Company: ABUS
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001447028-25-000083
Chunk: 65

Company: Arbutus Biopharma Corp
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1
Chunk 65
---
 including state security breach notification laws, state health information privacy laws, state genetic privacy laws, and federal and state consumer protection and privacy laws, (including, for example, Section 5 of the Federal Trade Commission Act (FTC Act) and the Health Breach Notification Rule, and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA)) govern the collection, use and disclosure of personal information. These laws may differ from each other in significant ways, thus complicating compliance efforts. Federal regulators, state attorneys general, and plaintiffs’ attorneys have been and will likely continue to be active in this space. Activities outside of the United States implicate local and national data protection standards, impose additional compliance requirements and generate additional risks of enforcement for non-compliance. The European Union’s General Data Protection Regulation, including as implemented in the United Kingdom, (collectively, GDPR) and other data protection, privacy and similar national, state/provincial and local laws may restrict the access, use, storage, disclosure and other processing activities concerning patient health information abroad. Compliance efforts will likely be an increasing and substantial cost in the future.

 27

Failure to comply with such laws and regulations could result in government enforcement actions and create liability for us (including the imposition of significant penalties), private litigation and/or adverse publicity that could negatively affect our business.  In addition, if we successfully commercialize our product candidates, we may obtain patient health information from healthcare providers that prescribe our products and research institutions we collaborate with, and they are subject to privacy and security requirements under HIPAA.  Although we are not directly subject to HIPAA other than potentially with respect to providing certain employee benefits, we could potentially be subject to criminal penalties if we, or our affiliates or our agents knowingly receive individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA.

The Federal Trade Commission (FTC) also sets expectations for failing to take appropriate steps to keep consumers’ personal information secure, or failing to provide a level of security commensurate to promises made to individual about the security of their personal information (such as in a privacy notice), which may constitute unfair or deceptive acts or practices in violation of Section 5(a) of the FTC Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.