Company: TCOM
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001193125-25-078429
Chunk: 121

Company: Trip.com Group Ltd
Filing Date: 2025-04-11
Form: 20-F
Item: Item 4
Chunk 121
---
 of data processors are also regulated, and companies undertaking processing activities are required to offer certain guarantees in relation to the security of processing and the handling of personal data. Contracts between data controllers and data processors will also need to be updated to include certain terms prescribed by the GDPR, and negotiating these updates may not be fully successful in all cases. Failure to comply with the European Union laws, including failure under the GDPR and other laws relating to the security of personal data may result in fines up to €20,000,000 (£17,500,000 under the UK GDPR) or up to 4% of the total worldwide annual turnover of the preceding financial year, if greater, and other administrative penalties including regulatory investigations, reputational damage, orders to cease/change our data processing activities, enforcement notices, assessment notices (for a compulsory audit),civil claims (including class actions) and, in certain EU jurisdictions, criminal liability. 
 In June 2024, the European Union legislators formally signed the EU Artificial Intelligence Act, or the EU AI Act, which came into effect on August 1, 2024. The EU AI Act sets a comprehensive legal framework for the development, provision, marketing and use of AI in the EU market, establishing a detailed classification for AI systems through a risk-based approach. Companies that develop, provide, or use AI in the EU are subject to a series of obligations under the EU AI Act, varying from risk levels of their AI use case, such as conformity assessments, transparency requirements, information provision, human oversight, accuracy and security. Violation of the provisions under the EU AI Act could result in fines of up to €35 million or 7% annual worldwide turnover from the preceding financial year, whichever is higher. 
 In the European Union, the Digital Services Act, which is known as the DSA, came into force on November 16, 2022. The act governs, among other things, potential liability for illegal products on online platforms as well as obligations around traceability of merchants/business users and require enhanced transparency measures including in relation to any recommendation systems used to present product options to a user, including the main parameters used by such systems and any available options for recipients to modify or influence them. In particular, if an online platform presents information about products in a way that would lead an average consumer to understand the product is provided by the platform directly, rather than by a third-party merchant, the platform may be liable directly under consumer protection law. Further, the DSA contains general requirements that user interfaces may