Company: WTFCN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001015328-25-000093
Chunk: 237

Company: WINTRUST FINANCIAL CORP
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 237
---
 Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”) applies to covered businesses that conduct business in California and meet certain revenue or personal information collection thresholds. The CCPA contains several exemptions, including that many, but not all, requirements of the CCPA are inapplicable to personal information that is collected, processed, sold or disclosed pursuant to the GLB Act. The CCPA imposes obligations on covered companies, broadly defines personal information, expands California residents’ rights with respect to personal information, and provides for civil penalties for violations. The CCPA may be interpreted or applied in a manner inconsistent with our understanding, resulting in further uncertainty and potentially requiring us to incur additional costs and expenses in an effort to comply with these requirements. Similar laws have been adopted by other states where we do business, or may in the future do business. At least four such laws (in Virginia, Colorado, Connecticut and Utah) took effect in 2023. In addition, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach. Moreover, the federal government has recently considered, and is currently considering, various proposals for more comprehensive data privacy and cybersecurity legislation, to which we may be subject if passed. 

Like other lenders, the banks and several of our operating subsidiaries use credit bureau data in their underwriting activities. Use of such data is regulated under the FCRA, and the FCRA also regulates, among other things, reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information (including personal information) between affiliates, and using affiliate data for marketing purposes. Similar state laws and regulations may impose additional requirements on us, the banks and our operating subsidiaries.

45

Further, in the spring of 2022, the Federal Reserve, OCC, and FDIC adopted a new regulation that requires a banking organization to notify its primary federal regulators as soon as possible and within 36 hours after identifying a “computer-security incident” that the banking organization believes in good faith is reasonably likely to materially disrupt or degrade its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit or franchise value, or pose a threat to the financial stability of the United States. The rule also imposes requirements on bank service providers to notify their affected banking organization customers