Company: DVAX
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001029142-25-000071
Chunk: 432

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-05-06
Form: 10-Q
Item: Part I, Item 2
Chunk 432
---
 upon whom we rely. 

We may be subject to new laws governing the privacy of consumer health data, including reproductive, sexual orientation, and gender identity privacy rights. For example, Washington’s My Health My Data Act (“MHMD”) broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws. California also recently passed a law protecting privacy of abortion-related records and other reproductive healthcare services. These laws would also apply to our employees in the respective states.

Outside the U.S., an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, the EU’s General Data Protection Regulation (“EU GDPR”), the UK’s General Data Protection Regulation (“UK GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements 

53

Table of Contents

for processing personal data. For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Regulators in the U.S. are also increasingly scrutinizing certain personal data transfers and may impose data localization requirements, for example, the Biden Administration’s executive order Preventing Access to Americans’ Bulk Sensitive Personal Data and U.S. Government-Related Data by Countries of Concern. Outside the U.S., certain jurisdictions have enacted data localization and cross-border data transfer laws, which could make it more difficult to transfer information across jurisdictions. In particular, the European Economic Area ("EEA") and the UK have significantly restricted the transfer of personal data to the U.S. and other countries whose privacy and data security laws they believe not to offer an adequate level of protection.

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the UK to the U.S. in compliance with law, such as the EU and UK’s standard contractual clauses, the U.K.’s International Data Transfer Agreement/Addendum and the EU-U