Company: ARVN
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0001655759-25-000016
Chunk: 260

Company: ARVINAS, INC.
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1A
Chunk 260
---
 enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems. 

In 2018, California passed into law the California Consumer Privacy Act, or the CCPA, which took effect on January 1, 2020 and imposed many requirements on businesses that process the personal information of California residents. Many of the CCPA’s requirements are similar to those found in the General Data Protection Regulation, or the GDPR, including requiring businesses to provide notice to data subjects regarding the information collected about them and how such information is used and shared, and providing data subjects the right to request access to such personal information and, in certain cases, request the erasure of such personal information. In November 2020, California voters passed a ballot initiative for the California Privacy Rights Act, or the CPRA, which went into effect on January 1, 2023 and significantly expanded the CCPA to incorporate additional GDPR-like provisions including requiring that the use, retention, and sharing of personal information of California residents be reasonably necessary and proportionate to the purposes of collection or processing, granting additional protections for sensitive personal information, and requiring greater disclosures related to 

114

notice to residents regarding retention of information. The provisions in the CPRA may apply to some of our business activities. 

In addition to California, at least eighteen other states have passed comprehensive privacy laws similar to the CCPA and CPRA. These laws are either in effect or will go into effect sometime before the end of 2026. Like the CCPA and CPRA, these laws create obligations related to the processing of personal information, as well as special obligations for the processing of “sensitive” data, which includes health data in some cases. Some of the provisions of these laws may apply to our business activities. There are also states that are strongly considering or have already passed comprehensive privacy laws during the 2024 legislative sessions that will go into effect in 2025 and beyond. Other states will be considering similar laws in the future, and Congress has also been debating passing a federal privacy law. There are also states that are specifically regulating health information that may affect our business. For example, Washington passed the My Health My Data Act in 2023 which specifically regulated health information that is not otherwise regulated by the HIPAA rules, and the law also has a private right of action, which further increases the relevant compliance risk. Connecticut and Nevada have also passed similar laws regulating