Company: VCYT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001384101-25-000014
Chunk: 31

Company: VERACYTE, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 31
---
 CJEU issued a ruling that expanded the scope of the “one stop shop” under the GDPR. According to the ruling, the competent authorities of EU Member States may, under certain strict conditions, bring claims to their national courts against a company for breaches of the GDPR, including unlawful cross-border processing activities, even if such company does not have an establishment in the EU member state in question and the competent authority bringing the claim is not the lead supervisory authority.

In addition, further to the UK’s exit from the EU on January 31, 2020, the UK’s European Union (Withdrawal) Act 2018 incorporated the GDPR (as it existed on December 31, 2020, but subject to certain UK-specific amendments) into UK law, referred to as the UK GDPR. The UK GDPR and the UK Data Protection Act 2018 set out the UK’s data protection regime, which is independent from but aligned to the EU’s data protection regime. Non-compliance with the UK GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher. With respect to transfers of personal data from the EEA to the UK, on June 28, 2021, the European Commission issued an adequacy decision in respect of the UK’s data protection framework, enabling data transfers from EU member states to the UK to continue without requiring organizations to put in place contractual or other measures in order to lawfully transfer personal data between the territories. While it is intended to last for at least four years, the European Commission may unilaterally revoke the adequacy decision at any point, and, if this occurs, it could lead to additional costs and increase our overall risk exposure.

Other Privacy Laws

Laws governing privacy may continue to be adopted in the future from time to time. We have taken steps to comply with health information privacy requirements to which we are aware that we are subject. For example, the Personal Information Protection Law, or PIPL, was implemented in China, and broadly regulates the processing of personal information and imposes compliance obligations and penalties comparable to those of the GDPR.  However, we can provide no assurance that we are or will remain in compliance with diverse privacy requirements in all of the jurisdictions in which we do business. Failure to comply with privacy requirements could result in civil or criminal penalties, which could have a materially adverse effect on our business.

Corporate Practice of Medicine

Numerous states, including California and Texas, have enacted laws prohibiting corporations such as us from