Company: RSI
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001793659-25-000047
Chunk: 155

Company: Rush Street Interactive, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 155
---
, have to change our business practices or face reputational harm, any of which could have an adverse effect on our business. Serious breaches of the GDPR can result in administrative fines of up to 4% of annual worldwide revenues. Fines of up to 2% of annual worldwide revenues can be levied for other specified violations; and 

38

•Various state privacy laws, many of which give new data privacy rights to their respective residents (including, in California, a private right of action in the event of a data breach resulting from our failure to implement and maintain reasonable security procedures and practices) and impose significant obligations on controllers and processors of consumer data.

Further, we are subject to evolving laws and regulations that dictate whether, how and under what circumstances we can transfer, process and/or receive personal data. The EU-U.S. Privacy Shield framework that previously allowed U.S. companies that self-certify to the U.S. Department of Commerce and publicly commit to comply with specified requirements to import personal data from the EU has been invalidated by the Court of Justice of the EU (the “CJEU”). The CJEU upheld Standard Contractual Clauses (“SCCs”) as a valid transfer mechanism, provided they meet certain requirements. On June 4, 2021, the European Commission published new SCCs for this purpose, and we may have to adapt our existing contractual arrangements to meet these new requirements. The validity of data transfer mechanisms remains subject to legal, regulatory and political developments in both Europe and the United States, such as recent recommendations from the European Data Protection Board, decisions from supervisory authorities, recent proposals for reform of the data transfer mechanisms for transfers of personal data outside the United Kingdom, and potential invalidation of other data transfer mechanisms, which, together with increased enforcement action from supervisory authorities in relation to cross-border transfers of personal data, could have a significant adverse effect on our ability to process and transfer personal data outside of the European Economic Area and/or the United Kingdom.

These laws and regulations are evolving and subject to interpretation, including developments that create some uncertainty, and compliance obligations could cause us to incur costs or harm the operations of our offerings in ways that harm our business. For example, in the EU, several supervisory authorities have issued new guidance concerning the ePrivacy Directive’s requirements regarding the use of cookies and similar technologies, including limitations on the use of data across messaging products and specific requirements for enabling users to accept or reject cookies, and have in some cases brought (and may bring in the future) enforcement action in