Company: ARVN
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0001655759-25-000016
Chunk: 261

Company: ARVINAS, INC.
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1A
Chunk 261
---
 consumer health data, and more states are considering such legislation in 2024. These laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products.

Plaintiffs’ lawyers are also increasingly using privacy-related statutes at both the state and federal level to bring lawsuits against companies for their data-related practices. In particular, there have been a significant number of cases filed against companies for their use of pixels and other web trackers. These cases often allege violations of the California Invasion of Privacy Act and other state laws regulating wiretapping, as well as the federal Video Privacy Protection Act.

Similar to the laws in the U.S., there are significant privacy and data security laws that apply in Europe and other countries. The collection, use, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals who are located in EEA, and the processing of personal data that takes place in the EEA, is regulated by the GDPR, which went into effect in May 2018 and which imposes obligations on companies that operate in our industry with respect to the processing of personal data and the cross-border transfer of such data. If our or our partners’ or service providers’ privacy or data security measures fail to comply with the GDPR requirements, we may be subject to litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data and/or fines of up to 20 million Euros or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, as well as compensation claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill.

The GDPR places restrictions on the cross-border transfer of personal data from the EU to countries that have not been found by the EU to offer adequate data protection legislation, such as the U.S. There are ongoing concerns about the ability of companies to transfer personal data from the EU to other countries. In July 2020, the Court of Justice of the European Union, or the CJEU, invalidated the EU-U.S. Privacy Shield, one of the mechanisms used to legitimize the transfer of personal data from the EEA to the U.S. The CJEU decision also drew into question the long-term viability of an alternative means of data transfer, the standard contractual clauses, for transfers of personal data from the EEA to the U.S. While we were not self-certified under the Privacy Shield, this CJEU decision may lead to increased scrutiny