Company: TEM
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000950170-25-025603
Chunk: 109

Company: Tempus AI, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 109
---
 by HIPAA, particularly if a state affords greater protection to individuals than HIPAA. Where state laws differ from HIPAA, we may have to comply with these provisions. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and our clients, and potentially exposing us to additional expense, adverse publicity and liability. Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify. Changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as PHI or other types of sensitive personally identifiable information, or PII, or increased demands for enhanced data security infrastructure applied to personally identifiable information, could greatly increase our costs of providing our products, decrease demand for our products, reduce our revenue and/or subject us to additional risks. In addition, the interpretation and application of consumer, health-related, and data protection laws, especially with respect to genetic samples and data, in the United States, the EU (including all countries in the EEA), and elsewhere are often uncertain, contradictory, and in flux. 

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security.  For example, EU GDPR and UK GDPR (collectively, GDPR) impose strict requirements for processing personal data. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. The GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, higher standards for obtaining consent from individuals to process their personal data, more robust disclosures to individuals and a strengthened individual data rights regime, timelines for data breach notifications as short as 72 hours for notification to supervisory authorities, limitations on retention of information, increased requirements pertaining to health data, other special categories of personal sequencing and pseudonymized (i.e., key-coded) data and additional obligations