Company: PRME
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001628280-25-008884
Chunk: 183

Company: Prime Medicine, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 183
---
 claims. Additionally, the FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business and the cost of available tools to improve security and reduce vulnerabilities. Over the past year, the FTC has focused enforcement efforts on protecting privacy in the context of personal health information, and failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C § 45(a). Additionally, through executive and legislative action, the federal government has taken steps to restrict data transactions involving certain sensitive data categories – including health data, genetic data, and biospecimens – with persons affiliated with China, Russia, and other countries of concern.

In the EU, the collection and processing of personal information is governed by the EU’s General Data Protection Regulation, or the EU GDPR, and in the UK the EU GDPR has been incorporated into the laws of the UK GDPR, together with the EU GDPR, the GDPR. The GDPR in the EU and the UK, which have been incorporated into their respective laws, impose stringent requirements on the processing of health and other sensitive data. These requirements encompass: (i) providing information to individuals regarding data processing activities; (ii) ensuring a legal basis or condition applies to the processing of personal information and, where applicable, obtaining consent from individuals to whom the data processing relates; (iii) responding to data subject requests; (iv) imposing requirements to notify the competent national data protection authorities and data subjects of personal data breaches; (v) implementing safeguards in connection with the security and confidentiality of the personal information; (vi) accountability requirements; and (vii) taking certain measures when engaging third-party processor. Failure to comply with the requirements of the GDPR may result in significant fines and other administrative penalties. In addition, we may be required to put in place additional mechanisms to comply with current and future privacy and data protection regulations in Europe and other worldwide jurisdictions which are or will become applicable to our business. This may interrupt or delay our development activities and/or require us to change our business practices, which could adversely affect our business, financial condition, results of operations and prospects.

Data privacy and protection legislation and enforcement will continue to be an evolving landscape at both the domestic and international level, with new laws, rules and regulations coming into effect and presenting novel legal challenges, and our efforts to comply with them may be unsuccessful