Company: SCYX
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000950170-25-038044
Chunk: 88

Company: SCYNEXIS INC
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1A
Chunk 88
---
 Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive data privacy and security laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020,  applies to personal data of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights. The CCPA provides for civil penalties for violations of up to $7,500 per violation, as well as a private right of action for individuals impacted by certain data breaches. The CCPA and other comprehensive state data privacy and security laws exempt some data processed in the context of clinical trials, but these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties upon whom we rely. 

Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. These developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely. 

Outside the U.S., an increasing number of laws, regulations, and industry standards may govern data privacy and security, including information that we collect about patients in connection with clinical trials and our other operations abroad. For example, the EU’s General Data Protection Regulation (EU GDPR) and the United Kingdom’s GDPR (UK GDPR) impose strict requirements for processing personal data, including health-related information. For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to the greater of 20 million euros or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. 

In addition, we may be