Company: BLCO
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001860742-25-000004
Chunk: 240

Company: Bausch & Lomb Corp
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 240
---
 individuals of security breaches involving particular personal information, which could result from breaches experienced by us or our service providers. For example, laws in all 50 U.S. states require businesses to provide notice to customers whose personal data has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly. Moreover, states have been frequently amending existing laws, requiring attention to changing regulatory requirements. We are also subject to various state and federal rules and laws governing cybersecurity risks and incidents, including an SEC rule relating to disclosure of material cybersecurity incidents and risks and state laws regarding notification of data breaches. Since these data security regimes are evolving, uncertain and complex, especially for a global business such as ours, we will need to update or enhance our compliance measures from time to time and these updates or enhancements will require further implementation costs. Any failure, or perceived failure, by us to comply with current and future regulatory or customer-driven privacy, data protection, and information security requirements, or to prevent or mitigate security breaches, cyber- attacks, or improper access to, use of, or disclosure of data, or any security issues or cyber-attacks affecting our business, could result in significant liability, costs (including the costs of mitigation and recovery), a material loss of revenue resulting from the adverse impact on its reputation and brand, loss of proprietary information and data, disruption to its business and relationships, and diminished ability to retain or attract customers and business partners. Such events may result in governmental enforcement actions and prosecutions, private litigation, fines and penalties or adverse publicity, and could cause customers and business partners to lose trust in us, which could have an adverse effect on our reputation and business.Internationally, laws and regulations in many jurisdictions apply broadly to the collection, transmission, dissemination, use, privacy, confidentiality, security, retention, availability, integrity and other processing of health-related and other sensitive and personal information. For example, the EU’s General Data Protection Regulation (“GDPR”), and the UK’s General Data Protection Regulation (“UK GDPR”) together with national legislation, regulations and guidelines of the EU member states and the UK governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, analyze, store, transfer and otherwise process personal data, including health data from clinical trials and adverse event reporting. The GDPR authorizes fines for certain violations of up to 4% of global annual revenue or €20 million (or GBP 17.5 million under the UK