Company: TEAM
Filing Date: 2025-01-31
Form Type: 10-Q
Source: 0001650372-25-000009
Chunk: 80

Company: Atlassian Corp
Filing Date: 2025-01-31
Form: 10-Q
Item: Part I, Item 3
Chunk 80
---
 example, in July 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S. Privacy Shield Framework, one of the mechanisms that allowed companies, including Atlassian, to transfer personal data from the European Economic Area (“EEA”) to the United States. Even though the CJEU decision upheld the Standard Contractual Clauses as an adequate transfer mechanism, the decision created uncertainty around the validity of all EU-to-U.S. data transfers. While the EU and U.S. governments have recently adopted the EU-U.S. Data Privacy Framework to foster EU-to-U.S. data transfers and address the concerns raised in the aforementioned CJEU decision, it is uncertain whether this framework will eventually be overturned in court like the previous two EU-U.S. bilateral cross-border transfer frameworks. Certain countries outside of the EEA have also passed or are considering passing laws requiring varying degrees of local data residency. By way of further example, statutory damages available through a private right of action for certain data breaches under the CPRA and potentially other U.S. states’ laws, may increase our and our customers’ potential liability and the demands our customers place on us. As another example, jurisdictions are considering legal frameworks on AI, which is a trend that may increase now that the first such framework has entered into force in the EU; several others have been passed in various jurisdictions.

The costs of compliance with, and other burdens imposed by, privacy laws, regulations and standards may limit the use and adoption of our services, reduce overall demand for our services, make it more difficult to meet expectations from our commitments to customers and our customers’ users, lead to significant fines, penalties or liabilities for noncompliance, impact our reputation, or slow the pace at which we close sales transactions, in particular where customers request specific warranties and unlimited indemnity for noncompliance with privacy laws, any of which could harm our business. We have adopted and continue to adopt data residency in certain territories. These services may enhance our ability to attract and retain customers operating in the relevant jurisdictions, but may also increase the cost and complexity of supporting those customers, the scope of our residency offering may not align with customer needs, and our customers may request similar offerings in other territories.

In addition to government activity, privacy advocates and other industry groups have established or may establish new self-regulatory standards that may place additional burdens on our ability to provide our services globally. Our customers expect us to meet voluntary certification and other standards established by third parties. If we are unable to maintain