Company: IMXI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001683695-25-000030
Chunk: 42

Company: International Money Express, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 42
---
 and/or require us to incur substantial compliance costs, which could have an adverse impact on our business. In addition, the California Privacy Rights Act of 2020 (“CPRA”) expanded the CCPA. For example, the CPRA established a California Privacy Protection Agency to implement and enforce the CPRA, which could increase the risk of an enforcement action. Other states have also enacted data privacy laws such as the Consumer Data Protection Act in Virginia, the Colorado Privacy Act in Colorado, and the Consumer Privacy Act adopted in Utah. Additionally, several states and localities have enacted measures related to the use of artificial intelligence and machine learning in products and services. In addition, data privacy and security laws have been proposed at the federal, state, and local levels in recent years, which could further complicate compliance efforts. Failure to comply with existing or future data privacy and cybersecurity laws, regulations, and requirements, including by reason of inadvertent disclosure of personal information, could result in significant adverse consequences, including reputational harm, civil litigation, regulatory enforcement, costs of remediation, increased expenses for security systems and personnel, or harm to our consumers and harm to our agents. 

22

Also, because our operations and services involve the collection, storage, and processing of personal data of consumers globally, we are subject to the GDPR and similar data protection laws outside the United States. The GDPR imposes strict requirements on how businesses collect, process, store, and share personal data, as well as mandates that consumers have specific rights, including the right to access, correct, and delete their data.

In addition, in connection with regulatory requirements to assist in the prevention of money laundering and terrorist financing and pursuant to legal obligations and authorizations, we make information available to certain U.S. federal and state, as well as certain foreign, government agencies. Periodically, we receive data sharing requests by these agencies, particularly in connection with efforts to prevent terrorist financing, human traffic or reduce the risk of identity theft. During the same period, there has also been increased public attention to the corporate use and disclosure of personal information, accompanied by legislation and regulations intended to strengthen data protection, information security, and consumer privacy. These regulatory goals may conflict, and the law in these areas is not consistent or settled. While we believe that we are compliant with our regulatory responsibilities, the legal, political, and business environments in these areas are rapidly changing, and subsequent legislation, regulation, litigation, court rulings, or other events could expose us to increased program costs, liability, and reputational damage that