Company: ZM
Filing Date: 2025-08-22
Form Type: 10-Q
Source: 0001585521-25-000141
Chunk: 197

Company: Zoom Communications, Inc.
Filing Date: 2025-08-22
Form: 10-Q
Item: Part II, Item 1A
Chunk 197
---
 on businesses collecting or processing biometric information.  For example, Illinois’ Biometric Information Privacy Act (“BIPA”) regulates the collection, use, safeguarding, and storage of biometric information and provides for substantial penalties and statutory damages.  The Federal Trade Commission (“FTC”), has indicated that use of biometric technologies (including facial recognition technologies) may be subject to additional scrutiny. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation, mass arbitration demands, and regulatory attention. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places 

57

additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties.

Laws Outside of the United States

Outside the United States, an increasing number of laws, regulations, and industry standards related to privacy, data protection, and information security may govern. For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing personal information. For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR and 17.5 million pounds sterling under the UK GDPR, or 4% of annual global revenue, in each case, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. China’s PIPL imposes a set of specific obligations on covered businesses in connection with their processing and transfer of personal information and imposes fines of up to RMB 50 million or 5% of the prior year’s total annual revenue of the violator. The Swiss Federal Act on Data Protection (“FADP”), also applies to the