Company: AGIO
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001439222-25-000116
Chunk: 234

Company: AGIOS PHARMACEUTICALS, INC.
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 8
Chunk 234
---
 protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. 

The FTC has been particularly focused on the unpermitted processing of health and genetic data through its recent enforcement actions and is expanding the types of privacy violations that it interprets to be “unfair” under Section 5 of the FTC Act of 1914, as well as the types of activities it views to trigger the Health Breach Notification Rule. The FTC is also in the process of developing rules related to commercial surveillance and data security that may impact our business. 

A number of states have passed comprehensive privacy laws and other states are strongly considering or in the process of enacting such laws. These laws create obligations related to the processing of personal information, as well as special obligations for the processing of “sensitive” data (which includes health data in some cases). In addition, Congress has also been debating passing a federal privacy law, and there are also states that are specifically regulating health information. These laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products.

There are also significant privacy and data security laws that apply in Europe and other countries. The collection, use, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals who are located in the European Economic Area, or EEA, and the processing of personal data that takes place in the EEA, is regulated by the 

41

GDPR. The GDPR imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and policies. While many other countries outside of the EEA loosely follow GDPR as a model, other laws contain different or conflicting provisions. 

Failure to comply with any of these laws and regulations could result in litigation, regulatory investigations or enforcement actions against us, orders to changes our practices, systems or policies, breaches of our contracts, fines, imprisonment of company officials and public censure, civil or criminal penalties, claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business, financial condition, results of operations or prospects. Even if we are not determined to have violated these laws, litigation or government investigations into these issues typically require the expenditure of significant resources and generate negative publicity.

Risks Related to Our Financial Position

We face challenges as a less diversified