Company: NCNA
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0000950170-25-042709
Chunk: 34

Company: NuCana plc
Filing Date: 2025-03-20
Form: 20-F
Item: Item 3
Chunk 34
---
 the Irish Data Protection Commission issued a €1.2 billion fine against Meta for transferring personal data to the United States in reliance on standard contractual clauses, on the basis that the personal data was not sufficiently protected in the United States. In light of all of these developments, it is expected that the uncertainty surrounding data transfers will continue into 2025 and beyond.
 As the legal challenges continue and/or supervisory authorities increase their enforcement activities, we could suffer additional costs, complaints, and/or regulatory scrutiny, investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide

our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results and generally increase compliance risk.
 The GDPR also provides that E.E.A. member states may make their own further laws and regulations to introduce specific requirements related to the processing of: “special categories of personal data”, including personal data related to health, biometric data used for unique identification purposes and genetic information; as well as personal data related to criminal offences or convictions. This fact may lead to greater divergence on the law that applies to the processing of such data types across the E.E.A. and U.K., compliance with which as and where applicable may increase our costs and could increase our overall risk.
 In the past 12 months, the European data protection authorities have been particularly active in seeking to regulate Artificial Intelligence, in the absence of comprehensive A.I. regulation. At least until the A.I. Act becomes applicable in the European Union (there is a staged implementation through to 2027), we expect to see this focus continue and so any use of A.I. within the healthcare sector will be subject to a heightened risk under European privacy laws.
 Now that the United Kingdom is no longer a member of the European Union, there is increasing scope for divergence in application, interpretation and enforcement of the data protection law between the United Kingdom and European Union. On October 23, 2024, the U.K. Government presented the ‘Data (Use and Access) Bill’ to Parliament, which seeks to amend various aspects of the United Kingdom’s data protection regime. The Bill is proceeding through the legislative process, but is expected to become law in Spring or Summer 2025. As currently drafted, the Bill will result in only very minor changes to the substance of the U.K. GDPR, and so the United Kingdom will remain very closely aligned with the European Union in