State Laws and Regulations Relating to Consumer and Data Protection 

• A number of states have enacted requirements similar to the federal FCRA. Some of these state laws impose additional, or more stringent, requirements than the FCRA, especially in connection with investigations and responses to reported inaccuracies in consumer reports. The FCRA preempts some of these state laws, but the scope of preemption continues to be defined by the courts. The state of Vermont is grandfathered under the original FCRA requirements and thus we are subject to additional requirements to comply with Vermont law. 

• All fifty states have adopted versions of data security breach laws that require notification to affected consumers and potentially regulators or law enforcement authorities in the event of a breach of personal information. A subset of these laws and other state laws require the implementation of data security measures as well. State attorneys general can enforce such state laws and can seek equitable as well as monetary remedies and in some cases private rights of action are permitted by such laws. 

• The New York State Department of Financial Services (“NYDFS”) has enacted extensive regulatory requirements applicable to CRAs that require registration with that agency, prohibit unfair and deceptive consumer practices and require compliance with significant portions of the NYDFS cybersecurity rules. 

• We or certain of our operations are also subject to and affected by new and evolving state privacy and data security laws such as new data broker registration requirements in California and Vermont, and the California Consumer Privacy Act (“CCPA”). The CCPA became effective January 1, 2020 and imposes additional data privacy requirements on many businesses operating in the state, including, potentially, with respect to employee data in addition to consumer data. The CCPA expansively defines “personal information” and imposes new notice requirements relating to the collection, use and sharing of personal information. It provides consumers with extensive rights, including the right to access the categories and specific pieces of personal information businesses collect, the right to request businesses delete information, and the right to opt-out of “sales” of personal information with sales being defined under the CCPA to include monetary and non-monetary valuable consideration. The CCPA also contains a private right of action in the event that a business suffers a security breach that was due to unreasonable security measures. In November 2020, California voters passed the California Privacy Rights Act (“CPRA”), which maintains the core framework but expands the requirements of the CCPA effective January 1, 2023. We may also become subject to and affected by new and proposed state privacy laws similar to the CCPA. A number of state legislatures, including New York and Washington, have introduced comprehensive data privacy legislation modeled after, and which contain certain elements of, the CCPA or the European Union's General Data Protection Regulation (“GDPR”), which is an extremely broad privacy law. Additional state legislatures are expected to consider similar legislation in 2021. If enacted, such laws may contain variations and impose new compliance risks and obligations on the Company. 

• State banking and financial services regulatory agencies have asserted either express or implied authority under applicable state laws to examine us as a third-party service provider to financial institutions, and in certain cases to bring enforcement actions against us. Generally, such examinations, and related enforcement actions, are focused on assessing our safety and soundness in support of financial institutions we serve. In 2018, we entered into a consent order with certain state banking regulators in response to their multi-state review of our information security program. This consent order obligated us to, among other things, make certain changes to our corporate governance and information security practices. 

• We are also subject to federal and state laws that are generally applicable to any U.S. business with national or international operations, such as antitrust laws, the Foreign Corrupt Practices Act, the Americans with Disabilities Act, state unfair or deceptive practices acts and various employment laws. We continuously monitor legislative and regulatory activities that involve credit reporting, data privacy, security and other relevant issues to identify issues in order to remain in compliance with all applicable laws and regulations. 

## Consent Orders with the FTC, CFPB, MSAG Group and NYDFS 

• As part of the Consumer Settlement (as defined below), we entered into consent orders with the FTC, CFPB, MSAG Group (as defined below) and NYDFS pursuant to which we agreed to implement certain business practice commitments related to consumer assistance and our information security program, including third party assessments of our program. These business practice commitments are extensive and require a significant amount of attention from management. 

