Company: CNTB
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001835268-25-000014
Chunk: 137

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 137
---
ations. We may be subject to diverging requirements under EU member state laws and UK law, such as whether consent can be used as a legal basis for processing and the roles, 

51

responsibilities and liabilities between the different parties involved in clinical trials. As these laws develop, we may need to make operational changes to adapt to these diverging rules, which could increase our costs and adversely affect our business. More generally, the GDPR imposes additional obligations on controllers, including, among other things, requirements around accountability and transparency, the obligation to consider data protection when any new products or services are developed, the obligation to comply with individuals’ data protection rights, and the obligation to report personal information breaches.  

Since we are under the supervision of the relevant data protection authorities in both the EEA and the UK, we may be fined under both the EU GDPR and the UK GDPR for the same breach. Failure to comply with the requirements of the GDPR may result in fines of up to €20,000,000 / £17,500,000 or up to 4% of the noncompliant company’s total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties. In addition, the GDPR confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR.

In relation to cross-border transfers, case law from the Court of Justice of the European Union (“CJEU”) states that reliance on the standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal information transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. In relation to data transfers to the US, the EU-US Data Privacy Framework (“DPF”) was approved by the European Commission in July 2023 as an effective EU GDPR data transfer mechanism to U.S. entities self-certified under the DPF. The UK Extension to the DPF followed in October 2023, as an effective UK GDPR data transfer mechanism to U.S. entities self-certified under the UK Extension to the DPF. 

We expect the existing legal complexity and uncertainty regarding international personal information transfers to continue under the UK GDPR and EU GDPR. In particular, we expect the DPF to be challenged and international transfers to the U.S. and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement