Company: LGNZZ
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000886163-25-000012
Chunk: 70

Company: LIGAND PHARMACEUTICALS INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 70
---
, we are also subject to the United Kingdom data protection regime, which imposes separate but similar obligations to those under the GDPR and comparable penalties, including fines of up to £17.5 million or 4% of a noncompliant company’s global annual revenue for the preceding financial year, whichever is greater. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government), as a UK GDPR data transfer mechanism to U.S. entities self-certified under the UK Extension to the DPF. As we continue to expand into other foreign countries and jurisdictions, we may be subject to additional laws and regulations that may affect how we conduct business. 

Furthermore, the FTC also has authority to initiate enforcement actions against entities that make deceptive statements about privacy and data sharing in privacy policies, fail to limit third-party use of personal health information, fail to implement policies to protect personal health information or engage in other unfair practices that harm customers or that may violate Section 5 of the FTC Act. Failing to take appropriate steps to keep consumers’ personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Additionally, federal and state consumer protection laws are increasingly being applied by FTC and states’ attorneys general to regulate the collection, use, storage, and disclosure of personal or personally identifiable information, through websites or otherwise, and to regulate the presentation of website content.

Compliance with applicable data privacy and security laws, rules and regulations could require us to take on more onerous obligations in our contracts, require us to engage in costly compliance exercises, restrict our ability to collect, use and disclose data, or in some cases, impact our or our partners’ ability to operate in certain jurisdictions. Each of these constantly evolving laws can be subject to varying interpretations. If we fail to comply with any such laws, rules or regulations, we may 

32

face government investigations and/or enforcement actions, fines, civil or criminal penalties, private litigation or adverse publicity that could adversely affect our business, financial condition and results of operations.

The regulatory approval processes of the FDA and comparable foreign authorities are lengthy, time consuming and inherently unpredictable, and if we or our partners are ultimately unable to obtain regulatory approval