Company: FCNCB
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000798941-25-000010
Chunk: 106

Company: FIRST CITIZENS BANCSHARES INC /DE/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1
Chunk 106
---
 Act of 2018 (the “CCPA”), and the New York Department of Financial Services’ (“NYDFS”) 2017 cybersecurity regulation (the “NY Cybersecurity Regulation”).

These laws govern the collection, sharing, use, disclosure and protection of personal information, the intent of which is to increase transparency related to how personal information is processed, choices individuals have to control how their information is used and to protect the privacy of such information. The GLBA and its implementing regulations and guidance limit the ability of financial institutions to disclose certain non-public information about consumers to nonaffiliated third parties, and further require financial institutions to notify consumers of their privacy policies and practices, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third-party in some cases, implement appropriate safeguards to their customers’ nonpublic, personal information, and, in some instances, notify regulators and/or customers in the event of a data breach under applicable laws. The 36 Hour Rule requires that banking organizations notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a computer-security incident that rises to the level of a notification incident under the rule, and that bank service providers notify any affected bank to which, or on behalf of which, the service provider provides services as soon as possible after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours. The Cybersecurity Form 8-K Item generally requires that public companies disclose a material cybersecurity incident on a Current Report on Form 8-K within four days of management’s determination that the incident is material. The CCPA provides for enhanced individual privacy rights and imposes increased obligations on companies handling personal information, and the NY Cybersecurity Regulation requires financial institutions regulated by NYDFS to, among other things, implement certain cybersecurity controls and make reports to NYDFS upon the occurrence of certain cybersecurity events. 

16

In addition, on October 22, 2024, the CFPB adopted its final rule for Personal Financial Data Rights, commonly known as the “Open Banking” rule, designed to facilitate the transfer of customer information at the direction of the customer to other financial institutions. This rule requires financial institutions to make consumers’ data available upon their request and without charge to other authorized financial institutions or other third parties in a secure and reliable manner and defines obligations for those third parties accessing consumers’ data, including privacy protections.

In addition to the foregoing, federal banking