Company: CRCL
Filing Date: 2025-05-16
Form Type: S-1/A
Source: 0001193125-25-121234
Chunk: 106

Company: Circle Internet Group, Inc.
Filing Date: 2025-05-16
Form: S-1/A
Chunk 106
---
 European Union and the United Kingdom, we are subject to the GDPR and the UK GDPR.
These regimes impose stringent data protection requirements and may increase both the risk of noncompliance and the costs of providing our products and services in a compliant manner. These regimes grant rights for data subjects in regard to their
personal data (including the right to be “forgotten” and the right to data portability) and enhance preexisting rights (e.g., data subject access requests). A breach of the GDPR or UK GDPR could result in regulatory investigations,
reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, assessment notices (for a compulsory audit), and civil claims, including representative actions and other class action-type
litigation. Further, Post-Brexit, the UK GDPR will not automatically incorporate changes made to the GDPR going forward, which creates a risk that the GDPR and the UK GDPR may increasingly diverge from each other, thereby increasing both our
compliance costs and the potential for noncompliance.

In addition, the GDPR imposes strict rules on the transfer of personal data out of the EEA to a “third
country,” including the United States. The same is true for the UK GDPR. These obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our
practices. On July 11, 2023, the European Commission entered into force its adequacy decision for the EU-U.S. Data Privacy Framework (the “EU-U.S. DPF”) (a new framework for transferring
personal information from the EEA to the United States), having determined that such framework ensures that the protection of personal information transferred from the EEA to the United States will be comparable to the protection offered in the EU.
However, this decision will likely face legal challenges and ultimately may be invalidated by the Court of Justice of the European Union just as the EU-U.S. Privacy Shield Framework was. Additionally, on
October 12, 2023, a UK-U.S. Data Bridge went into effect to operate as an extension of the EU-U.S. DPF to facilitate transfers of personal data from the United Kingdom to the United States. Such Data
Bridge could not only be challenged, but also may be affected by any challenges to the EU-U.S. DPF. Complying with these obligations and applicable guidance regarding cross-border data transfers could be expensive and time-consuming. It may require
us to modify our