Company: FSBC
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001275168-25-000038
Chunk: 92

Company: FIVE STAR BANCORP
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 92
---
 other forms of regulatory enforcement action as well as requirements for consumer remediation, any of which could have an adverse effect on our business, financial condition, and results of operations.

We are subject to laws regarding the privacy, information security, and protection of personal information, and any violation of these laws or other incidents involving personal, confidential, or proprietary information of individuals could damage our reputation and otherwise adversely affect our business.

Our business requires the collection and retention of large volumes of customer data, including personally identifiable information (“PII”), in various information systems that we maintain and in those maintained by third-party service providers. We also maintain important internal company data such as PII about our employees and information relating to our operations. We are subject to complex and evolving laws and regulations governing the privacy and protection of PII of individuals (including customers, employees, and other third parties). For example, our business is subject to the GLB Act, which, among other things: (i) imposes certain limitations on our ability to share nonpublic PII about our customers with nonaffiliated third parties; (ii) requires that we provide certain disclosures to customers about our information collection, sharing, and security practices and afford customers the right to “opt out” of any information sharing by us with nonaffiliated third parties (with certain exceptions); and (iii) requires that we develop, implement, and maintain a written comprehensive information security program containing appropriate safeguards based on our size and complexity, the nature and scope of our activities, and the sensitivity of customer information we process, as well as plans for responding to data security breaches. Various federal and state banking regulators and states have also enacted data breach notification requirements with varying levels of individual, consumer, regulatory, or law enforcement notification in the event of a security breach. The California Consumer Privacy Act grants California residents the rights to know about personal information collected about them, to delete certain of this personal information, to opt out of the sale of personal information, and to non-discrimination for exercising these rights.

Ensuring that our collection, use, transfer, and storage of PII complies with all applicable laws and regulations can increase our costs. Furthermore, we may not be able to ensure that customers and other third parties have appropriate controls in place to protect the confidentiality of the information that they exchange with us, particularly where such information is transmitted by electronic means. If personal, confidential, or proprietary information of customers or others were to be mishandled or misused (in situations where, for example, such information was erroneously