Company: RCUS
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001724521-25-000063
Chunk: 309

Company: Arcus Biosciences, Inc.
Filing Date: 2025-05-06
Form: 10-Q
Item: Part I, Item 8
Chunk 309
---
 Section 5 of the FTC Act), that govern the collection, use, disclosure, and protection of health-related and other personal information could apply to our operations or the operations of our collaborators. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. While we do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly regulated under HIPAA, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or 

55

conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information.

The legislative and regulatory landscape for privacy and data security continues to evolve, and we expect that there will continue to be new proposed laws, regulations and industry standards relating to privacy and data security in the U.S., the European Union (the "EU"), the United Kingdom (the "UK") and other jurisdictions. This increased focus on privacy and data security issues may negatively affect our operating results and our business. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA") applies to personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.

Foreign data protection laws also apply to health-related and other personal data obtained outside the U.S. The EU General Data Protection Regulation (the "EU GDPR"), the UK General Data Protection Regulation (the "UK GDPR" and, together with the EU GDPR, the "GDPR") and Canada’s Personal Information Protection and Electronic Documents Act ("PIPEDA"), or the applicable provincial alternatives, impose strict requirements, including the obligation to appoint data protection officers in certain circumstances, rights for individuals to be “forgotten” and to data portability, and the obligation to make public notification of significant data breaches. Under the GDPR, data protection authorities can impose temporary or definitive bans on data processing and other corrective actions or fines of up to