Connect Biopharma Holdings Ltd

Previous report

The legislative and regulatory landscape for privacy and data protection continues to evolve in jurisdictions worldwide, and there has been an increasing focus on privacy and data protection issues with the potential to affect our business. Complying with such requirements can be difficult, time-consuming, expensive, and could require us to change our business practices and put in place additional compliance mechanisms. Failure to comply with laws, regulations and contractual and other obligations governing personal or other sensitive information could result in enforcement actions against us, including fines, public censure, processing penalties, claims for damages by affected individuals, damage to our reputation and loss of goodwill. It is possible that new and existing laws may be interpreted and applied in a manner that is inconsistent with our practices and our efforts to comply with the evolving data protection rules may be unsuccessful.

Previous report

In the U.S., the Health Information Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, or collectively HIPAA, imposes, among other things, specific standards relating to the privacy, security, transmission and breach reporting of protected health information. Most healthcare providers, including research institutions from which we obtain patient’s protected health information, are subject to privacy and security regulations promulgated under HIPAA. While we do not believe that we are currently acting as a “covered entity” or “business associate” under HIPAA and thus are not directly regulated under HIPAA, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive protected health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information.

Previous report

Numerous states have also adopted data privacy and security laws and regulations, which govern the privacy, processing and protection of consumer health-related information and other personal information. Such laws and regulations are subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act of 2018 went into effect on January 1, 2020 and was amended by the California Privacy Rights Act on January 1, 2023 (as amended, the “CPRA”). The CPRA creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling specific personal information. It also provides a private right of action for data breaches which has increased the likelihood of, and risks associated with, data breach litigation and creates a statutory damages framework. In addition, the CPRA created a new state agency to oversee implementation and enforcement efforts. Additional compliance investment and potential business process changes may be required as the CPRA evolves and is enforced. Similar laws have passed in several other states, and have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the U.S. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. If we are subject to or affected by HIPAA, the CPRA, or other U.S. domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Previous report

Our operations in the European Union, or the EU, and the United Kingdom, or the UK, may also be subject to increased scrutiny or attention from data protection authorities. For example, the EU General Data Protection Regulation (“EU GDPR”) and the United Kingdom General Data Protection Regulation and Data Protection Act 2018, (together, the “UK GDPR”) (the EU GDPR and UK GDPR together referred to as the “GDPR”), impose comprehensive data privacy compliance requirements in relation to the processing of personal information of individuals. The GDPR increases our obligations with respect to clinical trials conducted in the EU and the UK by, for example, expanding the definition of personal information to include coded or pseudonymized data and imposing specific requirements regarding informed consent practices and the provision of detailed notices for clinical trial subjects and investigators. In addition, some of the personal information we process in respect of clinical trial participants is special category or sensitive personal information under the GDPR and subject to additional compliance obligations and local law derogations. We may be subject to diverging requirements under EU member state laws and UK law, such as whether consent can be used as a legal basis for processing and the roles, responsibilities and liabilities between the different parties involved in clinical trials. As these laws develop, we may need to make operational changes to adapt to these diverging rules, which could increase our costs and adversely affect our business. More generally, the GDPR imposes additional obligations on controllers, including, among other things, requirements around accountability and transparency, the obligation to consider data protection when any new products or services are developed, the obligation to comply with individuals’ data protection rights, and the obligation to report personal information breaches.

Previous report

Since we are under the supervision of the relevant data protection authorities in both the European Economic Area and the UK, we may be fined under both the EU GDPR and the UK GDPR for the same breach. Failure to comply with the requirements of the GDPR may result in fines of up to €20,000,000 / £17,500,000 or up to 4% of the noncompliant company’s total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties. In addition, the GDPR confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR.

Previous report

In relation to cross-border transfers, case law from the Court of Justice of the European Union states that reliance on the standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal information transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. In relation to data transfers to the US, the EU-US Data Privacy Framework (“DPF”) was approved by the European Commission in July 2023 as an effective EU GDPR data transfer mechanism to U.S. entities self-certified under the DPF. The UK Extension to the DPF followed in October 2023, as an effective UK GDPR data transfer mechanism to U.S. entities self-certified under the UK Extension to the DPF.

Previous report

We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue under the UK GDPR and EU GDPR. In particular, we expect the DPF to be challenged and international transfers to the U.S. and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. Further, the U.S. Department of Justice recently issued a final rule that went into effect in April 2025, known as the “Data Security Program” (the “DSP Rule”), which regulates data transactions that could grant access to certain volumes of specified types of U.S. sensitive personal data to certain foreign actors with connections to “countries of concern,” such as China, which the DSP Rule refers to as “covered persons.” We do not believe that we are currently engaged in covered data transactions that implicate the DSP Rule, but we may engage in such transactions in the future, in which case any such transactions could be restricted and subject to certain compliance obligations under the DSP Rule, including with respect to cybersecurity, recordkeeping, reporting and auditing. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement alternative transfer mechanisms and/or take additional compliance and operational measures; and/or it could otherwise affect the manner in which we provide our services, and could adversely affect our business, operations and financial condition.

Previous report

On January 31, 2022, the Clinical Trial Regulations entered into application. This regulation imposes obligations on the use of data generated from clinical trials and enables the EU patients to have the opportunity to access information about clinical trials.

Previous report

Regulatory authorities in the PRC have implemented and are considering a number of legislative and regulatory proposals concerning data protection. For example, the PRC’s Cyber Security Law, which became effective in June 2017, created the PRC’s first national-level data protection for “network operators,” which may include all organizations in the PRC that provide services over the internet or another information network. In addition, some industry-specific laws and regulations affect the collection and transfer of personal information in the PRC. For example, on May 28, 2019, the PRC State Council promulgated the Regulation on the Administration of Human Genetic Resources which became effective on July 1, 2019. Under the Regulation, international collaborative projects involving human genetic resources or HGR are subject to approval by the Ministry of Science and Technology (“MOST”) except for international collaborations on clinical trials intended to support marketing approval of drugs and devices in the PRC that do not transfer HGR Materials abroad. The PRC has established a record-filing procedure for such exceptions. This HGR regulatory regime is further confirmed by the Biosecurity Law of the PRC published by the Standing Committee of the National People’s Congress, or NPC, of the PRC in October 2020 and came into effect in April 2021. To comply with such record-filing procedure, the parties must submit information as to the types, quantities and purposes of the HGR used prior to the commencement of the trials. As for cross-border transfer of the HGR samples or associated data, they are subject to different forms of review and pre-approval, respectively. Any export or cross-border transfer of the HGR samples shall be subject to the approval of the MOST, and an export certificate shall be obtained. The provision of HGR associated data to non-PRC parties or permitting uses of HGR associated data by non-PRC parties requires a record filing with MOST and submission of that corresponding information’s copy. If such provision or permitting uses could impact the public health, national security or public interest of the PRC, an additional security review will be conducted. In May 2023, the MOST published the Implementing Rules for the Regulations of the PRC on the Administration of Human Genetic Resources, which offered certain clarification on the definition of non-PRC parties, the scope of international collaboration, HGR Information and HGR Materials, as well as criteria for security review. In March 2023, the 14th NPC announced a restructuring of the State Council, under which the HGR approval authorities were transferred from MOST to the National Health Commission (the “NHC”). This move was in alignment with the amended Regulation on the Administration of Human Genetic Resources, which was amended in March 2024 and took effect in May 2024. Under these amendments, the NHC has assumed the responsibility of conducting the review and approval p…

Excerpt shortened here; the source contains the full paragraph.

Previous report

For further information regarding data protection and cybersecurity laws in the PRC, see “Item 1.A. “Risk Factors— Risks Related to Doing Business in the PRC — Compliance with the PRC’s Data Security Law, Cybersecurity Review Measures, Personal Information Protection Law, regulations and guidelines relating to the multi-level protection scheme and any other future laws and regulations may entail significant expenses and could materially affect our business.”