We are subject to complex and evolving laws and regulations governing the privacy and protection of personal
information of our customers, employees, job applicants, and other individuals. Complying with laws and regulations applicable to our collection, use, transfer, and storage of personal information can increase operating costs, impact
the development and marketing of new products or services, and reduce operational efficiency. Any mishandling or
misuse of personal information by Key or our vendors could expose us to litigation or regulatory fines, penalties, or
other sanctions.
At the federal level, we are subject to the Gramm-Leach-Bliley Act of 1999, as amended, which requires financial
institutions to, among other things, periodically disclose their privacy policies and practices relating to sharing personal information and, in some cases, enables customers to opt out of the sharing of certain non-public personal information with unaffiliated third parties. We are also subject to the rules and regulations promulgated under the authority of the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to privacy and cybersecurity. A number of states have also recently enacted consumer privacy laws that impose compliance obligations with respect to personal information or issued guidance regarding the same, such as the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (known as the “CCPA”), and the New York Department of Financial Services Cybersecurity Regulations. In addition, there has been a significant increase in privacy-related litigation in recent years with respect to how organizations collect information and technical data from their public facing websites, and federal and state courts have been creating new legal frameworks around consumer and website privacy, which also creates new risks on businesses. As new privacy-related laws and regulations, and judicially-created frameworks, are implemented in jurisdictions in which KeyBank operates, the time and resources needed for us to comply with such laws and regulations, as well as our potential liability for noncompliance and reporting obligations in the case of data breaches, may significantly increase. Compliance with these laws and regulations has required and may continue to require us to change our policies, procedures, and technology for information security and segregation of data, which could, among other things, make us more vulnerable to operational failures, and subject us to monetary penalties for breach of such laws and regulations. As a result, some uncertainty remains as to the aggregate impact upon Key of significant regulations.