Motorola Solutions (MSI) Risk Analysis

We are a provider of certain services that include telecommunications in the U.S., including selective routing services for 911 calls. As such, we are subject to certain Federal Communications Commission (FCC) and possible state regulations relating to telecommunications, including some certification or licensing, service reliability, and regulatory fee requirements. If we do not comply with these regulations, we could be subject to enforcement actions, fines, and possibly loss of certifications or licenses to operate or offer certain of our services that are regulated telecommunications. Any enforcement action, which may be a public process, could also damage our reputation and erode customer trust. Additionally, we are subject to regulations in certain foreign countries where we offer services that include telecommunications or other types of communications services. For example, we are registered to provide WAVE PTX push-to-talk offerings, with and without telecommunications connectivity, in certain countries internationally. Local laws and regulations, and the interpretation of such laws and regulations, can differ significantly among the jurisdictions in which we provide these services. In some countries, certain services that we offer are not considered to be regulated communications services, while in other countries they are subject to regulations, including registration with the local telecommunications governing authority, which increases the level of scrutiny and potential for enforcement by regulators as well as our cost of doing business internationally. Further, enforcement and interpretations of the laws and regulations in some countries can be unpredictable and subject to the informal views of government officials. Failure to comply with these regulations could subject us to enforcement actions, fines and penalties, additional compliance obligations or liabilities, loss of authority to provide regulated services, and reputational harm, which could adversely affect our business. Moreover, it is possible that regulations in any of these jurisdictions may be changed, expanded or interpreted and applied in a manner that is inconsistent with our existing practices. Future applicable legislative, regulatory or judicial actions could increase the cost and complexity of our compliance and increase our exposure to potential liability.

Radio spectrum is required to provide wireless voice, data, and video communications services. The allocation of frequencies is regulated in the U.S. and other countries and limited spectrum is allocated to wireless services, including commercial, public safety and government users. The global demand for wireless communications has grown exponentially, and spurred competition for access among various networks and users. In response, regulators are reassessing the allocations of spectrum among users, including public safety users, and considering whether to change the allocation of certain spectrum bands from narrowband to broadband use, or to require sharing of spectrum bands. Our results could be negatively affected by the rules and regulations adopted by regulators. Our products operate both on licensed and unlicensed spectrum. The loss of available radio spectrum may result in the loss of business opportunities. Regulatory changes in current spectrum bands (e.g., the sharing of previously dedicated or other spectrum) may require modifications to some of our products so they can continue to be manufactured and marketed.

Various jurisdictions have adopted or are expected to introduce new laws and regulations regarding cybersecurity, privacy, data protection, data sovereignty and information security which have impacted, or we expect will impact, us by exposing us to increased costs and potential liabilities. With respect to cybersecurity laws and regulations, in the EU and other jurisdictions we are subject to, and expect to continue to become subject to, increasingly stringent and prescriptive cybersecurity legislation mandating the implementation of distinct cybersecurity risk management measures and obligations to demonstrate our compliance through certification or self-attestations. Such legislation typically includes obligations for ensuring the integrity of our supply chain, including supplier-focused cybersecurity obligations. The cybersecurity legal and regulatory environment is complex and continues to evolve across many jurisdictions. Compliance with these laws and regulations exposes us to increased costs and any noncompliance, whether actual or perceived, could result in potential liabilities. With respect to privacy and data protection, the EU's General Data Protection Regulation ("GDPR") strengthened individual privacy rights and enhanced data protection obligations for processors and controllers of personal data. The GDPR includes expansive disclosures about how personal information is to be used, limitations on retention of information and mandatory data breach notification requirements. Noncompliance with the GDPR can trigger significant fines. U.S. federal, state and other foreign governments and agencies have adopted or are considering adopting laws and regulations regarding the collection, storage, use, processing and disclosure of personal data. Numerous state governments within the U.S. have enacted their own versions of "GDPR-like" privacy legislation, which has created, and we expect will continue to create, additional compliance challenges, risks, and administrative burdens. A comprehensive U.S. federal privacy law is also in the process of being drafted by the House Privacy Working Group. This, as well as other standalone federal bills, could restrict the ability of companies to collect, store and sell certain types of data, as well as restrict the ability of law enforcement to collect, use and purchase data from companies (for example, ALPR data). It is possible that a one-size fits all compliance program may be difficult to achieve and manage globally, and that we will be forced to comply with a patchwork of inconsistent privacy regulations. Several other countries in which we operate have established legal requirements for cross-border data transfers. There is also an increasing trend towards data localization policies. Cloud-based solutions may be subject to further regulation with respect to data localization requirements and restrictions on the international transfer of data. If countries implement more restrictive regulations for cross-border personal data transfers (or customers do not permit personal data to leave the country of origin), it could affect the manner in which we provide our services or the geographical location or segregation of our relevant systems and operations, which could adversely impact our business. Because the interpretation and application of cybersecurity, privacy, data protection, data sovereignty and information security laws and regulations are complex and still uncertain, it is possible that they may be interpreted and applied in a manner that is inconsistent with our existing practices or the features of our products, software and services. Any failure or perceived failure by us, our business partners, or third-party service providers to comply with such laws and regulations, or applicable commitments in contracts, could result in proceedings against us by governmental entities or others and significant fines and penalties, and adversely affect our business.