Company: ALGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001097149-25-000012
Chunk: 65

Company: ALIGN TECHNOLOGY INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 65
---
 decentralized devices, we may be unable, or not have the capacity, knowledge or infrastructure, to respond to or remedy a cybersecurity incident in a timely manner. Any such cybersecurity incident may cause loss or damage to us, our customers or strategic business partners or may cause further malfunctions in, or damage to, our products, services, or IT systems, damage to, or loss, unavailability, or unauthorized acquisition, use, or other processing of our data, or disruption, interruption or temporary cessation of our operations. Further, any such security breach or incident, or other cybersecurity incident, or any belief or reporting that any of the foregoing has occurred, may otherwise have a negative impact upon our business or reputation.

We are also subject to federal, state, and foreign laws and regulations respecting the security and privacy of patient healthcare information applicable to healthcare providers and their business associates, such as HIPPA, the HITECH Act, and the Privacy Standards and Security Standards, as well as those relating to privacy, data security, content regulation and consumer protection, such as the California Consumer Protection Act, as amended by the California Privacy Rights Act (as amended, the “CCPA”). The CCPA requires covered businesses that process personal information of California residents to disclose certain practices, provides California residents with data privacy rights, imposes operational requirements, and provides for significant civil penalties for violations as well as a private right of action for certain data breaches and statutory damages. There are limited exemptions under the CCPA for protected health information covered by HIPAA and certain other state laws, but the CCPA and other new and evolving state laws could impact our business activities. Numerous other states have enacted laws relating to privacy, data protection, data governance and cybersecurity that either are in operation or slated to go into operation over the next several years. Many of these laws are comprehensive privacy laws similar to the CCPA. States also are enacting laws addressing specific subject matter, such as Washington’s My Health, My Data Act, which includes a private right of action. Laws in all 50 U.S. states may require businesses to provide notice to individuals whose personal data has been disclosed as a result of a data breach. Outside of the U.S., relevant legal requirements continue to evolve. For example, the collection and use of health data and other personal information is governed in the EU by the General Data Protection Regulation (“GDPR”), which imposes significant obligations upon companies and rights for individuals, with substantial penalties for noncompliance up to the greater of €20,000,000 or 4%