Company: SMNR
Filing Date: 2025-08-13
Form Type: 424B3
Source: 0001193125-25-179226
Chunk: 529

Company: Semnur Pharmaceuticals, Inc.
Filing Date: 2025-08-13
Form: 424B3
Chunk 529
---
 certain other third countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. One of the primary safeguards on which companies may rely to
import or export personal data from had been the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield frameworks administered by the U.S. Department of Commerce.
However, the EU-U.S. Privacy Shield was invalidated in July 2020 by the Court of Justice of the European Union (the “CJEU”) in a case known as “Schrems II.” Following this decision, the
Swiss Federal Data Protection and Information Commissioner (the “FDPIC”) announced that the Swiss-U.S. Privacy Shield does not provide adequate safeguards for the purposes of personal data
transfers from Switzerland to third countries that are deemed as not providing adequate protection, including the United States. While the FDPIC does not have authority to invalidate the Swiss-U.S. Privacy
Shield regime, the FDPIC’s announcement casts doubt on the viability of the Swiss-U.S. Privacy Shield as a compliance mechanism for Swiss-U.S. data transfers.

The CJEU’s decision in Schrems II also raised questions about whether one of the primary alternatives to the
EU-U.S. Privacy Shield, namely the European Commission’s Standard Contractual Clauses, can lawfully be used for personal data transfers from Europe to the United States or other third countries that are
not the subject of an adequacy decision of the European Commission. While the CJEU upheld the adequacy of the Standard Contractual Clauses in principle in Schrems II, it made clear that reliance on the Standard Contractual Clauses alone may not
necessarily be sufficient in all circumstances. Use of the Standard Contractual Clauses must now be assessed on a case-by-case basis taking into account the legal regime
applicable in the destination country, in particular regarding applicable surveillance laws and relevant rights of individuals with respect to the transferred data. In the context of any given transfer, where the legal regime applicable in the
destination country may or does conflict with the intended operation of the Standard Contractual Clauses and/or applicable European law, the decision in Schrems II and subsequent draft guidance from the European Data Protection Board (the
“EDPB”) would require the parties to that transfer to implement certain supplementary technical, organizational and/or contractual measures to rely on the Standard Contractual Clauses as a lawful “transfer mechanism.”
However, the draft guidance from the EDPB on such supplementary technical, organizational and/or