Company: PRTA
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001559053-25-000044
Chunk: 58

Company: PROTHENA CORP PUBLIC LTD CO
Filing Date: 2025-11-06
Form: 10-Q
Item: Part II, Item 1A
Chunk 58
---
 individual or from which an individual is identifiable), including clinical trial data, and grants individuals various data protection rights (e. g., the right to the erasure of personal data). The EU GDPR imposes a number of obligations on companies, including inter alia: (i) accountability and transparency requirements, and enhanced requirements for obtaining valid consent; (ii) obligation to consider data protection when any new products or services are developed, and to limit the amount of personal data processed; and (iii) obligations to implement appropriate technical and organizational measures to safeguard personal data and to report certain personal data breaches to: (x) the data protection supervisory authority without undue delay (and no later than 72 hours, where feasible) after becoming aware of the personal data breach, unless the personal data breach is unlikely to result in a risk to the data subjects’ rights and freedoms; and (y) affected data subjects where the personal data breach is likely to result in a high risk to their rights and freedoms. In addition, the EU GDPR prohibits the transfer of personal data from the European Economic

Area (“ EEA”) to jurisdictions that the European Commission does not recognize as having “adequate” data protection laws unless a data transfer mechanism has been put in place or a derogation under the EU GDPR can be relied on. In July 2020, the Court of Justice of the EU limited how organizations could lawfully transfer personal data from the EEA to the United States by invalidating the EU-US Privacy Shield Framework for purposes of international transfers and imposing further restrictions on the use of standard contractual clauses (“ EU SCCs”) including, a requirement for companies to carry out a transfer privacy impact assessment (“ TIA”), which, among other things, assesses the laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under the EU SCCs will need to be implemented to ensure an “essentially equivalent” level of data protection to that afforded in the EEA. On July 31, 2023, the European Commission adopted its Final Implementing Decision granting the United States adequacy (“ Adequacy Decision”), for EU-U. S. transfers of personal data for entities self-certified to the EU-U. S. Data Privacy Framework (“ DPF”). Entities relying on EU SCCs for transfers to the United States are also able to rely on the analysis in the Adequacy Decision as support for their TIA regarding the equivalence of U. S. national security safeguards and redress. The EU GDPR