Company: IOBT
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0000950170-25-047744
Chunk: 206

Company: IO Biotech, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 206
---
  Additionally, Nevada recently enacted a consumer health data privacy bill, and other states could adopt health-specific privacy laws that could impact our business. 

The FTC and many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the collection, use, dissemination and security of health-related and other personal information. For instance, the FTC has promulgated standards for fair information practices, which concern consumer notice, choice, security and access, and also require notice of certain health information breaches outside the HIPAA context. Privacy laws require us to publish statements that describe how we handle personal information and choices individuals may have about the way we handle their personal information. Violating individuals’ privacy rights, publishing false or misleading information about security practices, or failing to take appropriate steps to keep individuals’ personal information secure may constitute unfair or deceptive acts or practices in violation of Section 5 of the FTC Act. The FTC has also been active with respect to enforcement of its Health Breach Notification Rule and in scrutinizing the use and disclosure of sensitive personal information. The FTC finalized changes to the Health Breach Notification Rule in April 2024. Additionally, the FTC published an advance notice of proposed rulemaking on commercial surveillance and data security in 2022 and may implement new trade regulation rules or other regulatory alternatives concerning the ways in which companies (1) collect, aggregate, protect, use, analyze, and retain consumer data, as well as (2) transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive in the coming years. Federal regulators, state attorneys general and plaintiffs’ attorneys have been and will likely continue to be active in this space, and if we do not comply with existing or new laws and regulations related to patient health information, we could be subject to criminal or civil sanctions. 

Any actual or perceived failure by us to comply with applicable privacy and data security laws and regulations could result in regulatory investigations, reputational damage, orders to cease/ change our processing of our data, enforcement notices, and/ or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm. 

100

Risks Related to Intellectual Property 

If we are unable to obtain and maintain sufficient intellectual property protection for our platform technologies and product candidates, or if the scope of the intellectual property protection is