CARNIVAL PLC

With the increasing size and sophistication of cruise ships, the technologies employed to enhance guest experiences and operate ships have grown ever more complex and integrated. All our brands actively collaborate to maximize the business value of our information technology solutions, standards and processes to eliminate redundancies and drive process efficiencies, while increasingly leveraging our scale and common technologies. In order to achieve our goals, we are focusing on several key factors including applications, innovation, connectivity, infrastructure, modernization, cloud migration, cybersecurity, data privacy and compliance. Our global information technology model is designed to positively contribute to our guests, crew, shoreside team members and other stakeholders.

In response to the increasing threat of continuously evolving cybersecurity risks, we continue to invest in our information technology and operational technology cybersecurity programs. We manage risk and protect our company’s business operations through targeted people, process and technology-focused improvements, including the implementation of data privacy and security focused training for our shoreside and select shipboard team members. We have a Chief Information Security Officer who reports to the Chief Information Officer and is responsible for leading global cybersecurity risk reduction efforts and compliance.

Protecting data and the privacy of personal information is of critical importance to our business. As a company, we are entrusted with personal data belonging to our guests, team members and business partners. In light of this and the numerous jurisdictional data privacy and security laws/regulations, we have data privacy and security standards across the corporation. Our Chief Privacy Officer and Data Protection Officers oversee our focus on the proper processing of personal information in alignment with our privacy policy and applicable privacy laws and regulations.

Our Chief Information Officer and Chief Privacy Officer are responsible for risk management with respect to information technology operations, cybersecurity and data privacy. In addition, the Audit Committees are responsible for oversight of our risk management with respect to information technology operations and cybersecurity while the Compliance Committees oversee risk management in the area of data privacy. Despite our efforts with respect to information technology operations, cybersecurity and data privacy, we have been, and may continue to be, impacted by breaches in data security and lapses in data privacy, which occur from time to time. In 2023, the penalties and settlements paid in connection with cyber incidents were not material.