Company: LENZ
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001815776-25-000071
Chunk: 437

Company: LENZ Therapeutics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Part I, Item 8
Chunk 437
---
 is greater, for the most serious of violations. The GDPR also confers a private right of action on data subjects and consumer associations. Certain aspects of cross-border data transfers under the GDPR are uncertain as the result of legal proceedings in the EU, including a July 2020 decision by the Court of Justice for the European Union (“CJEU”) that invalidated the EU-U.S. Privacy Shield and called into question the efficacy and legality of using standard contractual clauses (“SCCs”). To address certain concerns of the CJEU, the European Commission issued revised SCCs in June 2021. The EU also has enacted numerous new laws and regulations addressing cybersecurity.

In the United Kingdom (“UK”), the Data Protection Act of 2018 implements and complements the GDPR and is effective along with a version of the GDPR referred to as the UK GDPR. These regimes authorize significant fines, up to the greater of £17.5 million or 4% of global turnover, and expose us to two parallel regimes and potentially divergent enforcement actions. Further, aspects of data protection in the UK remain uncertain. On June 28, 2021, the European Commission issued an adequacy decision, pursuant to which personal data generally may be transferred from the EU to the UK without restriction; however, this adequacy decision is subject to a four-year “sunset” period, after which it may be renewed. This decision may be revoked or modified at any time. Additionally, the UK’s Information Commissioner’s Office has issued standard contractual clauses to support personal data transfers out of the UK (“UK SCCs”). Regulatory guidance and other developments relating to cross-border personal data transfers, including the necessity of putting in place SCCs and UK SCCs, may increase the complexity of transferring personal data across borders and may require us to engage in additional contractual negotiations and to modify our policies and practices. Other jurisdictions also increasingly maintain laws and regulations addressing privacy, data protection, and cybersecurity. We may incur liabilities, expenses, costs, and other operational losses under the GDPR and local laws of applicable EU member states, the UK, and other regions in connection with any measures we take to comply with them. 

In the United States, in addition to HIPAA, HITECH and state laws addressing health-related information, numerous federal and state laws and regulations govern the collection, use, disclosure, and other processing of information relating to individuals. In California, the California Consumer Privacy Act (“CCPA”) requires covered companies to provide disclosures to consumers about such companies’ data collection, use and sharing practices