Company: LGNZZ
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000886163-25-000012
Chunk: 69

Company: LIGAND PHARMACEUTICALS INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 69
---
 the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA and the United States remains uncertain. Case law from the Court of Justice of the European Union (“CJEU”) states that reliance on the standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On October 7, 2022, President Biden signed an Executive Order on ‘Enhancing Safeguards for United States Intelligence Activities’ which introduced new redress mechanisms and binding safeguards to address the concerns raised by the CJEU in relation to data transfers from the EEA to the United States and which formed the basis of the new EU-US Data Privacy Framework (“DPF”), as released on December 13, 2022. The European Commission adopted its Adequacy Decision in relation to the DPF on July 10, 2023, rendering the DPF effective as a GDPR transfer mechanism to U.S. entities self-certified under the DPF. The DPF also introduced a new redress mechanism for E.U. citizens which addresses a key concern in the previous CJEU judgments and may mean transfers under standard contractual clauses are less likely to be challenged in future. With the advice of outside counsel and privacy experts, we take appropriate steps to ensure transfers of personal data outside the EEA and the UK, including to the United States, are conducted in a manner consistent with applicable law and legal requirements. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As a result, we may have to make certain operational changes and we will have to implement revised standard contractual clauses and other relevant documentation for existing data transfers within required time frames. Since the beginning of 2021, after the end of the transition period following the United Kingdom’s departure from the European Union