Company: NCNA
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0000950170-25-042709
Chunk: 37

Company: NuCana plc
Filing Date: 2025-03-20
Form: 20-F
Item: Item 3
Chunk 37
---
 My Data” Act provides exemptions for personal data used or shared in connection with certain research activities, including data subject to 45 C.F.R. Parts 46, 50 and 56. Notably, the “My Health My Data” Act contains a private right of action. In addition, Nevada recently enacted a consumer health data privacy bill, SB 370, which also regulates “consumer health data” and shares many similarities with Washington’s “My Health My Data” Act, and Connecticut recently amended its comprehensive privacy law to include heighted regulation of “consumer health data.” Additional states may adopt health-specific privacy laws that could impact our business activities and our collection and handling of health-related data.
 More broadly, various U.S. state laws regulate the processing of personal information. For example, California has enacted the California Consumer Privacy Act, or CCPA, which went into effect in January of 2020. The CCPA gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation. Although the CCPA includes exemptions for certain categories of health information, if we become subject to the CCPA, our compliance costs and potential liability with respect to other personal information we collect about California residents may increase. Additionally in 2020, California voters passed the California Privacy Rights Act, or the CPRA, which went into full effect on January 1, 2023. The CPRA significantly amended the CCPA, potentially resulting in further uncertainty, additional costs and expenses in an effort to comply and additional potential for harm and liability for failure to comply. Among other things, the CPRA established a new regulatory authority, the California Privacy Protection Agency, which is tasked with enacting new regulations under the CPRA and has expanded enforcement authority. In addition to California, more U.S. states are enacting similar legislation, increasing compliance complexity and increasing risks of failures to comply. In 2023, comprehensive privacy laws in Virginia, Colorado, Connecticut, and Utah all took effect, and laws in Montana, Oregon, and Texas took effect during 2024. Laws in a number of other U.S. states took effect, or are set to take effect, in 2025, in 2026, and beyond. Additional U.S. states have proposals under consideration, all of which are likely to increase