Company: LBTYK
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0001570585-25-000021
Chunk: 45

Company: Liberty Global Ltd.
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1
Chunk 45
---
 decision is subject to a “sunset clause”, which establishes the automatic expiration of the decision on June 27, 2025. Before then, the European Commission must evaluate whether the U.K. continues to ensure an adequate level of data protection, and if so, renew the decision for another four years. 

The European Commission has adopted an adequacy decision on the E.U.-U.S. Data Privacy Framework, which replaces the Privacy Shield deal which was struck down by the European Court of Justice in July 2020. U.S. companies can join the E.U.-U.S. Data Privacy Framework by committing to comply with a detailed set of privacy obligations. E.U. citizens also have access to a number of redress mechanisms in case their personal data is handled in violation of this framework, including an independent dispute resolution mechanism and a newly created ‘Data Protection Review Court’. This framework is subject to periodic review by the European Commission, European data protection authorities and applicable U.S. authorities.

When a data transfer involves a third country that has not been granted an adequacy decision, our operations must use SCCs. The European Commission has made clear that using SCCs does not automatically make an international data transfer GDPR compliant. Instead, the parties must perform “transfer impact assessments” in order to address any possible risks in the data transfer and take supplementary measures. The impact assessment takes into account matters such as the circumstances of the transfer, the nature of the parties, the personal data involved and the laws and practices of the country of destination.

Other Regulations

In addition to the industry-specific regimes discussed above, our operating companies must comply with a range of both specific and general legislation concerning cybersecurity and consumer protection, among other matters.

With respect to cybersecurity, in 2016, the E.U. adopted a directive on security of network and information systems (NIS Directive), which provides legal measures to boost the overall level of cybersecurity in the E.U. Our operations in the E.U. do not fall under the NIS Directive, but a transposition of the Directive in Ireland, Slovakia and the Netherlands has effectively introduced the NIS Directive concepts into those jurisdictions. The successor to the NIS Directive, a directive on measures for a high common level of cybersecurity across the E.U. (NIS 2 Directive), was adopted by the E.U. legislature in 2022. E.U. Member States had until October 17, 2024 to transpose the NIS 2 Directive into their national legislation, and each Member State must provide a