Company: HBAN
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000049196-25-000020
Chunk: 111

Company: HUNTINGTON BANCSHARES INC /MD/
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1
Chunk 111
---
. Huntington and its subsidiaries are subject to the rules and regulations promulgated under the authority of the CFPB and Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to cybersecurity and data privacy. Further, the GLBA, and its regulations such as Regulation P, require financial institutions to disclose their data privacy policies and practices relating to sharing personal information and enables retail customers to opt out of our ability to share their personal information with unaffiliated third parties under certain circumstances. The GLBA and its regulations require financial institutions to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information. An amendment to Regulation S-P, an implementing regulation under the GLBA, was adopted by the SEC on May 16, 2024 and requires registered investment advisers and broker-dealers to, among other things, adopt and implement an incident response program as part of their formal cybersecurity policies and procedures and report data breaches to affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization within 30 days of becoming aware of such data breach. Federal law also makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain customer information of a financial nature by fraudulent or deceptive means. Moreover, the U.S. Congress has recently considered, and is currently considering, various proposals for more comprehensive cybersecurity and data privacy legislation, to which we may be subject if passed.

Like other lenders, the Bank and other of our subsidiaries also use credit bureau data in their underwriting activities. Use of such data is regulated under the FCRA, and the FCRA also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on us and our subsidiaries.

The CISA is intended to improve cybersecurity in the U.S. by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions, and empowers the CISA Agency to oversee this information sharing process. The CISA also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out defensive measures on their own systems from cyber-attacks or other information or security breaches. The law includes liability protections for companies that share cyber-threat information with third parties so long as such sharing activity is conducted in accordance with the CISA. In addition, the enactment of the