Company: TXG
Filing Date: 2025-05-09
Form Type: 10-Q
Source: 0001770787-25-000032
Chunk: 324

Company: 10x Genomics, Inc.
Filing Date: 2025-05-09
Form: 10-Q
Item: Part II, Item 1A
Chunk 324
---
 enter into specific contractual provisions with services providers that process California resident personal information on the business’s behalf.  Additional compliance investment and potential business process changes may also be required. Similar laws have passed in other states and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging.

60

Furthermore, the Federal Trade Commission (“FTC”) has authority to initiate enforcement actions against entities that mislead customers about compliance with the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), make deceptive statements about privacy and data sharing in privacy policies, fail to limit third-party use of personal health information, fail to implement policies to protect personal health information or engage in other unfair practices that harm customers or that may violate Section 5(a) of the FTC Act. The FTC and many state Attorneys General also continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers’ personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the FTC Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.

Any failure or perceived failure by us or our vendors or partners to comply with these laws and regulations, our privacy and notice policies, our privacy-related obligations to employees, customers or other third parties or privacy or security-related legal obligations, or any actual or perceived compromise of security that results in the unauthorized access to or disclosure, alteration, theft, loss, transfer or use of personal or other information, including personally identifiable information or other sensitive data, may result in governmental enforcement actions, fines and penalties, litigation or public statements critical of us by consumer advocacy groups or others and could cause our customers, partners or others to lose trust in us, which could have an adverse effect on our business.

If we or our critical third-party providers experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected.

We collect and maintain information in digital form that is necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business.