Company: PERI
Filing Date: 2025-03-25
Form Type: 20-F
Source: 0001178913-25-001021
Chunk: 54

Company: Perion Network Ltd.
Filing Date: 2025-03-25
Form: 20-F
Item: Item 3
Chunk 54
---
 data” – broadly defined as personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. The Washington My Health My Data Act provides a private right of action and, together with the broad definition and scope, is likely to trigger a wave of related litigation. As such, we may be limited with the advertising services we can provide to customers in certain sectors in jurisdictions with such data privacy laws and regulations.
 
The Israeli Privacy Law and its regulations, including but not limited to the Israeli Privacy Protection Regulations (Data Security) 2017 impose obligations regarding processing, transferring and securing of personal data. In addition, in 2023, the Privacy Protection Regulations (Provisions Regarding Information Transferred to Israel from the European Economic Area), 2023 were enacted and consequently provide, in certain cases, additional rights to data subjects from the EEA and Israel. Therefore, significant changes to the PPL and its regulations may necessitate adjustments to our data protection and security practices. Lack of compliance with the PPL and its regulations could result in enforcement actions, litigation (including class actions), fines and penalties. Material amendment to the PPL was approved by the Israeli Parliament in August 2024 and will take effect on August 14, 2025 (“Amendment 13”). Among other things, Amendment 13 expands the Privacy Protection Authority investigation authority and the monetary sanctions that can be imposed for breach of the PPL and its regulations, to substantial amounts that may reach in certain cases millions of NIS.
 
Most of our products and services are provided without direct relationships with users/consumers, therefore, we rely on our data providers, customers or publishers to establish a legal basis required under the applicable data protection and data privacy laws and regulations (for example, to obtain the consent from the user) on our behalf to process their data and to implement any notice or choice mechanisms required under applicable data protection and data privacy laws and regulations, but if our data providers, customers or publishers do not follow this process (and in any event, as the legal requirements in this area continue to evolve and develop), we could be subject to liability.
 
The uncertainty created by these laws and regulations can be compounded when services hosted in one jurisdiction are directed at users in another jurisdiction. For instance, certain data protection and data privacy laws (including the GDPR and Canadian Privacy Law) have an extra-territorial scope causing such laws to potentially govern activities conducted by organizations established in jurisdictions outside of,