Company: PLSAY
Filing Date: 2025-05-09
Form Type: 20-F
Source: 0001884082-25-000012
Chunk: 50

Company: Polestar Automotive Holding UK PLC
Filing Date: 2025-05-09
Form: 20-F
Item: Item 3
Chunk 50
---
 European Union on 31  January 2020 the United Kingdom now has its own data privacy regime comprised of the United Kingdom General Data Protection Regulation and Data Protection Act 2018 (collectively, the “ UK GDPR”) (the GDPR and UK GDPR together referred to as the “ GDPR”) and California adopted the California Consumer Privacy Act of 2018 (“ CCPA”), which became effective in January 2020. Both the GDPR and the CCPA impose additional obligations on companies regarding the handling of personal data and provides certain privacy rights to individual persons whose data is collected. Compliance with existing, proposed and recently enacted laws and regulations (including implementation of the privacy and process

enhancements called for under the GDPR and CCPA) can be costly, and any failure to comply with these regulatory standards could subject Polestar to legal and reputational risks.

The GDPR imposes comprehensive data privacy compliance obligations in relation to Polestar’s collection, processing, sharing, disclosure, transfer and other use of personal information, including a principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit. The GDPR also regulates cross-border transfers of personal information out of the EEA and the UK. Recent legal developments in Europe have created complexity and uncertainty regarding such transfers, in particular in relation to transfers to the United States, and recent European court and regulatory decisions have taken a restrictive approach. Polestar currently relies on the standard contractual clauses and definition of supplementary measures, where applicable and available, or derogations, to transfer personal information outside the EEA and the UK, with respect to both intragroup and third party transfers. As the enforcement landscape further develops, and supervisory authorities issue further guidance on international data transfers, Polestar could suffer additional costs, complaints and/or regulatory investigations or fines; Polestar may have to stop using certain tools and vendors and make other operational changes; and/or it could otherwise affect the manner in which Polestar provides its services, and could adversely affect Polestar’s business, operations and financial condition.

Since Polestar is subject to the supervision of relevant data protection authorities under both the GDPR and the UK GDPR, Polestar could be fined under each of those regimes independently in respect of the same breach. Penalties for certain breaches are up to the greater of EUR 20 million/GBP 17.5 million or 4% of Polestar’s global annual turnover. In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease/change Polestar’s data processing activities,