Company: HOUS
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001398987-25-000020
Chunk: 63

Company: Anywhere Real Estate Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 63
---
 data minimization and data retention requirements. The CPRA also established the California Privacy Protection Agency, which is intended to take a more active role in enforcement of the law. As of January 2025, 19 states enacted their own privacy legislation which is effective or will become effective within a year, more than doubling the number of states requiring businesses to comply with privacy obligations and the number of individuals who will have privacy rights with respect to their personal information. 

Under the NYDFS cybersecurity regulation, regulated financial institutions, including Title Group, are required to establish and attest to a detailed cybersecurity program. Other state regulatory agencies have or are expected to enact similar requirements following the adoption of the Insurance Data Security Model Law by the National Association of Insurance Commissioners that is consistent with the New York regulation.

Internationally, the European Union’s General Data Protection Regulation ("GDPR") has conferred significant privacy rights on individuals (including employees and independent agents) and materially increased penalties for violations. In 2020, the Court of Justice of the European Union invalidated the E.U.-U.S. Privacy Shield, one of the methods for transfers of personal data into the U.S. As a result, companies may have to rely on standard contractual clauses, or binding corporate rules for the transfer of personal data while awaiting further guidance or regulation. In 2021, the European Commission issued an implementing decision regarding the use of Standard Contractual Clauses. In 2023, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework. Other countries have also recently expanded on their data privacy laws and regulations. 

For additional information with respect to our cybersecurity risk management strategy and governance framework, see "Item 1C.—Cybersecurity." for additional information with respect to the cybersecurity-related risks facing our business, see "Item 1A. Risk Factors" in this Annual Report, in particular under the caption "Cybersecurity incidents could disrupt business operations and result in the loss of critical and confidential information or litigation or claims arising from such incidents, any of which could have a material adverse effect on our reputation and results of operations."

The Telephone Consumer Protection Act. The TCPA restricts certain types of telemarketing calls and text messaging, and the use of automatic telephone dialing systems and artificial or prerecorded voice messages. The TCPA also established a national Do-Not-Call registry. The TCPA defines autodialing broadly and requires express written consent for certain communications to cellphones. Certain states have also adopted, or may in the future adopt