Company: ARWR
Filing Date: 2025-01-29
Form Type: ARS
Source: 0001628280-25-002866
Chunk: 49

Company: ARROWHEAD PHARMACEUTICALS, INC.
Filing Date: 2025-01-29
Form: ARS
Chunk 49
---
, analysis and transfer of) personal data of individuals in the EEA, including health data from clinical trials and adverse event reporting. The GDPR also includes requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals prior to processing their personal data or personal health data, notification obligations to the national data protection authorities and the security and confidentiality of the personal 25

data. EU member states may also impose additional requirements in relation to health, genetic and biometric data through their national implementing legislation. The GDPR also imposes specific restrictions on the transfer of personal data to countries outside of the EEA that are not considered by the European Commission to provide an adequate level of data protection. Appropriate safeguards are required to enable such transfers. Among the appropriate safeguards that can be used, the data exporter may use the standard contractual clauses (“SCCs”). In this respect, on June 4, 2021, the EU Commission has issued a new set of SCCs which replace the old sets of SCCs that were adopted under the previous European Data Protection Directive 95/46. In addition, when relying on SCCs, the data exporters are required to conduct a transfer risk assessment to verify if anything in the law and/or practices of the third country may impinge on the effectiveness of the SCCs in the context of the transfer at stake and, if so, to identify and adopt supplementary measures that are necessary to bring the level of protection of the data transferred to the EU standard of essential equivalence. Where no supplementary measure is suitable, the data exporter should avoid, suspend or terminate the transfer. On June 18, 2021, the European Data Protection Board adopted recommendations to assist data exporters with such assessment and their duty to identify and implement supplementary measures where they are needed to ensure compliance with the EU level of protection to the personal data they transfer to third countries. With regard to the transfer of data from the EEA to the US, on July 10, 2023, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework. On the basis of the new adequacy decision, personal data can flow from the EEA to US companies participating in the framework. Failure to comply with the requirements of the GDPR and the related national data protection laws of the EU member states may result in significant monetary fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company – whichever is greater – other administrative penalties, and a number of criminal