Company: AMWL
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000950170-25-019024
Chunk: 79

Company: American Well Corp
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1
Chunk 79
---
”) limited how organizations could lawfully transfer personal data from the EEA to the United States by invalidating the EU-US Privacy Shield and imposing further restrictions on use of the standard contractual clauses, which could affect our ability to efficiently process personal data from the EEA. The EU-US Privacy Shield has been replaced by an enhanced legal mechanism for data transfer namely the EU-US Data Privacy Framework (“DPF”) and the UK Extension to the DPF. However, the validity of the DPF is likely to be challenged before the CJEU. These obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practices. 

We may have obligations under GDPR’s personal data breach notification requirements. Under the breach notification requirements, notification must be provided to the national data protection authority without undue delay and within 72 hours, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of data subjects. In addition, data controllers must notify affected data subjects without unreasonable delay in the case of a personal data breach that is likely to result in a high risk to their rights and freedoms. GDPR also requires a data processor to notify its data controller clients of breaches by the data processor.  

A violation of the GDPR or UK GDPR could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, assessment notices (for a compulsory audit), and civil claims, including representative actions and other class action-type litigation. Data protection authorities may initiate legal proceedings against data controllers or processors for GDPR violations.  Data subjects have a right to lodge a complaint with the data protection authority and the right to an effective judicial remedy against a controller or processor. GDPR also establishes a right to compensation for damage as result of infringement. Data subjects can mandate a not-for-profit body, organization or association to exercise these remedies and to collect compensation on their behalf. In light of recent enforcement activity, and statements from data protection authorities and the European Data Protection Board, we expect continued enforcement efforts.  

In addition to the GDPR, in Europe we are subject to the Privacy and Electronic Communications Directive (“ePrivacyDirective”) and national implementing legislation in the UK and EU member states. The ePrivacy Directive requires that consent must be obtained to read or write data on a user’s device, for example tracking cookies, except where strictly necessary to provide the service. The ePrivacy Directive also governs unsolicited email and SMS text message marketing.

Outside Europe we are subject to