Company: LCTX
Filing Date: 2025-03-10
Form Type: 10-K
Source: 0000950170-25-036309
Chunk: 42

Company: Lineage Cell Therapeutics, Inc.
Filing Date: 2025-03-10
Form: 10-K
Item: Item 1
Chunk 42
---
), and record keeping obligations. We are also subject to a complex patchwork of data security and breach notification laws, which exist at a state level in the US (in addition to obligations under HIPAA, discussed above), and also in laws outside of the US, such as GDPR and UK GDPR. Obligations under these laws may include notification in the event of a data breach; limiting personal data processing to only what is necessary for specified, explicit, and legitimate purposes; implementing and maintaining technical and organizational safeguards for personal data. In addition to privacy and data security specific legislation, there are also enforcements brought under unfair and deceptive trade practice laws, such as Section V of the FTC Act. Regulators often issue guidance to assist companies, which guidance is frequently updated, and these guidance are relied on by enforcement bodies and courts.

There is a growing trend towards required public disclosure of clinical trial data in the EU which adds to the complexity of obligations relating to processing health data from clinical trials. Failing to comply with these obligations could lead to government enforcement actions and significant penalties against the Company, harm to its reputation, and adversely impact its business and operating results. The uncertainty regarding the interplay between different regulatory frameworks further adds to the complexity that the Company faces with regard to data protection regulation. In addition, Israel’s Protection of Privacy Law 5741-1981 and the regulations promulgated thereunder impose certain obligations with respect to the manner personal data is processed, and government regulators may issue fines or sanctions for non-compliance.

In certain circumstances we may transfer personal information of EU individuals to the US. Often we rely on standard contractual clauses.  These have been questioned by privacy advocates, which scrutiny has grown under the new US presidential administration, and their sufficiency be subject to legal review. In addition, Switzerland and the UK similarly restrict personal data transfers outside of those jurisdictions to countries, such as the United States, that do not provide an adequate level of personal data protection, and certain countries outside Europe (e.g., Israel) have also passed or are considering laws requiring local data residency or otherwise impeding the transfer of personal data across borders.

In addition, business practices in the healthcare industry have come under increased scrutiny, particularly in the U.S., by government agencies (e.g., the U.S. Federal Trade Commission (the “FTC”) and the U.S. Department of 

26

Health and Human Services (“HHS”)) and state attorneys general, which continue to stress the intersection of health and privacy as a compliance and enforcement priority