Company: MYGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000899923-25-000019
Chunk: 95

Company: MYRIAD GENETICS INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 95
---
.

Relatedly, following Brexit and the expiry of the Brexit transition period, which ended on December 31, 2020, the EU GDPR has been implemented in the United Kingdom (as the UK GDPR). The UK GDPR sits alongside the United Kingdom Data Protection Act 2018 which implements certain derogation in the GDPR into UK law. Under the UK GDPR, companies not established in the United Kingdom but who process personal data in relation to the offering of goods or services to individuals in the United Kingdom, or to monitor their behavior will be subject to the UK GDPR – the requirements of which are (at this time) largely aligned with those under the GDPR and as such, may lead to similar compliance and operational costs with potential fines of up to £17.5 million or 4% of global turnover.

50

Table of Contents

We are also subject to evolving GDPR requirements on data export, because we transfer data to third countries outside of the EU that are not deemed “adequate.” GDPR only permits exports of personal data outside of the EU to “non-adequate” countries where there is a suitable data transfer mechanism in place to safeguard personal data (e.g., the EU Commission approved Standard Contractual Clauses or certification under the newly-adopted Data Privacy Framework). On July 16, 2020, the Court of Justice of the EU (CJEU) issued a landmark opinion in the case Maximilian Schrems vs. Facebook (Case C-311/18) (Schrems II). This decision calls into question certain data transfer mechanisms as between the EU member states and the United States. The CJEU is the highest court in Europe and the Schrems II decision heightened the burden to assess United States national security laws on their business, and future actions of EU data protection authorities are difficult to predict at this time. While the newly-adopted Data Privacy Framework was meant to address the concerns raised by the CJEU in Schrems II, it will likely be subject to future legal challenges. Consequently, there is some risk of any data transfers from the EU being halted. If we have to rely on third parties to carry out services for us, including processing personal data on our behalf, we are required under GDPR to enter into contractual arrangements to flow down or help ensure that these third parties only process such data according to our instructions and have sufficient security measures in place. Any security breach or non-compliance with our contractual terms or breach of applicable law by such third parties could result in enforcement actions, litigation,