CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, NY 10022
PRIVACY IMPACT ASSESSMENT (PIA) FRAMEWORK & TEMPLATE
Cascade Retail Holdings Inc. — US State Privacy Compliance Program
CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT This document has been prepared by outside legal counsel at the direction of Cascade Retail Holdings Inc. and is protected by the attorney-client privilege and the work-product doctrine. This document is not intended for disclosure to third parties and should not be distributed, reproduced, or disclosed without the prior written consent of Calderwood & Harkness LLP and Cascade Retail Holdings Inc.
Prepared by: Alan Burke Senior Associate, Privacy & Data Security Calderwood & Harkness LLP
Reviewed by: Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP
Prepared for: Cascade Retail Holdings Inc.
Attention: Meredith Tanaka, General Counsel
Diana Polk, Associate General Counsel (Interim Chief Privacy Officer) 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Date: October 2025
Matter Number: 1038-00010
Right-click to update Table of Contents
PART I — PIA FRAMEWORK
Section 1: Purpose and Objectives
1.1 Purpose. This document establishes the Privacy Impact Assessment ("PIA") Framework and reusable PIA Template for Cascade Retail Holdings Inc. ("Cascade" or the "Company") and all of its direct and indirect subsidiaries, including Cascade Digital Marketplace LLC ("CDM"), Ridgeline Fulfillment Services Inc. ("Ridgeline"), Peakview Analytics Inc. ("Peakview"), and Cascade Rewards Corp. ("Cascade Rewards," and together with Cascade, CDM, Ridgeline, and Peakview, the "Covered Entities"). This Framework and Template are core components of Cascade's comprehensive US State Privacy Compliance Program (the "Program"), which Calderwood & Harkness LLP has been engaged to develop, implement, and support under the terms of the engagement letter dated March 15, 2025.
The purpose of this PIA Framework is to provide a structured, repeatable, and legally defensible methodology for evaluating the privacy implications of new products, features, vendor relationships, data-processing activities, and material changes to existing processing before those activities are implemented. By requiring systematic assessment at the front end of project development, the Framework embeds privacy considerations into the business decision-making process, ensuring that privacy risks are identified, assessed, and mitigated proactively rather than reactively.
This Framework is designed to serve as a single, consolidated assessment methodology that satisfies the overlapping and sometimes divergent requirements of the multiple US state privacy statutes applicable to Cascade's operations. Rather than requiring separate assessments under each statute, this Framework harmonizes those requirements into a unified process that captures the most protective standard applicable across all relevant jurisdictions.
1.2 Objectives. The specific objectives of this PIA Framework are as follows:
1.2.1 Identify and Mitigate Privacy Risks. The Framework provides a systematic process for identifying and assessing risks to the privacy interests of consumers, employees, and other data subjects whose personal information is collected, used, disclosed, or otherwise processed by any Covered Entity. Through the risk-identification and mitigation methodology described in Sections 4.5 and 4.6 below, the Framework ensures that each proposed processing activity is evaluated for the likelihood and severity of potential harms, and that appropriate mitigation measures are implemented to reduce those risks to an acceptable level before processing commences.
1.2.2 Ensure Multi-State Statutory Compliance. As of the date of this Framework, Cascade's operations trigger the applicability of nineteen (19) US state privacy statutes, each imposing distinct (though frequently overlapping) obligations on the collection, use, sale, sharing, and protection of personal information. These statutes include, without limitation, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("Colorado CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), the Iowa Consumer Data Protection Act ("ICDPA"), the Indiana Consumer Data Protection Act ("INCDPA"), the Tennessee Information Protection Act ("TIPA"), the Montana Consumer Data Privacy Act ("Montana MCDPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Oregon Consumer Privacy Act ("OCPA"), the Delaware Personal Data Privacy Act ("DPDPA"), the New Jersey Data Privacy Act ("NJDPA"), the New Hampshire Data Privacy Act ("NHDPA"), the Nebraska Data Privacy Act ("NDPA"), the Minnesota Consumer Data Privacy Act ("Minnesota MCDPA"), the Maryland Online Data Privacy Act ("MODPA"), the Kentucky Data Privacy Act ("KYDPA"), and any additional statutes enacted or becoming effective through calendar years 2025 and 2026. This Framework is designed to satisfy the compliance requirements applicable to each of these statutes and to be flexible enough to accommodate new legislative developments as they arise.
1.2.3 Comply with Statutory Data Protection Assessment Mandates. Several of the applicable state privacy statutes impose specific, affirmative obligations on controllers to conduct data protection assessments (or equivalent risk assessments) for certain categories of high-risk processing. These statutory mandates include:
(a) CCPA/CPRA (Cal. Civ. Code § 1798.185(a)(15)): Authorizes and directs the California Privacy Protection Agency ("CPPA") to issue regulations requiring businesses whose processing of personal information presents significant risk to consumer privacy to perform regular risk assessments with respect to that processing, and to submit those assessments to the CPPA on a regular basis. Although final rulemaking under this provision remains pending as of the date of this Framework, this Framework is designed to meet the anticipated requirements based on the CPPA's preliminary rulemaking activities and the standards set forth in the existing CCPA regulations.
(b) Virginia VCDPA (Va. Code § 59.1-580): Requires controllers to conduct and document data protection assessments for each of the following activities: (i) the processing of personal data for purposes of targeted advertising; (ii) the sale of personal data; (iii) the processing of personal data for purposes of profiling where such profiling presents a reasonably foreseeable risk of unfair or deceptive treatment, financial injury, physical injury, or other substantial injury to consumers; (iv) the processing of sensitive data; and (v) any processing activities involving personal data that present a heightened risk of harm to consumers.
(c) Colorado CPA (Colo. Rev. Stat. § 6-1-1309): Requires controllers to conduct and document data protection assessments for targeted advertising, the sale of personal data, certain types of profiling, and the processing of sensitive data. Notably, the Colorado CPA requires the controller to identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer, as mitigated by safeguards the controller can employ. Completed assessments must be made available to the Colorado Attorney General upon request in the context of a civil investigation.
(d) Connecticut CTDPA (Conn. Gen. Stat. § 42-520): Imposes data protection assessment requirements analogous to those of the Colorado CPA, covering targeted advertising, sale of personal data, profiling with risk of harm, and the processing of sensitive data.
(e) Other State Statutes: The Texas TDPSA, Oregon OCPA, Delaware DPDPA, New Jersey NJDPA, Montana MCDPA, Tennessee TIPA, Minnesota MCDPA, Maryland MODPA, and other applicable statutes contain analogous assessment provisions, which are captured and addressed by the unified assessment methodology in this Framework.
1.2.4 Embed Privacy-by-Design Principles. The Framework operationalizes the principle of "privacy by design" by requiring that privacy considerations be evaluated and addressed at the inception of a project or processing activity — not after implementation. This approach is consistent with the privacy-by-design requirements expressly stated or implied in multiple applicable statutes, including the Colorado CPA and CTDPA, and reflects best practices endorsed by the Federal Trade Commission ("FTC") and leading data-protection authorities.
1.2.5 Support Corporate Governance Obligations. The PIA Framework is a critical element of Cascade's overall privacy governance structure. It supports the Company's corporate governance obligations by:
(a) Providing a documented, auditable process that enables the Chief Privacy Officer ("CPO") to fulfill oversight and reporting responsibilities as defined in the Privacy Governance Charter, which is expected to be adopted by the Board of Directors on November 13, 2025;
(b) Generating structured risk-assessment data that is summarized in quarterly reports to the Audit & Risk Committee of the Board of Directors, chaired by Director Ellen Marchetti, in accordance with the Committee's charter and the Board's expectations regarding privacy-risk oversight; and
(c) Establishing clear escalation pathways for high-risk and critical-risk findings, ensuring that the Board receives timely notification of processing activities that present material compliance, reputational, or financial risk.
1.2.6 Create a Defensible Compliance Record. The Framework is designed to produce a comprehensive, contemporaneous record of privacy-related decision-making that demonstrates Cascade's good-faith efforts to comply with applicable legal requirements. The importance of maintaining such a record is heightened in light of Cascade's prior regulatory interactions, including the FTC Civil Investigative Demand (File No. 232-0147), which was issued in connection with an investigation of Cascade's data-collection and sharing practices and was closed without further action on April 3, 2024, as well as the informal inquiry from the California Attorney General's office dated February 6, 2024, regarding Cascade's compliance with CCPA opt-out obligations and its sale and sharing of personal information through advertising-technology integrations. Although both of these matters have been resolved without adverse findings, they underscore the need for Cascade to maintain a well-documented compliance program that can withstand regulatory scrutiny.
Section 2: Scope and Applicability
2.1 Covered Entities
This PIA Framework applies to all of the following entities (collectively, the "Covered Entities"):
Each Covered Entity is responsible for complying with this Framework with respect to data-processing activities within its operational scope. Where a processing activity spans multiple Covered Entities (for example, where CDM collects consumer data that is subsequently analyzed by Peakview and used by Cascade Rewards to generate personalized offers), the PIA should be conducted on an integrated basis, capturing data flows across all participating entities.
2.2 Covered Activities — Triggers Requiring a PIA
A Privacy Impact Assessment must be conducted before initiating any of the following activities (each, a "Triggering Activity"). These triggers are intentionally broad to ensure that the Framework captures all processing activities with material privacy implications:
2.2.1 New Products, Services, Features, or Applications. The launch of any new product, service, feature, or application — including mobile applications, website features, in-store technology, and fulfillment-related services — that involves the collection, use, disclosure, or other processing of personal information. This trigger encompasses both consumer-facing products and internal tools or systems that process personal information of consumers, employees, or other data subjects.
2.2.2 Material Changes to Existing Processing Activities. Any material change to an existing data-processing activity, including without limitation: the addition of new categories of personal information to an existing collection; the processing of existing personal information for new purposes not contemplated in the original PIA; changes to data-sharing arrangements (including new recipients or new categories of recipients); changes to data sale or sharing practices (as defined under CCPA/CPRA and equivalent state-law concepts); and changes to the technical infrastructure or storage locations used for processing.
2.2.3 New or Materially Modified Vendor Relationships. The establishment of new, or the material modification of existing, vendor, service-provider, contractor, or other third-party relationships that involve access to, or the processing of, personal information held or controlled by any Covered Entity. This trigger is particularly significant in the context of Cascade's current operational landscape, which includes approximately forty-seven (47) third-party advertising and analytics partners and approximately 3,800 marketplace sellers operating on the CDM platform, many of whom have access to certain categories of consumer personal information in connection with order fulfillment and product delivery.
2.2.4 New Tracking Technologies. The deployment of new cookies, tracking pixels, SDKs, browser fingerprinting technologies, analytics tools, or other tracking or surveillance technologies on any Cascade-owned or operated digital property. As of the date of this Framework, CDM operates twelve (12) categories of tracking technologies on cascade.com and its associated mobile application. Any addition to or material modification of these tracking technologies requires a PIA.
2.2.5 Processing of Sensitive Personal Information. Any new processing of sensitive personal information — including precise geolocation data, payment-card data, financial account information, account login credentials, racial or ethnic origin, religious beliefs, health data, genetic or biometric data, sexual orientation, or citizenship or immigration status — or any changes to the consent mechanisms, opt-in/opt-out processes, or purpose limitations governing the processing of sensitive personal information already collected.
2.2.6 Targeted Advertising, Profiling, and Automated Decision-Making. Any new or materially modified activity involving targeted advertising (as defined under applicable state statutes), profiling (as defined under applicable state statutes), or automated decision-making that produces legal or similarly significant effects on consumers. This trigger is especially relevant to the operations of Peakview Analytics Inc., which currently processes approximately 2.1 billion consumer-event data records per month in connection with behavioral modeling, audience segmentation, and advertising-optimization services.
2.2.7 Sale or Sharing of Personal Information. Any new arrangement, or material modification to an existing arrangement, under which personal information of consumers is sold or shared (as those terms are defined under CCPA/CPRA) or disclosed to third parties for targeted advertising purposes (under the equivalent concepts in VCDPA, Colorado CPA, CTDPA, and other applicable state statutes).
2.2.8 Processing Involving Children or Minors. Any processing activity that involves personal information of individuals known to be under the age of thirteen (13), sixteen (16), or eighteen (18), or that is directed at or reasonably likely to be accessed by children or minors, implicating the Children's Online Privacy Protection Act ("COPPA"), the California Age-Appropriate Design Code Act ("California AADC"), and analogous state-law protections for minors.
2.2.9 Material Changes to Data Retention or Disposal. Any material change to the periods for which personal information is retained or to the methods by which personal information is disposed of, deleted, or de-identified, including changes to the Data Retention & Disposal Schedule.
2.2.10 Geographic Expansion. The expansion of Cascade's operations, customer base, or data-processing activities into new states that triggers the applicability of additional state privacy statutes not previously applicable to the Covered Entities.
2.3 Statutory Mandates for Data Protection Assessments
Certain of the Triggering Activities listed above are subject to specific, affirmative data protection assessment mandates under applicable state privacy statutes. When a PIA is conducted for a Triggering Activity that falls within the scope of one or more of these statutory mandates, the PIA serves as the required data protection assessment under each applicable statute. The following is a summary of the key statutory mandates:
CCPA/CPRA (Cal. Civ. Code § 1798.185(a)(15)). The CCPA/CPRA authorizes the CPPA to adopt regulations requiring businesses whose processing of personal information presents significant risk to consumer privacy or security to perform and submit regular risk assessments. Although final rulemaking under this provision is still pending as of October 2025, the CPPA's preliminary rulemaking proposals indicate that risk assessments will be required for, among other things, the processing of sensitive personal information, the sale and sharing of personal information, and the use of automated decision-making technology. This Framework has been designed to meet the standards anticipated in the forthcoming regulations.
Virginia VCDPA (Va. Code § 59.1-580). The VCDPA requires controllers to conduct and document a data protection assessment for each of the following categories of processing: (a) targeted advertising; (b) sale of personal data; (c) profiling that presents a reasonably foreseeable risk of (i) unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (ii) financial, physical, or reputational injury to consumers; (iii) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; or (iv) other substantial injury to consumers; (d) processing of sensitive data; and (e) any processing that presents a heightened risk of harm to consumers. Each assessment must identify and weigh the benefits that may flow, directly or indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks.
Colorado CPA (Colo. Rev. Stat. § 6-1-1309). The Colorado CPA requires controllers to conduct data protection assessments for the same general categories of processing as the VCDPA. A data protection assessment conducted under the Colorado CPA must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards the controller can employ. Completed assessments must be made available to the Colorado Attorney General upon request in connection with a civil investigation.
Connecticut CTDPA (Conn. Gen. Stat. § 42-520). The CTDPA imposes data protection assessment requirements that are substantially analogous to those of the Colorado CPA, covering the same categories of processing and requiring a similar benefits-versus-risks balancing analysis.
Other State Statutes. The Texas TDPSA (Tex. Bus. & Com. Code § 541.153), the Oregon OCPA (Or. Rev. Stat. § 646A.582), the Delaware DPDPA (Del. Code tit. 6, § 12D-109), the New Jersey NJDPA (N.J. Rev. Stat. § 56:8-173), the Montana MCDPA (Mont. Code Ann. § 30-14-2409), the Tennessee TIPA (Tenn. Code Ann. § 47-18-3309), the Minnesota MCDPA, the Maryland MODPA, and other applicable statutes contain similar data protection assessment mandates, generally tracking the Virginia or Colorado models. In each case, the assessment requirements are satisfied by a PIA conducted in accordance with this Framework.
2.4 Exclusions. The following activities do not trigger a PIA under this Framework:
(a) Purely internal administrative processes that do not involve the collection, use, disclosure, or other processing of personal information of consumers, employees, or other natural persons (e.g., changes to internal budgeting processes, scheduling systems that do not process personal information, or physical facility maintenance);
(b) De minimis changes to existing processing activities that are already covered by a prior PIA, provided that the changes do not materially alter the scope, purpose, data categories, recipients, or risk profile of the processing activity as assessed in the prior PIA. In cases of doubt, the PIA Coordinator or CPO should be consulted to determine whether a new or updated PIA is required; and
(c) Processing of personal information that is fully de-identified in accordance with the standards set forth in the CCPA/CPRA (Cal. Civ. Code § 1798.140(m)) and maintained in a de-identified state with reasonable technical and organizational safeguards, provided that the Covered Entity has made no attempt to re-identify the information and has implemented business processes to prevent inadvertent re-identification.
In all cases, the determination that an activity falls within an exclusion should be documented and retained in the PIA Register as a screening record.
Section 3: Roles and Responsibilities
The effective operation of this PIA Framework depends on the clear assignment of roles and responsibilities across the organization. The following individuals and groups bear specific responsibilities under this Framework:
3.1 Chief Privacy Officer (or Interim CPO)
Diana Polk, Associate General Counsel, currently serving as Interim Chief Privacy Officer, is responsible for overall administration of the PIA program. Ms. Polk's responsibilities include:
(a) Overseeing the PIA process from initiation through approval and post-approval monitoring;
(b) Providing or coordinating the legal analysis required in Sections D through F of the PIA Template;
(c) Reviewing and granting final approval for all completed PIAs classified as Low or Medium risk;
(d) Reviewing High-Risk and Critical-Risk PIAs in coordination with the General Counsel and CISO, as described in Section 4.7 below;
(e) Escalating High-Risk and Critical-Risk findings to the General Counsel and, where warranted, to the Audit & Risk Committee of the Board of Directors; and
(f) Ensuring that quarterly PIA summary reports are prepared for the Audit & Risk Committee and that the PIA program is integrated into the broader privacy governance structure.
It is noted that Cascade intends to recruit and hire a full-time Chief Privacy Officer by the end of Q4 2025. Upon the appointment of a permanent CPO, the responsibilities described herein shall transfer to that individual, and Ms. Polk will resume her role as Associate General Counsel with continuing responsibility for privacy-related legal matters as directed by the CPO and General Counsel.
3.2 General Counsel
Meredith Tanaka, General Counsel of Cascade Retail Holdings Inc., is responsible for reviewing PIAs involving high-risk or critical-risk activities, regulatory-sensitive matters, or matters requiring Board-level reporting. Ms. Tanaka is also responsible for determining when outside counsel consultation is necessary and for managing the attorney-client privilege protections applicable to PIAs prepared at the direction of legal counsel.
3.3 Project / Product Owner (Requestor)
The business-unit leader or project manager proposing the new processing activity (the "Requestor") bears primary responsibility for initiating the PIA process. Specifically, the Requestor is responsible for:
(a) Completing the Threshold Screening Questionnaire (Appendix A) to determine whether a full PIA is required;
(b) Completing Sections A through C of the PIA Template (Project Overview, Data-Flow Description, and Legal Applicability — with support from the Legal/Privacy team on the Legal Applicability section);
(c) Providing accurate and complete descriptions of the proposed processing activity, including data-flow diagrams and technical architecture documentation;
(d) Implementing all approved mitigation measures within the timelines specified in the PIA; and
(e) Promptly notifying the PIA Coordinator and CPO of any material changes to the processing activity that may require an update to the PIA.
3.4 Chief Information Security Officer (CISO)
Gregory Farris, Chief Information Security Officer, is responsible for reviewing and approving the security-controls section of each PIA. Mr. Farris assesses the technical risks associated with each proposed processing activity, evaluates the adequacy of proposed technical safeguards, and provides recommendations for additional security measures where appropriate. Mr. Farris's sign-off is required for all PIAs classified as High-Risk or Critical-Risk.
3.5 VP, Data & Analytics
Priya Nandakumar, Vice President of Data & Analytics, provides data-flow and data-architecture input for each PIA. Ms. Nandakumar is responsible for validating the accuracy of data-mapping information provided by the Requestor, identifying data-flow connections across Covered Entities, and confirming the completeness of data-source and data-recipient descriptions. Ms. Nandakumar's team maintains the master data inventory and data-flow maps that serve as foundational inputs to the PIA process.
3.6 VP, Marketing & Customer Engagement
Jason Leclaire, Vice President of Marketing & Customer Engagement, is a required reviewer for any PIA involving advertising technology, marketing analytics, loyalty-program data (including Cascade Rewards), consumer-engagement features, or any other processing activity that intersects with Cascade's marketing and customer-relationship operations. Mr. Leclaire is responsible for ensuring that the business objectives described in the PIA accurately reflect the marketing team's intended use of personal information and for validating that proposed mitigation measures are operationally feasible within the marketing function.
3.7 Outside Counsel
Calderwood & Harkness LLP (Kevin Ostrowski, Partner; Alan Burke, Senior Associate; Sara Hendricks, Associate) serves as outside counsel for privacy and data-security matters and is available for consultation on PIAs involving novel legal questions, high-risk processing activities, or activities with regulatory precedent or heightened enforcement risk. Calderwood & Harkness's involvement in the PIA process is coordinated through the General Counsel's office. For PIAs classified as Critical-Risk, consultation with Calderwood & Harkness is required.
Whitfield Greaves LLP (Carolyn J. Marsden, Partner) is separately engaged as Cascade's securities-law counsel and may be consulted on the SEC-disclosure implications of processing activities or privacy incidents identified through the PIA process, where such activities or incidents could be material to Cascade's public disclosures or risk profile.
3.8 Technical Implementation Partner
Fieldhaven Consulting Group LLC (Marcus Ellerby, Engagement Lead) serves as Cascade's technical implementation partner for the data-mapping tool, consent-management platform ("CMP"), and data-subject-request ("DSR") automation system. Fieldhaven may be consulted on the technical feasibility of mitigation measures identified in PIAs that involve technology deployments within the scope of Fieldhaven's Statement of Work. Fieldhaven's role is advisory; it does not have approval authority over any PIA.
3.9 PIA Coordinator
A designated individual within the Legal/Privacy team (to be appointed by the CPO) serves as the PIA Coordinator, with the following responsibilities:
(a) Maintaining the PIA Register (described in Section 5 below), including logging all new PIA initiations, tracking completion status, and recording approvals;
(b) Assigning unique PIA tracking numbers to each new assessment;
(c) Routing completed PIA Templates to the appropriate reviewers and approvers based on the risk classification;
(d) Monitoring target completion dates and following up with Requestors and reviewers to ensure timely completion;
(e) Preparing quarterly PIA summary reports for the CPO and the Audit & Risk Committee; and
(f) Coordinating the annual review cycle for previously completed PIAs.
Section 4: PIA Process — Step-by-Step Methodology
This Section describes the eight-step methodology for conducting a Privacy Impact Assessment under this Framework. Each step is designed to build upon the prior step, producing a comprehensive, documented assessment that satisfies the requirements of all applicable state privacy statutes and supports Cascade's internal governance objectives.
4.1 Step 1: Threshold Screening
The PIA process begins with a brief threshold screening to determine whether a proposed activity triggers the requirement for a full PIA. The Threshold Screening Questionnaire, attached as Appendix A to this Framework, consists of ten questions designed to identify whether the proposed activity involves any of the Triggering Activities described in Section 2.2 above.
The Requestor is responsible for completing the Threshold Screening Questionnaire and submitting it to the PIA Coordinator. The screening criteria are aligned with the Triggering Activities listed in Section 2.2, and the questionnaire is designed to be completed quickly — typically within fifteen to thirty minutes — by a business-unit leader or project manager with knowledge of the proposed activity.
If the screening indicates that no Triggering Activity is present (i.e., all answers to the screening questions are "No"), the PIA Coordinator documents the screening result and retains it in the PIA Register. No further action is required, and the proposed activity may proceed without a full PIA, subject to the Requestor's obligation to notify the PIA Coordinator if the nature of the activity changes in a manner that would alter the screening result.
If the screening indicates that one or more Triggering Activities are present (i.e., one or more answers to the screening questions are "Yes"), the Requestor must proceed to Step 2 and initiate a full PIA using the PIA Template set forth in Part II of this document.
4.2 Step 2: PIA Initiation
Upon determination that a full PIA is required, the Requestor completes Sections A through C of the PIA Template. These sections capture the foundational information necessary for the assessment:
• Section A (Project / Activity Overview): The Requestor provides a narrative description of the proposed processing activity, including the business justification, the anticipated launch or implementation date, and an indication of whether the activity is new or represents a material change to an existing activity.
• Section B (Data-Flow Description): The Requestor, with input from the VP, Data & Analytics (Priya Nandakumar) and the CISO (Gregory Farris), documents the categories of personal information involved, the sources and recipients of that information, data-storage locations, retention periods, and disposal methods. A data-flow diagram is attached to the completed template.
• Section C (Legal Applicability Analysis): With assistance from the Legal/Privacy team, the Requestor identifies the applicable state privacy statutes and answers a series of questions regarding the legal characterization of the processing (e.g., whether it constitutes a "sale," "sharing," "targeted advertising," or "profiling" under applicable statutes).
Upon completion of these sections, the PIA is assigned a unique tracking number by the PIA Coordinator. The PIA Coordinator logs the assessment in the PIA Register and assigns a target completion date. For standard PIAs (involving processing activities of moderate complexity), the target completion date is generally fifteen (15) business days from the date of initiation. For complex PIAs (involving novel processing activities, multiple Covered Entities, high volumes of data subjects, or significant regulatory considerations), the target completion date is generally thirty (30) business days from the date of initiation.
4.3 Step 3: Data-Flow Mapping and Analysis
Step 3 involves a detailed analysis of the data flows associated with the proposed processing activity. The Requestor, in coordination with the VP, Data & Analytics (Priya Nandakumar) and the CISO (Gregory Farris), documents the following information in the PIA Template:
Categories of Personal Information. The categories of personal information involved in the processing activity are identified and classified using the CCPA/CPRA category taxonomy, which includes: identifiers (e.g., name, email address, IP address, device identifiers); commercial information (e.g., purchase history, browsing history, product preferences); internet or other electronic network activity information (e.g., browsing behavior, search queries, interaction with advertisements); geolocation data (specifying whether precise or approximate); audio, electronic, visual, or similar information; professional or employment-related information; education information; inferences drawn from the foregoing categories; and sensitive personal information (e.g., precise geolocation, financial account information, account login credentials, racial or ethnic origin, health data, biometric data).
Sources of Personal Information. The sources from which personal information is obtained are identified, including: direct collection from data subjects (e.g., through account registration, order placement, customer-service interactions); collection from third-party sources (e.g., data brokers, advertising partners); derivation or inference from other data (e.g., behavioral models generated by Peakview); collection from marketplace sellers or business partners; and any other sources.
Purposes of Processing. The specific purposes for which the personal information will be processed are documented, with reference to the legal basis for each purpose under applicable state statutes.
Recipients and Categories of Recipients. All recipients of the personal information are identified, including: internal business units within the Covered Entities; service providers and processors (with an indication of whether a Data Processing Agreement is in place); contractors (with an indication of DPA status); third parties (as defined under CCPA/CPRA); advertising and analytics partners (with a notation of whether the arrangement constitutes a "sale" or "sharing" of personal information); and government or regulatory bodies (where applicable).
Cross-Entity and Cross-Partner Data Flows. Where personal information flows across multiple Covered Entities (e.g., from CDM to Peakview for analytics processing, or from Cascade Rewards to CDM for personalized offer delivery) or to external partners (e.g., from CDM to Thornbridge Media Group or other advertising partners), those flows are documented with specificity, including the legal basis for each transfer.
Data Retention and Disposal. The applicable retention period for the personal information is documented, with a cross-reference to the Data Retention & Disposal Schedule. The method of disposal upon expiration of the retention period (e.g., secure deletion, anonymization, de-identification) is also documented.
Security Measures. The technical and organizational security measures that will be applied to protect the personal information during processing, storage, and transmission are documented, including but not limited to: encryption (at rest and in transit), access controls, multi-factor authentication, data segmentation, role-based access controls, intrusion-detection systems, and security monitoring.
4.4 Step 4: Legal Analysis — Necessity and Proportionality
Step 4 involves a substantive legal analysis of the proposed processing activity, conducted by the Legal/Privacy team (the CPO or designee, with outside counsel consultation as needed). This analysis is documented in Sections D through F of the PIA Template.
Necessity Assessment (Section D). The Legal/Privacy team assesses whether the proposed processing is necessary for the stated business purpose. This analysis considers whether the business purpose can be achieved with less personal information, with less sensitive categories of personal information, or through alternative means that present fewer privacy risks. The assessment includes an evaluation of data-minimization measures that have been or will be applied, and a confirmation that the personal information will be used only for the stated purpose(s) and not for incompatible secondary purposes.
Proportionality Assessment (Section E). The Legal/Privacy team conducts a proportionality analysis, weighing the benefits of the processing against the potential risks to consumer privacy. This analysis is specifically required by several applicable state statutes, most notably the Colorado CPA (§ 6-1-1309), which mandates that the assessment identify and weigh the benefits that may flow, directly or indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer, as mitigated by safeguards the controller can employ. The analysis considers benefits to Cascade (e.g., revenue generation, operational efficiency, competitive advantage), benefits to consumers (e.g., improved product recommendations, enhanced user experience, loyalty rewards), benefits to other stakeholders and the public (e.g., fraud prevention, marketplace safety), and the potential risks to consumers (e.g., risk of re-identification, unauthorized disclosure, discrimination, loss of autonomy, financial harm, reputational harm).
Statutory Compliance Analysis (Sections C through F). The legal analysis encompasses the identification of all applicable state statutes and specific compliance requirements, using the Multi-State Privacy Law Applicability Matrix as a reference tool. The analysis addresses:
(a) Whether the processing constitutes "sale," "sharing," "targeted advertising," or "profiling" under applicable statutes, and the specific obligations triggered by each such classification;
(b) Consent requirements applicable to the processing, particularly for sensitive personal information (including the opt-in consent requirements under CCPA/CPRA § 1798.121, VCDPA, Colorado CPA, and analogous statutes);
(c) Consumer-rights implications, including the impact of the processing on consumers' ability to exercise their rights to access, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and appeal adverse decisions;
(d) Whether the processing involves data of known children (under 13) or minors (under 16 or under 18), implicating COPPA, the California AADC, and analogous state-law requirements; and
(e) Whether specific data protection assessment requirements under applicable statutes are triggered by the processing, and whether the PIA as completed satisfies those requirements.
4.5 Step 5: Risk Identification and Assessment
Step 5 involves a systematic identification and assessment of the privacy risks associated with the proposed processing activity. The risk assessment is documented in Section G of the PIA Template using a structured risk matrix.
For each identified risk, the assessor records the following:
• Risk Description: A clear, specific description of the risk.
• Risk Category: Classification of the risk into one or more of the following categories: (i) unauthorized access, disclosure, or data breach; (ii) non-compliance with applicable state privacy statutes (including the risk of enforcement action, civil penalties, and private right of action where available under statute, such as the CCPA's private right of action for data breaches under § 1798.150); (iii) inadequate consumer-rights fulfillment (referencing Cascade's current DSR volume of approximately 38,400 requests annually and the target response time of fifteen (15) business days or less); (iv) regulatory scrutiny (noting Cascade's prior FTC and California AG inquiries and the heightened risk of enforcement attention for companies with prior regulatory interactions); (v) reputational harm (including media coverage, consumer backlash, and brand-trust erosion); (vi) financial exposure (including potential fines, settlement costs, litigation expenses, and impact on Cascade's cyber/privacy-liability insurance policy with Northcastle Indemnity Company, which provides coverage of $25 million per occurrence and $50 million annual aggregate); and (vii) discrimination or unfair treatment of consumers through profiling or automated decision-making.
• Likelihood: An assessment of the likelihood that the risk will materialize, rated as Low, Medium, or High.
• Severity: An assessment of the severity of the harm that would result if the risk materializes, rated as Low, Medium, or High.
• Overall Risk Rating: A composite risk rating derived from the combination of Likelihood and Severity, classified as Low, Medium, High, or Critical, in accordance with the following matrix:
The Overall Risk Rating determines the review and approval pathway for the PIA, as described in Step 7 below.
4.6 Step 6: Mitigation Measures
For each risk identified in Step 5, the assessor documents proposed mitigation measures in Section H of the PIA Template. Mitigation measures should be specific, actionable, and assigned to a responsible party with a defined implementation timeline.
The categories of mitigation measures to be considered include:
Technical Controls. Encryption (at rest and in transit), access controls, multi-factor authentication, data minimization (including the collection of only those data elements strictly necessary for the stated purpose), pseudonymization, data segregation, and role-based access controls. The assessment should specifically address the known gap identified in the Comprehensive Gap-Analysis Report regarding the commingling of marketplace seller data and first-party consumer data within certain CDM database environments. Where applicable, technical controls should be designed to remediate this commingling issue and to ensure that personal information is logically or physically segregated by source, purpose, and entity.
Organizational Controls. Privacy policies and procedures, employee training, vendor management processes, and internal audit mechanisms. These controls should reference the applicable provisions of Cascade's Internal Privacy Policy & Procedures Manual and the Employee Privacy Training Program.
Consent Mechanisms. Opt-in consent for the processing of sensitive personal information, opt-out mechanisms for the sale or sharing of personal information (including recognition of the Global Privacy Control signal), and other consent mechanisms as required by applicable statutes. These mechanisms should be implemented through the OnPoint Data Solutions consent-management platform ("CMP") currently being deployed by Fieldhaven Consulting Group.
Consumer-Rights Workflow Integration. Ensuring that the DSR automation system (also being implemented by Fieldhaven) is configured to cover the new processing activity, so that consumers can effectively exercise their rights to access, delete, correct, and opt out in connection with the personal information processed under the new activity.
Vendor Contractual Protections. Execution of Data Processing Agreements with all service providers, contractors, and processors using the master DPA templates developed as part of the Program. Contractual provisions should include audit rights, sub-processor controls, data-return and deletion obligations upon termination, and breach-notification requirements.
Data Minimization and Retention Limitations. Limiting the collection of personal information to what is strictly necessary for the stated purpose, and applying retention periods consistent with the Data Retention & Disposal Schedule. Where applicable, the assessment should consider whether shorter retention periods, automatic purging, or progressive de-identification can be implemented to reduce the risk profile.
Privacy-Enhancing Technologies. Where appropriate, the use of differential privacy, federated learning, synthetic data, tokenization, or other privacy-enhancing technologies to reduce the identifiability of processed data while preserving analytical utility.
After documenting all mitigation measures, the assessor conducts a residual risk assessment — an evaluation of the remaining risk after all proposed mitigation measures have been implemented. The residual risk rating is recorded in the mitigation table in Section H and is used to determine the final Overall PIA Risk Rating in Section I.
4.7 Step 7: Review and Approval
The review and approval process for each PIA is determined by the Overall PIA Risk Rating (after mitigation), as follows:
Standard PIAs (Low or Medium Overall Risk Rating). PIAs with a Low or Medium residual risk rating following mitigation are reviewed and approved by the Chief Privacy Officer (Diana Polk, interim) or her designee. The CPO or designee reviews the PIA for completeness, accuracy, and adequacy of mitigation measures, and records the approval in Section I of the template.
High-Risk PIAs. PIAs with a High residual risk rating are reviewed by the CPO and the General Counsel (Meredith Tanaka). The CISO (Gregory Farris) must provide sign-off on the adequacy of security measures. Consultation with outside counsel (Calderwood & Harkness LLP) is recommended for High-Risk PIAs, particularly where the processing involves regulatory-sensitive activities or novel legal questions. Both the CPO and the General Counsel must approve the PIA, and their approvals are recorded in Section I.
Critical-Risk PIAs. PIAs with a Critical residual risk rating are reviewed by the CPO, the General Counsel, and the CISO. Consultation with outside counsel (Calderwood & Harkness LLP) is required. A summary of the PIA findings, risk assessment, and proposed mitigation measures is reported to the Audit & Risk Committee of the Board of Directors (chaired by Director Ellen Marchetti) at the next quarterly meeting or, if the urgency of the matter warrants, through an interim report to the Committee Chair. All three reviewers (CPO, General Counsel, and CISO) must approve the PIA, and their approvals are recorded in Section I.
In all cases, the approval is recorded in Section I of the PIA Template, including the name and title of each approver, the date of approval, and any conditions attached to the approval. If the PIA results in a determination that the proposed processing activity should not proceed — either because the risks cannot be mitigated to an acceptable level, because the processing cannot be made compliant with applicable law, or because the costs of mitigation outweigh the business benefits — that determination is documented in Section I with a detailed rationale. The Requestor is notified of the determination, and the processing activity may not be implemented.
4.8 Step 8: Implementation and Monitoring
Upon PIA approval, the Requestor is authorized to proceed with the implementation of the proposed processing activity, subject to the following conditions:
Pre-Launch Conditions. Any conditions of approval specified in Section I of the PIA Template must be satisfied and documented before the processing activity goes live. The PIA Coordinator confirms that all conditions have been met and records the confirmation in the PIA Register.
Post-Implementation Monitoring. The approved PIA is not a static document. The Requestor and the PIA Coordinator are responsible for monitoring the processing activity on an ongoing basis to ensure that it continues to operate within the parameters assessed in the PIA. The PIA must be revisited and updated under the following circumstances:
(a) Material Changes. If material changes occur to the processing activity — including changes to data categories, purposes, recipients, data volumes, technical infrastructure, or risk profile — the Requestor must notify the PIA Coordinator, and the PIA must be updated to reflect the changed circumstances. Depending on the nature and extent of the changes, the CPO may determine that a new PIA is required.
(b) Annual Review. At least annually, as part of the annual privacy-program assessment cycle, all active PIAs are reviewed to confirm that the underlying processing activities remain within the assessed parameters and that the risk ratings and mitigation measures remain appropriate. The first annual review cycle is scheduled for completion by June 30, 2026.
(c) Legislative Changes. Upon the enactment of new or amended state privacy statutes that affect the legal analysis or compliance requirements applicable to the processing activity, the PIA must be updated to reflect the new legal landscape.
The results of all monitoring activities, reviews, and updates are documented as addenda to the original PIA and are maintained in the PIA Register.
Section 5: PIA Register and Recordkeeping
5.1 Central PIA Register
The PIA Coordinator maintains a central PIA Register that serves as the master record of all PIA activity across the Covered Entities. The Register is maintained in a secure, access-controlled electronic format and contains the following fields for each entry:
5.2 Retention Requirements
Completed PIAs, including all supporting documentation, data-flow diagrams, risk matrices, mitigation plans, and approval records, are retained for a minimum of five (5) years from the date of completion or the date on which the processing activity that is the subject of the PIA ceases, whichever is later. This retention period is designed to satisfy the longest applicable statutory retention requirement and to ensure that records are available for regulatory inquiries, litigation, or internal audit purposes.
5.3 Regulatory Availability
PIAs conducted under this Framework must be made available to state attorneys general upon lawful request, as required by, among other statutes, Colorado CPA § 6-1-1309, Connecticut CTDPA § 42-520, Virginia VCDPA § 59.1-580, and equivalent provisions in other applicable state statutes. Any request from a state attorney general or other regulatory authority for access to a PIA should be immediately forwarded to the General Counsel and outside counsel (Calderwood & Harkness LLP) for evaluation and response.
5.4 Privilege Protection
PIAs prepared under this Framework are confidential business records. To the extent that a PIA is prepared at the direction of or in consultation with legal counsel (whether in-house counsel or outside counsel), it is subject to protection under the attorney-client privilege and/or the work-product doctrine. All PIAs prepared with legal-counsel involvement should be marked "CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT" and should be treated in accordance with Cascade's privilege-protection protocols. The involvement of legal counsel in the PIA process should be documented to support privilege claims, and PIAs should not be shared with third parties outside the scope of the privilege without prior approval from the General Counsel.
Section 6: Integration with Related Compliance Program Elements
The PIA Framework does not operate in isolation. It is designed to function as an integrated component of Cascade's comprehensive US State Privacy Compliance Program. This Section identifies the key cross-references between the PIA Framework and other elements of the Program.
Internal Privacy Policy & Procedures Manual. The PIA Framework is referenced in, and should be read in conjunction with, Cascade's Internal Privacy Policy & Procedures Manual (dated October 2025), which establishes the overarching privacy policies and procedures governing the collection, use, disclosure, and protection of personal information across the Covered Entities. The Procedures Manual addresses topics including data classification, data handling, incident response, employee privacy obligations, and vendor management, all of which inform the PIA process.
Data Retention & Disposal Schedule. The Data Retention & Disposal Schedule (dated October 2025) establishes the retention periods and disposal methods applicable to each category of personal information processed by the Covered Entities. PIAs should cross-reference the Schedule to ensure that the retention periods and disposal methods documented in the PIA Template are consistent with the Schedule.
Data Subject Request (DSR) Standard Operating Procedures. The DSR Standard Operating Procedures (effective December 1, 2025) establish the workflows and timelines for receiving, verifying, processing, and responding to consumer rights requests under applicable state privacy statutes. PIAs should confirm that the DSR automation system is configured to support the exercise of consumer rights in connection with any new processing activity assessed under the PIA Framework.
Multi-State Privacy Law Applicability Matrix. The Multi-State Privacy Law Applicability Matrix (dated June 30, 2025) identifies the nineteen (19) state privacy statutes currently applicable to Cascade's operations and maps the specific requirements of each statute to the Covered Entities' processing activities. The Matrix is used as a reference tool during the Legal Applicability Analysis (Section C of the PIA Template) to ensure that all applicable statutory requirements are identified and addressed.
Third-Party Vendor DPA Rollout Plan. For PIAs involving new or modified vendor relationships, the Third-Party Vendor DPA Rollout Plan Memorandum (dated September 30, 2025) provides the schedule and priorities for executing Data Processing Agreements with Cascade's service providers, contractors, and other third parties. PIAs should confirm that the relevant vendor has executed (or is on schedule to execute) a DPA using the applicable master template.
Consumer-Facing Privacy Notices. PIAs should evaluate whether the proposed processing activity requires updates to any of Cascade's consumer-facing privacy notices, including the Omnibus Privacy Policy (dated September 12, 2025), the California-Specific Privacy Disclosures Addendum (dated September 12, 2025), the State-Specific Consumer Rights Supplement (dated September 12, 2025), and the Cookie & Tracking-Technology Notice (dated September 12, 2025). If updates are required, the PIA should note the specific changes needed and assign responsibility for implementing those changes.
Employee Privacy Training Program. All personnel with responsibilities under this PIA Framework — including Requestors, the PIA Coordinator, and members of the Legal/Privacy team — should receive training on their PIA obligations as part of the Employee Privacy Training Program (materials to be finalized Q4 2025). The training should cover the purpose and scope of the PIA Framework, the step-by-step methodology, the Threshold Screening Questionnaire, and the PIA Template.
Fieldhaven Consulting Group — Technical Implementations. The data-mapping tool, consent-management platform (OnPoint Data Solutions CMP), and DSR automation system being implemented by Fieldhaven Consulting Group LLC are foundational technical components that support the PIA process. Technical PIAs for the implementation of these tools should themselves be documented under this Framework, as each involves the processing of personal information and the deployment of new technology.
Section 7: Regulatory Considerations and Guidance
7.1 Summary of Key State-Law Assessment Mandates
As described in Section 2.3 above, multiple state privacy statutes impose affirmative obligations on controllers to conduct data protection assessments for certain categories of processing. The following table provides a summary of the key provisions, with statutory citations:
7.2 Unified Assessment Approach
PIAs completed under this Framework are designed to satisfy the overlapping assessment requirements across multiple state statutes simultaneously. Rather than conducting separate assessments for each jurisdiction, the unified PIA Template incorporates the most protective standards from across all applicable statutes, ensuring that a single, comprehensive assessment satisfies the requirements of every applicable law. This approach reduces duplication, streamlines compliance efforts, and ensures consistency in Cascade's privacy risk-management practices.
7.3 Benefits-Versus-Risks Balancing
Several applicable statutes — most notably the Colorado CPA and the VCDPA — require that the data protection assessment include a specific "balancing" or "weighing" analysis in which the benefits of the processing are weighed against the potential risks to consumers. The Proportionality Assessment (Section E of the PIA Template) is designed to satisfy this requirement. When completing Section E, the assessor should ensure that the analysis:
(a) Identifies the benefits of the processing to the controller (Cascade), to the consumer, to other stakeholders, and to the public;
(b) Identifies the potential risks of the processing to the rights of the consumer, including but not limited to the risk of re-identification, unauthorized disclosure, discrimination, loss of autonomy, financial harm, and reputational harm;
(c) Considers the safeguards and mitigation measures that the controller can employ to reduce those risks; and
(d) Reaches a documented conclusion as to whether the processing, as proposed or as mitigated, is proportionate — i.e., whether the benefits justify the risks in light of the available safeguards.
This balancing analysis should be conducted in good faith and with sufficient specificity to demonstrate that the controller has genuinely engaged with the privacy implications of the processing, rather than treating the assessment as a mere formality.
7.4 Anticipated CPPA Rulemaking
As of the date of this Framework, the California Privacy Protection Agency ("CPPA") has not yet finalized regulations implementing the risk-assessment mandate under CCPA/CPRA § 1798.185(a)(15). However, the CPPA has issued preliminary rulemaking proposals and has convened public forums indicating that the forthcoming regulations will likely require risk assessments for, among other things, the processing of sensitive personal information, the sale and sharing of personal information, and the use of automated decision-making technology. This Framework will be updated as necessary upon the issuance of final CPPA regulations to ensure continued compliance with California law.
7.5 Cascade's Regulatory History