Company: PRMB
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0002042694-25-000003
Chunk: 41

Company: Primo Brands Corp
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 41
---
If we are unable to securely maintain our customers’, associates’, or company private or personal information, including payment card information, or process such information in compliance with applicable laws and regulations, we could be subject to negative publicity, costly compliance obligations, costly government enforcement actions, or private litigation, which could damage our business reputation and negatively affect our results of operations.

The protection of customer, associate, and company data is critical and is an expanding focus of federal, state, and provincial legislatures and regulators in the United States, Canada, and Europe. For example, the California Consumer Privacy Act of 2018, which came into effect in January of 2020, gives California residents additional data privacy rights, including allowing consumers to opt out of certain data sharing with third parties, and provides an additional cause of action for data breaches. Moreover, the California Privacy Rights Act, which went into effect on January 1, 2023, significantly modified the California Consumer Privacy Act of 2018 (collectively, the “CCPA”), and imposed additional data privacy and protection obligations on certain companies doing business in California. Additionally, the European Union General Data Protection Regulation (the “EU GDPR”) and the United Kingdom General Data Protection Regulation and Data Protection Act 2018 (collectively, the “UK GDPR”) (the EU GDPR and UK GDPR together referred to as the “GDPR”) impose comprehensive data privacy compliance obligations in relation to our collection and other use of data relating to an identifiable living individual, including a principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit, as well as regulating cross-border transfers of personal data out of the European Economic Area and the United Kingdom.

The enactment of the CCPA is prompting a wave of similar legislative developments in other states in the United States, including laws in Virginia, Colorado, Connecticut, Utah, Texas, Montana, Oregon, Delaware, Iowa, New Hampshire, Nebraska, and New Jersey, which creates the potential for a patchwork of overlapping but different state laws. Many other states are currently reviewing or proposing the need for greater regulation of the collection, sharing, use, and other processing of information related to individuals for marketing purposes or otherwise, and there remains increased interest at the federal level as well. Additionally, laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet may be or become applicable to our business, such as the Federal Communications Act, the Electronic Communications Privacy Act, the Telephone Consumer Protection Act,