Company: ICUI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000883984-25-000007
Chunk: 141

Company: ICU MEDICAL INC/DE
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 141
---
 or health data, which could limit our ability to collect, use and share personal data, or could cause our compliance costs to increase, ultimately having an adverse impact on our business. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the European Economic Area, or the EEA, and the United States remains uncertain. Case law from the Court of Justice of the European Union (“CJEU”) states that reliance on the standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must now be assessed on a case-by-case basis. On July 10, 2023, the European Commission adopted its Adequacy Decision in relation to the new EU-US Data Privacy Framework (“DPF”), rendering the DPF effective as a GDPR transfer mechanism to U.S. entities self-certified under the DPF. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue as supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or start taking enforcement action. In particular, we expect the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. We could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the 

28

manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Further, from January 1, 2021, companies have to comply with the GDPR and also the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, e.g. fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government), as a data transfer mechanism from the UK to U.S. entities self-certified under the DPF. As we continue to expand