Company: DOMO
Filing Date: 2025-09-05
Form Type: 10-Q
Source: 0001505952-25-000075
Chunk: 37

Company: DOMO, INC.
Filing Date: 2025-09-05
Form: 10-Q
Item: Item 1A
Chunk 37
---
 to long term, and the United Kingdom is contemplating new data protection legislation. On June 28, 2021, the European Commission announced a decision of “adequacy” concluding that the United Kingdom ensures an equivalent level of data protection to the GDPR, which provides some relief regarding the legality of continued personal data flows from the European Economic Area to the United Kingdom. This adequacy determination must be renewed, however, and may be modified or revoked in the interim. The United Kingdom has proposed modifications to its data protection regime that may impact this adequacy determination, leading to the European Commission to propose extension of the deadline for renewal of its adequacy determination to December 27, 2025. Further, United Kingdom data protection law imposes restrictions on personal data transfers to the U.S., similar to those imposed by the GDPR, and the United Kingdom’s Information Commissioner’s Office issued new standard contractual clauses, effective March 21, 2022, that are required to be implemented.

We previously were certified under the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield with respect to our transfer of certain personal data from the E.U. and Switzerland to the United States. The E.U.-U.S. Privacy Shield framework and the use of E.U. Standard Contractual Clauses (the SCCs) to protect data exports between the E.U. and the U.S. have been subject to legal challenges in the E.U, and on July 16, 2020, the Court of Justice of the European Union (the CJEU), Europe's highest court, held in the “Schrems II” case that the E.U.-U.S. Privacy Shield was invalid, and imposed additional obligations in connection with the use of the SCCs. The Swiss data protection and information commissioner subsequently concluded that the Swiss-U.S. Privacy Shield was invalid on similar grounds. The European Commission issued new SCCs on June 4, 2021, addressing aspects of the CJEU’s opinion in the Schrems II case, which were required to be implemented. The European Commission and United States agreed in principle in March 2022 to a new EU-U.S. Data Privacy Framework (DPF), with respect to the European Commission adopted an adequacy decision in July 2023, allowing the DPF to be implemented and available for participating entities to use to legitimize transfers of personal data from the E.U. to the U.S. We have self-certified to the DPF, the Swiss-U.S. Data Privacy