our relationships with our existing and future customers, suppliers and employees, which could have an adverse effect on our business, financial results and operations. Legal and Regulatory Risks As part of a global settlement, we entered into agreements with various parties to settle the U.S. Consumer MDL Litigation and certain federal and state government investigations arising out of the 2017 cybersecurity incident. If we are unable to comply with our obligations under these agreements, if the U.S. Consumer MDL Litigation settlement is not upheld on appeal, or if other lawsuits or investigations are filed or commenced, it could have a material adverse effect on our financial condition. In July 2019, the Company entered into multiple agreements that resolve the U.S. consolidated consumer class action cases, captioned In re: Equifax, Inc. Customer Data Security Breach Litigation, MDL No. 2800 (Consumer Cases) (the “U.S. Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico (the “MSAG Group”) and the NYDFS (collectively, the “Consumer Settlement”) relating to the 2017 cybersecurity incident. On January 13, 2020, the U.S. District Court for the Northern District of Georgia (the “Court”) entered an order granting final approval of the settlement in connection with the U.S. Consumer MDL Litigation, from which several objectors have appealed. Until the appeals are finally adjudicated or dismissed and the settlement becomes final in accordance with its terms, we can provide no assurance that the U.S. Consumer MDL Litigation will be resolved as contemplated by the settlement agreement. If the Court’s order approving the settlement agreement was overturned by an appellate court and not cured in accordance with the terms of the consent orders with the FTC and CFPB, the consent orders with the FTC, CFPB and MSAG Group would remain in place and the Consumer Restitution Fund (as defined below) would be administered by the FTC. In that event, there is a risk that we would not be able to settle the U.S. Consumer MDL Litigation on acceptable terms or at all, which could have a material adverse effect on our financial condition. In addition to the monetary payments and consumer redress, we also agreed as part of the Consumer Settlement to implement certain business practice commitments related to consumer assistance and our information security program, including third party assessments of our program. These business practice commitments are extensive and require a significant amount of attention from management. To the extent we are unable to comply or we are viewed as not being in compliance with these business practice commitments or other requirements of a relevant order, we could face an enforcement action or contempt proceeding that could potentially result in fines, penalties and new business practice commitments, which, depending on the amount and type, could have a material adverse effect on our financial condition. In addition, other lawsuits and investigations related to the 2017 cybersecurity incident are still outstanding and additional lawsuits or investigations may be filed, commenced or issued. The resolution of these additional matters may result in damages, costs, fines or penalties, which, depending on the amount, could be material to the Company’s consolidated financial condition, results of operations, or cash flows in future periods. Any future losses we incur as a result of the incident will not be covered by insurance. We and our customers are subject to various current laws and governmental regulations, and could be affected by new and evolving consumer privacy and cybersecurity or other data-related laws or regulations, compliance with which may cause us to incur significant expenses and change our business practices, and if we fail to maintain satisfactory compliance with certain laws and regulations, we could be subject to civil or criminal penalties. We are subject to a number of U.S. federal, state, local and foreign laws and regulations relating to consumer privacy, cybersecurity, data and financial protection. See “Item 1. Business—Governmental Regulation” in this Form 10-K for a summary of the U.S. and foreign consumer and data protection laws and regulations to which we are subject. These regulations are complex, change frequently, have tended to become more stringent over time, and are subject to administrative interpretation and judicial construction in ways that could harm our business. In addition, new laws and regulations at the state and federal level are enacted or considered frequently. Examples of such new and evolving laws and regulations include amendments to the FCRA requiring the provision of free credit freezes to consumers, cybersecurity and other requirements promulgated by the New York Department of Financial Services, the CCPA which took effect on January 1, 2020, the California data broker registration requirements that took effect on January 31, 2020, and the CPRA taking effect on January 1, 2023. Furthermore, we expect there to be an increased focus on laws and regulations related to our business, including by the new U.S. presidential administration and the new U.S. Congress, because of the great public concern in the U.S. with regard to the operation of credit reporting agencies, as well as the collection, use, accuracy, correction and sharing of personal information. We also use algorithms, artificial intelligence and machine learning in our business processes. There are a number of legislative proposals pending before the U.S. Congress, various state legislative bodies and foreign governments concerning privacy or cybersecurity that could affect us. The Canadian government has initiated a review of consumer privacy laws, and 23