Company: IMCR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001671927-25-000006
Chunk: 78

Company: Immunocore Holdings plc
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 78
---
, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

In the United States, state consumer privacy laws are stringent, broad in scope and offer individuals the ability to exercise certain privacy rights. These state laws differ from each other, which may complicate compliance efforts. By way of example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), creates certain privacy rights for California residents and places increased privacy and security obligations on entities that are subject to the law. The CCPA requires covered businesses to provide specific disclosures to California residents about such covered businesses’ data collection, use and sharing practices and provide such residents mechanisms to opt out of certain disclosures of personal information. The CCPA provides for fines and authorizes private lawsuits to recover statutory damages for certain data breaches. The CCPA and other comprehensive U.S. state privacy laws exempt some data processed in the context of clinical trials, but these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us.

Certain aspects of our business, including those for which we rely upon collaborators, service providers, contractors or others, are or may become subject to HIPAA and its implementing regulations, which establish standards for covered entities (certain healthcare providers, health plans and healthcare clearinghouses) governing the conduct of certain electronic healthcare transactions and protecting the security and privacy of protected health information, including, among other requirements, mandatory contractual terms and technical safeguards designed to protect the privacy, security and transmission of protected health information and notification to affected individuals and regulatory authorities in the event of certain breaches of security of protected health information. The American Recovery and Reinvestment Act of 2009, commonly referred to as the economic stimulus package, included sweeping expansion of HIPAA’s privacy and security standards called the Health Information Technology for Economic and Clinical Health Act ("HITECH"), which became effective on February 17, 2010. Among other things, the HITECH makes HIPAA’s privacy and security standards directly applicable to business associates, or independent contractors or agents of covered entities, that receive or obtain protected health information in connection with providing a service on behalf of a covered entity, as well as their covered subcontractors. HITECH also increased the civil and criminal penalties that may be imposed against covered entities, business associates and possibly other persons, and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and