Company: CRCT
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0001828962-25-000039
Chunk: 89

Company: Cricut, Inc.
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1A
Chunk 89
---
 new privacy laws proposed and enacted in various jurisdictions. For example, in May 2018, the GDPR went into effect in the EU. The GDPR imposed stringent data protection requirements and provides penalties for noncompliance of up to €20 million or 4% of annual global revenue, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to the United States as well as other countries that have not been found to provide adequate protection to such personal data. The GDPR also imposes numerous requirements on companies operating in the EU, including enhanced disclosures to data subjects about how personal data is processed (including information about the profiling of individuals and automated individual decision-making), limited retention periods of personal data, mandatory data breach notification obligations and additional policies and procedures required to comply with the accountability principle under the GDPR. In addition, data subjects have more robust rights with regard to their personal data.

Although legal mechanisms have been designed to allow for the transfer of personal data from the United Kingdom, the EEA, and Switzerland to the United States, uncertainty about compliance with such data protection laws remains and such mechanisms may not be available or applicable with respect to personal data processing activities undertaken in researching, developing and marketing our products and services. For example, legal challenges in Europe to the mechanisms allowing companies to transfer personal data from the EEA, United Kingdom and Switzerland to the United States could result in further limitations on the ability to transfer personal data across borders, particularly if governments are unable or unwilling to reach agreement on or maintain existing mechanisms designed to support cross-border data transfers. Specifically, on July 16, 2020, the Court of Justice of the EU, or CJEU, invalidated the EU-U.S. Privacy Shield Framework. The same decision also imposed additional conditions with respect to use of the Standard Contractual Clauses, or the SCCs, to lawfully transfer personal data from Europe to the United States and most other countries. The Swiss Federal Data Protection and Information 

43

Commissioner also has stated that it no longer considers the Swiss-U.S. Privacy Shield adequate for the purposes of personal data transfers from Switzerland to the United States. On October 7, 2022, President Biden signed an Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities, directing the United States to take certain steps to implement the EU-U.S. Data Privacy Framework or the DPF. Following a July 10, 2023 adequacy decision issued by  the European Commission, the DPF, along with a United Kingdom extension