Company: WRBY
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001504776-25-000010
Chunk: 65

Company: Warby Parker Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 65
---
 other things, the CCPA: requires disclosures to such residents about the data collection, use and disclosure practices of covered businesses; gives California residents expanded rights related to their personal information, including the right to access, correct and delete their personal information, and opt-out for certain sales or transfers of personal information for cross-context behavioral advertising and for profiling and automated decision making in furtherance of decisions that produce legal or similarly significant effects; provides new audit requirements for higher risk data; provides for civil penalties for violations, and creates a private right of action for data breaches that is expected to increase data breach litigation. Similar laws have been enacted in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States. To the extent multiple state-level laws are introduced with inconsistent or conflicting standards and there is no federal law to preempt such laws, compliance with such laws could be difficult and costly to achieve and we could be subject to fines and penalties in the event of actual or perceived non-compliance.

Additionally, we are subject to certain health information privacy and security laws as a result of the health information that we receive in connection with our products and services. These laws and regulations include HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, and their implementing regulations. HIPAA requires us to develop and maintain policies and procedures governing protected health information (“PHI”) that is used or disclosed, and to implement administrative, physical and technical safeguards to protect PHI, including PHI maintained, used, and disclosed in electronic form. These safeguards include employee training, identifying business associates with whom covered entities need to enter into HIPAA-compliant contractual arrangements and various other measures. Ongoing implementation and oversight of these measures involves significant time, effort, and expense and we may have to dedicate additional time and resources to ensure compliance with HIPAA requirements. Additionally, it is not always possible to identify and deter misuse by our employees and other third parties, and the precautions we take to detect and prevent noncompliance may not be effective in preventing all misuse, breaches, or violations. For example, as discussed above, in 2018, we experienced a credential stuffing attack in which malicious third parties used credentials compromised in data breaches suffered by other companies to access accounts on our platform and received notice that OCR would be investigating the incident and our compliance with the Privacy, Security, and Breach Notification Rules and requesting certain information related to the incident and our compliance with the Privacy, Security, and Breach Notification Rules. The Company