Company: CALX
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001406666-25-000008
Chunk: 46

Company: CALIX, INC
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 46
---
 advertising, which could negatively affect our marketing cloud products. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. If we are subject to or affected by the CCPA, or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Furthermore, the Federal Trade Commission, or FTC, and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers’ personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.

The General Data Protection Regulation, or EU GDPR, adopted by the European Union, or EU, and the UK General Data Protection Regulation, or UK GDPR, adopted by the United Kingdom, or UK, (the EU GDPR and UK GDPR hereinafter referred to as the GDPR) and national data protection supplementing laws in these jurisdictions impose specific duties and requirements upon companies that are subject to their provisions and collect, process or control personal data of individuals. Although we currently do not have material operations or business in the EU or the UK, we are in the process of expanding in these jurisdictions, and we have incurred and will continue to incur substantial costs in this respect. Furthermore, the GDPR imposes significant penalties for noncompliance which can amount to the greater of €20 million (for the EU GDPR) or £17.5 million (for the UK GDPR) or 4% of the total worldwide annual turnover of the preceding financial year; thus, any non-compliance with the GDPR could result in a material adverse effect on our business, financial condition and results of operations.

The EU GDPR and UK GDPR regulate cross-border transfers of personal data out of the European Economic Area, or the EEA, and the UK. There is currently legal complexity and uncertainty regarding international personal data transfers, and we expect this to continue. In particular, we expect the European Commission approval of the current EU-US Data Privacy Framework for data transfers to certified entities in the U.S. to be challenged and international transfers to the U.S. and to other jurisdictions