Company: PGYWW
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001883085-25-000050
Chunk: 191

Company: Pagaya Technologies Ltd.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1A
Chunk 191
---
 store a large volume of personally identifiable information and other sensitive data relating to individuals, such as our Partners’ customers, asset investors and our employees. Our use, receipt, and other processing of data in our business subjects us to numerous state, federal and foreign laws and regulations, addressing privacy, cybersecurity, data protection, and the receipt, storing, sharing, use, transfer, disclosure, protection, and processing of certain types of data, including, for example, the GLBA, Children’s Online Privacy Protection Act, Personal Information Protection and Electronic Documents Act, CAN-SPAM, TCPA, FCRA, FTC Act, and the CCPA. These laws, rules, and regulations evolve frequently and their scope may continually change, through new legislation, amendments to existing legislation, and changes in interpretation or enforcement, and may be inconsistent from one jurisdiction to another.

For example, on December 9, 2021, the FTC adopted amendments to the GLBA’s Safeguards Rule, which requires financial services providers, like our Partners, to develop, implement, and maintain a comprehensive information security program. The amendments provide more prescriptive security controls that financial services providers are required to implement, such as specific access and authentication controls, risk assessment requirements, and oversight by appointment of a Chief Information Security Officer who is required to provide annual written reports to the board of directors. In addition, the FTC has brought enforcement actions against third-party service providers of financial services providers directly and against financial services providers for failures by service providers to implement appropriate controls to safeguard consumers’ personal information.

As another example, the CCPA applies to personal data of consumers, business representatives, and employees who are California residents and requires businesses to provide specific disclosures to California consumers and honor requests of consumers to exercise certain data privacy rights, including, among other things, the right to request a copy from a covered company of the personal information collected about them, the right to request correction of such personal information, the right to request deletion of such personal information, and the right to opt out of certain disclosures of personal information. The California Attorney General can enforce the CCPA, including seeking an injunction and civil penalties of up to $7,500 per intentional violation. Some observers have noted the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the United States, which could also increase our potential liability and adversely affect our business. For example, the CCPA has encouraged “copycat” or other similar laws to be considered and proposed in other states across the country, such as in