Company: PRTA
Filing Date: 2025-05-08
Form Type: 10-Q
Source: 0001559053-25-000023
Chunk: 57

Company: PROTHENA CORP PUBLIC LTD CO
Filing Date: 2025-05-08
Form: 10-Q
Item: Part II, Item 1A
Chunk 57
---
 investigations, fines and penalties as well as reputational damage which could adversely affect our business, operations, financial condition and prospects. Furthermore, the laws are not consistent, and compliance in the event of a widespread data breach is costly. In addition, states are constantly adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, the California Consumer Privacy Act (the “ CCPA”) went into effect January 1, 2020. The CCPA, among other things, imposes new data privacy obligations on covered companies and provides expanded privacy rights to California residents, including the right to access, delete, and opt out of certain disclosures of their information. The CCPA provides for civil penalties for violations, as well as a private right of action with statutory damages for certain data breaches, which may increase the frequency and likelihood of data breach litigation. Although the law includes limited exceptions for health-related information, including clinical trial data, such exceptions may not apply to all of our operations and processing activities. Further, the California Privacy Rights Act (the “ CPRA”) imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also creates a California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions went into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. Although the CCPA currently exempts certain health-related information, including clinical trial data, the CCPA and the amendments under the CPRA may increase our compliance costs and potential liability.

Multiple states have followed California to legislate comprehensive privacy laws with data privacy rights. For example, Virginia passed the Virginia Consumer Data Protection Act, which went into effect on January 1, 2023, and affords consumers similar rights to the CCPA, along with additional rights, such as the right to opt-out of processing for profiling and targeted advertising purposes. Additionally, the Colorado Privacy Act and Connecticut Personal Data Privacy and Online Monitoring Act went into effect on July 1, 2023. While these new laws generally include exemptions for HIPAA-covered and clinical trial data, they impact the overall privacy landscape. Several other states have followed suit and passed similar legislation which will go into effect in the coming years. Further, additional privacy laws that are similar in nature have been proposed in other states and at the federal level and, if