Company: FRFXF
Filing Date: 2025-03-26
Form Type: 424B3
Source: 0001104659-25-028272
Chunk: 72

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-03-26
Form: 424B3
Chunk 72
---
1, 2023. The CPRA provides for additional consumer privacy rights and additional regulatory obligations
over certain data. It also created a new privacy focused California regulatory agency with enforcement authority, the California Privacy
Protection Agency (“CPPA”). CPPA regulations that implement the CPRA became effective on March 29, 2023 and are
enforceable.

A number of other states
have also passed enhanced privacy laws that recently went into effect or will go into effect in the near future. While these states’
laws provide consumer privacy rights and protections similar to those in the CCPA and CPRA, they exempt financial institutions and data
subject to the Gramm-Leach-Bliley Act from their requirements.

<div align='center'>- 43 -</div>

In addition, states without
comprehensive privacy laws, like New York, continue to signal their willingness to enforce privacy on consumer protection grounds, especially
over website cookies and other web tracking technologies, based on existing consumer protection laws. Finally, there are several legislative
proposals pending before the U.S. Congress and various state legislative bodies concerning privacy. Privacy regulation is an evolving
area of state and federal regulation, which requires us to continue to monitor developments.

Cybersecurity

In 2017, the NAIC adopted
an Insurance Data Security Model Law (#668-1) that establishes minimum cybersecurity requirements applicable to licensed insurance companies
and licensed insurance intermediaries. Among other requirements, the Insurance Data Security Model Law requires licensees to maintain
an information security program based on a cybersecurity risk assessment, establish a written incident response plan, provide an annual
certification of compliance to state insurance regulators, and investigate and notify state insurance regulators regarding cybersecurity
events. As of March 4, 2025, the NAIC reports that 26 states have adopted a version of the Insurance Data Security Model Law or
portions thereof and adopting legislation was pending in three states. The New York Department of Financial Services already has a similar
cybersecurity regulation in effect and adopted a number of substantial amendments to the regulation in November 2023 that further
heighten its cybersecurity requirements, including with respect to governance, incident response and reporting, and implementing certain
security controls. Most of the new requirements are now in effect, with the final remaining requirements set to take effect on or before
November 1, 2025. Separately, Massachusetts also has regulations in place that require businesses to maintain a cybersecurity program
that meets certain minimum requirements. See also “