Company: PSTV
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0000950170-25-047698
Chunk: 104

Company: PLUS THERAPEUTICS, INC.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 104
---
 in violation of Section 5 of the FTC Act. The FTC also has the power to enforce the Health Breach Notification Rule, which imposes notification obligations on companies for breaches of certain health information contained in personal health records. Enforcement by the FTC under the FTC Act and Health Breach Notification Rule can result in civil penalties or enforcement actions.

Most states have laws requiring notification of affected individuals and state regulators (breach notification laws) in the event of a breach of personal information, which is a broader class of information than the health information protected by HIPAA. Many state laws impose significant data security requirements, such as encryption or mandatory contractual terms to ensure ongoing protection of personal information. For example, in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”) establishes certain requirements for data use and sharing transparency and creates new data privacy rights for California consumers, as that term is defined by law. Failure to comply with the CCPA may result in, among other things, significant civil penalties and injunctive relief, or statutory or actual damages. In addition, California consumers have the right to bring a private right of action in connection with certain types of incidents. These claims may result in significant liability and damages. Other jurisdictions have enacted or proposed similar legislation and/or regulations, such as consumer privacy laws that went into effect in 2023 in Virginia, Colorado, Utah, and Connecticut. Health-specific Consumer privacy laws were also passed in multiple other states, including consumer health privacy laws in Washington and Nevada, which govern consumer health data. 

Activities outside of the U.S. implicate local and national data protection standards, impose additional compliance requirements and generate additional risks of enforcement for non-compliance. For example, the EU’s General Data Protection Regulation, including as implemented in the UK (collectively “GDPR”) imposes fines of up to EUR 20 million or 4% of the annual global revenue of a noncompliant company, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with data protection authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. Canada’s Personal Information Protection and Electronic Documents Act and other data protection, privacy and similar national, state/provincial and local laws may also restrict the access, use and disclosure of patient health information abroad. Moreover, as a result of the broad scale release and availability of Artificial Intelligence (AI) technologies such as generative AI, there is a global trend towards more regulation (