Company: ATRA
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0000950170-25-035507
Chunk: 144

Company: Atara Biotherapeutics, Inc.
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1A
Chunk 144
---
 not provide adequate coverage against potential liabilities. We do not maintain insurance for environmental liability or toxic tort claims that may be asserted against us in connection with our storage or disposal of biological or hazardous materials.

In addition, we may incur substantial costs in order to comply with current or future environmental, health and safety laws and regulations. These current or future laws and regulations may impair our research, development or production efforts. Failure to comply with these laws and regulations also may result in substantial fines, penalties or other sanctions, which could adversely affect our business, financial condition, results of operations and prospects.

The actual or perceived failure by us, our customers, or vendors to comply with increasingly stringent laws, regulations and contractual obligations relating to privacy, data protection, and data security could harm our reputation, and subject us to significant fines and liability.

We are or may become subject to numerous domestic and foreign laws and regulations regarding privacy, data protection, and data security, the scope of which is changing, subject to differing applications and interpretations and may be inconsistent among countries, or conflict with other rules. We are also subject to the terms of our contractual obligations to customers and third parties related to privacy, data protection, and data security. The actual or perceived failure by us, our customers, our vendors, or other relevant third parties to address or comply with these laws, regulations, and obligations could increase our compliance and operational costs, expose us to regulatory scrutiny, actions, fines and penalties, cause regulators to reject, limit or disrupt our clinical trial activities, result in reputational harm, lead to a loss of customers, reduce the use of our products, result in litigation and liability, and could otherwise cause a material adverse effect on our business, financial condition, and results of operations.

For example, the EU General Data Protection Regulation (EU) 2016/679 (EU GDPR) imposes strict requirements on in-scope organizations regarding the processing of personal information (i.e., data which identifies an individual or from which an individual is identifiable) of individuals (or data subjects). The EU GDPR governs the collection, use, disclosure, transfer and other processing of personal information and has direct effect in all EU Member States and extraterritorial effect where organizations outside of the European Economic Area (EEA) process personal information of individuals in the EEA in relation to the offering of goods or services to those individuals or the monitoring of their behavior. The UK has implemented the EU GDPR into its national law by virtue of section 3 of the European Union (Withdrawal) Act