Company: HOUS
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001398987-25-000020
Chunk: 152

Company: Anywhere Real Estate Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1
Chunk 152
---
 comprehensive requirements on organizations that collect, sell and disclose personal information about California residents and employees. In November 2020, California passed Proposition 24, establishing the California Privacy Rights Act (“CPRA”), which took effect January 1, 2023. The CPRA provides further requirements that will impact our businesses’ compliance efforts and operational risks as the CPRA differentiates “personal information” and “sensitive information,” expands the term “sale” to include sharing of personal information, and imposes data minimization and data retention requirements. The CPRA also established the California Privacy Protection Agency, which is intended to take a more active role in enforcement of the law. As of January 2025, 19 states enacted their own privacy legislation which is effective or will become effective within a year, more than doubling the number of states requiring businesses to comply with privacy obligations and the number of individuals who will have privacy rights with respect to their personal information. 

Under the NYDFS cybersecurity regulation, regulated financial institutions, including Title Group, are required to establish and attest to a detailed cybersecurity program. Other state regulatory agencies have or are expected to enact similar requirements following the adoption of the Insurance Data Security Model Law by the National Association of Insurance Commissioners that is consistent with the New York regulation.

Internationally, the European Union’s General Data Protection Regulation ("GDPR") has conferred significant privacy rights on individuals (including employees and independent agents) and materially increased penalties for violations. In 2020, the Court of Justice of the European Union invalidated the E.U.-U.S. Privacy Shield, one of the methods for transfers of personal data into the U.S. As a result, companies may have to rely on standard contractual clauses, or binding corporate rules for the transfer of personal data while awaiting further guidance or regulation. In 2021, the European Commission issued an implementing decision regarding the use of Standard Contractual Clauses. In 2023, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework. Other countries have also recently expanded on their data privacy laws and regulations. 

For additional information with respect to our cybersecurity risk management strategy and governance framework, see "Item 1C.—Cybersecurity." for additional information with respect to the cybersecurity-related risks facing our business, see "Item 1A. Risk Factors" in this Annual Report, in particular under the caption "Cybersecurity incidents could disrupt business operations and result in the loss of critical and confidential information or litigation or claims arising from such incidents, any of which could have