Table of Contents • Privacy Laws.  The privacy and protection of consumer information is a developing area of regulation, and we continue to monitor legislative and regulatory developments at the federal, state, and local levels. In addition to the GLBA, we expect that there will continue to be enhanced state and/or federal regulation in the area of financial and consumer data privacy, including regulation similar to the California Consumer Privacy Act (“CCPA”). Such regulation may impose additional registration requirements and/or require us to make new disclosures to consumers about our data collection, use, and sharing practices and afford consumers new abilities to opt out of certain data sharing with third parties. Any such additional regulation could significantly impact some of our business practices. • Data Security.  In addition to the above, federal and state laws also impose requirements relating to the security of information held by us. For our businesses that involve the collection, processing, and distribution of personal public and non-public data, certain of their solutions and services are subject to regulation under US federal, state, and local laws and, to a lesser extent, foreign countries. These laws impose requirements regarding the collection, protection, use, and distribution of some of the data we have, and provide for sanctions and penalties in the event of violations of these requirements. In addition, certain state laws may impose breach notice responsibilities in the event of the loss of data due to third-party security breaches, employee error, or other events resulting in persons gaining unauthorized access to our data (including, in some cases, for losses that are incurred through our clients’ errors or systems). Some of these laws require additional data protection measures over and above the GLBA data safeguarding requirements. If data within our system is compromised by a breach, we may be subject to provisions of various state security breach laws. All states have adopted data security breach laws that require notice be given to affected consumers in the event of a breach of personal information, and in some cases the provision of additional benefits such as free credit monitoring to affected individuals. In addition, the CCPA provides consumers with a private right of action under certain circumstances if their personal information is subject to a breach. If data within our system is compromised by a breach, we may be subject to provisions of these various state security breach laws. • Real Estate Settlement Procedures Act  (“RESPA”). With respect to certain services provided to our financial institution clients, RESPA generally prohibits the payment or receipt of fees or any other item of value for the referral of real estate-related settlement services. RESPA also prohibits fee shares or splits or unearned fees in connection with the provision of residential real estate settlement services, such as mortgage brokerage services and real estate brokerage services. Notwithstanding these prohibitions, RESPA permits payments for goods furnished or for services actually performed, so long as those payments bear a reasonable relationship to the market value of the goods or services provided. Our mortgage origination-related businesses that supply credit reports, flood and tax solutions, valuation products, and all other settlement services to residential mortgage lenders are structured and operated in a manner intended to comply with RESPA and related regulations. The CFPB may enforce RESPA. RESPA also provides a private right of action to consumers under certain circumstances. • Real estate appraisals and automated valuation models (“AVMs”) are subject to federal and state regulation. The Dodd-Frank Act implemented rules and guidance thereunder, and inter-agency guidance jointly issued by the federal financial institution regulators have expanded regulation of these activities. Regulations address appraisals, AVMs, and other forms of property value estimates, which are subject to explicit and detailed regulations including licensing, pricing, and quality control requirements. In addition, creditors are required to disclose information to applicants about the purpose, and provide consumers with a free copy, of any appraisal, AVM or other estimate of a home's value developed in connection with a residential real estate mortgage loan application. In addition to the foregoing, our businesses may be subject to or impacted by additional laws and regulations applicable to their industry or geographic location, such as our flood and insurance businesses, and our businesses that operate in foreign jurisdictions. International Consumer Financial Regulations and Data Protection We are subject to consumer and data protection laws and regulations in the foreign countries where we conduct business. We conduct business in several international jurisdictions, including Australia, New Zealand, Canada, United Kingdom, various countries in Europe, and Brazil. Principal regulatory bodies and regulatory laws that impact our international operations include the Office of the Australian Information Commissioner, the agency with direct responsibility for administering the Australian Privacy Principles and Part IIIA of the Privacy Act 1988, and the Office of the Privacy Commissioner of New Zealand, which issued the Credit Reporting Privacy Code 2004. We are also subject to the European Union Data Protection Regulation, commonly known as GDPR, which places certain obligations on companies processing and controlling data on individuals in the European Union ("EU") and prohibits the transfer of personal information from the EU to other countries whose laws do not protect personal data to an adequate level of privacy or security. In Canada, we are subject to the Personal Information Protection and Electronic Documents Act of 2000, as well as substantially similar provincial laws enacted in Alberta, British Columbia, and Quebec. We are also subject to the recently implemented Brazilian General Data Protection Law, which is 11