Best Buy Fiscal Year 2022 ESG Report | 91 Data privacy and security . Data privacy. Best Buy’s purpose is to enrich lives through technology, and we only collect, use or share personally identifiable information for that purpose. We also take steps to ensure that consumers can actively engage with us concerning their privacy. For example, the California Consumer Privacy Act (CCPA) grants California consumers a set of personal information options, including asking for access to the information a business has collected about the consumer or to delete certain information. Best Buy has extended the availability of these personal information options to all Americans. Consumers can learn more about our privacy practices on our dedicated Privacy pages on BestBuy.com. Employee training. All Best Buy employees participate in our Valuable Information Protection (VIP) training and awareness program. VIP comprises traditional online training, engagement activities, and targeted training for specific roles based on responsibilities and risk level. We update VIP content continuously to reflect current security and privacy challenges. For example, we recently held a “phishing tournament” to increase employee awareness on how to identify and report phishing emails and the associated risks such as ransomware. ! ! 0 2 5 1 ! ! ! ! ? ? ? ? ? ? ? ?