Data Privacy. This section replaces Section 16 of the Agreement:

Data Privacy. The following provision supplements Section 16 of the Award:

subject to [Section 10.2.1(b)], changes to the Program Privacy Policy;

The following provision supplements paragraph D “Data Privacy” of Appendix A:

“Privacy Policies” means all written policies and procedures applicable to the Target Companies relating to PCI DSS and/or written policies publically posted relating to the Processing of Personal Information, including all website and mobile application privacy policies, as well as internal information security policies and procedures.

Data Privacy Acknowledgement. This provision supplements Section 9(f) of the Agreement:

For further details on CAE’s approach to personal information, please consult the Privacy section of the Corporate Policies & Procedures.

The collection, maintenance, transmission, transfer, use, disclosure, storage, disposal, and security of Personal Confidential Information and Protected Health Information by the Company and each Subsidiary has complied in all material respects with # HIPAA, # applicable Information Privacy and Security Laws, # Material Company Contracts that govern Personal Confidential Information or Protected Health Information, and # applicable privacy policies of the Company and each Subsidiary. No judicial or administrative action, suit, litigation, arbitration, proceeding is pending or, to the Company’s knowledge, threatened in writing against the Company or a Subsidiary relating to the Company’s or Subsidiary’s non-compliance with Information Privacy and Security Laws or laws concerning Protected Health Information.

This provision replaces in its entirety the data privacy section in the Acknowledgment of Conditions section of the Award Agreement.

Data Privacy. If the Employee resides or is employed in the EU or EEA, the following provision replaces [Section 12] of the Grant Agreement.