Company: ATRA
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0000950170-25-035507
Chunk: 148

Company: Atara Biotherapeutics, Inc.
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1A
Chunk 148
---
 sanctions may include (i) a temporary suspension to provide services in the EU (by suspending relevant authorizations/certifications); (ii) an order to make public certain elements of the infringement and/or inform customers; and (iii) injunctions to immediately cease infringing conduct. Importantly, NISD2 also provides that senior members of staff can be held personally liable, and face administrative fines or be temporarily suspended from exercising managerial functions at the legal representative or chief executive officer level.

Other countries outside of Europe and the UK continue to enact or are considering enacting similar cross-border data transfer restrictions and laws requiring local data residency, which could increase the cost and complexity of delivering our services and 

74

operating our business. For example, Brazil recently enacted the General Data Protection Law (Lei Geral de Proteção de Dados Pessoais or LGPD) (Law No. 13,709/2018), which broadly regulates the processing of personal information and imposes compliance obligations and penalties comparable to those of the EU GDPR and the UK GDPR.

Regulation of privacy, data protection, and data security has also become more stringent in the United States. HIPAA imposes requirements to protect the privacy and security of protected health information (PHI) and to provide notification in the event of a breach of PHI. Violations of HIPAA are punishable by civil money penalties and, in some cases, criminal penalties and imprisonment. HHS’ Office for Civil Rights (OCR), which is responsible for enforcing HIPAA, also may enter into resolution agreements requiring the payment of a civil money penalty and/or the establishment of a corrective action plan to address violations of HIPAA. Pursuant to HIPAA, HHS has adopted privacy regulations, known as the privacy rule, to govern the use and disclosure of PHI (the Privacy Rule). HHS has also adopted data security regulations that require Covered Entities and Business Associates to implement administrative, physical and technical safeguards to protect the integrity, confidentiality and availability of PHI that is electronically created, received, maintained or transmitted (such as between us and our affiliated practices).   While the vast majority of HIPAA obligations do not apply to pharmaceutical companies or clinical trial data, the requirements inform privacy and security practices across the industry and may impact interactions with health care providers.

Numerous state laws are also designed to address privacy and information security issues, including but not limited to state medical privacy laws, state laws protecting personal information, state data breach notification laws, state genetic privacy laws, human subjects research laws and federal and state consumer