Company: CMA
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000028412-25-000108
Chunk: 13

Company: COMERICA INC
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 13
---
 things, maintaining policies and procedures to protect the non-public confidential information of customers and employees. The privacy provisions of the Gramm-Leach-Bliley Act generally prohibit financial institutions from disclosing nonpublic personal financial information of consumer customers to third parties for certain purposes (primarily marketing) unless customers have the opportunity to “opt out” of the disclosure. Other laws and regulations, at the international, federal and state levels, limit Comerica’s ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers. The Gramm-Leach-Bliley Act also requires banks to implement a comprehensive information security program that includes administrative, technical and physical safeguards to ensure the security and confidentiality of customer records and information. 

Federal banking and securities regulations also impose certain requirements on Comerica and its subsidiary banks in the event of a cyber- or computer-related security incident. In 2021, the federal banking regulators issued the interagency rule for Computer-Security Incident Notification Requirements for Banking Organizations and Their Service Providers, which became effective on April 1, 2022. The rule requires a bank to notify its primary federal regulator of certain "computer-security" incidents within thirty-six (36) hours after the bank determines that a computer-security incident has occurred. The rule defines what constitutes a reportable computer-security incident and also requires bank service providers to provide notice to their respective banking organization customers of certain computer-security incidents.

Data privacy and data protection are also areas of increasing state legislative focus. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act in 2023 (collectively, the “CCPA”), applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds. The CCPA gives consumers the right to request disclosure of information collected about them, and whether that information has been sold or shared with others, the right to request deletion of personal information (subject to certain exceptions), the right to opt out of the sale of the consumer’s personal information, and the right not to be discriminated against for exercising these rights. The CCPA contains several exemptions, including an exemption applicable to information that is collected, processed, sold or disclosed pursuant to the Gramm-Leach-Bliley Act. Comerica has a physical footprint in California and is required to comply with the CCPA. Similar laws may also be adopted by other states. There have also been ongoing discussions and proposals in the U.S.