Company: GIFLF
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001104659-25-034245
Chunk: 41

Company: Grifols SA
Filing Date: 2025-04-11
Form: 20-F
Item: Item 3
Chunk 41
---
, as amended, and implementing regulations (“HIPAA”) and other data privacy regulations, we have made and continue to make certain operational changes to our business practices. Other governmental authorities throughout the United States and around the world are considering similar types of legislative and regulatory proposals concerning data protection. These privacy, security and data protection laws and regulations could impose increased business operational costs, require changes to our business, require notification to customers or workers of a security breach, or restrict our use or storage of personal information.
For example, health information laws and regulations, such as regulations under HIPAA and potential revisions thereto, include requirements to implement various recordkeeping, operational, notice and other practices intended to safeguard that information, limit its use to allowed purposes and notify affected individuals in the event of privacy and security breaches, establish standards regarding electronic health data transmissions and set rules for specific electronic transactions, such as transactions involving claims submissions to third party payers. Failure to comply with HIPAA and similar state laws could expose us to breach of contract claims, substantial fines, penalties and other liabilities and expenses, costs for remediation and harm to our reputation. Additionally, a U.S. federal privacy bill introduced to the U.S. House of Representatives on July 20, 2022 (and reported by the applicable committee on December 30, 2022), would establish new requirements for how companies handle personal data, including information that identifies or is reasonably linked to an individual, such as our consumers. If this bill becomes law, we may be required to implement certain security practices to protect and secure personal data against unauthorized access, and we may be subject to further requirements for complying with this requirement if any applicable agency issues related regulations.
In the United States and specifically in California, for example, the CCPA generally requires companies, such as us, to institute additional protections regarding the collection, use and disclosure of certain personal information of California residents. The California Attorney General announced the finalization of initial CCPA regulations on August 14, 2020, and two new sets of modifications to CCPA regulations have since been proposed and have completed the required public comment process, although they are still subject to internal review and finalization by the California Attorney General, the timing of which is uncertain. In addition to providing for enforcement by the California Attorney General, the CCPA also provides for a private right of action. Entities in violation of the CCPA may be liable for civil penalties. Significantly, in November 2020 California enacted the California Privacy Rights Act (“CPRA”), effective January