Company: REE
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001628280-25-025661
Chunk: 65

Company: REE Automotive Ltd.
Filing Date: 2025-05-15
Form: 20-F
Item: Item 3
Chunk 65
---
 access to, products, systems, networks and/or physical facilities utilized by REE’s service providers and vendors. There can be no assurance that any security measures that REE or its suppliers and strategic partners have implemented will be effective against current or future security threats.

The global data protection landscape is rapidly evolving, and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. REE may not be able to monitor and react to all developments in a timely manner. For example, the CCPA establishes a privacy framework for covered businesses, including an expansive definition of personal information and data privacy rights for California residents. The CCPA includes a framework with potentially severe statutory damages and private rights of action. The CCPA requires covered businesses to provide new disclosures to California residents, provide them new ways to opt-out of certain disclosures of personal information, and allow for a new cause of action for data breaches. As REE expands its operations, the CCPA may increase REE’s compliance costs and potential liability. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the U. S. Other states have begun to propose similar laws. Compliance with any applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and REE may be required to put in place additional mechanisms to comply with such laws and regulations.

REE publishes privacy policies and other documentation regarding its collection, processing, use and disclosure of personal information and/or other confidential information. Although REE endeavors to comply with its published policies and other documentation, REE may at times fail to do so or may be perceived to have failed to do so. Moreover, despite its efforts, REE may not be successful in achieving compliance if REE’s employees, contractors, service providers or vendors fail to comply with its published policies and documentation. Such failures can subject REE to potential local, state and federal action if they are found to be deceptive, unfair, or misrepresentations of its actual practices. Claims that REE has violated individuals’ privacy rights or failed to comply with data protection laws or applicable privacy notices even if REE is not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm its business.

REE and its suppliers, service providers, and strategic partners are subject to cybersecurity and other risks with respect to each of their respective technology, systems, and software and any material failure, weakness, interruption, cyber event, incident or breach of security in connection with the foregoing could prevent RE