Company: FLYW
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027078
Chunk: 171

Company: Flywire Corp
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 171
---
 loss of business.

China (home to the most online users in the world) passed its DSL and its PIPL in 2021. The DSL applies to a wide range of data processing activities including, but not limited to, processing personal information. With extraterritorial scope and severe fines and penalties, these laws are set to impose an increasingly complex and comprehensive legal framework for processing personal information when doing business in China. The PIPL is enforced and administered by the Cyberspace Administration of China and relevant state and local government departments. The law draws from the GDPR, with heavy penalties up to the greater of 5% of the previous year’s revenue (possibly global) or $7.7 million. Chinese authorities have demonstrated a willingness to impose significant fines for violations of PIPL and other privacy laws, as evidenced by enforcement actions against Alibaba Group Holding Ltd and Didi Global Inc. in 2022.

62

As a reaction to data security concerns, in 2022, the Australian parliament approved a bill to amend the country's privacy legislation, significantly increasing the maximum penalties for companies and data controllers who suffer large-scale data breaches to the greater of: (i) AU$50 million, (ii) three times the value of any benefit obtained through the misuse of information, and (iii) 30% of a company's adjusted turnover in the relevant period. Previously, the penalty for severe data exposures was AU$2.22 million, considered by the current parliament to be wholly inadequate to incentivize companies to improve their data security mechanisms. The Office of the Australian Information Commissioner has new regulatory tools and flexibility that should, together with an ongoing focus on funding enforcement, see a more proactive regulator with capacity and capability to investigate and litigate more privacy incidents in Australia.

We have taken steps to address compliance obligations that apply to us under the Amended APPI, the DSL, the PIPL and applicable Australian regulations, but cannot assure you that such steps will be effective, and we may face the risk of increased costs, liability and loss of business.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that, if adopted, may apply to us, or which clients or clients' customers may require us to adopt. Because the interpretation and application of privacy and data protection laws, regulations, rules, and other standards are still uncertain, it is possible that these laws, rules, regulations, and other actual or alleged legal obligations, such as contractual or self-regulatory obligations, may be