Company: ATRA
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0000950170-25-035507
Chunk: 147

Company: Atara Biotherapeutics, Inc.
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1A
Chunk 147
---
 resulting in us facing harms similar to those described above.

Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements, potential significant fines for non-compliance of up to the greater of €20 million (under the EU GDPR) or £17.5 million (under the UK GDPR) or 4% of consolidated annual global turnover and restrictions or prohibitions on data processing. The GDPR identifies a list of points to consider when determining the level of fines to impose (including the nature, gravity and duration of the infringement). The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the GDPR.

The UK GDPR also imposes similar restrictions on transfers of personal information from the UK to jurisdictions that the UK Government does not consider “adequate”, including the U.S. It should also be noted that the UK Government has published its own form of EU SCCs known as the UK International Data Transfer Agreement together with an International Data Transfer Addendum to the new EU SCCs. Further, on September 21, 2023, the UK Secretary of State of Science, Innovation and Technology established a UK-U.S. data bridge (i.e., a UK equivalent of the Adequacy Decision) and adopted UK regulations to implement the UK-U.S. data bridge (UK Adequacy Regulations). Personal information may now be transferred from the UK under the UK-U.S. data bridge through the UK extension to the DPF to organizations self-certified under the UK extension to DPF.

Cybersecurity requirements are laid down in various laws in the EU and the UK, the key ones being: (i) the GDPR (as discussed above), which requires controllers and processors to implement appropriate technical and organizational measures to safeguard personal data to a level of security appropriate to the data protection risk; (ii) the UK Network and Information Systems Regulation 2018 (NIS Regulations), and (iii) EU Network and Information Systems Security 2 Directive (NISD2). Under the NISD2, stringent cybersecurity and incident reporting requirements are imposed on ‘essential’ and ‘important’ entities, including, for example, entities carrying out research and development activities of medicinal. NISD2 states that any maximum fine which national implementing law provides for should at least be set at €10 million or 2% of total worldwide turnover, whichever is higher, where essential entities are concerned. Other