Company: BCS
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0000312069-25-000114
Chunk: 493

Company: BARCLAYS PLC
Filing Date: 2025-02-13
Form: 20-F
Chunk 493
---
 amended by the California Privacy Rights Act of 2020 (CPRA). The GLBA limits the use and disclosure of non-public personal information to non-affiliated third parties, and requires financial institutions to provide written notice of their privacy policies and practices and implement certain information security policies and practices. Any violations of the GLBA could subject Barclays Bank Delaware to additional reporting requirements or regulatory investigation or audits by the financial regulators. More broadly, the Group's US operations are subject to the CPRA which applies to personal information that is not collected, processed, sold or disclosed subject to the GLBA. The CPRA requires applicable members of the Group to both provide California residents with additional disclosures regarding the collection, use and sharing of personal information and grant California residents access, deletion, correction and other rights, including the right to opt-out of certain sales or transfers of personal information and the right to limit the processing of sensitive personal information to certain purposes. Any violations of the CPRA may be subject to enforcement by the California Privacy Protection Agency and the California Attorney General and the imposition of monetary penalties, as well as potential lawsuits arising from the private right of action provided to California residents in the case of certain data breaches. Bills proposed in the United States Congress and in the legislatures of various US states from time to time, if enacted, may have further impact on the data privacy practices of Barclays’ US operations. In addition, all 50 states have laws including obligations to provide notification of security breaches of computer databases that contain personal information to affected individuals, state officers and others. In May 2024, the SEC adopted amendments to expand the scope of and introduce new requirements under Regulation S-P, a set of privacy rules adopted pursuant to the GLBA and the Fair and Accurate Credit Transactions Act of 2003 that govern the treatment of non- public personal information about consumers by certain financial institutions, including BCI. In addition to expanding the scope of customer information protected under Regulation S-P’s safeguards and disposal rules, the amendments will require covered financial institutions to (i) develop, implement and maintain written policies and procedures for an incident response program reasonably designed to detect, respond to and recover from unauthorised access to or use of customer information, (ii) notify individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorisation as soon as practicable, but not later than 30 days, after becoming aware that an incident has or is reasonably likely to have occurred and (iii) establish, maintain and enforce written policies and