Company: SMNR
Filing Date: 2025-07-23
Form Type: S-4/A
Source: 0001193125-25-163401
Chunk: 550

Company: Semnur Pharmaceuticals, Inc.
Filing Date: 2025-07-23
Form: S-4/A
Chunk 550
---
 subject to, or our marketing activities may be limited by, data privacy and security regulations in the EEA, Switzerland, or the United Kingdom (“UK”), where the legislative and regulatory landscape continues to evolve. There has been increased regulator attention to privacy and data security issues that could potentially affect our business, including through legislation such as the EEA GDPR and UK GDPR, which each imposes strict obligations on the processing of personal data, including the transfer of personal data from the EEA, Switzerland, or UK to third countries that the European Commission has determined does not ensure an adequate level of protection, such as the United States. If we violate the GDPR, we may face significant penalties of up to EUR 10,000,000 or 2% of our total worldwide annual turnover, or for more serious violations, up to EUR 20,000,000 or 4% of our total worldwide annual turnover.

<div align='center'>329</div>

The GDPR and other EEA and UK data privacy and security regulations generally restrict the transfer of personal data from the EEA, UK and Switzerland, to the United States and certain other third countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. One of the primary safeguards on which companies may rely to import or export personal data from had been the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield frameworks administered by the U.S. Department of Commerce. However, the EU-U.S. Privacy Shield was invalidated in July 2020 by the Court of Justice of the European Union (the “CJEU”) in a case known as “Schrems II.” Following this decision, the Swiss Federal Data Protection and Information Commissioner (the “FDPIC”) announced that the Swiss-U.S. Privacy Shield does not provide adequate safeguards for the purposes of personal data transfers from Switzerland to third countries that are deemed as not providing adequate protection, including the United States. While the FDPIC does not have authority to invalidate the Swiss-U.S. Privacy Shield regime, the FDPIC’s announcement casts doubt on the viability of the Swiss-U.S. Privacy Shield as a compliance mechanism for Swiss-U.S. data transfers.

The CJEU’s decision in Schrems II also raised questions about whether one of the primary alternatives to the EU-U.S. Privacy Shield, namely the European Commission’s Standard Contractual Clauses, can lawfully be used for personal data transfers from Europe to the United States or other third countries that are not the subject of an adequacy decision