Company: ALGN
Filing Date: 2025-05-08
Form Type: 10-Q
Source: 0001097149-25-000034
Chunk: 182

Company: ALIGN TECHNOLOGY INC
Filing Date: 2025-05-08
Form: 10-Q
Item: Item 8
Chunk 182
---
”). The CCPA requires covered businesses that process personal information of California residents to disclose certain practices, provides California residents with data privacy rights, imposes operational requirements, and provides for significant civil penalties for violations as well as a private right of action for certain data breaches and statutory damages. There are limited exemptions under the CCPA for protected health information covered by HIPAA and certain other state laws, but the CCPA and other new and evolving state laws could impact our business activities. Numerous other states have enacted, or plan to enact, laws relating to privacy, data protection, data governance and cybersecurity, with such enacted laws either in operation or slated to go into operation over the next several years. Many of these laws are comprehensive privacy laws similar to the CCPA. States also are enacting laws addressing specific subject matter, such as Washington’s My Health, My Data Act, which includes a private right of action. Laws in all 50 U.S. states have required notice to individuals whose personal data has been disclosed as a result of a data breach. Outside of the U.S., relevant legal requirements continue to evolve. For example, the collection and use of health data and other personal information is governed in the EU by the General Data Protection Regulation, which imposes significant obligations upon companies and rights for individuals, with substantial penalties for noncompliance up to the greater of €20,000,000 or 4% of the total worldwide annual turnover of the preceding financial year, and by certain EU member state-level legislation. Numerous other jurisdictions maintain similar legislation or other laws or regulations addressing privacy, data protection, data governance, or cybersecurity.

We are also subject to data export restrictions and international transfer laws and regulations that prohibit or impose conditions upon certain data transfers. The mechanisms upon which we and many other companies rely for European data transfers have been the subject of legal challenge, regulatory interpretation and judicial decisions by the EU courts and regulators, and may be subject to significant changes. Several jurisdictions, including the EU, the United States, China, Australia, and Japan, have established legal requirements for cross-border transfers of all or certain personal information and certain jurisdictions have also established legal requirements for data localization, which may require us to maintain separate servers located in those countries so that all or certain personal information are maintained locally. These laws and regulations addressing cross-border data transfers and data localization are constantly evolving and may be created, interpreted, applied or amended in ways that could restrict our activities in certain jurisdictions, limit our ability to provide our products and services in those jurisdictions, require us to modify our