Company: ICUI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000883984-25-000007
Chunk: 52

Company: ICU MEDICAL INC/DE
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 52
---
 residents to access, delete, and correct their personal information, or to opt out of certain disclosures of their personal information;, and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf. Additional compliance investment and potential business process changes may be required. Similar laws have passed in other states, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the U.S. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging.  If we fail to comply with applicable laws and regulations we could be subject to penalties or sanctions, including criminal penalties if we knowingly obtain or disclose individually identifiable health information from a covered entity in a manner that is not authorized or permitted by HIPAA or applicable state laws. 

Furthermore, the FTC and many state attorneys general continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers' personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the FTC Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Additionally, federal and state consumer protection laws are increasingly being applied by FTC and states’ attorneys general to regulate the collection, use, storage, and disclosure of personal or personally identifiable information, through websites or otherwise, and to regulate the presentation of website content.

Foreign data protection laws, including the General Data Protection Regulation (the "GDPR"), which became effective in May 2018, and EU and EEA member state data protection legislation, may also apply to health-related and other personal data obtained outside of the U.S. The GDPR imposes strict requirements for processing the personal data of individuals within the EEA or in the context of our activities within the EEA. The GDPR has and will continue to increase compliance burdens on us, including by mandating potentially burdensome documentation requirements and granting certain rights to individuals to control how we collect, use, disclose, retain and process data about them. Fines for non-compliance with the GDPR are significant - the greater of €20 million or 4% of global turnover. In addition to fines, a breach of the GDPR may result in regulatory