Company: ERAS
Filing Date: 2025-03-20
Form Type: 10-K
Source: 0000950170-25-042682
Chunk: 225

Company: Erasca, Inc.
Filing Date: 2025-03-20
Form: 10-K
Item: Item 1A
Chunk 225
---
 The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches, which may increase our compliance costs and potential liability, including due to a new California data protection agency authorized to enforce the CCPA in addition to the Attorney General. Similar laws are already in effect in other states, including Virginia, Utah, Connecticut and Colorado, and have been enacted or proposed in other states and at the federal level, reflecting a trend toward more stringent privacy-related regulation in the United States. The enactment of such laws creates a patchwork of overlapping, but different and potentially conflicting, requirements that may make compliance challenging. Furthermore, the FTC and many state Attorneys General continue to enforce federal and state consumer protection laws against companies in relation to a variety of data privacy and security issues. In the event that we are subject to HIPAA, the CCPA, or similar state data privacy laws, compliance will likely involve significant expenditure and resources, and any failure or perceived failure to comply with the requirements of these laws could adversely affect our business, results of operations, and financial condition.

In Europe, the European Union General Data Protection Regulation (EU GDPR) and the United Kingdom General Data Protection Regulation and Data Protection Act (UK GDPR and together with the EU GDPR, GDPR) govern the collection, use, disclosure, transfer or other processing of personal information of individuals within the EEA. 

In addition, the GDPR increases the scrutiny of transfers of personal data from the EEA and UK to the US and other jurisdictions that the European Commission does not recognize as having “adequate” data protection laws. Reliance on standard contractual clauses (SCCs) alone may not be sufficient in all circumstances, and we expect the existing legal complexity and uncertainty regarding international personal data transfers, in particular to the US, to continue. As regulatory guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our business, results of operations, and financial condition.

Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may