Company: VCYT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001384101-25-000014
Chunk: 97

Company: VERACYTE, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 97
---
 the European Commission has published revised SCCs, which we implemented in advance of the December 27, 2022 deadline. The revised SCCs are not to be relied on for data transfers to non-EEA entities subject to the GDPR, and we are waiting for further guidance on valid mechanisms for data transfers from the EEA to such entities. As a result, we may have to make certain operational changes, and we will have to implement revised standard contractual clauses and other relevant documentation for existing data transfers within required time frames.

Following the United Kingdom’s withdrawal from the EEA and the EU, and the expiry of the transition period, companies processing the information of EU data subjects are now required to comply with both the GDPR and the GDPR as incorporated into United Kingdom national law, or UK GPDR. Under the UK GDPR, the Information Commissioner has the ability to separately fine up to the greater of £17.5 million or 4% of global turnover in certain circumstances.  The European Commission has adopted an adequacy decision in favor of the United Kingdom, enabling data transfers from EU member states to the United Kingdom without additional safeguards. However, the UK adequacy decision will automatically expire in June 2025 unless the European Commission re-assesses and renews/ extends that decision, and it remains under review by the Commission during this period. In December 2024, the UK government revived its attempts to amend the UK GDPR in a new Data (Use and Access) Bill. If passed, this may lead to additional compliance costs and could increase our overall risk. The relationship between the United Kingdom and the EU in relation to certain aspects of data protection law remains unclear, and it is unclear how UK data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the United Kingdom will be regulated in the long term. These developments may lead to additional costs and increase our overall risk exposure.

In the United States, numerous federal and state laws and regulations, including federal health information privacy laws, state data breach notification laws, state health information privacy laws and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA, as amended by HITECH. Depending