Company: FLYW
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027078
Chunk: 101

Company: Flywire Corp
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 101
---
 by the European Commission, have faced challenges in European courts (including being called into question in the Schrems II decision), and may be further challenged, suspended or invalidated for transfers to some or all countries. For example, guidance regarding Schrems II issued by the European 

23

Data Protection Board (which is comprised of representatives from every E.U. member state’s top data protection authority) have cast serious doubt on the validity of SCCs for most transfers of personal information to the United States. The Schrems II decision and related enforcement actions or other legal developments in this area could subject us to negative financial consequences, such as fines, penalties, loss of customers, and the need to engage in costly restructuring of our business and IT operations and restructuring of our relationships with service providers and other partners. 

In Asia, there has been an increase in both regulation and enforcement of privacy laws. The Act on Protection of Personal Information originally enacted in June 2020 by the Japanese government, was amended and came into effect on April 1, 2022 (Amended APPI). Since the passage of the Amended APPI, a number of implementing regulations and supporting documents have been released, addressing the requirements for transferring personal data outside Japan, notifying security breaches and creating pseudonymous information exempt from certain obligations under the Amended APPI. 

China passed its DSL and its PIPL in 2021. Both new laws impact every business operating in or doing business with China, coupling extensive obligations with respect to the processing of all types of data, with potentially significant penalties for noncompliance. With the promulgation of the DSL and PIPL, China has tightened up regulation on collection, processing, sharing and cross-border transfer of personal data and important data such as financial data. The data security regime has an extraterritorial effect and imposes additional compliance obligations with respect to processing (in and outside China) of personal data of Chinese individuals and other data which may be viewed sensitive or important. These regulations apply not only to our client’s payers who are Chinese nationals (such as students seeking to study abroad) but also China-based employees as well as third party business partners. 

As a reaction to data security concerns, the Australian parliament, in 2022, approved a bill to amend the country's privacy legislation, significantly increasing the maximum penalties for companies and data controllers who suffer large-scale data breaches to the greater of: (i) AU$50 million, (ii) three times the value of any benefit obtained through the misuse