Company: TVRD
Filing Date: 2025-02-14
Form Type: S-4/A
Source: 0001104659-25-013053
Chunk: 526

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: S-4/A
Chunk 526
---
 states, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States.

Tvardi also are or may become subject to privacy laws in the jurisdictions in which it is established, sell or market its products or run clinical trials. For example, in the EU, Regulation (EU) 2016/679 (the GDPR), governs the collection, control, processing, and other use of personal data (i.e., data relating to an identified or identifiable living individual). The GDPR is directly applicable in each EU and European Economic Area (EEA), Member State; however, it provides that EU and EEA Member States may introduce further conditions, including limitations which could limit Tvardi’s ability to collect, use and share personal data (including health and medical information), or could cause its compliance costs to increase, ultimately having an adverse impact on its business. The GDPR imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and implement policies as part of its mandated privacy governance framework. It also requires data controllers to be transparent and to disclose to data subjects (in a concise, intelligible and easily accessible form) how their personal information is to be used; imposes limitations on retention of personal data; imposes requirements with respect to pseudonymized (i.e., key-coded) data; introduces mandatory data breach notification requirements; and sets higher standards for data controllers to demonstrate that they have obtained valid consent for certain data processing activities.

Tvardi also may become subject to EEA rules with respect to cross-border transfers of personal data out of the EEA. As noted above, recent legal developments in the EU have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States, and the efficacy and longevity of current transfer mechanisms between the EEA and the United States remains uncertain. Case law from the Court of Justice of the European Union (the CJEU) states that reliance on the standard contractual clauses — a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism — alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On October 7, 2022, President Biden signed an Executive Order on ‘Enhancing Safeguards for U.S. Intelligence Activities’ which introduced new redress mechanisms and binding safeguards to address the concerns raised by the CJEU in relation to data transfers from the EEA to the United States and which formed the basis