Company: SCLXW
Filing Date: 2025-12-29
Form Type: 424B3
Source: 0001193125-25-335429
Chunk: 337

Company: Scilex Holding Co
Filing Date: 2025-12-29
Form: 424B3
Chunk 337
---
 decision, the Swiss Federal Data Protection and Information Commissioner (the “FDPIC”) announced that the Swiss-U.S. Privacy Shield does not provide adequate
safeguards for the purposes of personal data transfers from Switzerland to third countries that are deemed as not providing adequate protection, including the United States. While the FDPIC does not have authority to invalidate the Swiss-U.S. Privacy Shield regime, the FDPIC’s announcement casts doubt on the viability of the Swiss-U.S. Privacy Shield as a compliance mechanism for Swiss-U.S. data transfers.

The CJEU’s decision in Schrems II also raised questions about
whether one of the primary alternatives to the EU-U.S. Privacy Shield, namely the European Commission’s Standard Contractual Clauses, can lawfully be used for personal data transfers from Europe to the
United States or other third countries that are not the subject of an adequacy decision of the European Commission. While the CJEU upheld the adequacy of the Standard Contractual Clauses in principle in Schrems II, it made clear that reliance
on the Standard Contractual Clauses alone may not necessarily be sufficient in all circumstances. Use of the Standard Contractual Clauses must now be assessed on a
case-by-case basis taking into account the legal regime applicable in the destination country, in particular regarding applicable surveillance laws and relevant rights
of individuals with respect to the transferred data. In the context of any given transfer, where the legal regime applicable in the destination country may or does conflict with the intended operation of the Standard Contractual Clauses and/or
applicable European law, the decision in Schrems II and subsequent draft guidance from the European Data Protection Board (the “EDPB”) would require the parties to that transfer to implement certain supplementary technical,
organizational and/or contractual measures to rely on the Standard Contractual Clauses as a lawful “transfer mechanism.” However, the draft guidance from the EDPB on such supplementary technical, organizational and/or contractual
measures appears to conclude that any combination of such measures may not be sufficient to allow effective reliance on the Standard Contractual Clauses in the context of transfers of personal data “in the clear” to recipients in
countries where the power granted to public authorities to access the transferred data goes beyond that which is “necessary and proportionate in a democratic society”—which may, following the CJEU’s conclusions in Schrems II on relevant powers of United States public authorities and commentary in draft EDPB guidance, include the United States in certain circumstances (