Company: HURA
Filing Date: 2025-02-07
Form Type: S-4
Source: 0001193125-25-022803
Chunk: 248

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-02-07
Form: S-4
Chunk 248
---
erous. The EU GDPR imposes substantial fines for breaches and violations (up to the greater of €20 million or 4% of consolidated annual worldwide gross revenue), and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the EU GDPR. Relatedly, following the United Kingdom’s withdrawal from the EU (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the EU GDPR has been implemented in the United Kingdom (as the “UK GDPR”). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR, the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs with potential fines of up to the greater of £17.5 million or 4% of global turnover.

Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and Kineta may be required to put in place additional mechanisms ensuring compliance with the new data protection rules. Furthermore, the laws are not consistent, and compliance in the event of a widespread data breach is costly. In addition, states are constantly adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act (the “CCPA”), which took effect on January 1, 2020, became enforceable by the California Attorney General on July 1, 2020, and has been dubbed the first “GDPR-like” law in the United States. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their

<div align='center'>147</div>

personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provide such consumers new ways to opt-outof certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Further, the California Privacy