Company: ATRA
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0000950170-25-035507
Chunk: 146

Company: Atara Biotherapeutics, Inc.
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1A
Chunk 146
---
 the transfer of personal information from the EEA to countries that the European Commission does not recognize as having an “adequate” level of data protection unless the parties to the transfer have implemented specific safeguards to protect the transferred personal information (e.g., EU Standard Contractual Clauses or EU SCCs). Data protection laws in the UK (as discussed below) and Switzerland impose similar restrictions. There is also a requirement in certain cases for companies to carry out a transfer impact assessment (TIA) which, among other things, assess laws governing access to personal information in the recipient country and considers whether supplementary measures that provide privacy protections additional to those under the EU SCCs will need to be implemented to ensure an “essentially equivalent” level of data protection to that afforded in the EU. 

On July 10, 2023, the EC adopted its Final Implementing Decision granting the U.S. adequacy (Adequacy Decision) for EU-U.S. transfers of personal information for companies that self-certify to the Data Privacy Framework (DPF). Entities relying on EU SCCs for transfer to the U.S. are also able to rely on the analysis in the Adequacy Decision as support for their TIA regarding the equivalence of U.S. national security safeguards and redress. However, any transfers by us or our vendors of personal information subject to the EU GDPR may not comply with European data protection law, may increase our exposure to the EU GDPR’s heightened sanctions for violations of its cross-border data transfer restrictions, and may reduce demand from companies subject to European data protection laws.

Complying with the GDPR involves rigorous and time-intensive processes that may cause us to incur certain operational costs and/or require us to change our business practices. There may also be a risk that the measures will not be implemented correctly or that individuals within the business will not be fully compliant with the required procedures. If there are breaches of these measures, we could face significant administrative and monetary sanctions as well as reputational damage which may have a material adverse effect on our operations, financial condition and prospects. Assisting our customers, partners, and vendors in complying with the GDPR, or complying with the GDPR ourselves, may cause us to incur substantial operational costs or require us to change our business practices. There may also be a risk that the measures will not be implemented correctly or that individuals within the business will not be fully compliant with the required procedures. There is a risk that we could be impacted by a cybersecurity incident that results in loss or unauthorized disclosure of personal information, potentially