Company: BWNB
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001630805-25-000007
Chunk: 159

Company: Babcock & Wilcox Enterprises, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 159
---
 or private actions due to breaches.

We are subject to a variety of laws and regulations in the United States and other countries that involve matters central to our business, including user privacy, security, rights of publicity, data protection, content, intellectual property, distribution, electronic contracts and other communications, competition, protection of minors, consumer protection, taxation, and online-payment services. These laws can be particularly restrictive in countries outside the United States. Both in the United States and abroad, these laws and regulations constantly evolve. In addition, the application and interpretation of these laws and regulations are often uncertain, particularly in the evolving industry in which we operate. Because we store, process, and use data, some of which contains personal information, we are subject to complex and evolving federal, state, and foreign laws and regulations regarding privacy, data protection, content, and other matters. Many of these laws and regulations are subject to change and uncertain interpretation, which could result in investigations, claims, changes to our business practices, increased cost of operations, or reputational damage, any of which could seriously harm our business.

Several proposals have been adopted or are currently pending before federal, state, and foreign legislative and regulatory bodies that could significantly affect our business. The General Data Protection Regulation, or GDPR, in the European Union, which went into effect on May 25, 2018, placed new data protection obligations and restrictions on organizations, including restrictions on the cross-border transfer of information. Similar obligations and restrictions exist under United Kingdom data protection law, including the UK GDPR and the UK Data Protection Act. If we are not compliant with GDPR or UK GDPR requirements, we may be subject to significant fines and our business may be seriously harmed. We are certified under and currently rely upon the EU-U.S. Data Privacy Framework ("EU-U.S. DPF") and/or the UK Extension of the EU-U.S. DPF, as well as certain approved forms of data protection agreements, called Standard Contractual Clauses, for data transfers from EU and UK to the US. These transfer mechanisms may be subject to challenge or invalidation, which may restrict the transfer of personal data which could impact our operations and increase our costs. 

In addition, the California Consumer Privacy Act and the California Privacy Rights Act placed additional requirements on the handling of personal data, including employee data. Similar laws have passed in Virginia, Connecticut, Utah, Colorado, Indiana, Montana and Oregon and have been enacted or proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in