Company: MLTX
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001821586-25-000006
Chunk: 63

Company: MoonLake Immunotherapeutics
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 63
---
, suspend or terminate the transfer. With regard to the transfer of data from the EEA to the United States, on July 10, 2023, the EC adopted its adequacy decision for the EU-US Data Privacy Framework. On the basis of the new adequacy decision, personal data can flow from the EEA to U.S. companies participating in the framework. With regard to the transfer of data from the EU to the United Kingdom (“UK”), personal data may freely flow from the EEA to the UK since the UK is deemed to have an adequate data protection level. However, the adequacy decisions include a ‘sunset clause’ which entails that the decisions will automatically expire four years after their entry into force, unless renewed. 

Failure to comply with the requirements of the GDPR and the related national data protection laws of the EU Member States may result in significant monetary fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater, other administrative penalties and a number of criminal offenses for organizations and, in certain cases, their directors and officers, as well as civil liability claims from individuals whose personal data was processed. Data protection authorities from the different EU Member States may still implement certain variations, enforce the GDPR and national data protection laws differently, and introduce additional national regulations and guidelines, which adds to the complexity of processing personal data in the EU. Furthermore, there are specific requirements relating to processing health data from clinical trials, including public disclosure obligations provided in the EU Clinical Trials Regulation No. 536/2014 (“the Clinical Trials Regulation or CTR”), EMA disclosure initiatives and voluntary commitments by industry. Failure to comply with these obligations could lead to government enforcement actions and significant penalties against us, harm to our reputation, and adversely impact our business and operating results. 

Additionally, following the UK’s withdrawal from the EU and the EEA, companies also have to comply with the UK’s data protection laws (including the UK GDPR (as defined in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018 (the “DPA 2018”)), the DPA 2018, and related data protection laws in the UK). Separate from the fines that can be imposed by the GDPR, the UK regime has the ability to fine up to the greater of £17.5 million or 4% of global turnover. Companies are subject to specific transfer rules under the UK regime which broadly mirror