Company: CRNX
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-029050
Chunk: 188

Company: Crinetics Pharmaceuticals, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 188
---
 HIPAA. 

In addition, state laws govern the privacy and security of health-related and other personal information in certain circumstances, many of which differ from each other in significant ways and may not have the same requirements, thus complicating compliance efforts. By way of example, California enacted the California Consumer Privacy Act, or CCPA, effective January 1, 2020, which gives California residents expanded rights to access, correct, and delete their personal information, opt out of certain personal information sharing and disclosure, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that has increased the likelihood of, and risks associated with, data breach litigation. The CCPA may increase our compliance costs and potential liability. Further, the California Privacy Rights Act, or CPRA, generally went into effect on January 1, 2023, and significantly amends the CCPA. The CPRA imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also creates a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement, and additional compliance investment and potential business process changes may be required. Similar laws have passed or have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States. Further states have also enacted consumer health data privacy laws, including states without comprehensive consumer privacy laws, such as Nevada and Washington state. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

In the European Economic Area, or EEA, the General Data Protection Regulation, or GDPR, imposes stringent requirements for controllers and processors of personal data, including, for example, high standards for obtaining consent from individuals to process their personal data, robust disclosures to individuals and a strong individual data rights regime, short timelines for data breach notifications, limitations on retention and secondary use of information, significant requirements pertaining to health data and pseudonymized (i.e., key-coded) data and obligations when we contract third-party processors in connection with the processing of the personal data. Companies that must comply