Company: IMCR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001671927-25-000006
Chunk: 163

Company: Immunocore Holdings plc
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 163
---
 number of individuals or entities that can initiate actions against us may increase (including individuals, via a private right of action, and state actors).

Additionally, regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA,") as amended, establish privacy and security standards that limit the use and disclosure of individually identifiable health information and protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of such information and ensure the confidentiality, integrity and availability of electronic protected health information. 

In Europe, the Network and Information Security Directive ("NIS2") entered into force on January 17, 2023, aiming to improve the resilience and incident response capabilities of entities operating in a number of sectors, including the health sector. As it is a Directive, NIS2 will not automatically have legal force throughout every Member State, instead the Directive will need to be transposed into the national laws of each Member State by October 17, 2024. Non-compliance with NIS2 may lead up to administrative fines of a maximum of €10 million or up to 2% of the total worldwide turnover of the preceding financial year. As NIS2 has not yet been transposed into each Member States’ national law there remains a lot of uncertainty of how NIS2 will be regulated in practice.

In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and, we may become subject to additional obligations in the future. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR and the CCPA, require the imposition of specific contractual restrictions on their service providers. We publish privacy policies, marketing materials and other statements regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

Our employees and personnel use generative artificial intelligence ("AI") technologies to perform their work, including in our research and development activities and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If