Company: FLYW
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027078
Chunk: 100

Company: Flywire Corp
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 100
---
 processing of personal information, which in some cases are more restrictive than those in the United States. In addition to regulating the processing of personal information within the relevant jurisdictions, these legal requirements often also apply to the processing of personal information outside these jurisdictions, where there is some specified link to the relevant jurisdiction. For example, Flywire has multiple offices in Europe and serves clients and their customers throughout the E.U., where GDPR went into effect in 2018. The GDPR, which also is the law in Iceland, Norway, Liechtenstein, and—to a large degree—the U.K., has an extensive global reach and imposes robust obligations relating to the processing of personal information, including documentation requirements, greater control for data subjects (e.g., the “right to be forgotten” and data portability), security requirements, notice requirements, restrictions on sharing personal information, data governance obligations, data breach notification requirements, and restrictions on the export of personal information to most other countries. Fines of up to 20 million Euros or up to 4% of the annual global revenue of a noncompliant corporate family, whichever is greater, could be imposed for violations of certain of the GDPR’s requirements, and private claims also are possible. 

Recent legal developments have created compliance uncertainty regarding some transfers of personal information from the U.K. and EEA to locations where we or our clients operate or conduct business, including the United States and potentially Singapore. Under the GDPR, such transfers can take place only if certain conditions apply or if certain data transfer mechanisms are in place. In July 2020, the Court of Justice of the E.U. ruled in its “Schrems II” decision (C-311/18), that the Privacy Shield, a transfer mechanism used by thousands of companies to transfer data between those jurisdictions and the United States (and also used by Flywire), was invalid and could no longer be used due to the strength of United States surveillance laws. In September 2020, the Federal Data Protection and Information Commissioner of Switzerland (where the law has a similar restriction on the export of personal information) issued an opinion concluding that the Swiss-U.S. Privacy Shield Framework does not provide an adequate level of protection for data transfers from Switzerland to the United States pursuant to Switzerland’s Federal Act on Data Protection. We and our clients continue to use alternative transfer strategies including the European Commission’s Standard Contractual Clauses (SCCs) while the authorities interpret the Schrems II decision and the validity of alternative data transfer mechanisms. The SCCs, though previously approved