Company: ATHE
Filing Date: 2025-08-29
Form Type: 20-F
Source: 0001213900-25-082027
Chunk: 16

Company: ALTERITY THERAPEUTICS LTD
Filing Date: 2025-08-29
Form: 20-F
Item: Item 3
Chunk 16
---
 business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials,and other sensitive third-party data. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g. Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example HIPAA, as amended by HITECH, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. In the past few years, numerous U.S. states-including California, Virginia, Colorado, Connecticut, and Utah-have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (“CCPA”) applies to personal data of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.

The CCPA and other comprehensive U.S. state privacy laws exempt some data processed in the context of clinical trials, but these developments may further complicate compliance efforts and increase legal risk and compliance costs for us and the third parties with whom we work.

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union’s