Company: AGIO
Filing Date: 2025-05-01
Form Type: 10-Q
Source: 0001439222-25-000036
Chunk: 171

Company: AGIOS PHARMACEUTICALS, INC.
Filing Date: 2025-05-01
Form: 10-Q
Item: Part I, Item 8
Chunk 171
---
). The agency is also in the process of developing rules related to commercial surveillance and 

37

data security that may impact our business. We will need to account for the FTC’s evolving rules and guidance for proper privacy and data security practices in order to mitigate our risk for a potential enforcement action, which may be costly. If we are subject to a potential FTC enforcement action, we may be subject to a settlement order that requires us to adhere to very specific privacy and data security practices, which may impact our business. We may also be required to pay fines as part of a settlement (depending on the nature of the alleged violations). If we violate any consent order that we reach with the FTC, we may be subject to additional fines and compliance requirements.

A number of states have passed comprehensive privacy laws, which are either currently in effect or will go into effect sometime over the next several years. These laws create obligations related to the processing of personal information, as well as special obligations for the processing of “sensitive” data (which includes health data in some cases). Some of the provisions of these laws may apply to our business activities. There are also states that are strongly considering or are in the process of enacting privacy laws that will go into effect in 2025 and beyond. Other states will be considering these laws in the future, and Congress has also been debating passing a federal privacy law. There are also states that are specifically regulating health information that may affect our business. These laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products.

Plaintiffs’ lawyers in the United States are also increasingly using privacy-related statutes at both the state and federal level to bring lawsuits against companies for their data-related practices. In particular, there have been a significant number of cases filed against companies for their use of pixels and other web trackers. These cases often allege violations of the California Invasion of Privacy Act and other state laws regulating wiretapping, as well as the federal Video Privacy Protection Act. The rise in these types of lawsuits creates potential risk for our business. 

Similar to the laws in the United States, there are significant privacy and data security laws that apply in Europe and other countries. The collection, use, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals who are located in the European Economic Area, or EEA, and the processing of personal data that takes place in the EEA, is regulated by the GDPR, which went