Company: VCYT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001384101-25-000014
Chunk: 96

Company: VERACYTE, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 96
---
 users. The GDPR imposes compliance obligations applicable to our business, including accountability obligations requiring data controllers and processors to maintain a record of their data processing and implement policies as part of its mandated privacy governance framework. It also requires data controllers to be transparent and to disclose to data subjects how their personal data is to be used, protected, and shared; imposes limitations on retention of personal data; introduces mandatory data breach notification requirements; and sets higher standards for data controllers to demonstrate that they have obtained valid consent for certain data processing activities. Continued compliance with these obligations could cause us to change our 

46

business practices, and we risk financial penalties for noncompliance (including possible fines of up to 4% of global annual turnover for the preceding financial year or €20 million (whichever is higher) for the most serious infringements). In addition, the GDPR prohibits the transfer of personal data from the EEA to other jurisdictions that the European Commission does not recognize as having “adequate” data protection laws unless a data-protective transfer mechanism has been put in place. On July 16, 2020, the CJEU issued a decision undermining the validity of the data-protective transfer mechanisms previously relied on, creating widespread uncertainty about compliance with the GDPR rules on data transfers to non-“adequate” jurisdictions which, at that time, included the United States. The European Commission announced in July 2023 that it had adopted a new adequacy decision with respect to the United States under a new regulatory structure known as the EU-US Data Privacy Framework. Although the EU-US Data Privacy Framework potentially provides additional regulatory certainty regarding data transfers from the EU to the U.S., it may still be challenged before the CJEU. In addition, the EU-US Data Privacy Framework is not automatically available to all companies, but instead requires a company to meet certain jurisdictional and procedural requirements in order to get the benefit of utilizing such framework as a data-protective transfer mechanism.

Additionally, while the CJEU generally confirmed the validity of the European Commission-approved SCCs as a personal data-protective transfer mechanism, it made clear that reliance on the SCCs alone may not necessarily be sufficient in all circumstances. Use of the SCCs must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place, however, the nature of these additional measures is currently uncertain. In response to the CJEU decision,