Brighthouse Financial Inc

In the course of our business, we and our distributors collect and maintain customer data, including personally identifiable nonpublic financial and health information. We also collect and handle the personal information of our associates and certain third parties who distribute our products. As a result, we and the third parties who distribute our products are subject to U.S. federal and state privacy laws and regulations, including the Health Insurance Portability and Accountability Act as well as additional regulation, including those described below. These laws and regulations require that we implement and maintain certain policies and procedures to safeguard this information from improper use or disclosure and that we provide notice of our practices related to the collection and disclosure of such information. Other laws and regulations require us to notify affected individuals and regulators of security breaches.

Congress and many states have enacted privacy and information security laws and regulations that impose compliance obligations applicable to our business, including obligations to protect sensitive personal and creditworthiness information, as well as limitations on the use and sharing of such information. For example, the NYDFS’s Part 500 – Cybersecurity Regulation (the “NYDFS Cybersecurity Regulation”), which became effective in March 2017, requires companies to establish a cybersecurity program. In November 2023, the NYDFS announced amendments to the NYDFS Cybersecurity Regulation. The amended NYDFS Cybersecurity Regulation went into effect in phases beginning November 1, 2023 and continuing through December 2025, and it includes additional and new requirements regarding certification, governance, audit requirements, technology and business continuity, security control and training requirements, and notification obligations.

In addition, the California Consumer Privacy Act of 2018 (the “CCPA”), which became effective in January 2020, affords California residents expanded privacy protections and control over the collection, use and sharing of their personal information. The CCPA requires companies to make certain disclosures to California consumers regarding personal information, among other privacy protective measures. The CCPA’s definition of “personal information” is more expansive than those found in other privacy laws in the United States applicable to us. Failure to comply with the CCPA risks regulatory fines, and the CCPA grants a private right of action and statutory damages for an unauthorized access and exfiltration, theft, or disclosure of certain types of personal information resulting from the Company’s violation of a duty to maintain reasonable security procedures and practices. The CCPA, amended by the California Privacy Rights Act (the “CPRA”), effective as of January 1, 2023, and the implementing regulations require additional investment in compliance programs and potential modifications to business processes. Further, the CCPA, as amended, creates the California Privacy Protection Agency to enforce the statute as well as its regulations, and it imposes new requirements relating to additional consumer rights, data minimization, and other obligations. The California legislature did not extend certain exemptions under the amended CCPA, specifically information collected in employment or business-to-business contexts, and such information therefore is now covered by the CCPA. Enforcement of the CCPA, as amended by the CPRA, began on July 1, 2023.

In 2017, the NAIC adopted the Insurance Data Security Model Law, which established standards for data security and for the investigation and notification of insurance commissioners of cybersecurity events involving unauthorized access to, or the misuse of, certain nonpublic information. More than 20 U.S. states have enacted the Insurance Data Security Model Law or similar laws, and we expect more states to follow.

In July 2023, the SEC adopted the Risk Management, Strategy, Governance, and Incident Disclosure Final Rule (the “Cybersecurity Final Rule”) that enhances the disclosure requirements for registered companies covering cybersecurity risk and management. The Cybersecurity Final Rule requires registrants to disclose material cybersecurity incidents on Form 8-K. The Cybersecurity Final Rule also requires periodic disclosures of the Company’s cybersecurity risk management processes, governance, and management’s role in overseeing such a compliance program. See “Cybersecurity” for a discussion of our cybersecurity risk management and governance framework.

All U.S. states, the District of Columbia, and U.S. territories also require entities to provide notification to affected residents and, in certain instances, state regulators, such as state attorneys general or state insurance commissioners, in the event of certain security breaches affecting personal information. Also, as noted above, state governments, Congress, and agencies may consider and enact additional legislation or promulgate regulations governing privacy, cybersecurity, and data breach reporting requirements. We cannot predict whether such legislation will be enacted, or what impact, if any, such legislation may have on our business practices, results of operations or financial condition.