Letter to Lowe’s Requesting Third-Party Human Rights Risk Assessment

February 5, 2026

Mary Beth West
Chair, Sustainability Committee
Board of Directors
c/o Lowe’s Companies, Inc.
1000 Lowes Boulevard
Mooresville, North Carolina 28117

Dear Ms. West:

I am writing to request that the Sustainability Committee commission and oversee an independent third-party human rights risk assessment focused on Lowe’s collection, use, and sharing of license plate and other location-based data, including potential civil rights implications. This request is prompted by recent fatal shootings by U.S. immigration enforcement agents in Minneapolis and media reports highlighting that parking lots of large home improvement retailers—including Lowe’s and its peers—have become focal points for enforcement activity. Such an assessment would support effective oversight, mitigate legal and reputational risk, and help protect long-term shareholder value.

As Comptroller of the City of New York, I serve as investment adviser to, and custodian and a trustee of, the New York City Retirement Systems (“NYC Systems”), which are substantial long-term Lowe’s shareholders. My office maintains a history of productive engagement with the company, most recently regarding the transparency of workforce diversity through the disclosure of the Company’s EEO-1 Report data. I am therefore troubled by recent media reports that Lowe’s is winding down certain LGBTQ+ diversity and inclusion initiatives, and encourage continued EEO-1 disclosure to provide shareholders with transparency and support long-term employee engagement, corporate reputation, and shareholder value.

Lowe’s, as a national retailer, necessarily engages in a range of security and loss-prevention practices that may involve the sharing of information for legitimate security purposes. The Company’s U.S. Privacy Statement confirms that Lowe’s may use Automated License Plate Readers (ALPRs) and collect related data, including vehicle images and location information, and that such information may be disclosed to law enforcement and other government authorities where deemed appropriate or necessary to comply with legal obligations or to protect the rights and safety of the Company and others. Given the sensitive nature of this data and the potential downstream use by third parties, it is critical that Lowe’s actively implements and adheres to its human rights commitments, ensuring these practices do not create unintended risks.

Lowe’s acknowledges in its 2024 Form 10-K that its business, reputation, and long-term value depend on maintaining customer, associate, vendor, and shareholder trust, and that mismanagement or perceived mismanagement of social, environmental, or data-related matters—including diversity and inclusion, cybersecurity, and personal information—can create reputational, operational, and legal risks. Location-based surveillance data implicates these areas and raises human and civil rights considerations, underscoring the importance of independent Board oversight to ensure that Lowe’s practices align with its human rights commitments, protect stakeholder trust, and mitigate potential operational, legal, and reputational risk.

I am encouraged that Lowe’s commitments under its Human Rights Policy align with leading international standards, including the UN Guiding Principles on Business and Human Rights (UNGPs). I am optimistic that the Board’s oversight will ensure these commitments are both implemented and adhered to across the Company’s operations. The UNGPs emphasize that companies should identify and assess not only direct impacts but also potential human rights risks arising from business relationships—particularly where gaps in oversight could expose the company to regulatory, legal, reputational, or customer-trust risks. In the context of location-based or personal data, such risks can arise even when information is initially shared for lawful purposes, including cases where subsequent access or repurposing through inter-agency information-sharing occurs beyond the Company’s original intent.

While Lowe’s has conducted a Double Materiality Assessment to evaluate societal impacts, specific scrutiny of surveillance data is critical. Given the specialized nature of these risks, an independent assessment would provide the Board with the expertise necessary to exercise effective oversight.

Independent, third-party civil and human-rights assessments are increasingly used by large companies to inform board oversight in comparable circumstances. For example, Airbnb and Uber commissioned external assessments to evaluate risks related to civil liberties, human rights, and platform misuse, helping their Boards oversee data-related risks effectively.

These considerations have taken on added urgency in light of reported immigration enforcement actions at large retailers generally, and Lowe’s specifically. Public statements by senior federal officials—including a June 2025 meeting in which a White House official called for more aggressive enforcement at peer Home Depot—underscore that information initially shared with local law enforcement may ultimately be accessed or used by federal immigration authorities, even when such downstream use was not the original intent.

Given heightened public and investor scrutiny of surveillance technologies—such as the Flock Safety cameras reportedly used at Lowe’s locations—and the potential secondary use of personal information by public authorities, I believe it would be prudent for the Board to commission, oversee, and disclose a formal, independent assessment of the human rights implications of these practices.

Such an assessment would provide the Board and shareholders with greater clarity regarding:

• Whether and how license plate or similar location-based data is collected, retained, and shared;
• The categories of third parties with which such data may be shared, including law enforcement, and the Company’s knowledge of or control over downstream use;
• The safeguards, limitations, and oversight mechanisms in place to address potential downstream human rights impacts; and
• How the Board oversees data-related human rights and privacy risks.

I believe an independent human rights risk assessment—and disclosure of its non-proprietary findings and recommendations—would strengthen governance, ensure alignment with the Company’s stated human rights commitments, mitigate reputational and legal risk, and enhance long-term shareholder confidence in the Company. As Chair of the Sustainability Committee, you are responsible for overseeing the Company’s programs, policies, and practices relating to sustainability, environmental, and related social responsibility issues and impacts, and I respectfully urge you to ensure that the Committee fulfills that responsibility by commissioning and supervising this independent assessment.

Thank you for the Board’s consideration. I look forward to your written response. My team is available to discuss the Board’s perspective. To schedule a meeting, please contact Michael Garland, Assistant Comptroller for Corporate Governance and Responsible Investment in the Bureau of Asset Management, at mgarlan@comptroller.nyc.gov.

Sincerely,

New York City Comptroller Mark D. Levine

Mark D. Levine
New York City Comptroller

cc: Board of Directors