secure, accurate and relevant;
- administrative and technical controls to restrict staff access to World-Check information (including any information about you);
- a business continuity and disaster recovery strategy that applies to World-Check and which is designed to safeguard the continuity of access to, and security of, World-Check;
- physical security measures, such as staff security passes and strict controls on access to locations of World-Check servers;
- monitoring compliance with our policies, procedures and controls.
We also impose contractual restrictions on WC Customers and business partners requiring them to only use information on World-Check (including any information about you) in connection with Checks.
Why information may be transferred abroad
World-Check is a global service and your personal information may be stored and processed outside of your home country, including in countries that may not offer the same level of protection for your personal information as your home country. We have measures in place to ensure that when your personal information is transferred internationally, it is subject to appropriate safeguards in accordance with data protection laws. Often, these include contractual safeguards. More information about these safeguards (including copies, where relevant) can be obtained by contacting us contact us.
World-Check is a global service and the Thomson Reuters Group is a global organisation. Your personal information is therefore transferred to recipients in multiple jurisdictions outside of your home country whose laws may not provide the same level of data protection as your home country and which do not benefit from an adequacy decision by the EU Commission.
When we transfer personal information internationally, we put in place safeguards in accordance with applicable laws (including Articles 44 to 50 of the GDPR). If you would like to know more about our data transfer practices and any relevant safeguarding measures, please contact us.
How long we keep your personal information
How long your data is held in World-Check will depend on type of information we hold about you, details of which can be found here. You can find more information on the criteria used to determine retention periods below.
We calculate retention periods for your personal information in accordance with the following criteria:
- the length of time your personal information remains relevant to Checks;
- the length of time it is reasonable to keep records to demonstrate that we have fulfilled our duties and obligations;
- any limitation periods within which claims might be made;
- any retention periods prescribed by law or recommended by regulators, professional bodies or associations or inter-governmental bodies (for example, the Financial Action Task Force);
- the existence of any relevant proceedings.
You may have rights under European and other laws to have access to your information and to ask us to rectify, erase and restrict use of, your information. You may also have rights to object to your information being used and to withdraw consent to the use of your information. Further information on how to exercise your rights is set out below.
We will honour any rights you have under applicable data protection laws. You have the following rights under European laws in respect of personal information on World-Check, and you may have similar rights under the laws of other countries:
- Right of subject access: The right to make a written request for details of your personal information and a copy of personal information we hold about you
- Right to rectification: The right to have inaccurate information about you corrected or removed
- Right to erasure ('right to be forgotten'): The right to have certain personal information about you erased
- Right to restriction of processing: The right to request that your personal information is only used for restricted purposes
- Right to object: The right to object to processing of your personal information in cases where our processing is based on the performance of a task carried out in the public interest or we have let you know the processing is necessary for our or a third party’s legitimate interests
We do not levy a charge where you wish to exercise any of your rights but we will ask for information to verify your identity. This is to safeguard your own privacy. Any identification evidence that you provide will only be used to verify your identity for the purpose of your requests.
There are limits to the rights that you have in relation to your personal data and in certain circumstances we may not be required or able to meet your request, or we may meet your request in part only. Where this occurs, we will provide you with an explanation of the legitimate basis on which we are unable or not required to meet your request. You can also find further information on our approach towards any requests you make in the World-Check FAQ which is available here.
See also the “How to contact us” section below for details of how to contact us to exercise these rights and data protection regulators if you disagree with a decision we have reached.
How to contact us
If you have any questions, comments, complaints or suggestions in relation to data protection or this World-Check Privacy Statement, or any other concerns about the way in which we process information about you, please contact our Privacy Team at email@example.com or at Attn: Data Protection Officer, Reuters Limited, 30 South Colonnade-Canary Wharf, London E14 5EP, United Kingdom. You can also find out if information about you is on World-Check here.
We understand that you may have questions or concerns about this privacy statement or our privacy practices. You may also wish to submit a request to exercise any of your rights.
If so, please e-mail us at firstname.lastname@example.org or write to our data protection officer at the address below:
Attn: Data Protection Officer
30 South Colonnade
You may also use the contact details above if you wish to make a complaint to us in relation to the way we have handled your personal information or any privacy query or request that you have raised with us.
You also have a right to complain to a data protection regulator in the place where you live or work, or in the place where you think an issue in relation to your personal information has arisen. A list of national data protection regulators in the European Union can be found here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.
Changes to this privacy statement
We may modify or amend this privacy statement from time to time.
Any future changes or additions to the processing of personal information as described in this privacy statement affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you.
Your questions answered
Does Thomson Reuters make my personal data on World-Check available to the general public?
No, Thomson Reuters does not distribute personal data on World-Check to the general public. Only authorised World-Check subscribers have access to that personal data.
What steps does Thomson Reuters take to inform users about appropriate use of World-Check?
Thomson Reuters includes usage restrictions in its client contracts.
Why have I not been told that my personal data is on World-Check?
Your personal data has been collected from sources available to the general public and those sources generally do not provide reliable contact details such as email or postal addresses. In addition, even if we were able to find that information, we do not process detailed contact details such as this. If, however, one of our World-Check clients wants to conduct a search against you on World-Check they are required to inform you of this.
Why have you not obtained my consent to your processing of my sensitive personal data?
First, as mentioned above we do not have any reliable contact details for you and second, because of the limited reasons for which we make World-Check available to our subscribers, we are able to lawfully process your personal data without relying on your consent.
By including my personal data in World-Check are you advising your subscribers that I should be viewed negatively?
On the contrary, we make it clear that the inclusion of an individual on World-Check should not automatically be taken to draw any particular inference (negative or otherwise) about them, and this is enshrined in our client contracts. The personal data of many individuals is included in World-Check solely because they hold prominent political or other positions or are connected to such individuals. Furthermore, if, for example, your personal data on World-Check includes allegations about unlawful acts, we advise our users to assume that such allegations are denied by you
Does the fact that my personal data is on World-Check automatically mean that your clients cannot or will not do business with me?
No. We advise our users that they cannot rely solely upon personal data found on World-Check when making any decision to deal with any individual. Instead, they must make independent checks of such individual to verify the accuracy of the personal data we process and decide for themselves whether to conduct business with that individual.
Is the personal data in World-Check accurate?
We maintain research standards designed to ensure the accuracy and relevance of the personal data on World-Check. However, because of the nature of Public Domain Data, we cannot discount that data we process may contain some errors or become outdated. Therefore, if you find an error in any personal data that we process or you or believe it to be irrelevant or excessive, please send an email message to email@example.com
Please be assured that we will fully consider any communications that you send to us but it may not in every instance result in changes or deletions to the information about you on World-Check, if we conclude that the information remains accurate and relevant and/or there are other lawful grounds available to us which permit us to refrain from changing or deleting your personal data.
Can I find out what information Thomson Reuters has about me in World-Check?
Yes, you may request a copy of the personal data that we hold on you in World-Check. To ensure your privacy, we'll ask for information verifying your identity. To request a copy please send an email message to firstname.lastname@example.org
We make no charge for supplying you with your personal data.
Any identification evidence that you provide will only be used to verify your identity for this purpose and for no other. We reserve the right to deny unreasonable or unwarranted requests for access.
If you have questions about requesting a copy of your personal data, please send an email message to email@example.com
Can I have my personal data in World-Check updated or removed?
An individual may, request that his/her personal data be updated or removed from World-Check. However, it is important to note that any right you may have to request updates or deletions to your personal data on World-Check is not absolute and we may be lawfully permitted to refrain from making any update or deletion to your personal data on World-Check. In such circumstances, we will explain to you why this is the case.
Rest assured that we do, however, make extensive efforts to prevent inaccurate, outdated, irrelevant or excessive Personal Data being processed on World-Check.
Where you do wish to proceed with a request to update or remove your personal data from World-Check, we will need a written explanation of your request in order to assess it against applicable laws. Depending on the nature of the request and the personal data involved, we may also ask you to provide supporting information and/or documentation.
Additional questions about updating or removing your personal data or the kind of supporting documentation that may be required should be directed to firstname.lastname@example.org
Once a decision has been made on a request to update or remove personal data on World-Check, that decision will be communicated to you in writing.