Company: INTS
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001567264-25-000010
Chunk: 131

Company: INTENSITY THERAPEUTICS, INC.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1
Chunk 131
---
 any clinical trial activities in EU member states. The GDPR imposes strict requirements on controllers and processors of personal data, including special protections for “sensitive information” which includes health and genetic information of data subjects residing in the EU. GDPR grants individuals the opportunity to object to the processing of their personal information, allows them to request deletion of personal information in certain circumstances, and provides the individual with an express right to seek legal remedies in the event the individual believes his or her rights have been violated. Further, the GDPR only permits exports of data outside of the EU where the country where the recipient is located is deemed to have adequate data privacy laws by the European Commission or where there is a suitable data transfer solution in place to safeguard personal data (e.g., the EU Commission approved Standard Contractual Clauses). On July 10, 2023, the European Commission adopted an adequacy decision for a new mechanism for transferring data from the EU to the United States – the EU-US Data Privacy Framework, which provides EU individuals with several new rights, including the right to obtain access to their data, or obtain correction or deletion of incorrect or unlawfully handled data. The adequacy decision followed the signing of an executive order introducing new binding safeguards to address transfers of personal data from the EU to the United States. Notably, the new obligations were geared to ensure that data can be accessed by U.S. intelligence agencies only to the extent necessary and proportionate and to establish an independent and impartial redress mechanism to handle complaints from Europeans concerning the collection of their data for national security purposes. The European Commission will continually review developments in the United States along with its adequacy decision. Adequacy decisions can be adapted or even withdrawn in the event of developments affecting the level of protection in the applicable jurisdiction. Future actions of EU data protection authorities are difficult to predict. Failure to comply with the requirements of the GDPR and the related national data protection laws of the European Union Member States, which may deviate slightly from the GDPR, may result in fines of up to 4% of annual global turnover, or €20,000,000, whichever is greater. As a result of the implementation of the GDPR, we may be required to put in place additional mechanisms ensuring compliance with the new data protection rules.

There is significant uncertainty related to the manner in which data protection authorities will seek to enforce compliance with GDPR. For example, it is not clear if the authorities will conduct random audits of companies doing business in the EU, or if the authorities will wait for complaints