Company: WHWK
Filing Date: 2025-05-08
Form Type: 10-Q
Source: 0001628280-25-023932
Chunk: 534

Company: Whitehawk Therapeutics, Inc.
Filing Date: 2025-05-08
Form: 10-Q
Item: Part I, Item 8
Chunk 534
---
 of new requirements or policies, or if we or our collaborators are not able to maintain regulatory compliance, our product candidates may lose any marketing approval that may have been obtained and we may not achieve or sustain profitability, which would adversely affect our business.

Additionally, the collection and use of health data in the European Union is governed by the General Data Protection Regulation (the “GDPR”), which extends the geographical scope of European Union data protection law to non-European Union entities under certain conditions and imposes substantial obligations upon companies and new rights for individuals. Failure to comply with the GDPR and the applicable national data protection laws of European Union member states may result in fines up to €20.0 million or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties. Additionally, the UK has implemented legislation that substantially implements the GDPR, the UK GDPR, which provides for similar obligations and provides for penalties for noncompliance of up to the greater of £17.5 million or four percent of worldwide revenues. The European Union also has enacted numerous laws and regulations addressing cybersecurity. Similar laws have been proposed, and in certain cases enacted, in other foreign jurisdictions. For example, on August 20, 2021, the Personal Information Protection Law (“PIPL”) of the People’s Republic of China was adopted and went into effect on November 1, 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and limitations on cross-border data transfers. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company’s revenue in the prior year.

More generally, state and foreign laws addressing privacy, data protection and cybersecurity may apply to the privacy and security of information we maintain, and may differ from each other in significant ways, thus complicating compliance efforts. For example, the California Consumer Privacy Act of 2018 (the “CCPA”), which took effect on January 1, 2020, and subsequently was amended and supplemented by the CPRA, gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. In addition, the CCPA (a) allows enforcement by the California Attorney General, with fines set at $2,500 per violation (i.e., per person) or $7,500 per intentional violation and