Company: ASB
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000007789-25-000013
Chunk: 148

Company: ASSOCIATED BANC-CORP
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1
Chunk 148
---
 would not have taken effect until January 1, 2027.

Privacy, Data Protection, and Cybersecurity

We receive, store, use and otherwise process information that relates to individuals and/or constitutes “personal data,” “personal information,” “nonpublic personal information,” or similar terms under applicable data privacy laws. We and our vendors are subject to a number of U.S. federal, state, local and foreign laws and regulations, industry standards and other requirements relating to consumer privacy and data protection, including those that apply generally to the handling of personal information. Under privacy protection provisions of the GLBA and its implementing regulations and guidance, we are limited in our ability to disclose certain non-public information about consumers to nonaffiliated third parties. Financial institutions, such as the Bank, are required by statute and regulation to notify consumers of their privacy policies and practices and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a nonaffiliated third party. In addition, such financial institutions must appropriately safeguard their customers’ nonpublic, personal information. Consumers and, in some instances, state and federal regulators, must be notified in the event of a data breach under applicable state laws and federal regulations. We had no material data breaches in 2024.

The changing privacy laws in the United States, Europe and elsewhere create new individual privacy rights and impose increased obligations on companies handling personal information, including the CCPA, as amended by the CPRA. While GLBA-regulated nonpublic, personal information generally is exempt under the CCPA, the CCPA and other state laws apply to other personal information processed by the Bank. 

In addition, multiple states, Congress and regulators within and outside of the United States are considering similar laws or regulations which could create new individual privacy rights and impose additional obligations on the Bank. 

The federal banking agencies, including the OCC, have issued a rule imposing cybersecurity notification requirements for banking organizations and their service providers. Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a "computer-security incident" that rises to the level of a "notification incident," as those terms are defined under the final rule.

The federal banking agencies have also adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. A financial institution also should