Company: PERI
Filing Date: 2025-03-25
Form Type: 20-F
Source: 0001178913-25-001021
Chunk: 51

Company: Perion Network Ltd.
Filing Date: 2025-03-25
Form: 20-F
Item: Item 3
Chunk 51
---
 supervisory authorities (and in certain cases, affected individuals) of certain data breaches, set limitations on the retention of personal data and outline significant documentary requirements to demonstrate compliance through policies, procedures, training and audits. In the EEA and the U.K., failure to comply with the GDPR and the U.K. GDPR can result in significant fines and other liability under applicable law. In particular, under the GDPR, fines of up to EUR 20 million (or GBP 17.5 million under the U.K. GDPR) or up to 4% of the annual global revenue of the noncompliant company, whichever is greater, could be imposed for violations of certain of the GDPR’s requirements. European data protection authorities have already imposed fines for GDPR violations, in some cases, of hundreds of millions of euros.
 
In Canada, the data privacy landscape is made up of different provincial data privacy laws (including the Quebec Privacy Act and Quebec’s Law 25), Canadian federal data privacy laws as well as sector-specific data privacy laws. In 2021, Quebec passed Quebec’s Law 25 overhauling the Quebec Privacy Act. Quebec’s Law 25 imposes strict controller requirements, such as privacy policies; enhanced consent requirements when collecting, using or disclosing personal data; risk assessments and data breach notification. Quebec’s Law 25 also granted individuals certain data privacy rights including a right to erasure, right to restrict processing and, as of September 22, 2024, a right to data portability. Also under Quebec’s Law 25, organizations must provide, by default, the parameters ensuring the highest level of confidentiality of a technological product or service offered to the public. Canadian Privacy Law applies not only to third-party transactions, but also to transfers of information between us and our subsidiaries, and under Quebec’s Law 25, personal data would include employee information. Failure to comply with Canadian Privacy Law and other data privacy laws within Canada may expose us to administrative fines, litigation or enforcement actions brought by data subjects and regulatory authorities, class actions and even punitive damages. Canadian federal data privacy law is currently being overhauled and we expect that data privacy legislation across Canada will continue to evolve in the coming months and years.
 
 In the U.S., both federal and state laws and regulations govern the collection, use, maintenance and other processing of personal data, and the advertising industry has been subject to review by the FTC, U.S. Congress, and individual states. For example, at the U.S. federal level, we are subject to the rules