Company: WHWK
Filing Date: 2025-05-08
Form Type: 10-Q
Source: 0001628280-25-023932
Chunk: 176

Company: Whitehawk Therapeutics, Inc.
Filing Date: 2025-05-08
Form: 10-Q
Item: Part I, Item 4
Chunk 176
---
 including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and limitations on cross-border data transfers. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company’s revenue in the prior year.

More generally, state and foreign laws addressing privacy, data protection and cybersecurity may apply to the privacy and security of information we maintain, and may differ from each other in significant ways, thus complicating compliance efforts. For example, the California Consumer Privacy Act of 2018 (the “CCPA”), which took effect on January 1, 2020, and subsequently was amended and supplemented by the CPRA, gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. In addition, the CCPA (a) allows enforcement by the California Attorney General, with fines set at $2,500 per violation (i.e., per person) or $7,500 per intentional violation and (b) authorizes private lawsuits to recover statutory damages for certain data breaches. Numerous other states in the U.S. have proposed or enacted similar legislation. While the CCPA and many other similar state laws exempt some data regulated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and certain clinical trials data, the CCPA and such other laws, to the extent applicable to our business and operations, may increase our compliance costs and potential liability. Further, some states have enacted more specific legislation, such as Washington’s enactment of the My Health, My Data Act, which includes a private right of action. The U.S. federal government is also contemplating federal privacy legislation, and the U.S. Department of Justice has issued rules regarding certain bulk sensitive personal data transfers. The evolving trend toward more stringent laws and regulations in the United States relating to privacy, data protection and cybersecurity, including the foregoing laws and regulations and the potential for future laws and regulations, could increase our compliance costs and potential liability and adversely affect our business.

It is possible that the GDPR, UK GDPR, CCPA, CPRA, or other laws and regulations relating to privacy, data protection and cybersecurity may be interpreted and applied in a manner that is inconsistent from jurisdiction to jurisdiction or inconsistent with our policies and practices. We cannot guarantee that we are in compliance with all such laws and regulations, and we cannot be sure how these laws and regulations will be interpreted, enforced or