Company: OFIX
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000950170-25-026066
Chunk: 139

Company: Orthofix Medical Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 139
---
 financial condition, and results of operations. 

In the U.S., Federal and State privacy and security laws require certain of our operations to protect the confidentiality of personal information including patient medical records and other health information. In Europe, the Data Protection Directive requires us to manage individually identifiable information in the E.U., and the GDPR may impose fines of the greater of 20 million Euros or four percent of our global revenue in the event of violations. Some countries have also passed laws that require individually identifiable data on their citizens to be maintained on local servers and that may restrict the transfer or processing of that data. We are also subject to the California Consumer Privacy Act (the "CCPA"), which went into effect in January 2020. In November 2020, California passed the California Privacy Rights Act (the "CPRA"), which builds on the CCPA and expands consumer privacy rights to more closely align with the GDPR. The CPRA went into effect on January 1, 2023, and applies to information collected on or after January 1, 2022. The CCPA and CPRA, among other things, create new data privacy obligations for covered companies and provide new privacy rights to California residents, including the right to opt out of certain disclosures of their information. The CCPA also created a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. It remains unclear what, if any, additional modifications will be made to the CPRA by the California legislature or how it will be interpreted. We believe that we meet the expectations of applicable regulations and that the ongoing costs of compliance with such rules are not material to our business, but could become material due to new regulations. There is no guarantee that we will be able to comply with these regulations. We work with PII and PHI, and we may not be able to avoid the negative reputational and other effects that might ensue from a significant data breach or failure to comply with applicable data privacy regulations, each of which could have significant adverse effects on our business, financial condition, or results of operations.

In recent years, companies around the world have seen a surge in wire transfer "phishing" attacks that attempt to trick employees into wiring money from company bank accounts to criminals’ bank accounts. In some cases, companies have lost millions of dollars to such relatively simple attacks, and these funds often are not recovered. While we take efforts to train employees to be cognizant of these types of attacks and take appropriate precautions, the level of