Company: ATRA
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0000950170-25-035507
Chunk: 149

Company: Atara Biotherapeutics, Inc.
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1A
Chunk 149
---
 protection laws. For example, the CCPA, which took effect on January 1, 2020, give California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. The CCPA was substantially expanded on January 1, 2023, when the California Privacy Rights Act (CPRA) amendments to the CCPA became fully operative. The CPRA amendments, among other things, give California residents the ability to limit use of certain sensitive personal information, further restrict the use of cross-contextual advertising, establish restrictions on the retention of personal information, expand the types of data breaches subject to the CCPA’s private right of action, provide for increased penalties for CCPA violations concerning California residents under the age of 16, and establish a new California Privacy Protection Agency to implement and enforce the new law. 

Regulation of privacy, data protection and data security has also become more stringent in the United States, with several new laws following the CCPA and being enacted at the state level, including several comprehensive privacy laws. While these new laws and proposals generally include exemptions for HIPAA-covered data and clinical trial data, they add layers of complexity to compliance in the U.S. market, and could increase our compliance costs and adversely affect our business. Multiple other states and the federal government are considering enacting similar legislation, demonstrating a strong trend towards more stringent state privacy, data protection and data security legislation in the U.S., which could increase our potential liability and adversely affect our business. Other states have passed or amended existing state privacy laws to impose enhanced privacy and cybersecurity obligations for consumer health data, such as, the Washington My Health My Data Act and Nevada’s Consumer Health Data Privacy Law. For instance, Washington State's “My Health My Data Act” regulates “consumer health data” which is defined as “personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health.” 

The Federal Trade Commission (FTC) has authority under Section 5 of the FTC Act to regulate unfair or deceptive practices, and has used this authority to initiate enforcement actions against companies that implement inadequate controls around privacy and information security in violation of their externally facing policies. The FTC has recently brought