Company: ABUS
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001447028-25-000083
Chunk: 66

Company: Arbutus Biopharma Corp
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1
Chunk 66
---
 Individually identifiable health information is considered sensitive data that merits stronger safeguards. With respect to privacy, the FTC also sets expectations for failing to honor the privacy promises made to individuals about how the company handles consumers’ personal information; such failure may also constitute unfair or deceptive acts or practices in violation of the FTC Act.  Enforcement by the FTC under the FTC Act can result in civil penalties or enforcement actions. The FTC also has the power to enforce the Health Breach Notification Rule, which imposes notification obligations on companies for breaches of certain health information contained in personal health records. The FTC has brought enforcement actions under both Section 5 of the FTC Act and the Health Breach Notification Rule.

In California, the CCPA establishes certain requirements for data use and sharing transparency and provides California residents certain rights concerning the use, disclosure, and retention of their personal information. The CCPA and its implementing regulations have already been amended multiple times since their enactment. In November 2020, California voters approved the CPRA ballot initiative which introduced significant amendments to the CCPA and established and funded a dedicated California privacy regulator, the California Privacy Protection Agency (CPPA).  The amendments introduced by the CPRA went into effect on January 1, 2023, and implementing regulations continue to be introduced by the CPPA. Failure to comply with the CCPA may result in, among other things, significant civil penalties and injunctive relief, or statutory or actual damages. In addition, California residents have the right to bring a private right of action in connection with certain types of incidents. These claims may result in significant liability and damages. Other states, including Virginia, Colorado, Utah, Indiana, Iowa, Tennessee, Montana, Texas and Connecticut have enacted privacy laws similar to the CCPA that impose new obligations or limitations in areas affecting our business and we continue to assess the impact of these state legislations on our business as additional information and guidance becomes available. Similarly, there are a number of legislative proposals in the United States, at both the federal and state level, that could impose new obligations or limitations in areas affecting our business. These laws and regulations are evolving and subject to interpretation, and may impose limitations on our activities or otherwise adversely affect our business.

Activities outside of the United States implicate local and national data protection standards, impose additional compliance requirements and generate additional risks of enforcement for non-compliance. The European Union’s/United Kingdom’s GDPR and other data protection, privacy and similar national, state/provincial and local laws may also restrict the access, use, storage