Company: SCLXW
Filing Date: 2025-05-14
Form Type: 424B3
Source: 0001193125-25-119846
Chunk: 307

Company: Scilex Holding Co
Filing Date: 2025-05-14
Form: 424B3
Chunk 307
---
. If we violate the GDPR, we may face significant penalties of up to EUR 10,000,000 or 2% of our total worldwide annual turnover, or for more serious violations, up to EUR 20,000,000 or 4% of
our total worldwide annual turnover.

The GDPR and other EEA and UK data privacy and security regulations generally restrict the transfer
of personal data from the EEA, United Kingdom and Switzerland, to the United States and certain other third countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. One of the
primary safeguards on which companies may rely to import or export personal data from had been the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield frameworks
administered by the U.S. Department of Commerce. However, the EU-U.S. Privacy Shield was invalidated in July 2020 by the Court of Justice of the European Union (the “CJEU”) in a case known as
“Schrems II.” Following this decision, the Swiss Federal Data Protection and Information Commissioner (the “FDPIC”) announced that the Swiss-U.S. Privacy Shield does not provide
adequate safeguards for the purposes of personal data transfers from Switzerland to third countries that are deemed as not providing adequate protection, including the United States. While the FDPIC does not have authority to invalidate the Swiss-U.S. Privacy Shield regime, the FDPIC’s announcement casts doubt on the viability of the Swiss-U.S. Privacy Shield as a compliance mechanism for Swiss-U.S. data transfers.

The CJEU’s decision in Schrems II also raised questions about
whether one of the primary alternatives to the EU-U.S. Privacy Shield, namely the European Commission’s Standard Contractual Clauses, can lawfully be used for personal data transfers from Europe to the
United States or other third countries that are not the subject

197

of an adequacy decision of the European Commission. While the CJEU upheld the adequacy of the Standard Contractual Clauses in principle in Schrems II, it made clear that reliance on the
Standard Contractual Clauses alone may not necessarily be sufficient in all circumstances. Use of the Standard Contractual Clauses must now be assessed on a case-by-case
basis taking into account the legal regime applicable in the destination country, in particular regarding applicable surveillance laws and relevant rights of individuals with respect to the transferred data. In the context of any given transfer,
where the legal regime applicable in the destination country