Company: BLRX
Filing Date: 2025-03-31
Form Type: 20-F
Source: 0001178913-25-001123
Chunk: 99

Company: BioLineRx Ltd.
Filing Date: 2025-03-31
Form: 20-F
Item: Item 3
Chunk 99
---
 medicines with a new active substance is strengthened by
subjecting their authorization to additional monitoring activities.

Another relevant aspect in the EU regulatory framework is the “sunset
clause”: a provision leading to the cessation of the validity of any marketing authorization if it is not followed by marketing
within three years or, if marketing is interrupted for a period of three consecutive years.

Data Privacy in the EU

The EU has a strict regime on data privacy under the General Regulation
on Data Protection, Regulation 2016/679 (GDPR), as amended on May 4, 2016, that has become applicable on May 25, 2018. The GDPR as an
EU regulation does not have to be implemented into member states’ national law but applies directly in all member states. It applies
to companies with an establishment in the European Economic Area (EEA) that includes the 27 member states of the EU and Norway, Iceland
and Liechtenstein. Furthermore, the GDPR applies to companies not located in the EEA but processing personal data of individuals located
in the EEA (e. g., through online business). The GDPR implements stringent operational requirements for controllers of personal data, including,
for example, obligations to justify the collection, use and other processing of personal data (e. g., based on the individual’s consent),
to notify the individuals concerned about data processing activities, to protect all processed personal data through appropriate technical
and organizational measures, and to implement a data protection compliance management. Furthermore, the GDPR defines high data security
and compliance standards for the transfer of personal data to third countries, including the U. S. The operational requirements under the
GDPR are even stricter in case of sensitive personal data, such as health or genetic data, that typically have to be stored in a pseudonymized
(i. e., key-coded) manner. The GDPR provides that EU member states may in certain areas deviate from GDPR standards which results in varying
laws and regulations at member states level. The applicable data protection laws in the EEA may limit our ability to share and otherwise
process personal data. If our business falls below the GDPR standards, we may be subject to severe administrative fines up to 20,000,000
or up to 4 % of the total worldwide annual turnover of our preceding financial year, if greater, and other administrative penalties
including criminal liability, which may be onerous and adversely affect our business, financial condition, results of operations and prospects.
Failure to comply with the GDPR