Company: SMNR
Filing Date: 2025-07-02
Form Type: S-4/A
Source: 0001193125-25-154936
Chunk: 216

Company: Semnur Pharmaceuticals, Inc.
Filing Date: 2025-07-02
Form: S-4/A
Chunk 216
---
 new state agency, the CPPA, vested with authority to implement and, along with the California Attorney General, enforce the CCPA. Further, Washington’s My Health My Data Act, taking effect July 1, 2024, imposes requirements specific to consumer health data. Several other states have enacted or are considering similar state consumer privacy laws. The state privacy laws vary from each other in many ways, which may complicate compliance efforts. The effects on our business of the state privacy laws and general consumer protection authorities are potentially significant, and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to so comply. Privacy laws and regulations are constantly evolving and there are a number of legislative proposals at both the state and federal levels that could impose new obligations or limitations in areas affecting our business.

The FTC also sets expectations for failing to take appropriate steps to keep consumers’ personal information secure, or failing to provide a level of security commensurate to promises made to individuals about the security of their personal information (such as in a privacy notice) may constitute unfair or deceptive acts or practices in violation of Section 5(a) of the FTC Act. While we do not intend to engage in unfair or deceptive acts or practices, the FTC has the power to enforce promises as it interprets them, and events that we cannot fully control, such as data breaches, may be result in FTC enforcement. Enforcement by the FTC under the FTC Act can result in civil penalties or enforcement actions.

International data protection laws, including the EU’s and UK’s General Data Protection Regulation (“GDPR”), may also apply to health-related and other personal information obtained outside of the United States. The GDPR imposes several data protection requirements in the EU, as well as fines for violations that can reach up to the greater of €20 million or 4% of annual global revenue. The regulation imposes numerous requirements for the collection, use, storage and disclosure of personal information, including more stringent requirements relating to consent and the information that must be shared with data subjects about how their personal information is used, the obligation to notify regulators and affected individuals of personal data breaches, extensive new internal privacy governance obligations and obligations to honor expanded rights of individuals in relation to their personal information, including the right to access, correct and delete their data.

Compliance with international data protection laws and regulations could require us to take on more onerous obligations in our contracts, increase our compliance costs, restrict our ability to collect, use and disclose data, or in some cases