California Consumer Privacy Act

This California Consumer Privacy Act Disclosure (“CCPA Disclosure”) addresses how City National Bank and its subsidiaries (collectively “we”, “us”, “our,” or “City National”) collect, use, and share “Personal Information” as defined in the California Consumer Privacy Act (“CCPA”). This CCPA Disclosure supplements all other City National privacy policies and notices applicable to City National services and applies solely to California residents. Any capitalized terms used in this policy have the same meaning as in the CCPA unless otherwise defined.

Information Covered Under the CCPA

As used in this CCPA Disclosure, Personal Information means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include: (i) publicly available information from government records; (ii) de-identified or aggregated consumer information; or (iii) personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA) and the Gramm-Leach-Bliley Act (GLBA).

What Categories of Information Does City National Collect?

We have collected the following categories of Personal Information from consumers within the preceding twelve (12) months:

How Does City National Collect These Categories of Personal Information?

City National collects the Personal Information above from the following categories of sources:

• Directly from consumers
• Service providers
• Publicly available sources and registries
• City National affiliates
• Business partners
• Third parties authorized to share information with us
• Government entities

Why Does City National Collect These Categories of Personal Information?

City National uses the Personal Information above for the following purposes:

• Providing products and services to consumers
• Identifying and preventing fraud
• Verifying your identity
• Conducting data analysis and research
• Improving products and services
• Marketing and advertising
• Maintaining internal systems and infrastructure
• Ensuring compliance with all other applicable laws and regulations
• Responding to civil, criminal, or regulatory requests
• For any other use disclosed at or before the point of collecting the Personal Information

City National may also use the Personal Information referenced above for any one of the specific “business purposes” described in the CCPA:

• Auditing related to a current interaction with the consumer
• Detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, and prosecuting those responsible for that activity
• Identifying and debugging errors that impair functionality
• Permissible short-term transient use

Who Does City National Share Personal Information With?

City National shares the Personal Information above with the following parties:

• Affiliates
• Subsidiaries
• Our parent company – Royal Bank of Canada (“RBC”)
• Business partners
• Service providers
• Third parties with whom you authorize or direct us to share your information
• Government entities and others with whom we share information for legal or necessary purposes

Does City National Sell Any Personal Information?

City National does not sell any consumer Personal Information. To learn more about our commitment to protecting your Personal Information, see our Privacy & Security.

CCPA Consumer Rights

The CCPA also provides California consumers with certain additional rights regarding their Personal Information.

Right to Access

You have the right to request that we disclose the categories of Personal Information City National has collected about you in the preceding twelve-month period. We must also provide you with a summary of the purposes for which the categories of Personal Information were collected.

Once you submit an access request, you may also separately request a portable copy of the specific pieces of Personal Information City National has collected about you (subject to heightened verification).

We will disclose the applicable information specified above to you upon receipt of your verifiable consumer request (see “Submitting a Verifiable Consumer Request” section below).

Right to Deletion

You have the right to request that we delete any of your Personal Information subject to the various exceptions provided in the CCPA (see “Submitting a Verifiable Consumer Request” section below).

Submitting a Verifiable Consumer Request

In order to protect your information, we can only honor access or deletion requests upon receipt of a verifiable consumer request. Your request must provide information that enables us to verify your identity in order for us to respond.

You agree to respond to any reasonable requests from us for additional information to enable us to verify your identity in connection with your access or deletion requests.

You may submit a verifiable consumer request by calling (800) 773-7100 from Monday through Friday between 8:00 a.m. and 4:30 p.m. PT or emailing CompliancePrivacy@cnb.com.

Upon receiving a request, we will attempt to verify your identity and will respond within no more than forty-five days as required by the CCPA.

Once you have submitted a valid data access request, you will be issued a reference number which may then be used to submit either a deletion or specific information request (subject to heightened verification). For either of these data requests, simply email your data access reference number and the type of request to CompliancePrivacy@cnb.com.

Right to Nondiscrimination

We will not discriminate against you because you elect to exercise any of your rights under the CCPA including, but not limited to:

• Denying goods or services to you
• Charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties on you
• Providing a different level or quality of goods or services to you
• Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services

None of the foregoing, however, prohibits us from charging you a different price or rate, or from providing a different level or quality of goods or services to you, if that difference is reasonably related to the value provided to us by your data.

Updates

This CCPA Disclosure was last updated on September 28, 2021. We may modify this CCPA Disclosure at any time. More information on City National’s privacy practices may be found at cnb.com/privacy-security/privacy-statement.html.