Company: PRTA
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001559053-25-000044
Chunk: 56

Company: PROTHENA CORP PUBLIC LTD CO
Filing Date: 2025-11-06
Form: 10-Q
Item: Part II, Item 1A
Chunk 56
---
 and may increase our compliance costs and exposure to liability. In the United States, numerous federal and state laws and regulations, including state security breach notification laws,

federal and state health information privacy laws (including U. S. Health Insurance Portability and Accountability Act of 1996 (“ HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act, and regulations promulgated thereunder), and federal and state consumer protection laws (including Section 5 of the Federal Trade Commission Act), govern the collection, use, disclosure, and protection of personal information. Each of these laws is subject to varying interpretations by courts and government agencies, creating complex compliance issues. State privacy laws in particular are evolving, with more than a dozen new state privacy laws passed in recent years, along with additional health privacy specific laws. These laws may further increase our compliance obligations, and potential legal privacy risks. For example, Washington recently passed the My Health My Data Act, which has a broader scope than HIPAA and includes a private right of action. In addition, we may obtain health information from third parties, including research institutions from which we obtain clinical trial data, that are subject to privacy and security requirements under HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, and the regulations promulgated thereunder. Depending on the facts and circumstances, we could be subject to significant penalties if we obtain, use or disclose individually identifiable health information in a manner that is not authorized or permitted by HIPAA.

Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to substantially amend existing procedures and policies or put in place additional procedures and policies to ensure compliance with privacy and data protection rules and requirements. These changes could adversely impact our business by increasing operational and compliance costs or impact business practices. Further, there is a risk that the amended policies and procedures will not be implemented correctly or that individuals within the business will not be fully compliant with the new procedures. If we fail to comply with any such laws or regulations, we may face significant litigation, government investigations, fines and penalties as well as reputational damage which could adversely affect our business, operations, financial condition and prospects. Furthermore, the laws are not consistent, and compliance in the event of a widespread data breach is costly. In addition, states are constantly adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, the California Consumer Privacy Act (the “ CCPA