Company: DVAX
Filing Date: 2025-08-07
Form Type: 10-Q
Source: 0001029142-25-000117
Chunk: 431

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-08-07
Form: 10-Q
Item: Part I, Item 2
Chunk 431
---
 for processing personal data. For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Regulators in the U.S. are also increasingly scrutinizing certain personal data transfers and may impose data localization requirements, for example, the Biden Administration’s executive order Preventing Access to Americans’ Bulk Sensitive Personal Data and U.S. Government-Related Data by Countries of Concern. Outside the U.S., certain jurisdictions have enacted data localization and cross-border data transfer laws, which could make it more difficult to transfer information across jurisdictions. In particular, the European Economic Area ("EEA") and the UK have significantly restricted the transfer of personal data to the U.S. and other countries whose privacy and data security laws they believe not to offer an adequate level of protection.

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the UK to the U.S. in compliance with law, such as the EU and UK’s standard contractual clauses, the U.K.’s International Data Transfer Agreement/Addendum and the EU-U.S. Data Privacy Framework and the U.K. extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S. If we are unable to implement a legal mechanism to ensure that our transfers of personal data from the EEA or the U.K. are lawful, we could face adverse consequences, including increased exposure to regulatory actions, substantial fines and penalties and injunctions against processing or transferring personal data, and could be required to increase our data processing capabilities in the EEA, the U.K. or elsewhere at significant expense. Restrictions on our ability to transfer personal data from the EEA, the U.K. or elsewhere could impact our clinical trial activities in the EEA or the U.K. and limit our ability to collaborate with CROs and other third parties.

We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR and the CCPA, require our customers to