Company: PHAT
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0000950170-25-034183
Chunk: 187

Company: Phathom Pharmaceuticals, Inc.
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1A
Chunk 187
---
 regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million / GBP 17.5 million or up to 4% of the annual global revenues of the noncompliant company, whichever is greater. 

In addition, the GDPR increases the scrutiny of transfers of personal data from the EEA and UK to the United States and other jurisdictions that the European Commission does not recognize as having “adequate” data protection laws. Case law from the Court of Justice of the European Union, or CJEU, states that reliance on the standard contractual clauses – a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism – alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On July 10, 2023, the European Commission adopted its Adequacy Decision in relation to the new EU-US Data Privacy Framework, or DPF, rendering the DPF effective as an EU GDPR transfer mechanism to U.S. entities self-certified under the DPF. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government), as a data transfer mechanism from the UK to U.S. entities self-certified under the DPF. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines, we may have to stop using certain tools and vendors and make other operational changes, we have had to and will have to implement revised standard contractual clauses for existing customer and vendor arrangements within required time frames, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Our internal information systems, or those of any of our CROs, contract manufacturers, service providers, other contractors or consultants or potential future collaborators, may fail or suffer cybersecurity incidents or breaches, which could result in a material disruption of our product development programs.

The United States federal and various state and foreign governments have adopted or proposed requirements regarding the collection,