Company: HURA
Filing Date: 2025-05-06
Form Type: S-4/A
Source: 0001193125-25-113920
Chunk: 251

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-05-06
Form: S-4/A
Chunk 251
---
 no later than 72 hours where feasible). In addition, the EU GDPR prohibits the transfer of personal data from the EEA to the United States and other jurisdictions that the European Commission does not recognize as having “adequate” data protection laws unless a data transfer mechanism has been put in place. In July 2020, the Court of Justice of the EU (the “CJEU”) limited how organizations could lawfully transfer personal data from the EEA to the United States by invalidating the EU-US Privacy Shield for purposes of international transfers and imposing further restrictions on use of the standard contractual clauses (the “SCCs”), including a requirement for companies to carry out a transfer privacy impact assessment, which, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under SCCs will need to be implemented to ensure an essentially equivalent level of data protection to that afforded in the EEA. The European Commission subsequently issued new SCCs in June 2021 to account for the decision of the CJEU and recommendations made by the European Data Protection Board and which are in turn relatively more onerous. The EU GDPR imposes substantial fines for breaches and violations (up to the greater of €20 million or 4% of consolidated annual worldwide gross revenue), and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the EU GDPR. Relatedly, following the United Kingdom’s withdrawal from the EU (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the EU GDPR has been implemented in the United Kingdom (as the “UK GDPR”). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR, the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs with potential fines of up to the greater of £17.5 million or 4% of global turnover.

Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and Kineta may be required