Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 943

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 943
---
 to, among other things, periodically disclose their privacy policies and practices relating to sharing non-public personal information and enables retail customers to opt out of our ability to share such personal information with unaffiliated third parties under certain circumstances. The GLBA also requires financial institutions to implement a comprehensive information security program that includes administrative, technical and physical safeguards to ensure the security and confidentiality of customer records and information.

Like other lenders, Santander Bank and other of our US subsidiaries also use credit bureau data in their underwriting activities, and the use of such data is regulated under the Fair Credit Reporting Act (FCRA). Santander Bank and our US subsidiaries are also subject to the rules and regulations promulgated under the authority of the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to privacy, data protection and cybersecurity. Further, in the spring of 2022, federal banking regulators imposed a new cybersecurity-related notification rule that requires banking organizations to notify their primary federal regulator as soon as possible and within 36 hours of incidents that, among other things, have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the key viability of key operations of the banking organization, or impact the stability of the financial sector. The rule also imposes requirements on bank service providers to notify their affected banking organization customers of certain computer-security incidents. Moreover, the US Congress has recently considered, and is currently considering, various proposals for more comprehensive privacy, data protection and cybersecurity legislation, to which we and our US subsidiaries may be subject if passed. There has also been increasing regulatory scrutiny from the SEC with respect to adequately disclosing risks concerning privacy, data protection and cybersecurity, which increases the risk of investigations into the cybersecurity practices, and related disclosures, of companies within its jurisdiction, which at a minimum can result in distraction of management and diversion of resources for targeted businesses.

Privacy, data protection and cybersecurity are also areas of increasing state legislative focus, and states are increasingly proposing or enacting legislation that relates to privacy, data protection and cybersecurity. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, CCPA), gives California residents the right to, among other things, request disclosure of personal information collected about them, and whether that information has been sold or shared with others, the right to request deletion of personal information (subject to certain exceptions), the right to opt out of the sale of their personal information,