Company: RCUS
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001724521-25-000101
Chunk: 48

Company: Arcus Biosciences, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Part I, Item 3
Chunk 48
---
 protection laws, regulations, or other obligations could lead to government enforcement actions (which could include civil or criminal penalties), private litigation, and/or adverse publicity and could negatively affect our operating results and business. 

We and third parties upon whom we rely may be subject to federal, state, and foreign data protection, privacy, and information security laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations. In the U.S., numerous federal and state laws and regulations, including federal health information privacy laws, state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission ("FTC") Act), that govern the collection, use, disclosure, and protection of health-related and other personal information could apply to our operations or the operations of our collaborators. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under Health Insurance Portability and Accountability Act ("HIPAA"). While we do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly regulated under HIPAA, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information.

The legislative and regulatory landscape for privacy and data security continues to evolve, and we expect that there will continue to be new proposed laws, regulations and industry standards relating to privacy and data security in the U.S., the European Union (the "EU"), the United Kingdom (the "UK") and other jurisdictions. This increased focus on privacy and data security issues may negatively affect our operating results and our business. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA") applies to personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.

Foreign data