Company: BLCO
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001860742-25-000004
Chunk: 241

Company: Bausch & Lomb Corp
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 241
---
 GDPR), whichever is greater. European data protection authorities may interpret the GDPR and national laws differently and impose additional requirements, which contributes to the complexity of processing personal data in or from the European Economic Area or UK. Guidance on implementation and compliance practices is often updated or otherwise revised. These laws require data controllers to implement stringent operational requirements, including, for example, transparent and expanded disclosure to data subjects about how their personal data is collected and processed, grant rights for data subjects to access, delete or object to the processing of their data, mandatory data breach notification requirements (and in certain cases, affected individuals), set limitations on retention of information and outline significant 

48

documentary requirements to demonstrate compliance through policies, procedures, training and audits. The GDPR also provides that EU member states may introduce further conditions, including limitations, and make their own laws and regulations, further limiting the processing of ‘special categories of personal data,’ including personal data related to health, biometric data used for unique identification purposes and genetic information, which could limit our ability to collect, use and share EU data, and could cause our compliance costs to increase, ultimately having an adverse impact on our business, and harm our business and financial condition.The withdrawal of the UK from the European Union also has created uncertainty with regard to the regulation of data protection in the UK. Since January 1, 2021, when the transitional period following Brexit expired, we have been required to comply with the GDPR as well as the UK GDPR (combining the GDPR and the UK’s Data Protection Act of 2018), which exposes us to two parallel regimes, each of which authorizes similar fines and may subject us to increased compliance risk based on differing, and potentially inconsistent or conflicting, interpretation and enforcement by regulators and authorities (particularly, if the laws are amended in the future in divergent ways). With respect to transfers of personal data from the EEA, on June 28, 2021, the European Commission issued an adequacy decision in respect of the UK’s data protection framework, enabling data transfers from EU member states to the UK to continue without requiring organizations to put in place contractual or other measures in order to lawfully transfer personal data between the territories. While it is intended to last for at least four years, the European Commission may unilaterally revoke the adequacy decision at any point, and if this occurs, it could lead to additional costs and increase our overall risk exposure.In the EU, we are also subject to the new European Union Artificial Intelligence Act (the “EU AI Act