Company: FLYW
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027078
Chunk: 167

Company: Flywire Corp
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 167
---
-level privacy legislation, which could increase our potential liability and adversely affect our business. Several states in the U.S. have proposed or enacted laws that contain obligations similar to the CCPA and CPRA that have taken effect or will take effect in coming years. The U.S. federal government also is contemplating federal privacy legislation. The effects of recently proposed or enacted legislation potentially are far-reaching. Such legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

Many of the foreign jurisdictions where we or our clients operate or conduct business, including the E.U., have laws and regulations dealing with the collection, use, storage, and disclosure and other handling (collectively, processing) of personal information, which in some cases are more restrictive than those in the U.S. In addition to regulating the processing of personal information within the relevant jurisdictions, these legal requirements often also apply to the processing of personal information outside these jurisdictions, where there is some specified link to the relevant jurisdiction. For example, we have multiple offices in Europe and serves clients and their customers throughout the E.U., where the GDPR went into effect in 2018. The GDPR, which is also the law in Iceland, Norway, Liechtenstein, and—to a large degree—the U.K., has an extensive global reach and imposes robust obligations relating to the processing of personal information, including documentation requirements, greater control for data subjects (e.g., the “right to be forgotten” and data portability), security requirements, notice requirements, restrictions on sharing personal information, data governance obligations, data breach notification requirements, and restrictions on the export of personal information to most other countries. The solutions that we currently offer subject us to many of these laws and regulations in many of the foreign jurisdictions where we operate or conduct business, and these laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. 

Legal developments have created compliance uncertainty regarding some transfers of personal information from the U.K. and EEA to locations where we or our clients operate or conduct business, including the United States and potentially Singapore, particularly with respect to cross-border transfers. Under the GDPR, such transfers can take place only if certain conditions apply or if certain data transfer mechanisms are in place. In July 2020, the Court of Justice of the E.U. ruled in its “