Company: MYGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000899923-25-000019
Chunk: 94

Company: MYRIAD GENETICS INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 94
---
2026, and beyond. Additional U.S. states have proposals under consideration, all of which are likely to increase our regulatory compliance costs and risks, exposure to regulatory enforcement action, and other liabilities.

Likewise, the Federal Trade Commission and state attorneys general have been actively enforcing laws that protect consumers from unfair and deceptive acts or practices, including with respect to privacy and security. If our public statements regarding collection, use, storage or disclosure of personal information are or are perceived to be inconsistent with our actual practices, we may face claims under Section 5 of the Federal Trade Commission Act or state law equivalents. 

Numerous other countries have, or are developing, laws governing the collection, use and transmission of personal data as well. For example, the EU's GDPR became effective in 2018 and imposed a broad data protection framework that expanded the scope of EU data protection law, including to non-EU entities meeting the jurisdictional requirements that process, or control the processing of, personal data relating to individuals located in the EU, including clinical trial data. GDPR sets out a number of requirements for controllers and/or processors, as applicable, that must be complied with when handling the personal data of EU based data subjects, including: providing expanded disclosures about how their personal data will be used; higher standards for organizations to demonstrate that they have a legal basis to justify their data processing activities; the obligation to appoint data protection officers in certain circumstances; new rights for individuals to be “forgotten” and rights to data portability, as well as enhanced current rights (e.g., access requests); the principal of accountability and demonstrating compliance through policies, procedures, training and audit; and a new mandatory data breach regime. In particular, medical or health data, genetic data and biometric data are all classified as “special category” data under GDPR and afford greater protection and require additional compliance obligations. Further, EU member states have a broad right to impose additional conditions—including restrictions—on these data categories. This is because GDPR allows EU member states to derogate from the requirements of GDPR mainly in regard to specific processing situations (including special category data and processing for scientific or statistical purposes). 

GDPR is applicable to part of our business and has increased our responsibility and liability in relation to personal data that we process, and we may be required to put in place additional procedures to comply. GDPR is complex and regulatory guidance continues to evolve. Furthermore, national GDPR variations, including the fields of clinical study and other health-related information may raise our costs of compliance and result in greater legal risks