Company: BL
Filing Date: 2025-05-07
Form Type: 10-Q
Source: 0001666134-25-000016
Chunk: 122

Company: BLACKLINE, INC.
Filing Date: 2025-05-07
Form: 10-Q
Item: Part II, Item 1A
Chunk 122
---
2018, the global regulatory landscape relating to privacy, data protection, and cybersecurity has grown increasingly complex and fragmented and is rapidly evolving. As a result, our business faces current and prospective risks related to increased regulatory compliance costs, reputational harm, negative effects on our existing business and on our ability to attract and retain new customers, and increased potential exposure to regulatory enforcement, litigation, and/or financial penalties for non-compliance. For example, in July 2020, the Court of Justice of the European Union (“CJEU”) invalidated the Privacy Shield framework, which enabled companies to legally transfer data from the European Economic Area (“EEA”) to the U.S. This ruling from the CJEU and recent rulings from various European Union (“EU”) member state data protection authorities have created complexity and uncertainty regarding processing and transfers of personal data from the EEA to the U.S. and certain other countries outside the EEA. 

Moreover, on June 4, 2021, the European Commission adopted new Standard Contractual Clauses (“SCCs”), which impose additional obligations relating to personal data transfers out of the EEA. The new SCCs, and similar standard contractual clauses adopted in the UK, may increase the legal risks and liabilities associated with cross-border data transfers, and result in material increased compliance and operational costs. Following issuance of a U.S. Executive Order, a new framework, the EU-U.S. Data Privacy Framework (“DPF”) was created. Following an adequacy decision issued by the European Commission on July 10, 2023, the DPF, along with a UK extension to the DPF that allows the transfer of personal data from the UK to the U.S. (the “UK DPF Extension”) and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”), are available for companies to use to legitimize personal data transfers to the U.S. from the EEA, Switzerland, and UK. We have certified to the U.S. Department of Commerce that we adhere to the DPF, UK DPF Extension, and Swiss-U.S. DPF. However, the DPF has been subject to a legal challenge, and it, the UK DPF Extension, and the Swiss-U.S. DPF may be subject to legal challenges in the future from privacy advocacy groups or others. The European Commission's adequacy decision regarding the DPF also provides that the DPF will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations in scope by the