Company: MLTX
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001821586-25-000006
Chunk: 111

Company: MoonLake Immunotherapeutics
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 111
---
 data protection laws differently, and introduce additional national regulations and guidelines, which adds to the complexity of processing personal data in the EU. 

Furthermore, there are specific requirements relating to processing health data from clinical trials, including public disclosure obligations provided in the EU CTR, EMA disclosure initiatives and voluntary commitments by industry. Failing to comply with these obligations could lead to government enforcement actions and significant penalties against us, harm to our reputation, and adversely impact our business and operating results. 

Additionally, following the UK’s withdrawal from the EEA, known as Brexit, companies also have to comply with the UK’s data protection laws (including the GDPR, as incorporated into UK national law), the latter regime having the ability to impose fines up to the greater of £17.5 million or 4% of global turnover. Furthermore, transfers from the UK to other countries are subject to UK international transfer rules, which broadly mirror the EU GDPR rules. Personal data may however freely flow from the UK to the EEA since the EEA is deemed to have an adequate data protection level for purposes of the UK regime. With regard to the transfer of personal data from the UK to the United States, from  October 12, 2023, businesses in the UK can start to transfer personal data to US organizations certified to the “UK Extension to the EU-US Data Privacy Framework” under the UK GDPR, without the need for further safeguards. On March 21, 2022, the international data transfer agreement (IDTA) and the international data transfer addendum to the EC’s standard contractual clauses for international data transfers (Addendum), and a document setting out transitional provisions came into force and replaced the old EU SCCs for purposes of the UK regime. 

Furthermore, processing of personal data in Switzerland is governed by restrictive regulations, in particular the Federal Act on Data Protection (the “FDAP”), of September 25, 2020, as revised by the new FDAP, which came into force on the September 1, 2023. The FDAP is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data and taking certain measures when engaging processors. Breaches of or non-compliance with applicable data protection regulations and professional secrecy obligations could result in fines, or, under certain circumstances, criminal sanctions.