Company: PGEN
Filing Date: 2025-03-19
Form Type: 10-K
Source: 0001356090-25-000007
Chunk: 78

Company: PRECIGEN, INC.
Filing Date: 2025-03-19
Form: 10-K
Item: Item 1A
Chunk 78
---
 laws and regulations, even if ultimately successful, will incur significant legal expenses and divert management's attention from the operation of our business.

Failure to comply with current or future federal, state and foreign laws and regulations and industry standards relating to privacy and data protection laws could lead to governmental enforcement actions (which could include civil or criminal penalties), private litigation, and/or adverse publicity and could negatively affect our operating results and business.

We or our collaborators may be subject to federal, state and foreign data privacy and security laws and regulations. In the United States, numerous federal and state laws and regulations, including federal health information privacy laws, state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws, that govern the collection, use, disclosure, protection and other processing of health-related and other personal information could apply to our operations or the operations of our collaborators. Many state legislatures have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security and data breaches. Laws in all 50 states require businesses to provide notice to customers whose personally identifiable information has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is costly. For example, the CCPA imposes stringent data privacy and data protection requirements for the personal information of California residents, provides for civil penalties for violations, as well as a private right of action for data breaches. State laws are changing rapidly, as numerous other states have enacted, or are considering enacting, comprehensive data privacy laws that share similarities with the CCPA. The CCPA and evolving legislation may require us, among other things, to incur additional costs and expenses in an effort to comply.

Foreign data protection laws, including the European Union, or EU, General Data Protection Regulation, or the GDPR, may also apply to health-related and other personal information obtained outside of the United States. The GDPR introduced new data protection requirements in the EU, as well as potential fines for noncompliant companies of up to the greater of €20 million or 4 percent of annual global revenue. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EU and the United States remains uncertain. 

Further, the vote in the United Kingdom in favor of exiting the EU, referred to as Brexit, has created uncertainty with regard to data protection regulation in