Company: MSTR
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000950170-25-021814
Chunk: 237

Company: Strategy Inc
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1
Chunk 237
---
, failure to comply with federal and state laws (both those currently in effect and future legislation) regarding privacy and security of personal information could expose us to fines and penalties under such laws. In the event of a security breach, we also may have obligations to notify our customers or other parties or individuals about this breach, and this can lead to significant costs and the risk of potential enforcement and/or litigation. There is also a threat of consumer class actions related to these laws and the overall protection of personal data. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.

There are similar laws in other countries, including the General Data Protection Regulation (“GDPR”) in the European Union which imposes requirements regarding the handling and security of personal data, requires disclosure of data breaches to individuals, customers, and data protection authorities in certain circumstances, requires companies to honor data subjects’ requests relating to their personal data, permits regulators to impose fines of up to €20,000,000 or 4% of global annual revenue, whichever is higher, and establishes a private right of action.

In addition to these specific laws, we also are subject to other privacy, security, and data protection laws around the world. In addition to the laws in place already, other countries are also considering new or expanded laws governing privacy and data security that may impact our business practices.  These laws may impact our ongoing business activities and our relationships with our business partners, customers and service providers.  

Furthermore, the U.S. Congress is considering comprehensive privacy legislation. At this time, it is unclear whether Congress will pass such a law and if so, when and what it will require and prohibit.  Moreover, it is not clear whether any such legislation would give the Federal Trade Commission (“FTC”) any new authority to impose civil penalties for violations of the Federal Trade Commission Act in the first instance, whether Congress will grant the FTC rulemaking authority over privacy and information security, or whether Congress will vest some or all privacy and data security regulatory authority and enforcement power in a new agency, akin to EU data protection authorities.

Employees

As of December 31, 2024, we had a total of 1,534 employees, of whom 453 were based in the United States and 1,081 were based internationally. None of our employees in the United States is represented by a labor union; however, employees of certain of our foreign subsidiaries are members of