Company: WHWK
Filing Date: 2025-05-08
Form Type: 10-Q
Source: 0001628280-25-023932
Chunk: 535

Company: Whitehawk Therapeutics, Inc.
Filing Date: 2025-05-08
Form: 10-Q
Item: Part I, Item 8
Chunk 535
---
 (b) authorizes private lawsuits to recover statutory damages for certain data breaches. Numerous other states in the U.S. have proposed or enacted similar legislation. While the CCPA and many other similar state laws exempt some data regulated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and certain clinical trials data, the CCPA and such other laws, to the extent applicable to our business and operations, may increase our compliance costs and potential liability. Further, some states have enacted more specific legislation, such as Washington’s enactment of the My Health, My Data Act, which includes a private right of action. The U.S. federal government is also contemplating federal privacy legislation, and the U.S. Department of Justice has issued rules regarding certain bulk sensitive personal data transfers. The evolving trend toward more stringent laws and regulations in the United States relating to privacy, data protection and cybersecurity, including the foregoing laws and regulations and the potential for future laws and regulations, could increase our compliance costs and potential liability and adversely affect our business.

It is possible that the GDPR, UK GDPR, CCPA, CPRA, or other laws and regulations relating to privacy, data protection and cybersecurity may be interpreted and applied in a manner that is inconsistent from jurisdiction to jurisdiction or inconsistent with our policies and practices. We cannot guarantee that we are in compliance with all such laws and regulations, and we cannot be sure how these laws and regulations will be interpreted, enforced or applied to our operations. Furthermore, various jurisdictions are introducing or enhancing laws, rules, and regulations relating to privacy, data protection and cybersecurity, which could increase our compliance costs and the risks associated with noncompliance. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices, and our 

64

efforts to comply with the evolving data protection rules may be unsuccessful. Our actual or alleged non-compliance could result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures, and systems. The GDPR, UK GDPR, and other laws and regulations addressing privacy, data protection and cybersecurity may increase our responsibility and liability in relation to personal data that we may process, and we may be required to put in place additional mechanisms in an effort to comply with them.

Our actual or perceived failure to adequately