regulatory interference, or any unanticipated interference with its use of its current “cloud” service provider could impact LG Studios’ operations and its business could be adversely impacted.
LG Studios’ activities are subject to stringent and evolving obligations which may adversely impact its operations. LG Studios’ actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of its business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences.
Data Privacy and Security. In the ordinary course of its business, LG Studios collects, generates, uses, stores, processes, discloses, transmits, shares and transfers (collectively “process”) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, and third-party data, through its websites and applications and those of third parties. Among other purposes, LG Studios uses this information to engage with users, promote its programming, and monitor the use of its digital platforms. LG Studios’ collection and use of personal data may subject it to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.
In the U.S, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act and the Controlling the Assault of Non-Solicited Pornography and Marketing Act), and other similar laws (e.g., wiretapping laws). For example, in the past few years, numerous U.S. states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact LG Studios’ business and ability to provide its products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (“CCPA”) allows for civil penalties (up to $7,500 per intentional violation). Similar laws are being considered in several other states, as well as at the federal and local levels. These developments further complicate compliance efforts and increase legal risk and compliance costs for LG Studios and the third parties upon whom LG Studios relies.
Outside the U.S, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union’s General Data Protection Regulation (the “EU GDPR”), the United Kingdom’s GDPR (the “UK GDPR” and, together with the EU GDPR, “EU GDPR”), the EU Digital Services Act, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018) and Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) impose strict requirements for processing personal data. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros (under the EU GDPR) or, 17.5 million pounds sterling (under the UK GDPR), or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. As another example, in Canada, PIPEDA and various related provincial laws, as well as Canada’s Anti-Spam Legislation (“CASL”), may apply to LG Studios’ operations, as well as the LGPD in Brazil. The LGPD broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the GDPR.
Additionally, regulators are increasingly scrutinizing companies that process children’s data. Numerous laws, regulations, and legally-binding codes, such as the Children’s Online Privacy Protection Act (“COPPA”), California’s Age Appropriate Design Code, CCPA, other U.S. state comprehensive privacy laws, GDPR, and the
26