Company: MIRM
Filing Date: 2025-05-07
Form Type: 10-Q
Source: 0001759425-25-000032
Chunk: 264

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-05-07
Form: 10-Q
Item: Part II, Item 1A
Chunk 264
---
 consumers, business representatives and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines for violations and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA and other comprehensive state privacy laws exempt some data processed in the context of clinical trials, these laws may increase compliance costs and potential liability for us and the third parties with whom we work. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. 

Outside the U.S., an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the EU GDPR and the UK GDPR (together “GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018), Canada’s Personal Information Protection and Electronic Document Act (“PIPEDA”) and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing personal data, and violators of these laws may face significant penalties. 

For example, the GDPR imposes stringent requirements for controllers and processors of personal data, including, for example, more robust disclosures to individuals and a strengthened individual data rights regime, mandatory data breach notifications in certain circumstances, limitations on retention of information, increased requirements pertaining to special categories of data, such as health data, and additional obligations when we contract with third-party processors in connection with the processing of personal data. In addition, the definition of “personal data” under the GDPR is broad and captures “pseudonymized” or key-coded data that is commonly processed in a clinical trial-related context.

We are subject to the GDPR because of our data processing activities that involve the personal data of individuals residing in the EEA and UK, such as in connection with our clinical trials in Europe, and early access program in multiple EU countries, and because of certain processing of personal data carried out in the context of the activities of our relevant European subsidiaries. In addition, we maintain an office in Switzerland, which subjects us to privacy and data protection laws and regulations similar to the GDPR under the Swiss Federal Act on Data Protection, or the FADP. The FADP applies to the collection and processing of personal data, including health-related information, by companies located in Switzerland, or in certain circumstances, by companies