Company: AGIO
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001439222-25-000009
Chunk: 135

Company: AGIOS PHARMACEUTICALS, INC.
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1
Chunk 135
---
 or are in the process of enacting privacy laws that will go into effect in 2025 and beyond. Other states will be considering these laws in the future, and Congress has also been debating passing a federal privacy law. There are also states that are specifically regulating health information that may affect our business. These laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products.

Plaintiffs’ lawyers in the United States are also increasingly using privacy-related statutes at both the state and federal level to bring lawsuits against companies for their data-related practices. In particular, there have been a significant number of cases filed against companies for their use of pixels and other web trackers. These cases often allege violations of the California Invasion of Privacy Act and other state laws regulating wiretapping, as well as the federal Video Privacy Protection Act. The rise in these types of lawsuits creates potential risk for our business. 

Similar to the laws in the United States, there are significant privacy and data security laws that apply in Europe and other countries. The collection, use, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals who are located in the European Economic Area, or EEA, and the processing of personal data that takes place in the EEA, is regulated by the GDPR, which went into effect in May 2018 and which imposes obligations on companies that operate in our industry with respect to the processing of personal data and the cross-border transfer of such data. The GDPR imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and policies. If our or our partners’ or service providers’ privacy or data security measures fail to comply with the GDPR requirements, we may be subject to litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data and/or fines of up to 20 million Euros or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, as well as compensation claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill.

Beyond GDPR, there are privacy and data security laws in a growing number of countries around the world. While many loosely follow GDPR as a model, other laws contain different or conflicting provisions. These laws will impact our ability to conduct our business activities, including both our clinical trials and the sale and distribution of commercial products, through increased compliance costs, costs associated with contracting and potential enforcement