Company: PMVP
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030414
Chunk: 100

Company: PMV Pharmaceuticals, Inc.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 100
---
 transfers. The GDPR increased our responsibility and liability in relation to personal data that we process where such processing is subject to the GDPR, and we may be required to put in place additional mechanisms to ensure compliance with the GDPR, including as implemented by individual countries. Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm in connection with our European activities. Further, the United Kingdom’s vote in favor of exiting the EU, often referred to as Brexit, has created uncertainty with regard to data protection regulation in the United Kingdom. In particular, it is unclear how data transfers to and from the United Kingdom will be regulated. 

In the United States, most healthcare providers, including research institutions from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, and their respective implementing regulations. HIPAA imposes requirements on certain covered healthcare providers, health plans and healthcare clearinghouses as well as their respective business associates that perform services for them that involve the use, or disclosure of, individually identifiable health information, relating to the privacy, security and transmission of individually identifiable health information without appropriate authorization. HITECH also created new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates, and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorneys’ fees and costs associated with pursuing federal civil actions. Even when HIPAA does not apply, according to the Federal Trade Commission, or FTC, failing to take 

 58

appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C § 45(a). The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. 

In addition, certain states have enacted additional laws governing the privacy and security of health information in certain circumstances, many of which differ from each