Company: PRME
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001628280-25-008884
Chunk: 182

Company: Prime Medicine, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 182
---
 privacy and security standards, we could face significant civil and criminal penalties. HHS has the discretion to impose penalties without attempting to resolve violations through informal means. Such enforcement activity can result in financial liability and reputational harm, and our responses to such enforcement activity can consume significant internal resources. 

U.S. state laws also govern the privacy and protection of personal information. For example, the California Consumer Privacy Act, or the CCPA, establishes data privacy rights for individuals located in California and imposes certain requirements on how businesses can collect, use, and share personal information about such individuals. The California Privacy Rights Act, or the CPRA, significantly modifies the CCPA and imposes additional obligations on companies covered by the legislation, including by expanding consumers’ rights with respect to personal information, and establishes a state agency vested with the authority to enforce the CCPA. More than a dozen other states have passed similar, comprehensive privacy and data protection legislation. Moreover, some states have passed laws geared to protect specific categories of personal information, most notably Washington’s My Health Data Act, which provides an additional layer of protection to consumer health data which includes a private right of action. Many state privacy and data protection laws differ from each other in significant ways, and it is not yet fully clear how such laws will be enforced and interpreted. Thus, we may be required to incur substantial costs and expenses in an effort to comply with them, and may be required to modify or restrict our data collection and use practices. 

Additionally, all 50 states have laws in place which may require businesses to provide notice to customers whose personal information has been disclosed as a result of a data breach. Determining whether personal information has been handled in compliance with applicable state breach notification requirements, privacy standards and our contractual obligations can be complex and may be subject to statutory and contractual interpretation, thus potentially complicating our compliance efforts.

Further, the Federal Trade Commission, or FTC, as well as other state attorneys general, regulate the content of our privacy policies and other public statements that provide promises and assurances about our data privacy and protection practices. We make public statements about our use, collection, disclosure and other processing of personal information through our privacy policies, information provided on our website and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. If such statements are found to be deceptive, unfair or misrepresentative of our actual 

98

practices, we may subject us to government enforcement actions or other legal