Company: PLSAY
Filing Date: 2025-05-09
Form Type: 20-F
Source: 0001884082-25-000012
Chunk: 51

Company: Polestar Automotive Holding UK PLC
Filing Date: 2025-05-09
Form: 20-F
Item: Item 3
Chunk 51
---
 enforcement notices, assessment notices (for a compulsory audit) and/ or civil claims (including class actions).

Polestar is also subject to evolving EU and UK privacy laws. Recent European court and regulator decisions are driving increased attention to cookies and tracking technologies. In light of the complex and evolving nature of EU, EU Member State and UK privacy laws in this area, there can be no assurances that Polestar will be successful in its efforts to comply with such laws; violations of such laws could result in regulatory investigations, fines, orders to cease/ change Polestar’s use of such technologies, as well as civil claims including class actions, and reputational damage. Furthermore, the EU Data Act, which was adopted in January 2024 and will become applicable in September 2025, will apply to data alongside GDPR and extend to providers of internet-of-things devices, providers of related services and holders of both personal and non-personal data in the European Union.

The CCPA establishes a privacy framework for covered businesses, including an expansive definition of personal information and data privacy rights for California residents. The CCPA includes a framework with potentially severe statutory damages for violations and a private right of action for certain data breaches. The CCPA requires covered businesses to provide California residents with new privacy-related disclosures and new ways to opt-out of certain uses and disclosures of personal information. As Polestar expands its operations, the CCPA may increase its compliance costs and potential liability. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the United States.

Additionally, effective in most respects on January 1, 2023, the California Privacy Rights Act (“ CPRA”) has significantly modified the CCPA, including by expanding California residents’ rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA. Other US states have implemented or are implementing comprehensive privacy statutes that share similarities with the CCPA. For example, such laws have been enacted in Virginia, Colorado, Connecticut and Utah, and came into force in 2023. Additionally, Polestar may be subject to certain laws and regulations, e. g., “ Right to Repair” laws, that require Polestar to provide third-party access to its network and/or vehicle systems.

Other jurisdictions have begun to propose similar laws. Compliance with additional applicable privacy and data security laws and regulations is a rigorous and time-intensive process and may place restrictions on the conduct of