Company: RSKD
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001851112-25-000006
Chunk: 31

Company: RISKIFIED LTD.
Filing Date: 2025-03-06
Form: 20-F
Item: Item 3
Chunk 31
---
ements of the EU GDPR. Finally, in addition to these regulatory risks, any infringement of such legislation could lead to reputational risk and significantly undermine customers’ trust in our business.

There is currently complexity and uncertainty regarding transfers of Personal Information from the EEA or UK to countries outside the EEA or UK, as applicable. We expect this complexity and uncertainty, and enhanced scrutiny by regulators, to continue and we cannot guarantee the ongoing efficacy and longevity of our data transfer mechanisms (including the European Commission’s standard contractual clauses, or SCCs, and the UK Addendum to the SCCs, as well as the EU-US Data Privacy Framework and the UK Extension to the EU-US Data Privacy Framework). These recent developments may require us to review and amend the legal mechanisms by which we transfer Personal Information from the EEA and the United Kingdom. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the European Commission approval of the current EU-US Data Privacy Framework for data transfers to certified entities in the United States to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer Personal Information between and among countries and regions in which we operate, it could affect the manner in which we provide our products, the geographical location or segregation of our relevant systems and operations, and could adversely affect our business, financial condition and results of operation.

The GDPR also imposes stringent rules and restrictions on automated decision making including profiling, that results in a legal or similarly significant effect on an individual. A decision of the Court of Justice of the European Union (“ CJEU”) has introduced uncertainty in the interpretation of these rules, and may bring certain of our functionalities into scope of these rules on automated decision making. Following a referral from a German court, the CJEU has expanded the scope for automated decision making under the GDPR by finding that automated decision making activities (such as credit scoring) can fall within the GDPR’s restrictions even if the legal or similarly significant effect for the individual is carried out by a third party (such as a bank declining an application for a loan), in the certain circumstances. According to the CJEU, the concept of a ‘decision’ (in automated decision making) needs to be interpreted broadly. The judgment concluded that a decision may include a number of acts which