individual data rights regime, data export restrictions governing transfers of data from the EEA, to other jurisdictions, short timelines for data breach notifications, limitations on retention
of information, increased requirements pertaining to health data, other special categories of personal data and pseudonymised (i.e., key-coded) data and additional obligations if we contract third-party
processors in connection with the processing of personal data. The GDPR provides that EU and EEA member states may establish their own laws and regulations limiting the processing of personal data, including genetic, biometric or health data, which
could limit our ability to use and share personal data or could cause our costs to increase. If our or our partners or service providers privacy or data security measures fail to comply with GDPR requirements, we may be subject to
litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data and/or fines of up to 20 million Euros or up to 4% of our total worldwide annual turnover of the preceding financial year, whichever
is higher, as well as compensation claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill. Further, from January 1, 2021, companies have to comply with the GDPR and also the United
Kingdom GDPR, or the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, i.e., fines up to the greater of 20 million (£17.5
million) or 4% of global turnover. The relationship between the United Kingdom and the EU in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop
in the medium to longer term, and how data transfers to and from the United Kingdom will be regulated in the long term. Currently there is a four to six-month grace period agreed in the EU and United Kingdom
Trade and Cooperation Agreement, ending June 30, 2021 at the latest, whilst the parties discuss an adequacy decision. However, it is not clear whether (and when) an adequacy decision may be granted by the European Commission enabling data
transfers from EU member states to the United Kingdom long term without additional measures. These changes may lead to additional costs and increase our overall risk exposure.
Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these
requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived
failure by us or our employees, representatives, contractors, consultants, collaborators, or other third parties to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could result in additional cost
and liability to us, damage our reputation, and adversely affect our business and results of operations.
We are subject to
environmental, health and safety laws and regulations, and we may become exposed to liability and substantial expenses in connection with environmental compliance or remediation activities.
Our operations, including our development, testing and manufacturing activities, are subject to numerous environmental, health and safety laws
and regulations. These laws and regulations govern, among other things, the controlled use, handling, release and disposal of and the maintenance of a registry for, hazardous materials and biological materials, such as chemical solvents, human
cells, carcinogenic compounds, mutagenic compounds and compounds that have a toxic effect on reproduction, laboratory procedures and exposure to blood-borne pathogens. If we fail to comply with such laws and regulations, we could be subject to fines
or other sanctions.
As with other companies engaged in activities similar to ours, we face a risk of environmental liability inherent in
our current and historical activities, including liability relating to releases of or exposure to hazardous or biological materials. Environmental, health and safety laws and regulations are becoming more stringent. We may be required to incur
substantial expenses in connection with future environmental compliance or remediation activities, in which case, the production efforts of our third-party manufacturers or our development efforts may be interrupted or delayed.
We are subject to certain U.S. and foreign anti-corruption, anti-money laundering, export control, sanctions and other trade laws and regulations. We
can face serious consequences for violations.
Among other matters, U.S. and foreign anti-corruption, anti-money laundering, export
control, sanctions and other trade laws and regulations, which are collectively referred to as Trade Laws, prohibit companies and their employees, agents, clinical research organizations, legal counsel, accountants, consultants, contractors and
other partners from authorizing, promising, offering, providing, soliciting or receiving, directly or indirectly, corrupt or improper payments or anything else of value to or from recipients in the public or private sector. We have direct or
indirect interactions with officials and employees of government agencies or government-affiliated hospitals, universities and other organizations. We also expect our non-U.S. activities to increase in time.
We plan to engage third parties for clinical trials and/or to obtain necessary permits, licenses, patent registrations and other regulatory approvals and we can be held liable for the corrupt or other illegal activities of our personnel, agents or
partners, even if we do not explicitly authorize or have prior knowledge of such activities. Additionally, in many other countries, the healthcare providers who prescribe pharmaceuticals are employed by their government, and the purchasers of
pharmaceuticals are government entities; therefore, our dealings with these prescribers and purchasers are subject to regulation under the Trade Laws. Violations of Trade Laws can result in substantial criminal fines and civil penalties,
imprisonment, the loss of trade privileges, debarment, tax reassessments, breach of contract and fraud litigation, reputational harm and other consequences.
Risks Related to Our Intellectual Property
If we
fail to comply with our obligations under our existing intellectual property license with BMS and any future intellectual property licenses with third parties, we could lose rights that are important to our business, including the right to develop
and commercialize the AL101 and AL102 product candidates.
We are party to a license agreement with BMS which gives us the right to
practice certain issued patents to develop and commercialize AL101 and AL102 and methods of use thereof. We may enter into additional license agreements in the future. Our existing license agreements impose, and any future license agreements are
likely to impose, various diligence, milestone payment, royalty, insurance and other obligations on us. Any uncured, material breach under these license agreements could result in the loss of our rights to practice such in-licensed intellectual property and could compromise our development and commercialization efforts for any current product candidates, including requiring us to cease the development and commercialization of AL101
and AL102, or future product candidates and methods of use thereof.
65