Company: MLTX
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001821586-25-000006
Chunk: 110

Company: MoonLake Immunotherapeutics
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 110
---
 their national legislation.

The GDPR also imposes specific restrictions on the transfer of personal data to countries outside of the EEA that are not considered by the EU Commission to provide an adequate level of data protection. Appropriate safeguards are required to enable such transfers. Among the appropriate safeguards that can be used, the data exporter may use the standard contractual clauses (“SCCs”), as updated in 2021. In this respect, when relying on SCCs, the data exporters are required to conduct a transfer risk assessment to verify if anything in the law and/or practices of the third country may impinge on the effectiveness of the SCCs in the context of the transfer at stake and, if so, to identify and adopt supplementary measures that are necessary to bring the level of protection of the data transferred to the EU standard of essential equivalence. Where no supplementary measure is suitable, the data exporter should avoid, suspend or terminate the transfer. With regard to the transfer of personal data from the EEA to the United States, on July 10, 2023, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework. On the basis of the new adequacy decision, personal data can flow from the EEA to United States companies participating in the framework. With regard to the transfer of data from the EU to the United Kingdom, on 

56

MOONLAKE IMMUNOTHERAPEUTICSFORM 10-K FOR THE YEAR ENDED DECEMBER 31, 2024PART I

June 28, 2021, the EC adopted two adequacy decisions for the UK – one under the GDPR and the other for the Law Enforcement Directive. Personal data may now freely flow between the EEA and the UK since the UK is deemed to have an adequate data protection level for purposes of the EU regime. However, the adequacy decisions include a ‘sunset clause’ which entails that the decisions will automatically expire four years after their entry into force, unless renewed. 

Failure to comply with the requirements of the GDPR and the related national data protection laws of the EU Member States may result in significant monetary fines for noncompliance of up to €20 million or 4% of the annual global turnover of the noncompliant company, whichever is greater, other administrative penalties and a number of criminal offenses for organizations and, in certain cases, their directors and officers, as well as civil liability claims from individuals whose personal data was processed. Data protection authorities from the different EU Member States may still implement certain variations, enforce the GDPR and national