Company: ATRA
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0000950170-25-035507
Chunk: 150

Company: Atara Biotherapeutics, Inc.
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1A
Chunk 150
---
 several cases alleging violations of Section 5 of the FTC Act with respect to health information, and has proposed rulemaking on privacy and data security.

Lawmakers and regulatory bodies at the federal level have been considering more detailed regulation regarding these subjects and the privacy and security of personal information. For example, the FTC published an advance notice of proposed rulemaking on “commercial surveillance” and data security, and is seeking comment on whether it should implement new trade regulation rules or other regulatory alternatives concerning the ways in which companies (1) collect, aggregate, protect, use, analyze, and retain consumer data, as well as (2) transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive. The FTC’s rulemaking may create change throughout the economy and broader data ecosystem. The FTC has also been active with respect to enforcement of its Health Breach Notification Rule and in scrutinizing the use and disclosure of sensitive personal information. The FTC finalized changes to the Health Breach Notification.  Additionally, in 2021, the OCR has issued a Notice of Proposed Rulemaking, which proposed a number of changes to the HIPAA Privacy Rule, and in 2025, the OCR issued a Notice of Proposed Rulemaking which proposed a number of changes to HIPAA Security Rule.

Compliance with applicable U.S. and foreign privacy, data protection, and data security laws and regulations may result in government investigations or cause us to incur substantial costs or require us to change our business practices and compliance procedures in a manner adverse to our business. Moreover, complying with these various laws could require us to take on more 

75

onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. Failure to comply with U.S. and foreign privacy, data protection, and data security laws and regulations could result in government investigations or enforcement actions (which could include civil or criminal penalties), private litigation, claims, or public statements against us and/or adverse publicity and could negatively affect our operating results and business. Claims that we have violated individuals’ privacy rights, failed to comply with privacy, data protection, and data security laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend, could result in adverse publicity and could have a material adverse effect on our business, reputation, financial performance and business, and operations. Furthermore, the costs of compliance with, and other burdens imposed by, the laws,