Company: HURA
Filing Date: 2025-05-06
Form Type: S-4/A
Source: 0001193125-25-113920
Chunk: 147

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-05-06
Form: S-4/A
Chunk 147
---
 other personal, sensitive, or confidential information in its possession, TuHURA could be found to have breached its contracts. Further, if TuHURA fails to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, TuHURA could face significant administrative, civil and criminal penalties. Enforcement activity can also result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal and outside resources. In addition, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. In addition to the risks associated with enforcement activities and potential contractual liabilities, TuHURA’s ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to its policies, procedures and systems.

In the EU, TuHURA may be subject to the General Data Protection Regulation (“GDPR”) which went into effect in May 2018 and which imposes obligations on companies that operate in TuHURA’s industry with respect to the processing of personal data and the cross-border transfer of such data. The GDPR imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and policies. If TuHURA’s or TuHURA’s partners’ or service providers’ privacy or data security measures fail to comply with the GDPR requirements, TuHURA may be subject to litigation, regulatory investigations, enforcement notices requiring TuHURA to change the way TuHURA uses personal data and/or fines of up to 20 million Euros or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, as well as compensation claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill.

The GDPR may also impose additional compliance obligations relating to the transfer of data between TuHURA and its subsidiaries or other business partners. For example, the European Court of Justice recently invalidated the EU-U.S. Privacy Shield as a basis for transfers of personal data from the EU to the U.S. and raised questions about the continued validity of one of the primary alternatives to the EU-U.S. Privacy Shield, namely the European Commission’s Standard Contractual Clauses. Some customers or other service providers may respond to these evolving laws and regulations by asking TuHURA to make certain privacy or data-related contractual commitments that TuHURA is unable or unwilling to make. This could lead to the loss of current or prospective customers or other business relationships.

While TuH