Company: FRFXF
Filing Date: 2025-10-09
Form Type: F-10/A
Source: 0001104659-25-098335
Chunk: 103

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-10-09
Form: F-10/A
Chunk 103
---
 only), Jersey, New Zealand, the Republic of Korea, Switzerland, the United States (only commercial organizations participating in the EU-US Data Privacy Framework (“

#### DPF
”)) and Uruguay. The United Kingdom is also considered “adequate” under the EU GDPR in respect of transfers from the EEA, and the EEA is considered “adequate” under the UK GDPR in respect of transfers from the United Kingdom.

In July 2020, a European Court of Justice decision (“

#### Schrems II
”) invalidated one of the primary methods for transferring personal data to the United States at the time (Privacy Shield) and placed additional conditions on the use of the main alternative export solution, the Standard Contractual Clauses (the “

#### SCCs
”) (which could also be relied upon for transfers of personal data subject to the UK GDPR, if used alongside an addendum approved by the U.K. Information Commissioner’s Office). On July 10, 2023, the European Commission also adopted an “adequacy decision” in relation to the DPF, which enables the transfer of personal data from the EEA to DPF-certified U.S. organizations without using the SCCs or other export mechanisms and replaces the transfer mechanism from the European Union to companies in the United States that was invalidated by the Schrems II decision. Transfers can also be made from the United Kingdom to DPF-certified US organizations without using the SCCs or other export mechanisms, provided that the U.S. organization has certified to the “UK Extension” of the DPF.

National data protection authorities have increased enforcement powers under the EU GDPR and UK GDPR (which provide for maximum fines for non-compliance of the higher of €20 million/ £17.5 million and four per cent of an organization’s worldwide turnover). In recent years, enforcement has been particularly focused on issues such as inadequate security resulting in personal data breaches, the sending of unsolicited marketing communications (especially in the United Kingdom), and the retention of data for excessive periods of time. Alongside the EU GDPR and UK GDPR, the rules surrounding the sending of electronic marketing communications and the use of cookies (and similar tracking technologies) are governed by the -e-Privacy Directive, which has been implemented at a local level across each EU Member State and in the United Kingdom as the Privacy and Electronic Communications Regulations (commonly known as “

#### PECR
”). Under the DUAA (defined below), fines for non-compliance under PECR are