Company: CNTB
Filing Date: 2025-05-15
Form Type: 10-Q
Source: 0001835268-25-000035
Chunk: 91

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-05-15
Form: 10-Q
Item: Part I, Item 3
Chunk 91
---
 associate” under HIPAA and thus are not directly regulated under HIPAA, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive protected health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information.

Numerous states have also adopted data privacy and security laws and regulations, which govern the privacy, processing and protection of consumer health-related information and other personal information. Such laws and regulations are subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act of 2018 went into effect on January 1, 2020 and was amended by the California Privacy Rights Act on January 1, 2023 (as amended, the “CPRA”). The CPRA creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling specific personal information. It also provides a private right of action for data breaches which has increased the likelihood of, and risks associated with, data breach litigation and creates a statutory damages framework. In addition, the CPRA created a new state agency to oversee implementation and enforcement efforts. Additional compliance investment and potential business process changes may be required as the CPRA evolves and is enforced. Similar laws have passed in several other states, and have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the U.S. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. If we are subject to or affected by HIPAA, the CPRA, or other U.S. domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Our operations in the European Union, or the EU, and the United Kingdom, or the UK, may also be subject to increased scrutiny or attention from data protection authorities. For example, the EU General Data Protection Regulation (“EU GDPR”) and the United Kingdom General Data Protection Regulation and Data Protection Act 2018, (together, the “UK GDPR”) (the EU GDPR and UK GDPR together referred to as the “GDPR”), impose comprehensive data privacy compliance requirements in relation to the processing of personal information of individuals. The GDPR increases our obligations with respect to clinical trials conducted in the EU and