Company: IOBT
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0000950170-25-047744
Chunk: 205

Company: IO Biotech, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 205
---
 2020, became enforceable by the California Attorney General on July 1, 2020, and was the first comprehensive state privacy law in the United States. The CCPA covers businesses operating in California and gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provide such consumers new ways to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Further, the California Privacy Rights Act (the “CPRA”), which further amended the CCPA, went into effect on January 1, 2023. The CCPA, as amended by the CPRA, imposes additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions went into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. The CCPA currently exempts certain health-related information, including clinical trial data, but the CCPA (as amended by the CPRA) may increase our compliance costs and potential liability once we become subject to the law. Similar laws have been enacted or proposed in many other states as well as at the federal level, and such laws may have potentially conflicting requirements that would make compliance challenging. These proposals and new laws generally include exemptions for HIPAA-covered and clinical trial data, but they add layers of complexity to compliance in the U.S. market, and could increase our compliance costs and adversely affect our business.     

Additionally, state laws related to health privacy may result in additional compliance costs. For example, the state of Washington enacted the “My Health My Data” Act, which regulates “consumer health data,” defined as “personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health.”  The “My Health My Data” Act provides exemptions for personal data used or shared in research, including data subject to 45 C.F.R. Parts 46, 50, and 56.