Company: GHC
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000104889-25-000022
Chunk: 215

Company: Graham Holdings Co
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 215
---
 time they occur, may be deemed material later in the aggregate.

•    Failure to Comply with Privacy Laws or Regulations Could Have an Adverse Effect on the Company’s Businesses.

Various U.S. federal, state and international laws and regulations govern the collection, use, retention, sharing and security of personal data. This area of the law is evolving, and interpretations of applicable laws and regulations differ. Legislative activity in the privacy area may result in new laws that are relevant to the Company’s operations, including restrictions on the collection, use and sharing of personal data that could limit our ability to use the data for marketing or advertising, and could result in exposure to material liability. For example, data privacy regulations adopted by the EU known as the General Data Protection Regulation (GDPR), became effective in May 2018. These regulations require certain of the Company’s operations to meet extensive requirements regarding the handling of personal data, including its use, protection and transfer. In addition, the GDPR provides the legal right for persons whose data is stored to request access to or correction or deletion of their personal data, among other rights. Failure to meet the applicable requirements in the GDPR could result in fines of up to 4% of the Company’s annual global revenues. In addition to the GDPR in Europe, new privacy laws and regulations are rapidly developing and being implemented elsewhere around the globe, including amendments to the scope, penalties and other provisions of existing data protection laws. Failure to comply with these international data protection laws and regulations could have a negative impact on the Company’s reputation and subject the Company to significant fines, penalties or other liabilities or restrict the Company’s ability to continue operating its existing business processes, all of which may increase the cost of operations, reduce customer growth, or otherwise harm the Company’s business.

The California Consumer Privacy Act of 2018 (CCPA), which became effective on January 1, 2020, provided a new private right of action for data breaches and requires companies that process personal information pertaining to California residents to make disclosures to consumers about their data collection, use and sharing practices and allows consumers to opt out of certain data sharing with third parties. The enforcement of the CCPA by the California Attorney General commenced on July 1, 2020. In November 2020, the California Privacy Rights Act (CPRA) was approved by California voters, and went into effect on January 1, 2023. The CPRA included new requirements that were not in the CCPA. Similar privacy laws also went into effect in