Company: ARVN
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0001655759-25-000016
Chunk: 197

Company: ARVINAS, INC.
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1
Chunk 197
---
ing a data protection officer, providing notification of data breaches, and taking certain measures when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside the EEA, including the U.S., and permits data protection authorities to impose large penalties for violations of the GDPR, including potential fines of up to €20 million or 4% of annual global revenues, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. Compliance with the GDPR is a rigorous and time-intensive process that may increase the cost of doing business or require companies to change their business practices to ensure full compliance.

76

Following the July 2020 Court of Justice of the European Union judgement invalidating the so-called EU-U.S. Privacy Shield, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework in July 2023. This adequacy decision permits U.S. companies who self-certify under the EU-U.S. Data Privacy Framework to rely on it as a valid data transfer mechanism for data transfers from the European Union to the United States. However, some privacy advocacy groups have already suggested that they will be challenging the EU-U.S. Data Privacy Framework. If these challenges are successful, they may not only impact the EU-U.S. Data Privacy Framework, but also further limit the viability of the so-called standard contractual clauses and other data transfer mechanisms. The uncertainty around this issue has the potential to impact our business.

On June 23, 2016, the electorate in the United Kingdom voted in favor of leaving the EU, commonly referred to as Brexit. Following the withdrawal of the United Kingdom from the EU, the U.K. Data Protection Act 2018 applies to the processing of personal data that takes place in the United Kingdom and includes parallel obligations to those set forth by GDPR. The United Kingdom government has already determined that it considers all European Union 27 and EEA member states to be adequate for the purposes of data protection, ensuring that data flows from the United Kingdom to the EU/EEA remain unaffected. The European Commission decided in June 2021 that the level of data protection in the United Kingdom is “essentially adequate” for purposes of data transfer from the EU to the United Kingdom, although this decision may be re-evaluated in the future, including in light of changes in United Kingdom data protection law likely to occur