Company: ATLCL
Filing Date: 2025-11-10
Form Type: 10-Q
Source: 0001437749-25-033947
Chunk: 123

Company: Atlanticus Holdings Corp
Filing Date: 2025-11-10
Form: 10-Q
Item: Item 8
Chunk 123
---
 our security measures could misappropriate proprietary information, cause interruption in our operations, damage our computers or those of our users, or otherwise damage our reputation and business.

       56

Regulation in the areas of privacy and data security could increase our costs. We are subject to various regulations related to privacy and data security/breach, and we could be negatively impacted by these regulations. For example, we are subject to the Safeguards guidelines under the Gramm-Leach-Bliley Act. The Safeguards guidelines require that each financial institution develop, implement and maintain a written, comprehensive information security program containing safeguards that are appropriate to the financial institution’s size and complexity, the nature and scope of the financial institution’s activities and the sensitivity of any customer information at issue. Broad-ranging data security laws that affect our business also have been adopted by several states.

The California Consumer Privacy Act (the "CCPA") became effective on January 1, 2020. The CCPA requires, among other things, covered companies to provide new disclosures to California consumers and afford such consumers with expanded protections and control over the collection, maintenance, use and sharing of personal information. The CCPA continues to be subject to new regulations and legislative amendments. Although we have implemented a compliance program designed to address obligations under the CCPA, it remains unclear what future modifications will be made or how the CCPA will be interpreted in the future. The CCPA provides for civil penalties for violations and a private right of action for data breaches.

In addition, in November 2020, California voters approved the California Privacy Rights Act of 2020 (the "CPRA") ballot initiative, which became effective on January 1, 2023. The CPRA established the California Privacy Protection Agency to implement and enforce the CCPA and CPRA. We anticipate that the CPRA and certain regulations promulgated by the California Privacy Protection Agency will apply to our business and we will work to ensure compliance with such laws and regulations by their effective dates.

Compliance with these laws regarding the protection of consumer and employee data could result in higher compliance and technology costs for us, as well as potentially significant fines and penalties for noncompliance. Further, there are various other statutes and regulations relevant to the direct email marketing, debt collection and text-messaging industries including the Telephone Consumer Protection Act. The interpretation of many of these statutes and regulations is evolving in the courts and administrative agencies and an inability to comply with them may have an adverse impact on our business.

In addition to the foregoing enhanced