Company: IMRX
Filing Date: 2025-08-13
Form Type: 10-Q
Source: 0001790340-25-000104
Chunk: 258

Company: Immuneering Corp
Filing Date: 2025-08-13
Form: 10-Q
Item: Part II, Item 1A
Chunk 258
---
GDPR"), governs certain collection and other processing activities involving personal data about individuals in the European Economic Area (the "EEA"). The GDPR imposes substantial fines for breaches and violations. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the GDPR. Further, since January 1, 2021, companies have to comply with the GDPR and also the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR. 

The GDPR and UK GDPR regulate cross-border transfers of personal data out of the EEA and the UK respectively. Recent legal developments in Europe have created complexity and uncertainty regarding such transfers, in particular in relation to transfers to the United States. On July 16, 2020, the Court of Justice of the European Union or the CJEU invalidated the EU-US Privacy Shield Framework ("Privacy Shield") under which personal information could be transferred from the EEA (and the UK) to relevant self-certified U.S. entities. The CJEU further noted that reliance on the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism and potential alternative to the Privacy Shield) alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. In March 2022, the US and EU announced a new regulatory regime intended to replace the invalidated regulations; however, this new EU-US Data Privacy Framework has not been implemented beyond an executive order signed by President Biden on October 7, 2022 on Enhancing Safeguards for United States Signals Intelligence Activities. European court and regulatory decisions subsequent to the CJEU decision of July 16, 2020 have taken a restrictive approach to international data transfers. As the enforcement landscape further develops, and supervisory authorities issue further guidance on international data transfers, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; and/or it could otherwise affect the manner in which we provide our services, and could also adversely affect our business, operations and financial condition.

If we or third-party CMOs, CROs or other contractors, consultants or agents fail to comply with applicable federal, state, local or foreign regulatory requirements, we could be subject to a range of regulatory actions