Company: MIRM
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001759425-25-000041
Chunk: 158

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Part I, Item 4
Chunk 158
---
 violations can result in significant financial penalties, including penalties or criminal fines imposed by the Federal Communications Commission or fines of up to $1,500 per violation imposed through private litigation or by state authorities. 

Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, at the state level, the California Consumer Privacy Act, as amended, (“CCPA”), applies to personal data of California consumers, business representatives and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines for violations and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA and other comprehensive state privacy laws exempt some data processed in the context of clinical trials, these laws may increase compliance costs and potential liability for us and the third parties with whom we work. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. 

Outside the U.S., an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the EU GDPR and the UK GDPR (together “GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018), Canada’s Personal Information Protection and Electronic Document Act (“PIPEDA”) and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing personal data, and violators of these laws may face significant penalties. 

For example, the GDPR imposes stringent requirements for controllers and processors of personal data, including, for example, more robust disclosures to individuals and a strengthened individual data rights regime, mandatory data breach notifications in certain circumstances, limitations on retention of information, increased requirements pertaining to special categories of data, such as