Company: DAWN
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000950170-25-026654
Chunk: 200

Company: Day One Biopharmaceuticals, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 200
---
 adopted comprehensive privacy and security laws and regulations, which govern the privacy, processing and protection of personal information, including certain specific requirements and laws with respect to health-related information. For example, Washington state has passed the My Health My Data Act, which is focused on the collection of consumer health data, which has a broader scope than HIPAA and includes a private right of action.

In California, the CCPA, grants individual privacy rights for California consumers and places increased privacy and data security obligations on entities handling personal information of consumers or households. The CCPA is enforced by the California Privacy Protection Agency, or the CPPA. The CCPA gives California residents expanded privacy rights, including the right to request correction, access and deletion of their personal information, the right to opt out of certain personal information sharing, and the right to receive detailed information about how their personal information is processed, including by California residents’ employers, and provides for civil penalties and a private right of action for data breaches that is expected to increase data breach litigation.

We are also subject to foreign data protection laws, including the General Data Protection Regulation, or GDPR, which applies to personal information (including health-related data) obtained from individuals in the European Economic Area, or the EEA (as well as substantially similar laws that govern the collection of data from individuals 

80

in the UK and Switzerland). The GDPR imposes strict obligations on businesses, including requiring changes to informed consent practices and more detailed notices for clinical trial subjects and investigators, requiring limitations on data processing, establishing a legal basis for processing personal information, notification of data processing obligations, notification of security incidents to appropriate data protection authorities or data subjects, protecting the security and confidentiality of the personal information, and establishing means for data subjects to exercise rights in relation to their personal information. The GDPR subjects noncompliant companies to fines of up to the greater of 20 million Euros (17.5 million GBP in the UK) or 4% of their global annual revenues, potential bans on processing of personal information (including clinical trials), and private litigation. To the extent applicable, the GDPR will increase our responsibility and liability in relation to personal information that we process, and we may be required to put in place additional mechanisms and expend additional time and resources to ensure compliance with the EU data protection rules. Changes in international legislations may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment in resources for compliance programs, could impact strategies and availability of previously useful data, and could result in increased compliance costs and/or changes