Company: PTHS
Filing Date: 2025-05-27
Form Type: DEFM14C
Source: 0001140361-25-020509
Chunk: 162

Company: Pelthos Therapeutics Inc.
Filing Date: 2025-05-27
Form: DEFM14C
Chunk 162
---
 in May 2018 and imposes strict requirements for processing the personal data of individuals within the European Economic Area (“EEA”) or in the context of our activities within the EEA. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease/change LNHC’s data processing activities, enforcement notices, assessment notices (for a compulsory audit) and/or civil claims (including class actions). Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA and the United States remains uncertain. Case law from the Court of Justice of the European Union (“CJEU”) states that reliance on the standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On July 10, 2023, the European Commission adopted its Adequacy Decision in relation to the new EU-US Data Privacy Framework (“DPF”), rendering the DPF effective as a GDPR transfer mechanism to U.S. entities self-certified under the DPF. LNHC expects the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, LNHC expects the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As a result, LNHC may have to make certain operational changes and LNHC will have to implement revised standard contractual clauses and other relevant documentation for existing data transfers within required time frames. Further, the U.S. Department of Justice recently issued a final rule that went into effect in April 2025, known as the “Data Security Program,” (the “DSP Rule”), which regulates data transactions that could grant access to US sensitive personal data to certain foreign actors with connections to “countries of concern,” such as China, which the DSP refers to as “covered persons.” As supervisory authorities issue further guidance on personal data export mechanisms, and/or start taking enforcement action,