Company: FRFXF
Filing Date: 2025-10-09
Form Type: F-10/A
Source: 0001104659-25-098335
Chunk: 82

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-10-09
Form: F-10/A
Chunk 82
---
public personal information” about individuals who obtain financial products or services for personal, family or household purposes. A variety of state privacy statutes and regulations also govern the privacy of information about consumers and require notification to state authorities and individuals if certain personally identifiable information is subject to unauthorized access or disclosure. States, like New York State under its Stop Hacks and Improve Electronic Data Security Act of 2019, as amended (the “

#### SHIELD Act
”), have also begun to expand upon the definition of personal information that requires protection and notification in cases of a breach, to include biometric information, genetic information and email addresses with their corresponding passwords or security questions and answers. In June 2018, the State of California enacted the California Consumer Privacy Act of 2018 (“

#### CCPA
”), which went into effect on January 1, 2020 and (subject to certain exemptions) requires companies that process information that can be tied to identifiable California residents to make new disclosures to California residents about their data collection, use and sharing practices, and provides certain new rights, including allowing individuals to opt out of certain data sharing with third parties. The statute also created a new cause of action where an individual’s personal information is subject to a data breach due to a business’s failure to implement and maintain reasonable security practices. Additionally, California voters approved the California Privacy Rights Act of 2020 (“

#### CPRA
”) as part of the November 2020 ballot. The CPRA substantially amends the CCPA, and it became fully effective on January 1, 2023. The

<div align='center'>50</div>

TABLE OF CONTENTS

CPRA provides for additional consumer privacy rights and additional regulatory obligations over certain data. It also created a new privacy focused California regulatory agency with enforcement authority, the California Privacy Protection Agency (“

#### CPPA
”). CPPA regulations that implement the CPRA became effective on March 29, 2023 and are enforceable.

A number of other states have also passed enhanced privacy laws that recently went into effect or will go into effect in the near future. While these states’ laws provide consumer privacy rights and protections similar to those in the CCPA and CPRA, they exempt certain financial institutions, including insurers and insurance producers, and data subject to the Gramm-Leach-Bliley Act from their requirements.

In addition, states without comprehensive privacy laws, like New York, continue to signal their willingness to enforce privacy on consumer protection grounds, especially over website cookies and other web tracking