Company: GDOT
Filing Date: 2025-03-04
Form Type: 10-K
Source: 0001386278-25-000009
Chunk: 18

Company: GREEN DOT CORP
Filing Date: 2025-03-04
Form: 10-K
Item: Item 1
Chunk 18
---
 (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences.

Privacy and Data Security Laws

Green Dot Bank is subject to a variety of federal and state privacy and data security laws, which govern the collection, safeguarding, sharing and use of customer information, and require that financial institutions have in place policies regarding information privacy and security. For example, the Gramm-Leach-Bliley Act of 1999 requires all financial institutions offering financial products or services to retail customers to provide such customers with the financial institution’s privacy policy and practices for sharing nonpublic information with third parties, provide advance notice of any changes to the policies and provide such customers the opportunity to “opt out” of the sharing of certain personal financial information with unaffiliated third parties. It also requires banks to safeguard personal information of consumer customers.

Some state laws also protect the privacy of information of state residents and require adequate security for such data, and certain state laws may, in some circumstances, require Green Dot Bank to notify individuals with impacted information of security breaches of computerized data that contain their personal information. These laws may also require Green Dot Bank to notify law enforcement, regulators or consumer reporting agencies in the event of a data breach, as well as businesses and governmental agencies that own affected data.

Privacy and data security remain areas of state legislative focus. By the end of 2024, eight U.S. states had consumer privacy laws in effect. Similar laws come into effect in eight more states in 2025, and another three states in 2026. These laws provide residents of these states certain privacy rights in the collection and disclosure of their personal information and require covered businesses to make certain disclosures and take certain other acts in furtherance of those rights. Other U.S. states are considering similar privacy laws. State regulators are authorized to implement and enforce existing consumer privacy laws, which has resulted in increased scrutiny on privacy and data security. In addition, the federal government may also pass data privacy or data security legislation.

Like other lenders, Green Dot Bank and other of our subsidiaries use credit bureau data in their underwriting activities. Use of such data is regulated under the Fair Credit Reporting Act (the “FCRA”), and the FCRA also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates and using affiliate data for marketing purposes. Similar state laws may impose additional