Data Privacy. This section replaces Section 16 of the Agreement:

Data Privacy. The following provision supplements Section 16 of the Award:

subject to [Section 10.2.1(b)], changes to the Program Privacy Policy;

The following provision supplements paragraph D “Data Privacy” of Appendix A:

“Privacy Policies” means all written policies and procedures applicable to the Target Companies relating to PCI DSS and/or written policies publically posted relating to the Processing of Personal Information, including all website and mobile application privacy policies, as well as internal information security policies and procedures.

Data Privacy Acknowledgement. This provision supplements Section 9(f) of the Agreement:

This Privacy Notice does not form part of any contract of employment or other contract to provide services.

Authorization to Release and Transfer Necessary Personal Information. The following provision supplements paragraph D “Data Privacy” of Appendix A.

For further details on CAE’s approach to personal information, please consult the Privacy section of the Corporate Policies & Procedures.

The collection, maintenance, transmission, transfer, use, disclosure, storage, disposal, and security of Personal Confidential Information and Protected Health Information by the Company and each Subsidiary has complied in all material respects with # HIPAA, # applicable Information Privacy and Security Laws, # Material Company Contracts that govern Personal Confidential Information or Protected Health Information, and # applicable privacy policies of the Company and each Subsidiary. No judicial or administrative action, suit, litigation, arbitration, proceeding is pending or, to the Company’s knowledge, threatened in writing against the Company or a Subsidiary relating to the Company’s or Subsidiary’s non-compliance with Information Privacy and Security Laws or laws concerning Protected Health Information.