Company: ADPT
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030913
Chunk: 38

Company: Adaptive Biotechnologies Corp
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1
Chunk 38
---
 expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business and the cost of available tools to improve security and reduce vulnerabilities. Although we have and maintain a system for compliance with privacy laws and regulations, failure to comply with them could expose us to potential FTC enforcement action and fines.

21

In addition, certain state laws govern the privacy and security of health information and personal information. Some of the state laws governing health information privacy and security are more stringent than HIPAA (including providing a private right to litigate for patients under these state laws) and often differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. There has also recently been an influx of state privacy and security laws that introduce similar compliance complexities, including the Washington state My Health My Data Act, the California Consumer Privacy Act in combination with the California Privacy Rights Act and associated regulations and the Colorado Privacy Act. In addition, there are state breach notification laws in every state, as well as in the District of Columbia, Guam and Puerto Rico. Failure to comply with these laws, where applicable, can result in the imposition of significant civil or criminal penalties and private litigation as further detailed in the “Risk Factors” section.

In addition to laws that directly impose privacy and data protection obligations on companies, there is also a growing interest in laws and regulations that govern data areas that are related to, but not completely related to data privacy. One area of these laws relates to use and testing of genetic and genomic data. In addition to the federal Genetic Information Nondiscrimination Act, there are a number of state laws that have recently passed (e.g., the California Genetic Information Privacy Act) and that continue to make appearances on states’ legislative schedules. There have been similar draft bills at the state level that would regulate machine learning, artificial intelligence, the Internet of Things, and human specimen use. 

General Data Protection Regulation in the EU and other International Privacy Laws

The General Data Protection Regulation (“GDPR”) is a legal framework that sets requirements for the collection and processing of personal information of individuals within the European Economic Area (“EEA”). The GDPR sets out the principles for data management and the rights of the individual, while also imposing very significant fines that can be revenue-based. It applies to U.S. companies that process personal information of persons in the EEA in connection with the offer of products or services to those persons, or the monitoring of such persons’