Company: FRFXF
Filing Date: 2025-03-14
Form Type: F-4
Source: 0001104659-25-024010
Chunk: 93

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-03-14
Form: F-4
Chunk 93
---
 GDPR
prohibit companies from transferring personal data from inside the EEA or the United Kingdom to countries that are outside the EEA or
the United Kingdom that are not considered to provide “adequate” protections to personal data unless an export solution is
in place or a derogation is used. Countries considered to be “adequate” are Andorra, Argentina, Canada (commercial organizations
only), Faroe Islands, Guernsey, Isle of Man, Israel, Japan (private-sector organizations only), Jersey, New Zealand, the Republic
of Korea, Switzerland, the United States (only commercial organizations participating in the EU-US Data Privacy Framework (“DPF”)
and Uruguay. The United Kingdom is also considered “adequate” under the EU GDPR in respect of transfers from the EEA, and
the EEA is considered “adequate” under the UK GDPR in respect of transfers from the United Kingdom.

In July 2020, a European
Court of Justice decision (“Schrems II”) invalidated one of the primary methods for transferring personal data to
the United States at the time (Privacy Shield) and placed additional conditions on the use of the main alternative export solution, the
Standard Contractual Clauses (the “SCCs”) (which could also be relied upon for transfers of personal data subject
to the UK GDPR, if used alongside an addendum approved by the U.K. Information Commissioner’s Office). On July 10, 2023, the
European Commission also adopted an “adequacy decision” in relation to the DPF, which enables the transfer of personal data
from the EEA to DPF-certified U.S. organizations without using the SCCs or other export mechanisms and replaces the transfer mechanism
from the European Union to companies in the United States that was invalidated by the Schrems II decision. Transfers can also be made
from the United Kingdom to DPF-certified US organizations without using the SCCs or other export mechanisms, provided that the U.S. organization
has certified to the “UK Extension” of the DPF.

| - 54 - |

National data protection
authorities have increased enforcement powers under the EU GDPR and UK GDPR (which provide for maximum fines for non-compliance of the
higher of €20 million/£17.5 million and four per cent of an organization’s worldwide turnover). In recent years, enforcement
has been particularly focused on issues such as inadequate security resulting in personal data breaches, the sending of unsolicited marketing
communications