Company: CORT
Filing Date: 2025-05-05
Form Type: 10-Q
Source: 0001628280-25-022173
Chunk: 160

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-05-05
Form: 10-Q
Item: Part I, Item 3
Chunk 160
---
 CCPA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. Additional legislation proposed at the federal level and in other states, along with increased regulatory action, reflect a trend toward more stringent privacy legislation in the United States.

Outside the United States, many jurisdictions have or are in the process of enacting sweeping data privacy regulatory regimes. In Europe, the GDPR took effect in 2018, and is imposing stringent requirements for controllers and processors of personal data of individuals within the EEA, particularly with respect to clinical trials. The GDPR provides that EEA member states may make their own further laws and regulations limiting the processing of health data, which could limit our ability to use and share personal data or could cause our costs to increase and harm our business and financial condition. In addition, the GDPR increases the scrutiny that clinical trial sites located in the EEA should apply to transfers of personal data from such sites to countries that are considered to lack an adequate level of data protection, such as the United States. Legal developments have added complexity and compliance uncertainty regarding certain transfers of information from the EEA to the United States. 

36

Following EU court decisions, updated standard contractual clauses (“SCCs”) were adopted to account for these judicial decisions, imposing new requirements on data transfers. The revised SCCs must be used for relevant new data transfers from September 27, 2021, and existing SCC arrangements were required to be migrated by December 27, 2022. As supervisory authorities issue further guidance on personal data export mechanisms, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. Further, on July 10, 2023, the European Commission adopted its adequacy decision on the E.U.-U.S. Data Privacy Framework (“DPF”). The decision, which took effect on the day of its adoption, concludes that the United States ensures an adequate level of protection for personal data transferred from the EEA to companies certified to the DPF. It is currently unclear how the future of DPF will evolve and what impact it will have on our international activities. The GDPR imposes substantial fines for breaches of data protection requirements, which can be up to