Company: RILYN
Filing Date: 2025-09-19
Form Type: 10-K
Source: 0001464790-25-000011
Chunk: 196

Company: B. Riley Financial, Inc.
Filing Date: 2025-09-19
Form: 10-K
Item: Item 1A
Chunk 196
---
 personally identifiable information) of our employees, customers, business partners, and others. In addition, the increased use of social media by our employees and contractors could result in inadvertent disclosure of sensitive data or personal information, including but not limited to, confidential information, trade secrets and other intellectual property.

Any such disruption or security breach, as well as any action by us or our employees or contractors that might be inconsistent with the rapidly evolving data privacy and security laws and regulations applicable within the United States and elsewhere where we conduct business, could result in enforcement actions by U.S. states, the U.S. Federal government or foreign governments, liability or sanctions under data privacy laws that protect personally identifiable information, regulatory penalties, other legal proceedings such as but not limited to private litigation, the incurrence of significant remediation costs, disruptions to our development programs, business operations and collaborations, diversion of management efforts and damage to our reputation, which could harm our business and operations. Because of the rapidly moving nature of technology and the increasing sophistication of cybersecurity threats, our measures to prevent, respond to and minimize such risks may be unsuccessful.

In addition, the European Parliament and the Council of the European Union adopted a comprehensive general data privacy regulation (“GDPR”) in 2016 that took effect in 2018 and governs the collection and use of personal data in the European Union. The GDPR, which is wide-ranging in scope, imposes several requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals, the security and confidentiality of the personal data, data breach notification requirements and the use of third party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the European Union to the United States, enhances enforcement authority and imposes large penalties for noncompliance, including the potential for fines of up to €20 million or 4% of the annual global revenues of the infringer, whichever is greater. In addition, the California Consumer Privacy Act ("CCPA") effective since January 1, 2020 applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds. The CCPA established new requirements regarding handling of personal data to entities serving or employing California residents, and gave consumers the right to request disclosure of information collected about them, and whether that information has been sold or shared with others, the right to request deletion of personal information (subject to certain exceptions), the right to opt out of the sale of the consumer’s personal