Lionsgate Studios (LION) Risk Analysis

Data Privacy and Security. In the ordinary course of its business, Lionsgate collects, generate, uses, stores, processes, discloses, transmits, shares and transfers (collectively "process") personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, and third-party data, through its websites and applications and those of third parties. Among other purposes, Lionsgate uses this information to engage with users, promote its programming, and monitor the use of its digital platforms. Lionsgate's processing of personal data subjects it to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. In the U.S, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act and the Controlling the Assault of Non-Solicited Pornography and Marketing Act), and other similar laws (e.g., wiretapping laws). For example, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact Lionsgate's business and ability to provide its products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance, for example, the California Consumer Privacy Act ("CCPA"). Similar laws are being considered in several other states, as well as at the federal and local levels. These developments will further complicate compliance efforts and increase legal risk and compliance costs for Lionsgate and the third parties with whom Lionsgate works. Outside the U.S, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union's General Data Protection Regulation (the "EU GDPR"), the United Kingdom's GDPR (the "UK GDPR" and, together with the EU GDPR, the "GDPR"), the EU Digital Services Act, Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or "LGPD") (Law No. 13,709/2018) and Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") impose strict requirements for processing personal data. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros (under the EU GDPR) or 17.5 million pounds sterling (under the UK GDPR), or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. As another example, in Canada, PIPEDA and various related provincial laws, as well as Canada's Anti-Spam Legislation ("CASL"), apply to Lionsgate's operations, as well as the LGPD in Brazil. The LGPD broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the GDPR. Additionally, regulators are increasingly scrutinizing companies that process children's data. Numerous laws, regulations, and legally-binding codes, such as the Children's Online Privacy Protection Act ("COPPA"), California's Age-Appropriate Design Code, CCPA, other U.S. state comprehensive privacy laws, GDPR, and the UK Age-Appropriate Design Code impose various obligations on companies that process children's data, including requiring certain consents to process such data and extending certain rights to children and their parents with respect to that data. Some of these obligations have wide ranging applications, including for services that do not intentionally target child users (defined in some circumstances as a user under the age of 18 years old). These laws may be, or in some cases, have already been, subject to legal challenges and changing interpretations, which may further complicate Lionsgate's efforts to comply with these laws. Lionsgate is subject to certain new laws governing the processing of consumer health data, including by providing for reproductive, sexual orientation, and gender identity privacy rights. For example, Washington's My Health My Data Act ("MHMD") broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws. Additionally, under various privacy laws (such as the Video Privacy Protection Act) and other obligations, Lionsgate may be required to obtain certain consents to process personal data. Noncompliance with such obligations is increasingly subject to challenges by class action plaintiffs. Lionsgate's inability or failure to obtain such consents could result in adverse consequences. In the ordinary course of business, Lionsgate transfers personal data from Europe and other jurisdictions to the U.S. or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area ("EEA") and the United Kingdom ("U.K.") have significantly restricted the transfer of personal data to the U.S. and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the U.S. in compliance with law, such as the EEA standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that Lionsgate can satisfy or rely on these measures to lawfully transfer personal data to the U.S. If there is no lawful manner for Lionsgate to transfer personal data from the EEA, the UK or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer are too onerous, Lionsgate could face significant adverse consequences, including the interruption or degradation of its operations, the need to relocate part of or all its business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against processing or transferring of personal data necessary to operate its business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of the EEA for allegedly violating the GDPR's cross-border data transfer limitations. Lionsgate is also bound by contractual obligations related to data privacy and security, and its efforts to comply with such obligations may not be successful. For example, Lionsgate is contractually subject to certain industry standards adopted by industry groups, such as the Payment Card Industry Data Security Standard ("PCI DSS"). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with PCI DSS can result in penalties ranging from fines of $5,000 to $100,000 per month by credit card companies, litigation, damage to Lionsgate's reputation, and revenue losses. Lionsgate relies on third parties to process payment card data, who may be subject to PCI DSS, and its business may be negatively affected if these parties are fined or suffer other consequences as a result of PCI DSS noncompliance. Moreover, Lionsgate publishes privacy policies, marketing materials and other statements regarding data privacy and security, including as required by applicable laws and regulations. Regulators in the United States are increasingly scrutinizing these materials, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading or misrepresentative of Lionsgate's practices, it may be subject to investigation, enforcement actions by regulators or other adverse consequences. Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources and has in the past and may continue to necessitate changes to Lionsgate's information systems, policies and practices and to those of any third parties upon with whom it works. Lionsgate may at times fail (or be perceived to have failed) in efforts to comply with data privacy and security obligations. Moreover, despite its efforts, its personnel or third parties with whom it works may fail to comply with such obligations, which could negatively impact Lionsgate's business operations and compliance posture. If Lionsgate or the third parties with whom it works fails, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, Lionsgate could face significant consequences, including, but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; or orders to destroy or not use personal data. In particular, plaintiffs have become increasingly active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on Lionsgate's reputation, business, or financial condition, including, but not limited to: loss of customers; interruptions or stoppages in business operations; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize its products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to its business model or operations. Consumer Protection Laws. The continued growth and development of the market for online commerce may lead to more stringent consumer protection laws both domestically and internationally, which may impose additional burdens on Lionsgate. If authorities start taking increased enforcement action related to statutes governing perceived unfair deceptive acts and practices, Lionsgate could suffer additional costs, complaints and/or regulatory investigations or fines. Several of these laws also have private rights of action. Lionsgate's actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions, litigation, fines and penalties, reputational harm, and other adverse business consequences. Other changes in consumer protection laws and the interpretations thereof, could have a materially adverse effect on Lionsgate's business, financial condition and results of operations. Levies/Taxes. Governments are increasingly looking to introduce regulations related to media and tax that may apply to Lionsgate's services. For example, some international governments have enacted or are considering enacting laws that impose levies and other financial obligations on media operators located outside their jurisdiction. Other changes in levy or tax laws and the interpretations thereof could have a materially adverse effect on Lionsgate's business, financial condition and results of operations.

Legislative action may be taken by the U.S. Congress that, if ultimately enacted, could limit the availability of tax benefits or deductions that Lionsgate expects to claim, override tax treaties upon which it expects to rely, or otherwise increase the taxes that the U.S. imposes on Lionsgate's worldwide operations. Such changes could materially adversely affect Lionsgate's effective tax rate and/or require it to take further action, at potentially significant expense, to seek to preserve its effective tax rate. In addition, if proposals were enacted that had the effect of limiting Lionsgate's ability as a Canadian company to take advantage of tax treaties with the U.S., it could incur additional tax expense and/or otherwise incur business detriment.

There is no assurance that Lionsgate will be able to maintain any particular worldwide effective corporate tax rate because of uncertainty regarding the tax policies in the jurisdictions in which it and its affiliates operate. Lionsgate's actual effective tax rate may vary from its expectations, and such variance may be material. Additionally, tax laws or their implementation and applicable tax authority practices in any particular jurisdiction could change in the future, possibly on a retroactive basis, and any such change could have an adverse impact on Lionsgate and its affiliates.

Original programming requires substantial financial commitment, which can occasionally be offset by foreign, state or local tax incentives. However, there is a risk that the tax incentives will not remain available for the duration of a series. If tax incentives are no longer available or reduced substantially, it may result in increased costs for it to complete the production, or make the production of additional seasons more expensive. If Lionsgate is unable to produce original programming content on a cost-effective basis its business, financial condition and results of operations would be materially adversely affected.

The U.S. Congress, the Organisation for Economic Co-operation and Development ("OECD") and other government agencies in jurisdictions where Lionsgate and its affiliates will conduct business have had an extended focus on issues related to the taxation of multinational corporations. For the past several years, the primary focus has been in the area of "base erosion and profit shifting," including situations where payments are made between affiliates from a jurisdiction with high tax rates to a jurisdiction with lower tax rates. As part of its so-called Base Erosion and Profit Shifting ("BEPS") project, OECD and the G-20 developed changes to numerous long-standing international tax principles. More recently, countries are increasingly seeking ways to tax what is sometimes referred to as the digitalized economy. For example, in response to the increasing globalization and digitalization of trade and business operations, OECD is working on a proposal as an extension of its BEPS project to establish a global minimum corporate taxation rate. The rules are designed to ensure that large multinational groups pay corporate income taxes at the minimum rate of 15% in the countries where they operate. As of January 2025, 55 jurisdictions have enacted or introduced legislation to implement these rules, while an additional 10 jurisdictions have taken concrete steps toward doing so. Tax laws are dynamic and subject to change as new laws are passed and new interpretations of the law are issued or applied. The U.S. Congress and various state legislatures are currently evaluating, or may in the future propose, tax legislation, including, at the federal level, new laws to address the expiration of provisions enacted under the Tax Cuts and Jobs Act of 2017, the timing and substance of which remain uncertain. Many countries in the European Union, as well as a number of other countries and organizations such as OECD, are increasingly scrutinizing the tax positions of companies and actively considering changes to existing tax laws that, if enacted, could increase its tax obligations in countries where it does business. For example, the OECD has urged its member countries to raise taxes to protect against future fiscal risks attributed to high deficit and debt levels. There can be no assurance that Canadian federal income tax laws, the judicial interpretation thereof, or the administrative policies and assessing practices of the Canada Revenue Agency will not be changed in a manner that adversely affects Lionsgate or the holders of Lionsgate new common shares. If U.S. or other foreign tax authorities change applicable tax laws, its overall taxes could increase, and its business, financial condition or results of operations may be adversely impacted.

Lionsgate depends on a limited number of titles in any given fiscal quarter for the majority of the revenues generated by its library. In addition, many of the titles in its library are not presently distributed and generate substantially no revenue. Moreover, the rights to the titles in its library vary; in some cases, Lionsgate only holds the right to distribute titles in certain media and territories for a limited term; in other cases, certain rights may be reserved and/or granted to third parties or otherwise only granted to it for a limited period. If Lionsgate cannot acquire new product and the rights to popular titles through production, distribution agreements, acquisitions, mergers, joint ventures or other strategic alliances, or renew expiring rights to titles generating a significant portion of its revenue on acceptable terms, any such failure could have a material adverse effect on its business, financial condition, operating results, liquidity and prospects. Lionsgate has not entered into any agreements regarding material acquisitions of titles, renewals, business combinations, joint ventures or sales that have not yet closed.