Company: FSLY
Filing Date: 2025-05-07
Form Type: 10-Q
Source: 0001517413-25-000111
Chunk: 395

Company: Fastly, Inc.
Filing Date: 2025-05-07
Form: 10-Q
Item: Part I, Item 8
Chunk 395
---
 Geral de Proteção de Dados Pessoais or “LGPD”) (Law No. 13,709/2018), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Canada’s Anti-Spam Legislation (“CASL”), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing the personal information of individuals. For example, under the GDPR, government regulators may impose restrictions or injunctions on data processing, and fines of up to 20 million euros (£17.5 million) or 4% of annual global revenue, whichever is greater. The GDPR also provides for private litigation related to the processing of personal information, which can be brought by classes of data subjects or consumer protection organizations authorized by law to represent the interests of such classes. European legislative proposals and existing laws and regulations also apply to cookies and similar tracking technologies, electronic communications, and marketing. In the EU and the United Kingdom ("UK"), regulators are increasingly focusing on compliance with requirements related to the online behavioral advertising ecosystem. It is anticipated that the ePrivacy Regulation and national implementing laws will replace the current national laws that implement the ePrivacy Directive that governs electronic communications. Compliance with these laws may require us to make significant operational changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, and subject us to liabilities. Furthermore, there is a new regulation in the EU related to AI that will impose onerous obligations related to the use of AI-related systems and may require us to change our business practices. We may also become subject to new laws in the EU that regulate cybersecurity and non-personal information, such as the European Data Act. 

73

Depending on how these laws are interpreted, we may have to adapt our business practices and products to comply with such obligations.

Certain jurisdictions have enacted data localization laws and cross-border personal information transfer laws, which could make it more difficult to transfer information across jurisdictions. In particular, the European Economic Area (“EEA”) and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy and data security laws are generally believed to be inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border personal information transfer laws. Although there are currently various mechanisms that may be used to lawfully transfer personal information to the United States, such as the standard contractual clauses for transfers from the EEA and UK, the UK’s International Data Transfer Agreement / Addendum, and the EU-U