Company: HRTX
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028374
Chunk: 74

Company: HERON THERAPEUTICS, INC. /DE/
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 74
---
 of information obtained in the course of clinical trials, which could result in regulatory sanctions and serious harm to our reputation. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to be in compliance with such laws or regulations. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business and results of operations, including the imposition of significant fines or other sanctions.

We are and may become subject to stringent and evolving laws, regulations, rules, contractual obligations, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with 

46

such obligations could lead to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, and other adverse business consequences.

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, "processing") personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, business plans, transactions and financial information (collectively, "sensitive data"). Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. 

In the U.S., federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the CCPA requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights.  The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages.  In addition, the CPRA, which became operative January 1, 2023, expanded the CCPA’s requirements, including applying to personal information of business representatives and employees and establishing a new regulatory agency to