Company: WHWK
Filing Date: 2025-01-31
Form Type: DEFM14A
Source: 0001193125-25-018470
Chunk: 391

Company: Whitehawk Therapeutics, Inc.
Filing Date: 2025-01-31
Form: DEFM14A
Chunk 391
---
 per violation (i.e., per person) or $7,500 per intentional violation and (b) authorizes private lawsuits to recover
statutory damages for certain data breaches. Numerous other states in the U.S. have proposed or enacted similar legislation. While the CCPA and many other similar state laws exempt some data regulated by the Health Insurance Portability and
Accountability Act of 1996 (“HIPAA”) and certain clinical trials data, the CCPA and such other laws, to the extent applicable to our business and operations, may increase our compliance costs and potential liability. Further, some states
have enacted more specific legislation, such as Washington’s enactment of the My Health, My Data Act, which includes a private right of action. The U.S. federal government is also contemplating federal privacy legislation. The evolving trend
toward more stringent privacy legislation in the United States, including the foregoing laws and regulations and the potential for future laws and regulations, could increase our compliance costs and potential liability and adversely affect our
business.

It is possible that the GDPR, UK GDPR, CCPA, CPRA, or other laws and regulations relating to privacy and data protection may be interpreted and
applied in a manner that is inconsistent from jurisdiction to jurisdiction or inconsistent with our policies and practices. We cannot guarantee that we are in compliance with all such applicable data protection laws and regulations, and we cannot be
sure how these regulations will be interpreted, enforced or applied to our operations. Furthermore, other jurisdictions outside the EU are similarly introducing or enhancing privacy and data security laws, rules, and regulations, which could
increase our compliance costs and the risks associated with noncompliance. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices, and our efforts to comply with the evolving data protection
rules may be

- 268 -

unsuccessful. Our actual or alleged non-compliancecould result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures, and systems. Our actual or perceived failure to adequately comply with applicable laws and regulations or other actual or asserted obligations relating to privacy and data protection, or to protect personal data and other data we process or maintain, could result in regulatory enforcement actions against us, including fines, imprisonment of company officials and