Company: PRTA
Filing Date: 2025-05-08
Form Type: 10-Q
Source: 0001559053-25-000023
Chunk: 59

Company: PROTHENA CORP PUBLIC LTD CO
Filing Date: 2025-05-08
Form: 10-Q
Item: Part II, Item 1A
Chunk 59
---
acy Decision”), for EU-U. S. transfers of personal data for entities self-certified to the EU-U. S. Data Privacy Framework (“ DPF”). Entities relying on EU SCCs for transfers to the United States are also able to rely on the analysis in the Adequacy Decision as support for their TIA regarding the equivalence of U. S. national security safeguards and redress. The EU GDPR imposes substantial fines for breaches and violations (up to the greater of €20 million or 4% of the noncompliant company’s total annual global turnover). The EU GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with data protection supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the EU GDPR.

The EU GDPR has been implemented (as implemented, the “ UK GDPR”) in the United Kingdom (“ UK”). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but which process personal data in relation to the offering of goods or services to individuals in the UK, or the monitoring of their behavior will be subject to the UK GDPR - the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs with potential fines up to the greater of £17.5 million or 4% of the noncompliant company’s total annual global turnover. The UK GDPR also imposes similar restrictions on international transfers of personal data from the UK to jurisdictions that the UK Government does not consider “adequate”. The UK’s Information Commissioner’s Office published: (i) its own form of EU SCCs, known as the International Data Transfer Agreement for transfers to outside the UK; (ii) a “ UK addendum” to the new EU SCCs which amends the relevant provisions of such clauses to work in a UK context; and (iii) its own version of the TIA (although entities may choose to adopt either the EU or UK-style TIA). Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-U. S. data bridge (i. e., a UK equivalent of the Adequacy Decision) and adopted UK regulations to implement the UK-U. S. data bridge (“ UK Adequacy Regulations”). Personal data may now be transferred from the UK under the UK-U.