Company: BLND
Filing Date: 2025-08-07
Form Type: 10-Q
Source: 0001855747-25-000069
Chunk: 149

Company: Blend Labs, Inc.
Filing Date: 2025-08-07
Form: 10-Q
Item: Part I, Item 3
Chunk 149
---
 process a large volume of personal information and other sensitive data relating to individuals, such as consumers and our employees. Our collection, use, receipt, and other processing of data in our business subjects us to numerous state, federal, and foreign laws and regulations, addressing privacy, information security, data protection, and the collection, storing, sharing, use, transfer, disclosure, protection, and processing of certain data. Such regulations include, for example, the GLBA, FCRA, California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (the “CPRA”). These laws, rules, and regulations evolve frequently and their scope may continually change, through new legislation, amendments to existing legislation, and changes in interpretation or enforcement, and may impose conflicting and inconsistent obligations. 

For example, in 2021, the Federal Trade Commission (“FTC”) amended the GLBA’s Safeguards Rule, which requires covered financial services firms, which may include some of our customers, to develop, implement, and maintain a comprehensive information security program. The rule provides more prescriptive security controls that financial services firms must implement and oversight by a designated Qualified Individual who must provide annual written reports to the board of directors or equivalent governing body. The FTC further amended the GLBA’s Safeguards Rule in November 2023 to provide for reporting to the FTC certain security incidents in which unencrypted personal information involving 500 or more consumers is acquired without authorization. In addition, the FTC has brought enforcement actions against service providers of financial services firms directly and against financial services firms for failures by service providers to implement appropriate controls to safeguard consumers’ personal information. 

The CCPA went into effect on January 1, 2020, and, among other things, requires certain disclosures to California consumers and affords such consumers certain data privacy rights. The California Attorney General can enforce the CCPA, including seeking an injunction and civil penalties of up to $7,500 per violation. The CCPA also provides a private right of action for certain data breaches that may increase data breach litigation. Additionally, the CPRA was approved by California voters in November 2020, and significantly modified the CCPA, including expanding California consumers’ rights with respect to certain personal information and creating a new state agency to oversee implementation and engage in enforcement efforts. The CPRA created obligations relating to consumer data beginning on January 1, 2022 and it became effective on January 1, 2023. Numerous states have proposed, and in certain cases enacted, legislation addressing privacy and