Spok Holdings Inc
For the period ended Dec 31, 2024. Filed Feb 27, 2025.
View on SEC.govAbout this filing
A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.
FY2024 · Filed Feb 27, 2025
What changed in Risk Factors?
Read the current filingPrevious report: 10-K
Period ended 2023-12-31; filed 2024-02-22.
0001289945-24-000010
Item 1A. Risk FactorsCurrent report: 10-K
Period ended 2024-12-31; filed 2025-02-27.
0001289945-25-000008
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 98 previous paragraphs and 97 current paragraphs.
66 unchanged; 30 reworded; 1 added; 1 removed; 1 previous and 0 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (1)
Current report
As another example, in 2020, the FCC made available for broadband use spectrum in the 900 MHz band that is adjacent to certain frequencies used by us to provide paging services. In early 2025, the FCC proposed to further expand these adjacent bands’ use for broadband services, in part by eliminating 500 KHz guard bands between these frequencies and those in which we operate. Although the FCC has tentatively concluded that this proposed band allocation would not result in harmful interference to users in adjacent spectrum bands, we cannot be certain that this expectation will be validated in practice, and any harmful interference resulting from the adoption of this proposal could negatively impact the Company by making its paging services less effective and its affected spectrum licenses less valuable.
Removed paragraphs (1)
Previous report
The GDPR could limit our ability to use and share personal data or could cause our costs to increase and harm our business, financial condition, operating results and cash flows. Failure to comply with the requirements of the GDPR and the applicable European Union member states may result in fines of up to €20,000,000 or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties. To comply with the data protection rules imposed by the GDPR, we may be required to put in place additional mechanisms that could be onerous and adversely affect our business, financial condition, and operating results.
Reworded paragraphs (30)
Previous wording
We have investigated potential acquisitions and may not be able to identify an opportunity at favorable terms or have the ability to close on the financing necessary to consummate the transaction.
Current wording
We have investigated potential acquisitions and may be unable to identify an opportunity at favorable terms or have the ability to close on the financing necessary to consummate the transaction.
Previous wording
We cannot provide any assurances that we will be successful in finding such acquisitions or consummating future acquisitions on favorable terms. We anticipate that future acquisitions will be financed through a combination of methods, including, but not limited to, the use of available cash on hand, and, if necessary, borrowings from third-party financial institutions. Disruptions or volatility in credit markets may impede our access to capital markets, including higher borrowing costs, less available capital, more stringent terms and tighter covenants, and may limit our ability to finance acquisitions.
Current wording
We cannot provide any assurances that we will be successful in finding such acquisitions or consummating future acquisitions on favorable terms. We anticipate that future acquisitions will be financed through a combination of methods, including, but not limited to, the use of available cash on hand, and, if necessary, borrowings from third-party financial institutions. Disruptions or volatility in credit markets may impede our access to capital markets, including higher borrowing costs, less available capital, more stringent terms and tighter covenants may limit our ability to finance acquisitions.
Previous wording
We have investigated potential acquisitions and may be unable to successfully integrate such acquisitions into our business and may not achieve all or any of the operating synergies or anticipated benefits of those acquisitions.
Current wording
We have investigated potential acquisitions and may be unable to successfully complete or integrate such acquisitions into our business, and may not achieve all or any of the operating synergies or anticipated benefits of those acquisitions.
Previous wording
Economic conditions that are largely out of our control may adversely affect our financial condition and statement of operations.
Current wording
Economic conditions that are largely out of our control may adversely affect our financial condition and results of operations.
Previous wording
A significant portion of our revenue is derived from healthcare customers, and we are impacted by changes in the healthcare economic environment. The healthcare industry is highly regulated and is subject to changing political, legislative, regulatory, and other economic developments. These developments can have a dramatic effect on the decision-making and spending by our customers for information technology and software. This economic uncertainty can add to the unpredictability of decision-making and lengthen our sales cycle. We are unable to predict the full consequences of this uncertainty on our operations. Adverse changes in the economic environment could adversely impact our ability to increase the prices we charge for our offerings, while effectively managing customer churn, or to successfully market and sell our wireless and software solutions to healthcare customers.
Current wording
A significant portion of our revenue is derived from healthcare customers, and we are impacted by changes in the healthcare economic environment. The healthcare industry is highly regulated and is subject to changing political, legislative, regulatory, and other economic developments. These developments can have a dramatic effect on the decision-making and spending by our customers for information technology and software, including our ability to increase prices. This economic uncertainty can add to the unpredictability of decision-making and lengthen our sales cycle. We are unable to predict the full consequences of this uncertainty on our operations. Adverse changes in the economic environment could adversely impact our ability to increase the prices we charge for our offerings, while effectively managing customer churn, or to successfully market and sell our wireless and software solutions to healthcare customers.
Previous wording
Software products, such as those we offer, may contain defects, vulnerabilities and bugs when they are first introduced or as new versions are released, or their release may be delayed due to unforeseen difficulties during product development. If any of our products, including products of companies we have acquired, or third-party components used in our products, contain defects, vulnerabilities or bugs, or have reliability, quality or compatibility problems, we may not be able to successfully design workarounds or resolve these issues. Any defects or vulnerabilities we do not detect and fix in pre-release testing could result in reduced sales and revenue, damage to our reputation, repair or remediation costs, delays in the release of new products or versions or legal liability. In addition, we do not control the quality, security or testing of various third-party software, hardware or infrastructure products that are utilized in our business. There can be no assurance that provisions in our license agreements that limit our exposure to liability will be sufficient or withstand legal challenge. Computer programmers and hackers also may be able to develop and deploy viruses, worms, and other malicious software programs that attack our or a critical third party's products or otherwise exploit any security vulnerabilities of such products.
Current wording
Software products, such as those we offer, may contain defects, vulnerabilities and bugs when they are first introduced or as new versions are released, or their release may be delayed due to unforeseen difficulties during product development. If any of our products, including products of companies we have acquired, or third-party components used in our products, contain defects, vulnerabilities or bugs, or have reliability, quality or compatibility problems, we may not be able to successfully design workarounds or resolve these issues. Any defects or vulnerabilities we do not detect and fix in pre-release testing could result in reduced sales and revenue, damage to our reputation, repair or remediation costs, delays in the release of new products or versions or legal liability. In addition, we do not control the quality, security or testing of various third-party software, hardware or infrastructure products that are utilized in our business. There can be no assurance that provisions in our license agreements that limit our exposure to liability will be sufficient or withstand legal challenge. Computer programmers and hackers also may be able to develop and deploy, including through technologies such as artificial intelligence, viruses, worms, and other malicious software programs that attack our or a critical third party's products or otherwise exploit any security vulnerabilities of such products.
Previous wording
We are dependent on the U.S. healthcare provider industry for most of our revenue.
Current wording
We are dependent on the United States healthcare provider industry for most of our revenue.
Previous wording
We may receive claims that we have infringed the intellectual property rights of others, including claims regarding patents, copyrights, and trademarks. The number and types of these claims may grow as a result of constant technological change in the segments in which our wireless services and software products compete, the extensive patent coverage of existing technologies, and the rapid rate of issuance of new patents.
Current wording
We may receive claims that we have infringed the intellectual property rights of others, including claims regarding patents, copyrights, and trademarks. The number and types of these claims may grow as a result of constant technological change, including the increased use of artificial intelligence, in the segments in which our wireless services and software products compete, the extensive patent coverage of existing technologies, and the rapid rate of issuance of new patents.
Previous wording
System disruptions and security threats to our computer networks, satellite control or telecommunications systems, or to those of our service providers, could have a material adverse effect on our business.
Current wording
System disruptions, data compromises and other cybersecurity threats to our computer networks, satellite control, telecommunications systems and other IT Systems, or to those of our service providers, could have a material adverse effect on our business.
Previous wording
The performance and reliability of computer systems, hardware, software and satellite networks and telecommunications systems infrastructure (collectively, “IT Systems”) is critical to our operations. We own and manage certain IT Systems but rely heavily on critical IT Systems that are owned and/or managed by third parties. These IT Systems may be vulnerable to damage or interruption from natural disasters, power loss, telecommunication failures, terrorist attacks, software errors and other events. Any IT System (such as a satellite network) error or failure, regardless of cause, could result in a substantial outage that materially disrupts our operations. In addition, we face the threat to our computer systems, or those of our service providers, of unauthorized access, computer hackers, computer viruses, malicious code, organized cyber-attacks and other security problems and system disruptions (e.g., distributed denial of service (DDoS) attacks, ransomware attacks). Our wireless services depend on connectivity provided by third-party satellite network services that could fail and result in a loss of service to our customers. With respect to our Enterprise Reporting and Management systems and data storage, and other operational needs, we rely on third-party data centers and services for maintaining accessibility, reliability and uninterrupted connectivity, among other things.
Current wording
The performance and reliability of computer systems, hardware, software and satellite networks and telecommunications systems infrastructure (collectively, “IT Systems”) is critical to our operations. We own and manage certain IT Systems but rely heavily on critical IT Systems that are owned and/or managed by third parties. These IT Systems are vulnerable to material damage or interruption from natural disasters, power loss, telecommunication failures, terrorist attacks, software errors and other events. Any IT System (such as a satellite network) error or failure, regardless of cause, could result in a substantial outage that materially disrupts our operations. In addition, we face the threat of material compromise to our computer systems, or those of our service providers, of unauthorized access, computer hackers, computer viruses, malicious code, organized cyberattacks and other security problems and system disruptions (e.g., distributed denial of service (DDoS) attacks or ransomware attacks). Our wireless services depend on connectivity provided by third-party satellite network services where failure would result in a loss of service to our customers. With respect to our Enterprise Reporting and Management systems and data storage, and other operational needs, we rely on third-party data centers and services for maintaining accessibility, reliability and uninterrupted connectivity, among other things.
Previous wording
Our disaster recovery planning may not be sufficient for every eventuality, such as a ransomware attack that encrypts some or all of our or our service providers' IT Systems, data or infrastructure. We may not carry business interruption insurance sufficient to protect us from all losses that may result from interruptions in our services as a result of IT Systems and infrastructure failures or cyberattacks, or to cover all contingencies. We may be required to expend significant resources to protect against the threat of these IT System disruptions or to remediate or otherwise alleviate problems caused by such disruptions. Any interruption in the availability of our websites and online interactions with customers or partners may cause a reduction in customer or partner satisfaction levels, which in turn could result in legal claims, reduced revenue or loss of customers or partners. There can be no assurance that any precautions we take will prove successful, and such problems could result in, among other consequences, a loss of data, a loss of confidence in the stability and reliability of our offerings, damage to our reputation, and legal liability, all of which may adversely affect our business, financial condition, operating results and cash flows.
Current wording
Our disaster recovery planning may not be sufficient for every eventuality, such as a ransomware attack that encrypts some or all of our or our service providers' IT Systems, data or infrastructure. We may not carry business interruption insurance sufficient to protect us from all losses that may result from interruptions in our services as a result of IT Systems and infrastructure failures or cyberattacks, or to cover all contingencies. We expend significant resources to protect against the threat of these IT System disruptions. Any interruption in the availability of our websites and online interactions with customers or partners may cause a reduction in customer or partner satisfaction levels, which in turn could result in legal claims, reduced revenue or loss of customers or partners. There can be no assurance that any precautions we take will prove successful, and such problems could result in, among other consequences, a loss of data, a loss of confidence in the stability and reliability of our offerings, damage to our reputation, and legal liability, all of which may adversely affect our business, financial condition, operating results and cash flows.
Previous wording
We rely on data centers and other systems and technologies provided by third parties, and technology systems and electronic networks supplied and managed by third parties, to operate our business. Any major interruption or performance problems with these systems, technologies and networks may adversely affect our business and operating results.
Current wording
We rely on data centers and other IT Systems and technologies provided by third parties, and technology systems and electronic networks supplied and managed by third parties, to operate our business. Any major interruption or performance problems with these systems, technologies and networks may adversely affect our business and operating results.
Previous wording
We rely on data centers and other systems and technologies provided by third parties. If key third parties are unable to perform services for us because of service interruptions or extended outages, or because those services are no longer available on commercially reasonable terms, our expenses could increase. Switching our technology to another service provider, if available, could result in significant disruption, data loss or corruption, or unsuccessful data transfers could cause data to be incomplete or contain inaccuracies.
Current wording
We rely on data centers and other IT Systems and technologies provided by third parties. If key third parties are unable to perform services for us because of service interruptions or extended outages, or because those services are no longer available on commercially reasonable terms, our expenses could materially increase. Switching our technology to another service provider, if available, could result in significant disruption, data loss or corruption, or unsuccessful data transfers could cause data to be incomplete or contain inaccuracies.
Previous wording
We do not control, or in some cases have limited control over, the data center facilities we use. These facilities are vulnerable to damage from earthquakes, floods, fires, power loss, telecommunications failures and similar events. These facilities may also be subject to theft, vandalism or other security related events. Despite precautions taken at these facilities, adverse events could result in lengthy interruptions in our services and the loss or corruption of, or unauthorized access to or acquisition of, customer data. In addition, the owners of our data center facilities have no obligation to renew their agreements with us on commercially reasonable terms. If we are required to relocate to another data center facility, we may not be able to rapidly identify and obtain new facilities, and we may incur significant costs or interruptions to our services, as a result.
Current wording
We do not control, or in some cases have limited control over, the data center facilities we use. These facilities are vulnerable to damage from natural disasters and adverse weather, including hurricanes, storms, earthquakes, floods, fires, power loss, telecommunications failures and similar events. These facilities are also at risk of serious theft, vandalism or other security related events. Despite precautions taken at these facilities, adverse events could result in lengthy interruptions in our services and the loss or corruption of, or unauthorized access to or acquisition of, customer data. In addition, the owners of our data center facilities have no obligation to renew their agreements with us on commercially reasonable terms. If we are required to relocate to another data center facility, we may not be able to rapidly identify and obtain new facilities, and we may incur significant costs or interruptions to our services, as a result.
Previous wording
Cyberattacks, data breaches or other compromises to our or our critical third parties' systems, data, products or services could have a material adverse effect on our business.
Current wording
Cyberattacks, data breaches or other compromises to our or our critical third parties' IT Systems, data, products or services could have a material adverse effect on our business.
Previous wording
We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of IT Systems and Confidential Information. Accidental or willful cyberattacks, breaches or other unauthorized access events committed or enabled by third parties or by our employees or contractors (for example, due to social engineering or phishing attacks) can impact the security of or disrupt access to our facilities, our systems or the systems of our third-party providers, and the information maintained in such systems. In addition, computer viruses, malware (for example, ransomware) or security vulnerabilities in our or our service providers' data, software, products or services, as well as external cyberattacks and data breaches, could expose us to the risks of corruption, loss, and misappropriation of proprietary and confidential information. We also routinely transmit and receive proprietary and Confidential Information, including through third parties, which makes that information vulnerable to interception, misuse or mishandling.
Current wording
We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of IT Systems and Confidential Information. Accidental or willful cyberattacks, breaches or other unauthorized access events committed or enabled by third parties or by our employees or contractors (for example, due to social engineering or phishing attacks) impact the security and integrity of our facilities, our systems or the systems of our third-party providers, and the information maintained in such systems. In addition, computer viruses, malware (for example, ransomware) or security vulnerabilities in our or our service providers' data, software, products or services, as well as external cyberattacks and data breaches, expose us to the risks of material corruption, loss, and misappropriation of proprietary and confidential information. We also routinely transmit and receive proprietary and Confidential Information, including through third parties, which makes that information vulnerable to interception, misuse or mishandling that may materially impact our business.
Previous wording
The frequency and scope of cyberattacks has been steadily increasing, and attackers are increasingly sophisticated, using tools and techniques, including artificial intelligence, that we and our service providers may be unable to detect or identify, or that may cause significant delays in our detection or identification. Once identified, we and our service providers may be unable to investigate or remediate incidents due to attackers taking steps to obfuscate or remove forensic evidence and to circumvent logging tools and counter-measures, rendering us unable to anticipate or implement adequate preventative or restorative measures.
Current wording
The frequency and scope of cyberattacks has been steadily increasing, and attackers are increasingly sophisticated, using tools and techniques, including artificial intelligence, to evade detection or cause significant delays in detection and identification. Even once identified, investigation and remediation of an incident is increasingly challenging due to attackers taking steps to obfuscate or remove forensic evidence and to circumvent logging tools and counter-measures, which renders us unable to fully anticipate or implement adequate preventative or restorative measures.
Previous wording
We and our service providers are routinely subjected to cyberattacks such as denial of service, attempted unauthorized network intrusions, malware, viruses, social engineering (phishing), ransomware attacks or other persistent cyber threats. In addition, remote working arrangements at our Company and many third-party providers, increase cybersecurity risks due to the IT challenges associated with managing remote computing assets and vulnerabilities inherent in many non-corporate and home networks. In sum, there can also be no assurance that our or our third-party providers’ cybersecurity risk management programs, including relevant policies, processes and controls, will be fully implemented, complied with or effective in protecting IT Systems or Confidential Information that are critical to our business.
Current wording
We and our service providers are routinely subjected to cyberattacks, such as denial of service, attempted unauthorized network intrusions, malware, viruses, social engineering (phishing), ransomware attacks or other persistent cyber threats. In addition, remote working arrangements at our Company and many third-party providers, increase cybersecurity risks due to the IT challenges associated with managing remote computing assets and vulnerabilities inherent in many non-corporate and home networks. There can also be no assurance that our or our third-party providers’ cybersecurity risk management programs, including relevant policies, processes and controls, will be fully implemented, complied with or effective in protecting IT Systems or Confidential Information that are critical to our business from materially adverse events.
Previous wording
We have significant deferred income tax assets that are available to offset future taxable income and increase cash flows from operations. The use of these deferred income tax assets is dependent on the availability of taxable income in future periods. The availability of future taxable income is dependent on our ability to profitably manage our operations to support a growing base of software revenue offset by declining wireless subscribers and revenue. To the extent that anticipated reductions in wireless operating expenses do not occur or sufficient revenue is not generated, we may not achieve sufficient taxable income to allow for use of our deferred income tax assets. The accounting for deferred income tax assets is based upon an estimate of future results, and any valuation allowance we may apply to our deferred tax assets may be increased or decreased as conditions change or if we are unable to implement certain tax planning strategies. If we are unable to use these deferred income tax assets, our financial condition and statement of operations may be materially affected. In addition, a significant portion of our deferred income tax assets relate to net operating losses. If our ability to utilize these losses is limited, due to Internal Revenue Code ("IRC") Section 382, our financial condition and statement of operations may be materially affected. For example, we maintained a valuation allowance of $2.3 million at December 31, 2023 and 2022 to reduce net deferred income tax assets as their realization did not meet the applicable more-likely-than-not criterion.
Current wording
We have significant deferred income tax assets that are available to offset future taxable income and increase cash flows from operations. The use of these deferred income tax assets is dependent on the availability of taxable income in future periods. The availability of future taxable income is dependent on our ability to profitably manage our operations to support a growing base of software revenue offset by declining wireless subscribers and revenue. To the extent that anticipated reductions in wireless operating expenses do not occur or sufficient revenue is not generated, we may not achieve sufficient taxable income to allow for use of our deferred income tax assets. The accounting for deferred income tax assets is based upon an estimate of future results, and any valuation allowance we may apply to our deferred tax assets may be increased or decreased as conditions change or if we are unable to implement certain tax planning strategies. If we are unable to use these deferred income tax assets, our financial condition and results of operations may be materially affected. In addition, a significant portion of our deferred income tax assets relate to net operating losses. If our ability to utilize these losses is limited, due to Internal Revenue Code ("IRC") Section 382, our financial condition and results of operations may be materially affected. For example, we maintained a valuation allowance of $2.3 million at December 31, 2024 and 2023 to reduce net deferred income tax assets as their realization did not meet the applicable more-likely-than-not criterion.
Previous wording
If our long-lived assets or goodwill are deemed to be impaired, an impairment loss equal to the amount by which the carrying amount exceeds the fair value of the assets would be recognized. We may be required to record a significant charge in our financial statements during the period in which any impairment of our long-lived assets or goodwill is determined, which would negatively affect our results of operations. For example, as a result of our periodic evaluation of our capitalized software development costs, we recorded an impairment charge of $15.7 million for the year ended December 31, 2021.
Current wording
If our long-lived assets or goodwill are deemed to be impaired, an impairment loss equal to the amount by which the carrying amount exceeds the fair value of the assets would be recognized. We may be required to record a significant charge in our financial statements during the period in which any impairment of our long-lived assets or goodwill is determined, which would negatively affect our results of operations.
Previous wording
A substantial portion of our revenue comes from healthcare customers. As part of our business, we (or third parties with whom we contract) may receive, store and process our data, as well as our customers’ and partners’ private data and personal information. As such, our business is subject to a variety of federal, state and international laws and regulations that apply to the collection, use, retention, protection, disclosure, transfer and processing of personal data.
Current wording
In connection with running our business, we receive, store, use and otherwise process information that relates to individuals and/or constitutes “personal data,” “personal information,” “personally identifiable information,” “protected health information” or similar terms under applicable data privacy laws (collectively, “Personal Information”), including from and about actual and prospective customers, as well as our employees and business contacts. As such, our business is subject to a variety of federal, state and international laws and regulations that apply to the collection, use, retention, protection, disclosure, transfer and processing of Personal Information.
Previous wording
Our software solutions may handle or have access to personal health information subject in the United States to HIPAA, HITECH and related regulations as well as legislation and regulations in foreign countries. These statutes and related regulations impose numerous requirements regarding the use and disclosure of personal health information with which we and our software solutions must comply. Our failure to accurately anticipate or interpret these complex and technical laws and regulations could subject us to civil and/or criminal liability. Such failure could adversely impact our ability to market and sell our software solutions to healthcare customers and have a material adverse impact on our software sales.
Current wording
A substantial portion of our revenue comes from healthcare customers. Our software solutions may therefore handle or have access to personal health information subject in the United States to HIPAA, HITECH and related regulations as well as legislation and regulations in foreign countries. These statutes and related regulations impose numerous requirements regarding the use and disclosure of personal health information with which we and our software solutions must comply. Our failure to accurately anticipate or interpret these complex and technical laws and regulations could subject us to civil and/or criminal liability. Such failure could adversely impact our ability to market and sell our software solutions to healthcare customers and have a material adverse impact on our software sales.
Previous wording
In addition to personal health information, the Company may handle or have access to personal information in the European Union subject to the General Data Protection Regulation (the "GDPR"). The GDPR imposes several stringent requirements for controllers and processors of personal data and increases our obligations, including, for example, by requiring more robust disclosures to individuals, strengthening the individual data rights regime, shortening timelines for data breach notifications, limiting retention periods and secondary use of information, and imposing additional obligations when we contract third-party processors in connection with the processing of personal data. In addition, the GDPR restricts transfers of personal data outside of the European Economic Area and the UK, including to the United States, under certain scenarios. While lawful data transfer mechanisms have been proposed, there remains uncertainty, and we are exposed to potential investigations and enforcement in this area.
Current wording
In addition, customers may use our wireless services to transmit protected health information subject to HIPAA and other regulatory requirements. While we offer encrypted pagers to our customers, many customers use wireless devices provided by us that do not encrypt text messages. While we disclaim liability for customer non-compliance with HIPAA and other privacy requirements, there remains some risk we could be held responsible for privacy violations by our customers. In addition to protected health information, the Company may handle or have access to Personal Information in the European Union or United Kingdom subject to the General Data Protection Regulation or its United Kingdom equivalent (together, the "GDPR"). The GDPR imposes several stringent requirements for controllers and processors of Personal Information and increases our obligations, including, for example, by requiring more robust disclosures to individuals, strengthening the individual data rights regime, shortening timelines for data breach notifications, limiting retention periods and secondary use of information, and imposing additional obligations when we contract third-party processors in connection with the processing of personal data. In addition, the GDPR restricts transfers of personal data outside of the European Economic Area and the United Kingdom, including to the United States, under certain scenarios. While lawful data transfer mechanisms exist, there remains uncertainty, and we are exposed to potential investigations and enforcement in this area.
Previous wording
Existing privacy-related laws and regulations in the United States and other countries are evolving and are subject to potentially differing interpretations, and various federal and state or other international legislative and regulatory bodies may expand or enact laws regarding privacy and data security-related matters. For example, in the U.S., the state of California enacted the California Consumer Privacy Act ("CCPA"), which came into effect in January 2020, and the California Privacy Rights Act (“CPRA”), which came into effect in January 2023, expanding upon the CCPA. The CCPA and CPRA require covered businesses to, among other things, provide certain disclosures to California consumers and afford such consumers certain privacy rights. The CCPA provides for civil penalties for violations, as well as a private right of action for certain security breaches that may increase security breach litigation. The CPRA imposes additional obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses and disclosure of sensitive personal information. The CPRA also creates a new California data protection agency authorized to issue substantive regulations and could result in increased privacy, cybersecurity and data protection enforcement. The CCPA and CPRA have spurred similar legislation in many other states, and we expect this trend to continue.
Current wording
We are subject to existing privacy-related laws and regulations in the United States and other countries, which are evolving and are subject to potentially differing interpretations, and various federal and state or other international legislative and regulatory bodies may expand or enact laws regarding privacy and data security-related matters that impact our business. For example, in the United States, we are subject to the California Consumer Privacy Act ("CCPA"), which requires covered businesses to, among other things, provide certain disclosures to California consumers and afford such consumers certain privacy rights. The CCPA provides for civil penalties for violations, as well as a private right of action for certain security breaches that may increase security breach litigation. The CCPA has spurred similar legislation in many other states, and we expect this trend to continue.
Previous wording
There can be no assurance that the security and testing measures we take relating to our offerings and operations will prevent all security breaches and data loss that could harm our business or the businesses of our customers and partners. These risks may increase as we continue to grow our services and offerings and as we receive, store and process more of our customers’ data. Actual or perceived vulnerabilities may lead to regulatory investigations, claims against us by customers, partners or other third parties, or costs, such as those related to providing customer notifications and fraud monitoring. There can be no assurance that any provisions in our customer agreements limiting our liability will be enforceable or effective under applicable law. In addition, the cost and operational consequences of implementing further data protection measures could be significant.
Current wording
There can be no assurance that the security and testing measures we take relating to our offerings and operations will prevent all security breaches and data loss that could harm our business or the businesses of our customers and partners or otherwise expose us to privacy-related liability. These risks may increase as we continue to grow our services and offerings and as we receive, store and process more of our customers’ data. Actual or perceived vulnerabilities may lead to regulatory investigations, claims against us by customers, partners or other third parties, or costs, such as those related to providing customer notifications and fraud monitoring. There can be no assurance that any provisions in our customer agreements limiting our liability will be enforceable or effective under applicable law. In addition, the cost and operational consequences of implementing further data protection measures could be significant.
Previous wording
The data privacy and protection-related laws and regulations to which we are subject are evolving, with new or modified laws and regulations proposed and implemented frequently, and existing laws and regulations subject to new or different interpretations. Any failure by us to comply with data privacy- and protection-related laws and regulations could result in enforcement actions, significant penalties or other legal actions against us or our customers or suppliers. An actual or alleged failure to comply, which could result in negative publicity, reduce demand for our offerings, increase the cost of compliance, require changes in business practices that result in reduced revenue, restrict our ability to provide our offerings in certain locations, result in our customers’ inability to use our offerings and prohibit data transfers or result in other claims, liabilities or sanctions, including fines, and could have an adverse effect on our business, financial condition, operating results and cash flows.
Current wording
The data privacy and protection-related laws and regulations to which we are subject are evolving, with new or modified laws and regulations proposed and implemented frequently, and existing laws and regulations subject to new or different interpretations. Any failure by us to comply with data privacy- and protection-related laws and regulations could result in enforcement actions, significant penalties or fines or other legal actions (including class action lawsuits) against us or our customers or suppliers. An actual or alleged failure to comply, which could result in negative publicity, reduce demand for our offerings, increase the cost of compliance, require changes in business practices that result in reduced revenue, restrict our ability to provide our offerings in certain locations, result in our customers’ inability to use our offerings and prohibit data transfers or result in other claims, liabilities or sanctions, including fines, and could have an adverse effect on our business, financial condition, operating results and cash flows.
Previous wording
Our wireless products are regulated by the FCC and, to a lesser extent, state and local regulatory authorities. Changes in regulation could result in increased costs to us and our customers.
Current wording
Our wireless products are regulated by the FCC and, to a lesser extent, state and local regulatory authorities. Changes in regulation could result in increased costs to us and our customers and other operational impacts.
Previous wording
We are subject to regulation by the FCC and, to a lesser extent, by state and local authorities. Changes in regulatory policy could increase the fees we must pay to the government or to third parties and could subject us to more stringent requirements that could cause us to incur additional capital and/or operating costs. To the extent additional regulatory costs are passed along to customers, those increased costs could adversely impact subscriber cancellations.
Current wording
We are subject to regulation by the FCC and, to a lesser extent, by state and local authorities. Changes in regulatory policy could increase the fees we must pay to the government or to third parties and could subject us to more stringent requirements or otherwise impact our operations potentially causing us to incur additional capital and/or operating costs. To the extent additional regulatory costs are passed along to customers, those increased costs could adversely impact subscriber cancellations.
Previous wording
For example, the FCC issued an order in October 2007 that mandated paging carriers (including the Company) along with all other CMRS providers serving a defined minimum number of subscribers to maintain an emergency back-up power supply at all cell sites to enable operation for a minimum of eight hours in the event of a loss of commercial power (the "Back-up Power Order"). Ultimately, after a hearing by the U.S. Court of Appeals for the DC Circuit and disapproval by the Office of Management and Budget (the "OMB") of the information collection requirements of the Back-up Power Order, the FCC indicated that it would not seek to override the OMB’s disapproval. Rather the FCC indicated that it would issue a Notice of Proposed Rulemaking with the goal of adopting revised back-up power rules. To date, there has been no Notice of Proposed Rulemaking by the FCC, and we are unable to predict what impact, if any, a revised back-up power rule could have on our business, financial condition, operating results and ability to pay cash dividends to stockholders.
Current wording
For example, the FCC issued an order in October 2007 that mandated paging carriers (including the Company) along with all other CMRS providers serving a defined minimum number of subscribers to maintain an emergency back-up power supply at all cell sites to enable operation for a minimum of eight hours in the event of a loss of commercial power (the "Back-up Power Order"). Ultimately, after a hearing by the United States Court of Appeals for the DC Circuit and disapproval by the Office of Management and Budget (the "OMB") of the information collection requirements of the Back-up Power Order, the FCC indicated that it would not seek to override the OMB’s disapproval. Rather the FCC indicated that it would issue a Notice of Proposed Rulemaking with the goal of adopting revised back-up power rules. To date, the FCC has not adopted revised back-up power rules applicable to the Company, and we are unable to predict what impact, if any, revised back-up power rules to which the Company is subject could have on our business, financial condition, operating results and ability to pay cash dividends to stockholders.
Previous wording
As a further example, the FCC continues to consider changes to the rules governing the collection of universal service fees. The FCC is evaluating a flat monthly charge per assigned telephone number as opposed to assessing universal service contributions based on telecommunication carriers’ interstate and international revenue. There is no timetable for any rulemaking to implement this numbers-based methodology. If the FCC adopts a numbers-based methodology, our attempt to recover the increased contribution costs from our customers could significantly diminish demand for our services, and our failure to recover such increased contribution costs could have a material adverse impact on our business, financial condition and operating results.
Current wording
As a further example, the FCC has considered changes to the rules governing the collection of universal service fees, including a flat monthly charge per assigned telephone number as opposed to assessing universal service contributions based on telecommunication carriers’ interstate and international revenue. However, there is no timetable for any rulemaking to implement this numbers-based methodology. If the FCC adopts a numbers-based methodology, our attempt to recover the increased contribution costs from our customers could significantly diminish demand for our services, and our failure to recover such increased contribution costs could have a material adverse impact on our business, financial condition and operating results. In addition, the FCC’s universal service contribution mechanism has been the subject of several recent court challenges, and the United States Supreme Court has agreed to consider the validity of the methodology on constitutional and other grounds. The outcome of this case is uncertain, but a decision by the Supreme Court invalidating the FCC’s universal service contribution mechanism could impact our business.
Rearranged previous paragraphs (1)
Previous report — wording carried elsewhere
In addition, customers may use our wireless services to transmit patient health information subject to HIPAA and other regulatory requirements. While we offer encrypted pagers to our customers, many customers use wireless devices provided by us that do not encrypt text messages. While we disclaim liability for customer non-compliance with HIPAA and other privacy requirements, there remains some risk we could be held responsible for privacy violations by our customers.