Company: MIRM
Filing Date: 2025-05-07
Form Type: 10-Q
Source: 0001759425-25-000032
Chunk: 159

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-05-07
Form: 10-Q
Item: Part I, Item 4
Chunk 159
---
 the Irish Data Protection Commission determined that a major social media company’s use of the standard contractual clauses to transfer personal data from Europe to the U. S. was insufficient and levied a 1.2 billion Euro fine against the company and prohibited the company from transferring personal data to the U.S. Additionally, companies that transfer personal data to recipients outside of the EEA and/or UK to other jurisdictions, particularly to the U.S., are subject to increased scrutiny from regulators, individual litigants and activist groups. Regulators in the U.S. such as the Department of Justice are also increasingly scrutinizing certain personal data transfers and have proposed and may enact certain data export restrictions and localization requirements, for example, the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons rule finalized by the Department of Justice in late 2024, enacting the Biden administration’s executive order Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern, which went into effect April 8, 2025.

In addition, we are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. Additionally, some of our customer contracts require us to host personal data locally. We also publish privacy policies, marketing materials and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning artificial intelligence, data privacy and security. Regulators in the United States may scrutinize these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading or misrepresentative of our practices, we may be subject to adverse consequences.

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. 

Although we endeavor to comply with our data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations and compliance posture.