National and local governments and agencies in the countries in which ChargePoint operates and in which customers operate have adopted, are considering adopting, or may adopt laws and regulations regarding the collection, use, storage, processing and disclosure of information regarding consumers and other individuals, which could impact its ability to offer services in certain jurisdictions. Laws and regulations relating to the collection, use, storage, disclosure, security and other processing of individuals’ information can vary significantly from jurisdiction to jurisdiction and are particularly stringent in Europe. The costs of compliance with, and other burdens imposed by, laws, regulations, standards and other obligations relating to privacy, data protection and information security are significant. In addition, some companies, particularly larger enterprises, often will not contract with vendors that do not meet these rigorous standards. Accordingly, the failure, or perceived inability, to comply with these laws, regulations, standards and other obligations may limit the use and adoption of ChargePoint’s solutions, reduce overall demand, lead to regulatory investigations, litigation and significant fines, penalties or liabilities for actual or alleged noncompliance, or slow the pace at which it closes sales transactions, any of which could harm its business. Moreover, if ChargePoint or any of its employees or contractors fail or are believed to fail to adhere to appropriate practices regarding customers’ data, it may damage its reputation and brand.
Additionally, existing laws, regulations, standards and other obligations may be interpreted in new and differing manners in the future, and may be inconsistent among jurisdictions. Future laws, regulations, standards and other obligations, and changes in the interpretation of existing laws, regulations, standards and other obligations could result in increased regulation, increased costs of compliance and penalties for
non-compliance,
and limitations on data collection, use, disclosure and transfer for ChargePoint and its customers.
Additionally, the EU adopted the GDPR in 2016, and it became effective in May 2018. The GDPR establishes requirements applicable to the handling of personal data and imposes penalties for
non-compliance
of up to the greater of €20 million or 4% of worldwide revenue. The costs of compliance with, and other burdens imposed by, the GDPR may limit the use and adoption of ChargePoint’s products and services and could have an adverse impact on its business. Further, California adopted the CCPA and the California State Attorney General has begun enforcement actions. Although ChargePoint initiated a compliance program designed to ensure CCPA compliance after consulting with outside privacy counsel, ChargePoint may remain exposed to ongoing legal risks and compliance costs related to CCPA and the new California Privacy Rights Act (“CPRA”), which will become effective in most material respects starting on January 1, 2023.
The costs of compliance with, and other burdens imposed by, laws and regulations relating to privacy, data protection and information security that are applicable to the businesses of customers may adversely affect ability and willingness to process, handle, store, use and transmit certain types of information, such as demographic and other personal information. The EU and the United States agreed in 2016 to the
EU-US
Privacy Shield Framework, which provided one mechanism for lawful cross-border transfers of personal data between the EU and the United States. However, the Court of Justice of the EU issued a decision on July 16, 2020 invalidating the
EU-US
Privacy Shield Framework, thereby creating additional legal risk for ChargePoint. In addition, the other bases on which ChargePoint and its customers rely for the transfer of personal data across national borders, such as the Standard Contractual Clauses promulgated by the EU Commission Decision 2010/87/EU, commonly referred to as the Model Clauses, continue to be subjected to regulatory and judicial scrutiny. If ChargePoint or its customers are unable to transfer data between and among countries and regions in which it operates, it could decrease demand for its products and services or require it to modify or restrict some of its products or services.
In addition to government activity, privacy advocacy groups, the technology industry and other industries have established or may establish various new, additional or different self-regulatory standards that may place additional burdens on technology companies. Customers may expect that ChargePoint will meet voluntary certifications or adhere to other standards established by them or third parties. If ChargePoint is unable to maintain these certifications or meet these standards, it could reduce demand for its solutions and adversely affect its business.
Failure to comply with anticorruption and anti-money laundering laws, including the FCPA and similar laws associated with activities outside of the United States, could subject ChargePoint to penalties and other adverse consequences.
ChargePoint is subject to the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, the Anti-Bribery Act and possibly other anti-bribery and anti-money laundering laws in countries in which it conducts activities. It faces significant risks if it fails to comply with the FCPA and other anti-corruption laws that