Company: CNTB
Filing Date: 2025-05-15
Form Type: 10-Q
Source: 0001835268-25-000035
Chunk: 61

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-05-15
Form: 10-Q
Item: Part I, Item 8
Chunk 61
---
 litigation and creates a statutory damages framework. In addition, the CPRA created a new state agency to oversee implementation and enforcement efforts. Additional compliance investment and potential business process changes may be required as the CPRA evolves and is enforced. Similar laws have passed in several other states, and have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the U.S. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. If we are subject to or affected by HIPAA, the CPRA, or other U.S. domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Our operations in the European Union, or the EU, and the United Kingdom, or the UK, may also be subject to increased scrutiny or attention from data protection authorities. For example, the EU General Data Protection Regulation (“EU GDPR”) and the United Kingdom General Data Protection Regulation and Data Protection Act 2018, (together, the “UK GDPR”) (the EU GDPR and UK GDPR together referred to as the “GDPR”), impose comprehensive data privacy compliance requirements in relation to the processing of personal information of individuals. The GDPR increases our obligations with respect to clinical trials conducted in the EU and the UK by, for example, expanding the definition of personal information to include coded or pseudonymized data and imposing specific requirements regarding informed consent practices and the provision of detailed notices for clinical trial subjects and investigators. In addition, some of the personal information we process in respect of clinical trial participants is special category or sensitive personal information under the GDPR and subject to additional compliance obligations and local law derogations. We may be subject to diverging requirements under EU member state laws and UK law, such as whether consent can be used as a legal basis for processing and the roles, responsibilities and liabilities between the different parties involved in clinical trials. As these laws develop, we may need to make operational changes to adapt to these diverging rules, which could increase our costs and adversely affect our business. More generally, the GDPR imposes additional obligations on controllers, including, among other things, requirements around accountability and transparency, the obligation to consider data protection when any new products or services are developed, the obligation to comply with individuals’ data protection rights, and the obligation to report personal information breaches.  

Since we are under the supervision of the relevant data protection authorities in both the European Economic Area and the UK, we may be fined under both the EU GDPR and the