Company: KODK
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0000950170-25-040256
Chunk: 47

Company: EASTMAN KODAK CO
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1A
Chunk 47
---
 actions or allegations of such acts could damage our reputation and subject us to civil or criminal investigations and related shareholder lawsuits, could lead to substantial civil and criminal, monetary and non-monetary penalties and could cause us to incur significant losses as a victim and legal and investigatory fees. In addition, the government may seek to hold us liable for violations committed by companies in which we invest or that we acquire.  If Kodak is found to have violated laws and regulations, it could materially adversely affect our business, reputation, results of operations and financial condition.

Failure to comply with privacy, data protection and cyber security laws and regulations could have a materially adverse effect on Kodak’s reputation, results of operations or financial condition. 

Kodak receives, processes, transmits and stores information relating to identifiable individuals (personal information), both in our role as a technology provider and as an employer. As a result, Kodak is subject to numerous U.S. federal and state and foreign laws and regulations relating to personal information.

Examples of data privacy laws include (but are not limited to) the EU’s General Data Protection Regulation (“GDPR”) and ePrivacy laws, California’s Consumer Privacy Act (“CCPA”) and other U.S. state privacy laws, China’s Personal Information Protection Law (“PIPL”), and Brazil’s General Data Protection Law (“LGPD”). These laws have been subject to frequent changes, and new legislation 

22

in this area may be enacted at any time. Additionally, the application of existing and new laws in the areas of cloud services and AI is evolving, and we may face challenges monitoring and complying with these requirements. 

Failure to comply with existing and newly enacted laws and regulations that are applicable, may subject Kodak to, among other things, additional costs or changes to our business practices, liability for monetary damages, fines and/or criminal prosecution, unfavorable publicity, restrictions on our ability to obtain and process information and allegations by our customers and clients that we have not performed our contractual obligations. We may also face risk (including loss of substantial business) if our customers and other stakeholders are not confident that our products and service can be used in a manner that is compliant with applicable data protection laws.

Recent developments in the regulation of cross-border data transfers from the European Economic Area and countries with similar regimes, including enforcement decisions and regulatory guidance issued by key supervisory authorities, creates uncertainty as to our and our customers’ ability to use platforms and processing services located in the U.S. and other non-adequate jurisdictions. While existing data transfer mechanisms