Company: SLDE
Filing Date: 2025-01-22
Form Type: DRS/A
Source: 0000950123-25-000502
Chunk: 64

Company: Slide Insurance Holdings, Inc.
Filing Date: 2025-01-22
Form: DRS/A
Chunk 64
---
 litigation.

On November 3, 2020,
California enacted the CPRA expanding on existing rights under the CCPA and creating new consumer privacy rights for California residents, including rights to correct personal information. Further, the CPRA imposes additional obligations on
businesses to implement data retention and minimization practices, perform cybersecurity audits and risk assessments, and implement reasonable security protections. The CPRA also permits consumers to opt out of the sharing of personal information
for use in behavioral advertising, which may impact our ability to market our products and services. The CPRA also establishes the California Privacy Protection Agency, which is the first data privacy regulator in the United States to enforce the
CPRA. The

41

CPRA strengthens some of the enforcement authority established under the CCPA and could result in increased enforcement actions and fines. The enactment of the CCPA and other state privacy, data
protection and cybersecurity laws, rules and regulations is prompting a wave of similar legislative developments in other states in the United States, which creates the potential for a patchwork of overlapping but different state laws. For example,
Virginia has adopted a new state data protection act referred to as the Virginia Consumer Data Protection Act (“VCDPA”), which became effective on January 1, 2023, Colorado has adopted a new state data protection act titled the
Colorado Privacy Act (“CPA”), which became effective on July 1, 2023, and Connecticut has adopted a new state data protection act titled the Connecticut Data Privacy Act (“CTDPA”), which became effective on July 1,
2023. The VCDPA, the CPA and the CTDPA have some similarities to the CCPA and introduced new data privacy rights for residents of such states and new operational requirements for covered companies, including consent requirements for the collection
of sensitive personal information. At least nine additional states (Utah, Iowa, Indiana, Tennessee, Montana, Delaware, Oregon, Texas and Florida) have passed similar laws, with some scheduled to take effect in subsequent years, and other states are
considering enacting similar laws. In addition, laws in all 50 states in the United States require businesses to provide notice to consumers whose personal information has been accessed or acquired as a result of a data breach (and, in some cases,
also to regulators). Some observers have noted that these new laws could mark the beginning of a trend toward more stringent privacy legislation in the United States. There is also discussion in Congress of a new comprehensive federal data
protection and privacy law to which