Company: LIMN
Filing Date: 2025-01-16
Form Type: POS AM
Source: 0001104659-25-003835
Chunk: 138

Company: Liminatus Pharma, Inc.
Filing Date: 2025-01-16
Form: POS AM
Chunk 138
---
 to personal data that we process, and we may be required to put in place additional mechanisms ensuring compliance. In particular, with respect to cross-border transfers of personal data, judicial and regulatory developments in the European Union have created uncertainty. In a decision issued by the Court of Justice of the European Union (“CJEU”) on July 16, 2020, the CJEU invalidated one mechanism for cross-border personal data transfer, the EU-U.S. Privacy Shield, and imposed additional obligations on companies, including us, relying on standard contractual clauses (“SCCs”) issued by the European Commission for cross-border personal data transfers. The European Commission released new SCCs designed to address the CJEU concerns on June 4, 2021. We have undertaken certain efforts to conform transfers of personal data from the European Economic Area (“EEA”) to the United States to our understanding of current regulatory obligations and guidance of data protection authorities, but the CJEU’s decision, the revised SCCs, regulatory guidance and opinions, and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of the EEA, which may increase compliance costs, lead to increased regulatory scrutiny or liability, may require additional contractual negotiations, and may adversely impact our business, financial condition and operating results. Any actual or alleged failure to comply with the requirements of the GDPR or other laws, regulations, and directives of the member states of the European Union may result in substantial fines, other administrative penalties and civil claims being brought against us, which could have a material adverse effect on our business, financial condition and results of operations.

In addition, U.S. states are adopting new laws or amending existing laws and regulations, requiring attention to frequently changing regulatory requirements applicable to data related to individuals. For example, California has enacted the California Consumer Privacy Act (“CCPA”). The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined and which can include any of our current or future employees who may be California residents or any other California residents whose data we collect or process) and provide such residents new ways to opt out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. As we expand our operations and trials (