Company: ARWR
Filing Date: 2025-01-29
Form Type: ARS
Source: 0001628280-25-002866
Chunk: 50

Company: ARROWHEAD PHARMACEUTICALS, INC.
Filing Date: 2025-01-29
Form: ARS
Chunk 50
---
 offenses (punishable by uncapped fines) for organizations and in certain cases their directors and officers as well as civil liability claims from individuals whose personal data was processed. Data protection authorities from the different EU member states may still implement certain variations, enforce the GDPR and national data protection laws differently, and introduce additional national regulations and guidelines, which adds to the complexity of processing personal data in the EU. Guidance developed at both EU level and at the national level in individual EU member states concerning implementation and compliance practices are often updated or otherwise revised. There is, moreover, a growing trend towards required public disclosure of clinical trial data in the EU which adds to the complexity of obligations relating to processing health data from clinical trials. Such public disclosure obligations are provided in the EU Clinical Trials Regulation, EMA disclosure initiatives and voluntary commitments by industry. Failing to comply with these obligations could lead to government enforcement actions and significant penalties against us, harm to our reputation, and adversely impact our business and operating results. The uncertainty regarding the interplay between different regulatory frameworks, such as the Clinical Trials Regulation and the GDPR, further adds to the complexity that we face with regard to data protection regulation. With regard to the transfer of data from the EEA to the UK, on June 28, 2021 the European Commission adopted two adequacy decisions for the UK: one under the GDPR and the other for the Law Enforcement Directive. Personal data may now freely flow from the EU to the UK since the UK is deemed to have an adequate data protection level for the purposes of the EU regime. However, the adequacy of decisions are subject to a ‘sunset clause’ which entails that the decisions will automatically expire four years after their entry into force, unless renewed. Additionally, following the UK’s withdrawal from the EEA, companies also have to comply with the UK’s data protection laws (including the GDPR as incorporated into UK national law), the latter regime having the ability to impose fines up to the greater of £17.5 million or 4% of global turnover. Furthermore, transfers from the UK to other countries, including to the EEA, are subject to specific transfer rules under the UK regime; personal data may freely flow from the UK to the EEA, since the EEA is deemed to have an adequate data protection level for purposes of the UK regime. These UK international transfer rules broadly mirror the EU GDPR rules. On February 2, 2022, the UK Secretary of State laid before the UK Parliament the international data transfer agreement (IDTA)