We rely upon our information systems and networks in connection with a variety of business activities, and we collect and store sensitive data. Increased security threats to information systems and more sophisticated computer crime pose a risk to the security of our systems and networks and the confidentiality, availability and integrity of our data. We are the subject of cyber-attacks from time to time, and must invest resources to protect our systems and defend against and respond to incidents. A failure of or breach in technology security could expose us and our customers and suppliers to risks of misuse of information or systems, the compromising of confidential information, manipulation and destruction of data, defective products, production downtimes and operating disruptions, which in turn could adversely affect our reputation, competitive position, business and results of operations. In addition, such breaches in security could result in litigation, regulatory action and potential liability and the costs and operational consequences of implementing further data protection measures.
Cyber-attacks could be attempted on any of the Company's external surfaces, such as internet access points or operational technology. Threat actors may gain access to the Company's protected data, information and/or access credentials to initiate cyber-attacks or to sell or expose Company information using various schemes, including social engineering, phishing and/or artificial intelligence, including deepfakes, as well as through data breaches, whether intentional or unintentional,including as a result of malicious insiders, insider errors, third parties who access the Company's information, data transfers and/or data classification. The Company may face additional cybersecurity risks with respect to operational technologies, including those of acquired entities or assets. Cyber-attacks on operational technology surfaces could be initiated by threat actors or malicious insiders. Pathways for cyber-attacks or incidents on operational technology or in other parts of our networks or systems could also be initiated by a third party, such as a vendor or consultant, intentionally or unintentionally, who uses a compromised device to access our operational technology and transfers the compromise, such as malware or a virus. Cyber-attacks on operational technology could include attack of various systems such as industrial control systems (ICS) or supervisory control and data acquisition (SCADA) systems for various purposes, such as control of operations, and can spread systemically beyond the point of entry due to the interconnectivity of such systems internally and with the internet. Cyber risks with legacy systems (including legacy systems inherited in acquisitions) could include structural weaknesses or vulnerabilities, and challenges with patches and upgrades necessary to defend against threat actors. Threat actors who penetrate the Company's information systems may attempt to install malicious code (such as malware or ransomware) to gain control of systems, data, or information for the purpose of extracting a ransom; shutting down operations; initiating an equipment override to cause a fire, hazardous release or explosion; or exposing confidential or proprietary information. Cyber-attacks can also be executed within the various supply chains in which the Company operates, which could impact the availability of raw materials, transport of finished goods, port operations, markets, prices or product demand.
Furthermore, we are subject to complex and evolving laws and regulations regarding, cybersecurity, privacy, know-your-customer requirements, data protection, cross-border data movement and other matters. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. It is possible that these laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices or inconsistent with one another. If personal, confidential or proprietary information of customers or employees in our possession is mishandled or misused, we may face regulatory, reputational and operational risks which could have an adverse effect on our financial condition and results of operations. For example, the General Data Protection Regulation ("GDPR") imposes stringent data protection requirements with respect to (among other things):
- accountability and transparency requirements, requiring controllers to demonstrate and record compliance with the GDPR and to provide detailed information to individuals regarding the processing of their personal data;- requirements to process personal data lawfully, including specific requirements for obtaining valid consent where consent is the lawful basis for processing;- obligations to comply with various data protection rights which can be exercised by individuals;- an obligation to report certain personal data breaches to the competent data protection supervisory authority without undue delay (and no later than 72 hours) and to affected individuals; and - obligations relating to international transfer of personal data.
The GDPR also provides for significant penalties for noncompliance, and data protection supervisory authorities have the power under the GDPR to (among other things) impose significant fines for serious breaches. Individuals also have a right to compensation as a result of an organization's breach of the GDPR which has affected them, for financial or non-financial losses (e.g., distress). Additionally, we are subject to the general data protection law in Brazil, which has similar requirements and restrictions as GDPR, as well as potential penalties for noncompliance.
Additionally, in the EU, the EU Network and Information Systems Security 2 Directive ("NIS2") (and the implementing laws at a national EU Member State level), to which the Company is also subject, imposes stringent cybersecurity and incident reporting requirements on "essential" and "important" entities. The NIS2 empowers the EU Member States to define all rules regarding penalties applicable to infringements, provided that they are effective, proportionate, and dissuasive, and provides that any maximum fines set by Member States for "essential" entities should be at least 10 million euros or 2% of total worldwide annual revenue, whichever is higher. In addition to monetary fines, other sanctions may include (i) a temporary suspension on providing services in the EU (by suspending relevant authorizations/certifications); (ii) an order to make public certain elements of the infringement and/or inform customers; and (iii) injunctions to immediately cease infringing conduct. Importantly, NIS2 also provides that senior members of staff can be held personally liable, and face administrative fines or be temporarily suspended from exercising managerial functions at the legal representative or chief executive officer level.
We may face difficulty in fully complying with these regulations and any failure to do so could subject us to significant monetary penalties, liabilities, and adverse publicity. In the United States, the California Consumer Privacy Act ("CCPA") is a far-reaching data privacy law, which has been significantly amended by the California Privacy Rights Act ("CPRA"). The full impact of the amended CCPA on us and others in our industry remains uncertain because regulations that are necessary to fully implement the law have not been finalized. Those include regulations that would be the first in the US to comprehensively regulate the use of artificial intelligence when used to make decisions about individuals. In addition to California, other states have passed data privacy laws, some of which are currently in effect and others that will take effect over the next two years; meanwhile, other states continue to evaluate the enactment of other data privacy and cybersecurity laws. Additionally, the Federal Trade Commission ("FTC") and many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the collection, use, dissemination and security of personal information. We also expect additional laws and regulations to be passed regulating various uses of artificial intelligence, including as described in the October 2023 White House Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence. In addition, in August 2024, EU Regulation 2024/1689 on artificial intelligence ("EU AI Act") entered into force. Most of the rules will go into effect in August 2026. The EU AI Act governs the development and deployment of AI placed on the EU market, used in the EU, or where the output is used or intended to be used within the EU. The EU AI Act aims to ensure the safe and ethical development of artificial intelligence technologies, and establishes a risk-based regulatory framework, categorizing artificial intelligence systems into four levels of risk (i.e., unacceptable, high, limited and minimal). In case of non-compliance, the fine threshold is set at 35 million euros or 7% of total annual worldwide turnover, whichever is higher, and regulators have the power to remove non-compliant products from the EU market. Achieving compliance with the EU AI Act may require significant investments in adapting artificial intelligence systems to meet regulatory requirements. This could include implementing enhanced data governance, ensuring human oversight, and providing detailed technical documentation, which may increase costs and deployment timelines. The impact of these cybersecurity, privacy, and artificial intelligence laws and orders on us and others in our industry is uncertain. We also may be required to expend significant resources to prepare for and comply with the evolving standards. We could be adversely affected if state, federal or international data privacy or cybersecurity laws or regulations are interpreted in a manner that would require changes in our business practices, or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively affect our business, financial condition and results of operations.