LOGITECH INTERNATIONAL SA

Current report

The collection, storage, transmission, use and distribution of personal data could give rise to liabilities and additional costs of operation as a result of laws, governmental regulation and risks of data breaches and security incidents.

Current report

In connection with our operations, we collect and otherwise process personal data, including that of our consumers. The processing of this information is increasingly subject to legislation, regulations and enforcement in numerous jurisdictions around the world. Global data privacy regulation is increasingly fragmented, with increasing enforcement efforts and penalties. Such fragmentation requires more complex and costly compliance structures, while heightened enforcement increases the cost and reputational risk associated with even minor compliance errors. For example, the General Data Protection Regulation ("GDPR"), which is applicable to us and to all companies processing data of people in the European Union, imposes significant fines and sanctions for violation of the Regulation. Compliance with the GDPR's international transfer rules has been made more difficult by the invalidation of the European Union-U.S. Privacy Shield and we are now required to put in place additional privacy protective measures for transfer of data of people in the European Union to certain countries outside of the European Economic Area. In the United States, several states have adopted broad privacy laws. Such laws and regulations are typically intended to protect the privacy and security of personal information and its collection, storage, transmission, use, disclosure and other processing. For example, California has enacted the California Consumer Privacy Act (the “CCPA”), which, among other things, requires covered companies to provide disclosures to California consumers and afford such consumers abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (the “CPRA”), was approved by California voters in November 2020. The CPRA significantly modifies the CCPA and has made compliance more uncertain and complex. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation. Other laws and regulations may follow, at state and federal levels. Other regions also have robust data protection and privacy legislation. For example, China has enacted the Personal Information Protection Law of the People’s Republic of China (“PIPL”), which strictly regulates the processing of personal information and the transfer of personal data of Chinese residents to territories outside of China.

Current report

In addition, because various jurisdictions have different laws and regulations concerning the use, storage, transmission and other processing of such information, we may face requirements that pose compliance challenges in existing markets as well as new international markets that we seek to enter. The collection and processing of personal data also heightens the risk of security breaches and other data security issues related to our IT systems and the systems of third-party data storage and other service and IT providers. Such laws and regulations, variation between jurisdictions and risks presented by our processing of personal data could limit our ability to use data and develop new features and services, subject us to increased costs, require allocation of additional resources and changes to our policies and practices, which may be difficult to achieve in a commercially reasonable manner or at all. Any actual or perceived failure by us to comply with these laws, regulations, or other actual or asserted obligations relating to privacy or the collection, use or other processing of personal data may lead to significant fines, penalties, regulatory investigations, lawsuits, significant costs for remediation, damage to our reputation, or other liabilities, all of which could adversely affect our business.