Company: ATLCL
Filing Date: 2025-05-08
Form Type: 10-Q
Source: 0001437749-25-015559
Chunk: 105

Company: Atlanticus Holdings Corp
Filing Date: 2025-05-08
Form: 10-Q
Item: Item 8
Chunk 105
---
 with expanded protections and control over the collection, maintenance, use and sharing of personal information. The CCPA continues to be subject to new regulations and legislative amendments. Although we have implemented a compliance program designed to address obligations under the CCPA, it remains unclear what future modifications will be made or how the CCPA will be interpreted in the future. The CCPA provides for civil penalties for violations and a private right of action for data breaches.

In addition, in November 2020, California voters approved the California Privacy Rights Act of 2020 (the "CPRA") ballot initiative, which became effective on January 1, 2023. The CPRA established the California Privacy Protection Agency to implement and enforce the CCPA and CPRA. We anticipate that the CPRA and certain regulations promulgated by the California Privacy Protection Agency will apply to our business and we will work to ensure compliance with such laws and regulations by their effective dates.

Compliance with these laws regarding the protection of consumer and employee data could result in higher compliance and technology costs for us, as well as potentially significant fines and penalties for noncompliance. Further, there are various other statutes and regulations relevant to the direct email marketing, debt collection and text-messaging industries including the Telephone Consumer Protection Act. The interpretation of many of these statutes and regulations is evolving in the courts and administrative agencies and an inability to comply with them may have an adverse impact on our business.

In addition to the foregoing enhanced data security requirements, various federal banking regulatory agencies, and all 50 states, the District of Columbia, Puerto Rico and the Virgin Islands, have enacted data security regulations and laws requiring varying levels of consumer notification in the event of a security breach. Also, federal legislators and regulators are increasingly pursuing new guidelines, laws and regulations that, if adopted, could further restrict how we collect, use, share and secure consumer information, possibly impacting some of our current or planned business initiatives.

Unplanned system interruptions or system failures could harm our business and reputation. Any interruption in the availability of our transactional processing services due to hardware, operating system failures, or system conversion will reduce our revenues and profits. Any unscheduled interruption in our services results in an immediate, and possibly substantial, reduction in our ability to serve our customers, thereby resulting in a loss of revenues. Frequent or persistent interruptions in our services could cause current or potential consumers to believe that our systems are unreliable, leading them to switch to our competitors or to avoid our websites or services, and could permanently harm our reputation.