Company: WHWK
Filing Date: 2025-01-31
Form Type: DEFM14A
Source: 0001193125-25-018470
Chunk: 324

Company: Whitehawk Therapeutics, Inc.
Filing Date: 2025-01-31
Form: DEFM14A
Chunk 324
---
 respect to safeguarding - 226 -

the privacy, security and transmission of individually identifiable health information, State data privacy and security laws may differ from each other in significant ways and often are not pre-empted by HIPAA, which may complicate compliance efforts in states or jurisdictions we conduct business. For example, in 2020, California enacted the CCPA, which created new individual privacy rights for
California consumers, as defined in the law, and placed increased privacy and security obligations on entities handling personal data of consumers or households. The CCPA requires covered companies to provide certain disclosures to consumers about
its data collection, use and sharing practices, and to provide affected California residents with ways to opt-out of certain sales or transfers of personal information. The CCPA went into effect on
January 1, 2020 and became enforceable by the California Attorney General on July 1, 2020. It was further amended and supplemented by the California Privacy Rights Act, which became effective on January 1, 2023, and imposes additional
privacy and security obligations on companies doing business in California. While there is currently an exception in the CCPA for protected health information that is subject to HIPAA and clinical trial regulations, as currently written, numerous
other states have enacted legislation similar to the CCPA, and several states have enacted other privacy and security legislation, such as Washington’s My Health, My Data Act, which includes a private right of action. The CCPA and such other
new and evolving legislation may impact our business activities significantly, and these and other applicable state and foreign privacy laws, as well as uncertain changes in future regulation and legislation, could impact our business strategies,
increase our potential liability, increase our compliance costs, and adversely affect our business.

The collection and use of personal health data in the
European Union are governed by the GDPR and applicable member state legislation. The GDPR and related member state legislation impose several requirements relating to consent of the individuals to whom the personal data relates, information provided
to the individuals, and the security and confidentiality of personal data. Legislation similar to the GDPR, the UK GDPR, also has been adopted in the United Kingdom. The GDPR and UK GDPR also impose strict rules on the transfer of personal data out
of the European Union and United Kingdom, respectively, to the U.S. Both the GDPR and UK GDPR provide for substantial fines for noncompliance. Failure to comply with the requirements of the GDPR, UK GDPR, or data protection laws of European Union
member states may result