Company: USB-PA
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000036104-25-000016
Chunk: 23

Company: US BANCORP \DE\
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1
Chunk 23
---
 and its implementing regulations, as amended in 2020 by the California Privacy Rights Act (the "CCPA"), which provided residents of California with specific rights with respect to the collection of their personal information. The CCPA exempts NPI from its scope. The process of drafting and finalizing implementing regulations for the CCPA is ongoing. The Company continues to evaluate the new regulations, and the effects on the Company will depend on the form of any additional rulemakings.

Similar comprehensive consumer privacy laws have been adopted by other states where the Company does business. Each of these state laws, however, includes an entity level exemption for “financial institutions” that are subject to the GLBA like the Company. The United States Congress has also proposed legislation relating to data privacy and data protection, and the federal government may in the future pass such legislation.

In addition, in the European Union (“ EU”), privacy law is governed by the General Data Protection Regulation (“ GDPR”), which is directly binding and applicable in each EU member state. The GDPR contains enhanced compliance obligations and increased penalties for non-compliance and is regularly enforced by European regulators. Canada is in the process of replacing its federal privacy law, the Personal Information Protection and Electronic Documents Act, with a new privacy framework that the Company expects will impose additional compliance obligations on the Company’s Canadian operations.

In October 2024, the CFPB finalized a rule regarding personal financial data rights, which applies to financial institutions that control or possess data relating to covered consumer financial products or services, such as Regulation E accounts and credit card issuers. Under the final rule, USBNA will be required to provide consumers and, upon the consumer’s request, their authorized third parties electronic access to “covered data.” This includes transaction information, account balances, upcoming bill information, information to initiate payment to and from accounts, the terms and conditions under which an account or credit card was provided, and certain other basic account verification information. The final rule, which is being challenged by several banking industry groups, requires “data providers” such as USBNA to create detailed access interfaces for both consumers and developers in order to effectuate consumers’ access to, and transfer of, their personal financial data. USBNA will be prohibited from imposing any fees or charges for maintaining or providing access to or facilitating the transfer of such data. Unless the rule is overturned or rescinded, USBNA must comply with the final rule by April 1, 2026.

Like other lenders, USBNA and other subsidiaries of the Company use consumer reports in their under