Company: PLSAY
Filing Date: 2025-05-09
Form Type: 20-F
Source: 0001884082-25-000012
Chunk: 133

Company: Polestar Automotive Holding UK PLC
Filing Date: 2025-05-09
Form: 20-F
Item: Item 4
Chunk 133
---
 from the European Data Protection Board, much of the data in the context of connected vehicles may be viewed as personal data and therefore subject to the EU GDPR. In the US, Polestar needs to comply with the California Consumer Privacy Act (CCPA) and similar state-level comprehensive privacy laws which enter into force starting from 2023 in e. g. Virginia, Colorado and other states.

Violations of data privacy and data protection laws may result in consequences such as substantial fines, damages, ceasing with the infringing activity and deletion of erroneously collected information.

In China, several pieces of legislation have been adopted in recent years, applicable in part or in full to Polestar’s operations in China. These include the Data Security Law and the Personal Information Protection Law, which entered into force in 2021. Both laws impose requirements on data activities or personal information processing activities, including security reviews and specific requirements on activities on data regarding Chinese persons carried out outside of China. The Several Measures on the Automobile Data Security Management (for Trial Implementation) from the CAC, which entered into force in October 2021, imposes requirements on processing of personal information and important data during the process of designing, manufacturing, selling, maintaining, managing automobiles within the territory of China. It specifically requires the operators to store certain personal information and important data within the territory of China, or in case overseas transfers are necessary, to go through the data export security assessment organized by the CAC in accordance with such laws.

The Cybersecurity Review Measures from the CAC, which came into effect in February 2022, requires data processors in China who hold more than one million users’ personal information and plan to list on a stock exchange in a foreign country to apply for a cybersecurity review. It also gives the CAC the power to initiate cybersecurity review in certain situations.

The Cross-border Data Transfer Security Measures (the “Security Assessment Measures”) from the CAC, effective from September 2022, requires security assessment for data being exported. Data handlers must submit application materials to the CAC offices at the provincial level for the security assessment within a six-month “rectification period”.

In addition to the legislative requirements to protect personal data, Polestar operations are subject to various regulations concerning cybersecurity in general. In Europe, the NIS 2 directive and corresponding national legislation require Polestar to maintain a cybersecurity management system ensuring that Polestar’s data and digital assets are protected against cyber-attacks. This includes for example operational aspects such as Vulnerability and Network Protection Management, Security Incident Management