Company: CRCL
Filing Date: 2025-02-13
Form Type: DRS/A
Source: 0000950123-25-001965
Chunk: 99

Company: Circle Internet Group, Inc.
Filing Date: 2025-02-13
Form: DRS/A
Chunk 99
---
 and provides a private right of action for certain data breaches
involving the loss of personal data. The California Privacy Rights Act modified the CCPA by expanding consumers’ rights with respect to certain personal data and creating a new state agency to oversee implementation and enforcement efforts.
Another example is the Virginia Consumer Data Protection Act, which regulates how businesses collect and share personal information. With bills proposed in many other jurisdictions, it remains quite possible that other states will enact similar
privacy and data protection legislation. Such proposed legislation, if enacted, may add additional complexity, conflicting requirements, additional restrictions, and potential legal risk. The existence of comprehensive privacy laws in different
states will make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance.

As a result of our presence in Europe and some of our customers being located in the European Union and the United Kingdom, we are subject to the GDPR and the UK GDPR.
These regimes impose stringent data protection requirements and may increase both the risk of noncompliance and the costs of providing our products and services in a compliant manner. These regimes grant rights for data subjects in regard to their
personal data (including the right to be “forgotten” and the right to data portability) and enhance preexisting rights (e.g., data subject access requests). A breach of the GDPR or UK GDPR could result in regulatory investigations,
reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, assessment notices (for a compulsory audit), and civil claims, including representative actions and other class action-type
litigation. Further, Post-Brexit, the UK GDPR will not automatically incorporate changes

62

CONFIDENTIAL TREATMENT REQUESTED BY CIRCLE INTERNET GROUP, INC. PURSUANT TO 17 C.F.R. § 200.83

made to the GDPR going forward, which creates a risk that the GDPR and the UK GDPR may
increasingly diverge from each other, thereby increasing both our compliance costs and the potential for noncompliance.

In addition, the GDPR imposes strict rules
on the transfer of personal data out of the EEA to a “third country,” including the United States. The same is true for the UK GDPR. These obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to
another and may conflict with other requirements or our practices. On July 11, 2023, the European Commission entered