Company: PACB
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001299130-25-000061
Chunk: 280

Company: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1
Chunk 280
---
 imposes obligations on companies that process their personal information, came into effect on January 1, 2020. Among other things, the CCPA requires covered companies to provide new disclosures to California consumers and provide such consumers new data protection and privacy rights, including the ability to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. In November 2020, California also passed the California Privacy Rights Act, or (“CPRA”), which significantly expanded the CCPA as of January 1, 2023, including by introducing additional obligations such as data minimization and storage limitations and granting additional rights to consumers, among others. The enactment of the CCPA has prompted similar legislative developments in other states, and numerous other states have proposed, and in certain cases enacted, legislation relating to privacy and data security, many of which are similar to the CCPA and CPRA. Similar laws are being considered by other state legislatures. In addition, laws in all 50 U.S. states require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach. State laws are changing rapidly and there has been discussion in the U.S. Congress of a new comprehensive federal data privacy law. These and future laws and regulations may increase our compliance costs and potential liability.

Furthermore, regulations promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), establish privacy and security standards that limit the use and disclosure of individually identifiable health information (known as “protected health information”) and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. Determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can require complex factual and statistical analyses and may be subject to changing interpretation. Although we take measures to protect sensitive data from unauthorized access, use or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses or disrupted, breached or otherwise compromised due to employee error, malfeasance or other malicious or inadvertent disruptions. Any such breach or disruption could compromise our networks and the information stored there could be accessed, manipulated, publicly disclosed, lost, stolen, made unavailable, or otherwise processed without authorization. Any such