Company: IMCR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001671927-25-000006
Chunk: 162

Company: Immunocore Holdings plc
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 162
---
 substantial fines and penalties, the inability to transfer data, the inability to work with certain collaborators, partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and United Kingdom to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.

85

Table of Contents

In the United States, federal, state and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws and consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 ("CCPA") applies to personal data of consumers, business representatives, and employees who are California residents to the CCPA requires businesses to provide specific disclosures in privacy notices and honor California residents’ requests to exercise certain privacy rights. The CCPA allows for statutory fines for non-compliance and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA and other comprehensive state privacy laws exempt some data processed in the context of clinical trials, but these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely. Other laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. If we become subject to new data privacy or security laws the risk of enforcement action against us could increase because we may become subject to additional obligations, and the