Company: CNTB
Filing Date: 2025-05-15
Form Type: 10-Q
Source: 0001835268-25-000035
Chunk: 62

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-05-15
Form: 10-Q
Item: Part I, Item 8
Chunk 62
---
 UK GDPR for the same breach. Failure to comply with the requirements of the GDPR may result in fines of up to €20,000,000 / £17,500,000 or up to 4% of the noncompliant company’s total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties. In addition, the GDPR confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR.

24

In relation to cross-border transfers, case law from the Court of Justice of the European Union states that reliance on the standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal information transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. In relation to data transfers to the US, the EU-US Data Privacy Framework (“DPF”) was approved by the European Commission in July 2023 as an effective EU GDPR data transfer mechanism to U.S. entities self-certified under the DPF. The UK Extension to the DPF followed in October 2023, as an effective UK GDPR data transfer mechanism to U.S. entities self-certified under the UK Extension to the DPF. 

We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue under the UK GDPR and EU GDPR. In particular, we expect the DPF to be challenged and international transfers to the U.S. and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. Further, the U.S. Department of Justice recently issued a final rule that went into effect in April 2025, known as the “Data Security Program” (the “DSP Rule”), which regulates data transactions that could grant access to certain volumes of specified types of U.S. sensitive personal data to certain foreign actors with connections to “countries of concern,” such as China, which the DSP Rule refers to as “covered persons.” We do not believe that we are currently engaged in covered data transactions that implicate the DSP Rule, but we may engage in such transactions in the future, in which case any such transactions could be restricted and subject to certain compliance obligations under the DSP Rule, including with respect to cybersecurity, recordkeeping, reporting and auditing. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have