Company: INKT
Filing Date: 2025-03-18
Form Type: 10-K
Source: 0000950170-25-041379
Chunk: 83

Company: MiNK Therapeutics, Inc.
Filing Date: 2025-03-18
Form: 10-K
Item: Item 1A
Chunk 83
---
 framework, one of the mechanisms used to legitimize the transfer of personal data from the EEA to the United States, has led to increased scrutiny on data transfers from the EEA to the United States generally and may increase our costs of compliance with data privacy legislation. If our or our partners’ or service providers’ privacy or data security measures fail to comply with the GDPR requirements, we may be subject to litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data and/or fines of up to €20.0 million or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, as well as claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill. Additionally, following Brexit, we must comply with the GDPR and the United Kingdom GDPR, each regime having the ability to fine up to the greater of €20.0 million or 4% of global turnover for violations. The relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, for example around how data can lawfully be transferred between each jurisdiction, which exposes us to further compliance risk. In addition, we may be the subject of litigation and/or adverse publicity, which could adversely affect our business, results of operations and financial condition. 

Data privacy remains an evolving landscape at both the domestic and international level, with new regulations coming into effect and continued legal challenges, and our ongoing efforts to comply with evolving laws and regulations may be costly and require ongoing modifications to our policies, procedures and systems. Our efforts to comply may also be unsuccessful. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices. Failure to comply with laws regarding data protection would expose us to risk of enforcement actions taken by data protection authorities in the European Union and elsewhere and carries with it the potential for significant penalties if we are found to be non-compliant. Similarly, failure to comply with federal and state laws in the United States regarding privacy and security of personal information could expose us to penalties under such laws. Any such failure to comply with data protection and privacy laws could result in government-imposed fines or orders requiring that we change our practices, claims for damages by data subjects, regulatory investigations and enforcement action, litigation and significant costs for remediation, any of which could adversely affect our business. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate