Company: ARVN
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0001655759-25-000016
Chunk: 262

Company: ARVINAS, INC.
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1A
Chunk 262
---
 on data transfers from the EEA to the U.S. generally and increase our costs of compliance with data privacy legislation as well as our costs of negotiating appropriate privacy and security agreements with our vendors and business partners. 

As a response to the CJEU decision, former President Biden signed an executive order to implement the EU-U.S. Data Privacy Framework, which would serve as a replacement to the EU-U.S. Privacy Shield. The EU initiated the process to adopt an adequacy decision for the EU-U.S. Data Privacy Framework in December 2022. It is unclear if and when the framework will be finalized and whether it will be challenged in court. The uncertainty around this issue may further impact our business operations in the EU.

Following the withdrawal of the UK from the EU, the UK Data Protection Act 2018 applies to the processing of personal data that takes place in the UK and includes parallel obligations to those set forth by GDPR. In relation to data transfers, both the UK and the EU have determined, through separate “adequacy” decisions, that data transfers between the two jurisdictions are in compliance with the UK Data Protection Act 

115

and the GDPR, respectively. Any changes or updates to these adequacy decisions have the potential to impact our business.

Beyond GDPR, there are privacy and data security laws in a growing number of countries around the world. While many loosely follow GDPR as a model, other laws contain different or conflicting provisions. These laws will impact our ability to conduct our business activities, including both our clinical trials and the sale and distribution of commercial products, through increased compliance costs, costs associated with contracting and potential enforcement actions.

While we continue to address the implications of the recent changes to data privacy regulations, data privacy remains an evolving landscape at both the domestic and international level, with new regulations coming into effect and continued legal challenges, and our efforts to comply with the evolving data protection rules may be unsuccessful. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices. We must devote significant resources to understanding and complying with this changing landscape. Failure to comply with laws regarding data protection would expose us to risk of enforcement actions taken by data protection authorities in the EEA and elsewhere and carries with it the potential for significant penalties if we are found to be non-compliant. Similarly, failure to comply with federal and state laws in the U.S. regarding privacy and security of personal information could expose us to penalties under such laws. Any such failure to comply with data protection and privacy laws could result