Company: RWT-PA
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000930236-25-000007
Chunk: 186

Company: REDWOOD TRUST INC
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 186
---
 own AI legislation. Data Privacy, AI, and other such laws governing the use of technology continue to develop and may be inconsistent from jurisdiction to jurisdiction or from sector to sector, expensive or difficult to comply with, or unclear due to a lack of regulatory guidance. Complying with emerging and changing requirements of Data Privacy Laws or AI Laws may cause us to incur substantial costs, and has required and may again in the future require us to change our business practices. Noncompliance could result in significant penalties, fines, or legal liability, including as a result of private civil action or regulatory enforcement. Furthermore, we make statements in the form of privacy notices about our collection, use and disclosure of personal information, including statements provided on our websites and other privacy notices provided to consumers, borrowers, customers, third-party vendors, employees or job applicants. Any failure by us to comply with these statements, as well as any failure to provide comprehensive and transparent disclosure in such statements, or to comply with other federal, state, local or international privacy or data protection laws and regulations could result in inquiries or proceedings against us by governmental entities, regulators, consumer organizations, and private litigants, as well as potential fines, penalties, and monetary or other liability, any of which could have a material adverse effect on our business, results of operations, and financial condition.

Under Data Privacy Laws, we may be liable for statutory, actual, or other damages suffered by individuals whose personal information is compromised or stolen as a result of a breach of the security of the systems upon which we or third parties and service providers of ours store this information, and any such liability could be material. Even if we are not liable for such losses, any breach of these systems could expose us to material costs, including, but limited to, costs relating to investigating and notifying affected individuals and providing credit monitoring services or other services or compensation to them, as well as regulatory fines or penalties, or, in the event of a ransomware attack, any ransom payment we decide to make in order to restore our systems and data following such attack. In addition, any breach of these systems could disrupt our normal business operations and expose us to reputational damage and lost business, revenues, and profits. 

Furthermore, several federal and state regulators have begun mandating the reporting of certain security incidents in a particular format and within required timeframes, including, without limitation, the Securities and Exchange Commission, the Federal Trade Commission, and the New York State Department of Financial Services. Our failure to comply with applicable reporting obligations could