Company: DVAX
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001029142-25-000049
Chunk: 85

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 85
---
-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair or misrepresentative of our practices, we may face adverse consequences, which may include, but are not limited to, governmental enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar), litigation (including class-related claims) and mass arbitration demands, additional reporting requirements and/or oversight, bans on processing personal data, orders to destroy or not use personal data, civil and criminal liability and imprisonment of company officials.  In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business or financial condition, including but not limited to interruptions or stoppages in business operations (including clinical trials), inability to process personal data or to operate in certain jurisdictions, limited ability to develop or commercialize our products, expenditure of time and resources to defend any claim or inquiry or revision or restructuring of our operations.

In addition, privacy advocates and industry groups have proposed, and may propose, standards with which we are legally or contractually bound to comply or may become subject to in the future.

Our obligations related to privacy and data security are quickly changing and becoming increasingly stringent, creating uncertainty. These obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources. These obligations may also necessitate changes to our information technologies, systems and practices and those of third parties upon which we rely. Moreover, despite our efforts, our personnel or third parties upon which we rely may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. 

For instance, in the European Union, the second Network and Information Security Directive (Directive (EU) 2022/2555, “NIS2”) entered into force on 17 January 2023 and had to be transposed into the national law of each Member State by 17 October 2024. NIS2 creates a specific legal framework for the resilience and incident response capabilities of entities operating in 18 sectors, including the health sector. As a result, companies in