Company: MYGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000899923-25-000019
Chunk: 93

Company: MYRIAD GENETICS INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 93
---
 business. In the United States, numerous federal and state laws and regulations, including state data breach notification laws, state genetic testing laws, state health information privacy laws and federal and state consumer protection laws govern the collection, use, disclosure and protection of health-related and other personal and protected health information. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, which may create uncertainty in our business, affect our or our service providers’ ability to operate in certain jurisdictions or to collect, store, transfer, use and share personal data, result in liability, or impose additional compliance or other costs on us.  Failure, or perceived failure, to comply with these laws and regulations, where applicable, could result in government enforcement actions, which could include civil or criminal penalties, private litigation and/or adverse publicity, diversion of management time and effort, and could negatively affect our operating results and business. 

49

Table of Contents

Various U.S. states now regulate the processing of personal information. For example, California was the first of an increasing number of states to enact comprehensive state privacy legislation with the California Consumer Privacy Act (CCPA), which went into effect in January of 2020. The CCPA established a privacy framework for covered businesses by creating an expanded definition of personal information, establishing data privacy rights for California residents, requiring covered businesses to provide disclosures to California residents, and creating a statutory damages framework with the potential for severe damages for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches, as well as a private right of action for certain data breaches. Additionally in 2020, California voters passed the California Privacy Rights Act  (CPRA), which went into effect on January 1, 2023. The CPRA significantly amended the CCPA, potentially resulting in further uncertainty, additional costs and expenses in an effort to comply and additional potential for harm and liability for failure to comply. Among other things, the CPRA established a new regulatory authority, the California Privacy Protection Agency, which enacts new regulations under the CPRA and has expanded enforcement authority. More U.S. states are enacting similar legislation, increasing compliance complexity and increasing risks of failures to comply. In 2023, comprehensive privacy laws in Virginia, Colorado, Connecticut, and Utah all took effect, and laws in Montana, Oregon, and Texas took effect in 2024. Laws in a number of other U.S. states took effect, or are set to take effect, in 2025,